Fuji dSLR remote control

Note: the Fuji driver for GNU/Linux can be found here.

I once had a Fuji Finepix S3 Pro digital camera. Starting from the Finepix S2 and up, Fuji’s line of DSLRs has support for remote control of the camera using the computer. Of course, you can only do this with the bundled Hyperutility software suite, which may or may not come with your camera. If you’re unlucky and don’t get it bundled, you’ll have to pony up a lot of money to buy it.

Because I wanted to use this camera for Astrophotography where remote control is necessary, and because I mainly use GNU/Linux, I decided to reverse engineer the Fuji RC protocol.

Even though my camera got stolen, effectively bringing this project to a premature end, I will post it here in the hope it might be of use to someone else. Also, the same protocol works with the S2 Pro, and probably also for Fujis later iterations.

The reversing
The starting point was trying to decipher the protocol. The obvious place to start is to use Fuji’s HyperUtility software. The base protocol is contained in SU500API.DLL, and the firewire access library is FTL1394.DLL.

The DLL was decompiled, and the program executed with a hook to log all executed functions and arguments. Hyperutility was a little bit finicky about which DLLs gets loaded, so I modified the Hyperutility.exe file in the following manner to load my logger DLL,

//Wipe out Debug/Log function sub_4F2900 offset 0xF2900

//with ordinary calls have no bussiness beyond this point

C3                       ret
// load the dll

68 22 29 4F 00           push 4F2922h (offset fujihook_dll)

FF 15 D0 10 54 00        call LoadLibraryA

58                       pop eax

// backupped instructions from main 

55                       push ebp

8B EC                    mov ebp, esp

6A FF                    push 0FFFFFFFh

// jmp back to main

E9 08 36 03 00           jmp 525F1Fh

// mini-data section

"fujihook.dll\0" ( @f2922 = 4F2922)

Functions
There are a number of functions in the driver, listed below with the accompanying access code. The drivers queries the camera, and retrieves a list of function codes that the camera supports. Each corresponding function has an associated settings table, which can also be readily mapped to the associated values. Of the following, I only implemented those immediately necessary for my own needs,

  • ShootFromCamera 000E0100
  • CancelShootFromCamera 000F0100
  • CheckShootStatus 000D0100
  • GetDeviceInfo 00150000
  • GetAEMode 00018822
  • GetAEModeCaps 00008822
  • GetSensitivity 00018827
  • GetSensitivityCaps 00008827
  • SetSensitivity 00028827
  • GetColorSpaceMode 00051111
  • GetPresetMode 00051007
  • GetCCDMode 00051008
  • GetDrangeMode 00051005
  • GetDrangeModeCaps 00041005
  • GetToneMode 00011004
  • GetSharpness 00011001
  • GetWhiteBalanceMode 00019208
  • GetAFModeCaps 00040300
  • GetAFMode 00050300
  • GetFNumberEx 0001829d
  • SetShutterSpeedEx 00029201
  • SetFunction 0006000f
  • SetAEMode 00028822
  • SetAperture 00029202
  • SetSensitivity 00028827
  • SetColorSpaceMode 00061111
  • SetCCDMode 00061008
  • SetWhiteBalanceMode 00029208
  • SetAFMode 00060300
  • SetShootingCondition 00060111
  • SetPresetMode 00061007
  • SetDrangeMode 00061005
  • SetColorMode 00021003
  • SetToneMode 00021004
  • SetSharpness 00021001
  • GetMeteringMode 00019207
  • GetMeteringModeCaps 00009207
  • SetMeteringMode 00029207
  • SetAutoWhiteBalance 00019208
  • GetFlashMode 00050200
  • GetFunctionCaps 00040000
  • GetFunction 0005000F
  • GetMeterinModeCaps 00009207
  • GetShutterSpeedEx 00019201
  • GetShutterSpeedCapsEx 00009201
  • GetExposureBias 00019204
  • SetExposureBias 00029204
  • GetExposureBiasCaps 00009204
  • GetAperture 00019202
  • GetApertureCaps 00009202
  • GetWhiteBalanceModeCaps 00009208
  • GetExposureTimeEx 0001829A
  • SetFlashMode 00060200
  • GetFlashModeCaps 00040200
  • SetFlashBias 00060201
  • ReadImageEx 00450101
  • GetFrameCount 00050100
  • CheckFrameEx 00050100
  • CheckAllFrames 00050100
  • ClearFrame 00060100
  • ClearAllFrames 00060100
  • SetFrameInternalIndex 00060100
  • GetPowerStatus 00050005

Further?
As my camera got stolen, the project is, for me, stopped. I noticed that gPhoto2 mentiones no support for Fuji Finepix cameras. This is sad, especially in light of the fact I posted my results and all thats needed to write a driver on their website. I would gladly write gphoto support, but since I don’t have a Fuji camera anymore, this would be pointless.

2 thoughts on “Fuji dSLR remote control

  1. Pingback: Fuji Finepix remote control tool | phym

  2. 76Bettye

    Hi admin, i must say you have very interesting posts here.
    Your website should go viral. You need initial traffic
    only. How to get it? Search for: Mertiso’s tips go viral

    Reply

Leave a Reply

Your email address will not be published. Required fields are marked *