Hacking a backup camera: Remove OSD

Post about your projects!
Posts: 1
Joined: Sat May 10, 2014 5:36 pm

Re: Hacking a backup camera: Remove OSD

Unread postby jpapadami » Sat May 10, 2014 5:56 pm

Have the same camera as the one posted at the beginning of the thread. Great howto as I plan on getting an IPAS for my car and it would be a good idea to remove the distance line markers as the IPAS already has them.

I was wondering if there is a way to replace the OSD? Some have one color grids (like your OSD) while others have green, yellow, and red markers. Is there any way to change/replace them?

Posts: 1
Joined: Mon Jun 23, 2014 11:54 pm

Re: Hacking a backup camera: Remove OSD

Unread postby Ced » Tue Jun 24, 2014 12:06 am

Hey Derrick,

Great job! Thanks for revealing what you found about the OSD.

Speaking of, I have the same backup camera as http://www.amazon.com/gp/product/B005CT ... m-feens-20 except that the circuit board is round. Yours is square. Further, the components do not seem to match.

I was wondering if you could give me a hand on figuring out a way to invert the image as I am going to be using this backup camera as a front view camera. Thus, I will not be using the mirrored image view.

I understand you were able to fix your camera by connecting the GND with the SDA on the chip. How could I go about finding out which pin of the eeprom is SDA without blowing up my camera and video interface?

Thank you for any help you can provide.

1.jpg (275.3 KiB) Viewed 11072 times

Posts: 2
Joined: Wed Nov 05, 2014 10:23 pm

Re: Hacking a backup camera: Remove OSD

Unread postby dahook » Thu Nov 06, 2014 12:08 am


Thanks for this great post! It inspired me to take it a few steps further, and actually look into whats in that EEPROM. I want to install a few cameras on my tractor digger, and it would be nice to have a text that identifies the camera instead of some parking lines. I bought a different camera that has a different imaging chip, but the overall design with an 2-wire EEPROM seems quite common.
When looking into the design of these things i found that some imaging chips have better features than others. My camera (I bought this http://www.aliexpress.com/store/product ... 60178.html) has ha PixelPlus 7030 chip, while yours has a OmniVision 7950. It seems most of the PixelPlus chips has predefined parking guide lines, while OmniVision has an overlay feature (which is much better for our purpose :-))

(By the way, I dissected the inline coupler on my camera. It only contains a 3.3 volt stabilizer)

So how did I come to these conclusions? Well, I started off with an Arduino that I connected to the EEPROM and read the contents using a simple sketch. I don't have access to my ugly sketch from my current location, but I based it on the sample "master_reader" found in Sketch and some info I found here http://www.hobbytronics.co.uk/arduino-external-eeprom. The EEPROM has adress 0x50. I scanned for other devices on the bus and found the 7030 chip on address 0x33 also.

Apologies for the tech level on this, I should have added information on how I connected it all, but for know You'll just have to tinker yourself :-D It's quite easy, you only need two wires from the Arduino. Make sure the camera and the arduino has a common ground. I powered the Arduino from my PC and the cam from a 12V stabilizer, so I just put a ground cable from the stabilizer to the arduino ground. Not sure if it is absolutely necessary, but it felt right at the time.
If you want to write to the EEPROM you will have to ground the write protection pin as well (or cut it). I used very small cable clips that I put on the EEPROM pins, but I think there is better clamps for this. You could also gently solder some wires to it :-). Note, I take no responsibility for any damage. I was willing to risk my camera burning up. It did'nt. Your camera might have a less tolerable design.

Just looking at the memory contents told me nothing so I shorted the write protection pin on the EEPROM and did some poking around to see what would happen. Although things actually changed (for example the thickness of the parking lines) I could not really find a pattern to what change did what, so I started googling around. PixelPlus keep their programming guides well hidden, and I could'nt find a guide for the 7030. I did find a guide for PixelPlus 1030 on a strange chinese site (http://www.docin.com/p-67670514.html), and although the actual programming is different it told me that the parking guide lines is sort of hard coded in these chips (see page 43 in the document, it shows the design of the parking lines).
From what I can tell most of the programming is done by selecting a register and then setting it to a specific value. When looking at the EEPROM contents one can see something like 01 XX 02 YY 03 ZZ, where 01 selects register 1 and sets it to value XX.

Whenever you change something in the EEPROM you have to restart the camera (at least on my cam).

I did try to speak to the 7030 directly (at I2C 0x33), and found that it is possible to flip images etc without restarting as well. But realtime control would require constant access to the I2C bus, and that would require more electronics in the direct vicinity of the camera. Not in my scope, but maybe someone can find it useful.

Ah well, it seems my camera is a bit boring when it comes to replacing images then. I did find the byte that flips and mirrors the image, but I have yet to find the byte that turns off the parking guide.

Your camera however seems much more fun :-D I'll have to order one of those.

Once again, programming guides could be a bit hard to find. http://www.zhopper.narod.ru/mobile/ has quite a collection, and the OV7950 advanced information datasheet can be downloaded there. This chip has "Two sets of dynamic overlay controls". The datasheet also says "SPI/EEPROM used to control overlay and set other customer variables".
Looks promising :-D

Page 5 says "The OV7950/OV7451 CAMERACHIP sensor has an overlay capability where the user can store an overlay bit map image in an external storage device with an SPI interface."

I don't have one of these cams yet, but I imagine that you could for example talk to device 0x60 on the I2C bus and write 0x00 to register 0x08 to change the mirroring of the image (in realtime, not saved). Look at page 18 in the datasheet for details. Register 08 is called "COM1".
Page 7 tells us where the value for register "COM1" is stored in the EEPROM. I can't really figure out exactly what address that is, but I expect it to be revealed once I have a camera to play with :-)

I hope this is useful to someone, I'll try to post more specific information when I've learned more!



User avatar
Posts: 129
Joined: Mon Feb 04, 2013 6:40 pm
Location: Orono

Re: Hacking a backup camera: Remove OSD

Unread postby Derrick » Thu Nov 06, 2014 12:51 am

Thanks so much for this. Very interesting.

I've since ordered additional cameras from amazon in the same varieties and I've found that even the same item numbers come with different components inside. I was going to write up some details on what I'd found, and this post may have inspired me to do that.

There was a variety of the camera which in I could not disable the image flipping, but was able to remove the grids on, I'll take another look at that one with this new information.

Best regards! Keep posting!

Posts: 2
Joined: Wed Nov 05, 2014 10:23 pm

Re: Hacking a backup camera: Remove OSD

Unread postby dahook » Thu Nov 06, 2014 1:45 am

Cool :-)

I just remembered (kinda) how I identified the camera chip. I think it was also written in the simple manual, but who looks at that? And anyway, as you say, they seem to come in varieties.
I used this sketch http://playground.arduino.cc/Main/I2cScanner to find what was on the I2C bus. I found something at 0x33 and the EEPROM at 0x50, 51 and 52 (guess that's the way it works, I only used 0x50 though).
I tried googling for I2C address 0x33 and somehow I managed to find out that it was a PixelPlus that way. I can't find out how i found it though... The PixelPlus has the type number in the first bytes, so when reading from 0x33 it showed "70 30" there. OmniVision seem to use address 0x60, so that is a way to find out what it is. I've seen cameras using the Micron MT9V125 also, and according to the datasheet here http://www.aptina.com/products/soc/mt9v125ia7xtc/ they use 0x90 or 0xBA.



Posts: 1
Joined: Wed Dec 17, 2014 9:15 pm

Re: Hacking a backup camera: Remove OSD

Unread postby captainmel » Wed Dec 17, 2014 9:17 pm

Have you figured out anything more about the first camera with the different circuit board?

Posts: 1
Joined: Tue Feb 24, 2015 4:58 am

Re: Hacking a backup camera: Remove OSD

Unread postby iRoush » Tue Feb 24, 2015 5:28 am

Hi all, I apologize for bumping an old thread but I ran across this page when I was searching for a solution to get rid of the OSD from my reverse camera. I bought the super small one from eBay that I was hoping would have the same or similar internals as the ones in this thread but no such luck it seems. I was hoping someone could advise which pin I should I should pull on this guy, thank you in advance!


Posts: 1
Joined: Wed Apr 15, 2015 9:38 pm

Re: Hacking a backup camera: Remove OSD

Unread postby bgrr » Wed Apr 15, 2015 10:03 pm

Hi all,

Bought this camera recently on aliexpress.com and tried to remove the OSD but no success :-(


It has an 24C08 8 Kbit Serial I2C Bus EEPROM and lifting the VCC pin did not remove the OSD.

Even complete removing the 24C08 chip did not remove the OSD :evil:
After removing the 20C08 the camera works fine even the night vision is still working.
So i have no clue about the function of this ic i removed :-)

Could there by anything else on the board that's generating the OSD overlay or is the overlay programmed in the camera CCD ?

Greetings Barry

Posts: 1
Joined: Mon Apr 20, 2015 11:24 am

Re: Hacking a backup camera: Remove OSD

Unread postby Petio » Mon Apr 20, 2015 11:50 am

Hi Derrick
I have a small back up camera (similar to the one in iRouse's picture of the 24th February 2015). Thanks to your info and pics I have managed to remove the back up lines by connecting the GND to the SDA link, but I still have the flashing STOP warning, any ideas as to how I can remove it? for general info my eeprom is WINBOND W25x40bvnig.

Posts: 1
Joined: Tue Oct 13, 2015 5:48 pm

Re: Hacking a backup camera: Remove OSD

Unread postby Felipe_T » Tue Oct 13, 2015 6:09 pm

Hi everybody,

Very nice research you're doing. I seem to have the same issue of Barry (bgrr).
Did the same procedure of connecting GND to SDA but still have a clear view of the OSD guidelines.
Just one information though, the image itself got blured. Don't think it was a good sign.

My camera is this one: http://www.banggood.com/18-IR-LEDS-Truck-Bus-Rear-View-Monitor-Backup-Camera-Night-Vision-p-906503.html
And here is a pic of the pcb, where we can see a OSD P/N written on it

If I have some success I'll be back to post it
Regards, Felipe


Return to Projects

Who is online

Users browsing this forum: No registered users and 2 guests