Remote Capture Control

Remote Capture Control
Prev	Chapter 4. New USB Interface	Next

requesttype=0x25

I think this is the new version of Remote Camera Control. Subcommands seen so far:

Table 4.6. Remote Camera Control Codes

Subcommand	Sample Parameters	Reply Length	Function
00	none	5C	Camera control initialization
01	none	5C	Exit release control
04	none	5C	Release shutter
07	buffer of 0x34 bytes	5C	Set release parameters
09	04 00 00 00 09 00 00 00	5C	Set transfer mode
0A	none	8C	Get release parameters
0D	none	60	Get available shot
10	none	60	Get size of extended release parameters
12	none	varies	Get extended release parameters
13	<block of parameters>	5c	Set extended parameters
1B	0x4 0xb	5e	Unknown
1C	none	67, 6d, 70, 66, 65	Unknown

The following functions haven't been seen yet. Some (e.g. get custom functions) have, I think, been superseded by other opcodes; others (e.g. Start viewfinder, Set zoom position) don't really apply to the EOS cameras that, so far, are the only ones using this protocol.

Table 4.7. Remote Camera Control Codes

Subcommand	Sample Parameters	Reply Length	Function
02	none	5C	Start viewfinder
03	none	5C	Stop viewfinder
0B	none	60	Get zoom position
0C	04 00 00 00 01 00 00 00	5c	Set zoom position
0E	???	??	Set custom function
0F	14 bytes	66	Get custom function
11	????	????	Get version of extended release parameters
14	01 00 00 00 00 03	5C	Select camera output
15	????	??	Do auto exposure, focus, and white balance

The subcommand is stored as a little-endian 4-byte number at the start of the message payload (i.e. starting 0x50 bytes from the start of the buffer). Parameters vary by subcommand, as noted below; they follow the subcommand in the message payload. The minimum is <subcommand> 0 with another zero byte, so the minimum length of a command packet is 0x59. The extra byte means that the length of this command will always be odd.

In the reply, the payload will always start with status, <subcommand>. After that, the minimum is one more zero word (plus an extra zero byte), or there may be more information. The minimum length is 0x5c.

Camera control initialization: 00

Takes no parameters.

Command: 0x59 bytes

00000000  19 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 19 00 00 00 68 e7 12 00  ....%.......h...
00000050  00 00 00 00 00 00 00 00 00                       .........

Camera response: 0x5c bytes

00000000  1c 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 1c 00 00 00 68 e7 12 00  ....%.."....h...
00000010  00 00 00 00 00 00 00 00 00 00 00 00              ............

Exit release control: 01

Takes no parameters

Command: 0x59 bytes

00000000  19 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 19 00 00 00 58 e7 12 00  ....%.......X...
00000050  01 00 00 00 00 00 00 00 00                       .........

Response: 0x5c bytes

00000000  1c 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 1c 00 00 00 58 e7 12 00  ....%.."....X...
00000010  00 00 00 00 01 00 00 00 00 00 00 00              ............

Release shutter: 04

Takes no parameters. We haven't figured out interrupt communication yet.

Command: 0x59 bytes

00000000  19 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 19 00 00 00 44 e9 17 01  ....%.......D...
00000050  04 00 00 00 00 00 00 00 00                       .........

Response: 0x5c bytes

00000000  1c 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 1c 00 00 00 44 e9 17 01  ....%.."....D...
00000010  00 00 00 00 04 00 00 00 00 00 00 00              ............

Set release parameters: 07

Takes a payload of 0x39 bytes: 0x35 after subcommand code.

Command: 0x59 bytes

00000000  49 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  I...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 49 00 00 00 44 e9 17 01  ....%...I...D...
00000050  07 00 00 00 30 00 00 00 20 02 01 02 00 00 ff 00  ....0... .......
00000060  03 01 00 ff 03 ff 02 90 08 ff 00 ff 7f 7f 7f 7f  ................
00000070  ff ff 58 00 20 00 70 00 00 00 ff ff 18 00 50 00  ..X. .p.......P.
00000080  ff ff ff ff ff ff 01 00 00                       .........

Response: 0x5c bytes (success):

00000000  1c 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 1c 00 00 00 44 e9 17 01  ....%.."....D...
00000010  00 00 00 00 07 00 00 00 00 00 00 00              ............

Set transfer mode: 09

Takes 2 parameters: 4, <code> where <code> is a combination of the following bits:

#define THUMB_TO_PC 0x0001
#define FULL_TO_PC 0x0002
#define THUMB_TO_DRIVE 0x0004
#define FULL_TO_DRIVE 0x0008

These may be combined in any way.

00000000  1d 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 1d 00 00 00 58 e7 12 00  ....%.......X...
00000050  09 00 00 00 04 00 00 00 02 00 00 00 00           .............

Response: 0x5c bytes

00000000  1c 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 1c 00 00 00 58 e7 12 00  ....%.."....X...
00000010  00 00 00 00 09 00 00 00 00 00 00 00              ............

Get release parameters: 0A

Takes no parameters. Returns 0x34 bytes after the echo of the subcommand code. First 4-byte integer is 0x00000030, which is the count of remaining bytes. I assume that the 0x34 bytes are the same as is sent down by code 07, set release parameters.

Command: 0x59 bytes

00000000  19 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 19 00 00 00 4c e7 12 00  ....%.......L...
00000050  0a 00 00 00 00 00 00 00 00                       .........

Response: 8c bytes

00000000  4c 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  L...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 22 4c 00 00 00 4c e7 12 00  ....%.."L...L...
00000050  00 00 00 00 0a 00 00 00 30 00 00 00 20 04 02 00  ........0... ...
00000060  00 00 ff 00 01 01 00 ff 03 ff 02 90 02 ff 00 ff  ................
00000070  7f 7f 7f 7f ff ff 58 00 1c 00 74 00 00 00 ff ff  ......X...t.....
00000000  18 00 50 00 ff ff ff ff ff ff 01 00              ..P.........

Get available shot: 0D

No parameters

Command: 0x59 bytes

0000 19 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00 ................
0010 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0020 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0030 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................
0040 02 00 00 00 13 00 10 12 18 00 00 00 1f 00 00 00 ..............%.
0050 0d 00 00 00 00 00 00 00 00                      ........

Reply 0x60 bytes:

0000:  20 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00   ...............
0010:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0020:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0030:  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
0040:  02 00 00 00 25 00 10 22 20 00 00 00 1f 00 00 00  ....%.." .......
0050:  00 00 00 00 0d 00 00 00 04 00 00 00 e8 03 00 00  ................

The last word is the estimated number of shots remaining: i.e. the free storage space divided by the estimated size of an image file in the current mode.

Get size of extended release parameters: 10

No parameters

Command: 0x59 bytes

00000000  19 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 19 00 00 00 5c e7 12 00  ....%.......\...
00000050  10 00 00 00 00 00 00 00 00                       .........

Response: 0x60 bytes

00000000  20 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00   ...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 20 00 00 00 5c e7 12 00  ....%.." ...\...
00000010  00 00 00 00 10 00 00 00 04 00 00 00 3c 00 00 00  ............<...

Get extended release parameters: 12

Parameters are the 8-byte result from Get size of extended release parameters.

Command: 0x5d bytes

00000000  1d 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 1d 00 00 00 4c e7 12 00  ....%.......L...
00000050  12 00 00 00 04 00 00 00 3c 00 00 00 00           ........<....

Response: 0x98 bytes

00000000  58 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  X...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 22 58 00 00 00 4c e7 12 00  ....%.."X...L...
00000050  00 00 00 00 12 00 00 00 3c 00 00 00 3c 00 00 00  ........<...<...
00000060  00 00 05 00 00 00 00 00 ff ff ff ff 00 00 00 00  ................
00000070  ff ff ff ff ff ff ff ff 00 00 ff ff ff ff ff ff  ................
00000000  ff ff 00 00 50 14 ff ff 01 00 ff ff ff ff 00 00  ....P...........
00000010  ff ff 00 00 00 00 00 00                          ........

Table 4.8. Contents of extended release parameters block

Offset	Content	Meaning
0x00	0x0000003c	Length of block
0x04	0x0000	??
0x06	0x0005	??
0x08	0x00000000	??
0x0c	0xffffffff (-1)	??
0x10	0x00000000	??
0x14	0xffffffff (-1)	??
0x18	0xffffffff (-1)	??
0x1c	0x0000	??
0x1e	0xffff (-1)	??
0x20	0xffffffff (-1)	??
0x24	0xffff (-1)	??
0x26	0x0000	??
0x28	0x1450	??
0x2a	0xffff (-1)	??
0x2c	0x0001	??
0x2e	0xffff (-1)	??
0x30	0xffff (-1)	??
0x32	0x0000	??
0x34	0xffff (-1)	??
0x36	0x0000	??
0x38	0x00000000	??

Set extended parameters: 12

Command: 0x95 bytes

00000000  55 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  U...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 55 00 00 00 44 e9 17 01  ....%...U...D...
00000050  13 00 00 00 3c 00 00 00 3c 00 00 00 00 00 05 00  ....<...<.......
00000060  00 00 00 00 ff ff ff ff 00 00 00 00 ff ff ff ff  ................
00000070  ff ff ff ff 00 00 ff ff ff ff ff ff ff ff 00 00  ................
00000080  50 14 ff ff 01 00 ff ff ff ff 00 00 ff ff 00 00  P...............
00000090  00 00 00 00 00                                   .....

Table 4.9. Contents of parameter block for Set Extended Parameters

Offset	Content	Meaning
0x00	0x0000003c	Length of block
0x04	0x0000	??
0x06	0x0005	??
0x08	0x00000000	??
0x0c	0xffffffff (-1)	??
0x10	0x00000000	??
0x14	0xffffffff (-1)	??
0x18	0xffffffff (-1)	??
0x1c	0x0000	??
0x1e	0xffff (-1)	??
0x20	0xffffffff (-1)	??
0x24	0xffff (-1)	??
0x26	0x0000	??
0x28	0x1450	??
0x2a	0xffff (-1)	??
0x2c	0x0001	??
0x2e	0xffff (-1)	??
0x30	0xffff (-1)	??
0x32	0x0000	??
0x34	0xffff (-1)	??
0x36	0x0000	??
0x38	0x00000000	??
0x3c	0x00	padding

Response: 0x5c bytes

00000000  1c 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 1c 00 00 00 44 e9 17 01  ....%.."....D...
00000010  00 00 00 00 13 00 00 00 00 00 00 00              ............

Unknown command: 1B

This command might just set up for command code 0x1c, which has no parameters but seems to give various responses.

Two parameters: count of following bytes (4), subcode {0x0b,0x0e,0x17,0x18,0x19,0x1a}. Commands seem to come in that order, and each is immediately followed by a command with subcode 0x1c.

00000000  1d 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 1d 00 00 00 4c e7 12 00  ....%.......L...
00000050  1b 00 00 00 04 00 00 00 0b 00 00 00 00           .............

Response: 0x5e bytes

4-byte status code, echo of major code (0x1b), count of remaining bytes (2), 16 bit byte count for the result of the subsequent 0x1c command. This varies with the command subcode:

Return values for command 0x1b

0x0b: 0x000b
0x0e: 0x0011
0x17: 0x0014
0x18: 0x0026, 0x000a
0x19: 0x0052, 0x0009
0x1a: 0x0009, 0x0011

Unknown command: 1C

Command: 0x59 bytes

00000000  19 00 00 00 01 02 00 00 00 00 00 00 00 00 00 00  ................
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 12 19 00 00 00 4c e7 12 00  ....%.......L...
00000050  1c 00 00 00 00 00 00 00 00                       .........

Response after 0x25/0x1b/0x0b: 0x67 bytes

00000000  27 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  '...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 27 00 00 00 4c e7 12 00  ....%.."'...L...
00000010  00 00 00 00 1c 00 00 00 0b 00 00 00 03 00 00 00  ................
00000020  02 00 00 00 03 04 05                             .......

At offset 0x50, there is the customary 4-byte status code, followed by an echo of the 4-byte command code 0x0000001c, followed by a byte count which is identical to the value returned by the previous command with subcode 0x1b. After the byte count comes a count N of entities, then what I think is an entity type. 2 seems to be a single-byte entity; 4 is a 2-byte entity. Then come N data elements. At least sub-subcodes 0x18, 0x19, 0x1a can vary their length.

Response after 0x25/0x1b/0x0e: 0x6d bytes

00000000  2d 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  -...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 2d 00 00 00 4c e7 12 00  ....%.."-...L...
00000010  00 00 00 00 1c 00 00 00 11 00 00 00 09 00 00 00  ................
00000020  02 00 00 00 00 01 02 03 04 05 06 08 09           .............

Response after 0x25/0x1b/0x17: 0x70 bytes

00000000  30 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  0...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 30 00 00 00 4c e7 12 00  ....%.."0...L...
00000010  00 00 00 00 1c 00 00 00 14 00 00 00 06 00 00 00  ................
00000020  04 00 00 00 48 00 50 00 58 00 60 00 68 00 70 00  ....H.P.X.`.h.p.

Response after 0x25/0x1b/0x18: 0x66 bytes

00000000  26 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  &...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 26 00 00 00 4c e7 12 00  ....%.."&...L...
00000010  00 00 00 00 1c 00 00 00 0a 00 00 00 00 00 00 00  ................
00000020  04 00 00 00 ff ff                                ......

Response after 0x25/0x1b/0x18: 0x82 bytes

00000000  42 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  B...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000040  02 00 00 00 25 00 10 22 42 00 00 00 4c e7 12 00  ....%.."B...L...
00000050  00 00 00 00 1c 00 00 00 26 00 00 00 0f 00 00 00  ........&.......
00000060  04 00 00 00 18 00 1c 00 20 00 24 00 28 00 2c 00  ........ .$.(.,.
00000070  30 00 34 00 38 00 3c 00 40 00 44 00 48 00 4c 00  0.4.8.<.@.D.H.L.
00000000  50 00                                            P.

This has status code, 4-byte count of following bytes, 4-byte 0xf (15), 4-byte 0x4, then 15 2-byte integers that start at 0x18 (24) and count up by 4.

Response after 0x25/0x1b/0x19: 0x65 bytes

00000000  25 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  %...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 25 00 00 00 4c e7 12 00  ....%.."%...L...
00000010  00 00 00 00 1c 00 00 00 09 00 00 00 00 00 00 00  ................
00000020  02 00 00 00 ff                                   .....

Response after 0x25/0x1b/0x1a: 0x6d bytes

00000000  2d 00 00 00 01 03 00 00 00 00 00 00 00 00 00 00  -...............
00000010  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000020  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000030  00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
00000000  02 00 00 00 25 00 10 22 2d 00 00 00 4c e7 12 00  ....%.."-...L...
00000010  00 00 00 00 1c 00 00 00 11 00 00 00 09 00 00 00  ................
00000020  02 00 00 00 f0 f4 f8 fc 00 04 08 0c 10           .............

After the byte count, a 4-byte 0x9, 4-byte 0x2, then single bytes counting up by 4: -16, -12, -8, -4, 0, 4, 8, 12, 16.

Prev	Up	Next
Get Photo Abilities	Home	Get captured image