back to index

Reverse engineering: Spy Pen

Spy Pen

There are various James Bond wannabe things on the market these days. Mostly from China.

One of them is a spy pen. A thick, functional metal pen with a built-in video camera. Put it in your pocket, press a button, and order a shaken-not-stirred martini. It's not expensive, too; around $50-$70 will fetch you a 2 gigabyte model.

This particular model was bought in Prague, Czech Republic, in a GM Electronics branch. Its manual comes in English and Chinese, the pen itself lacks manufacturer mark except a tiny label on the white plastic plug on the USB connector side saying "Golden Land hd Video".

The pen can be unscrewed in half. Inside it there is an USB connector. When connected to the computer, the device acts as an USB Mass Storage device, formatted with FAT32 filesystem and USB ID 115e:0003. The disk has no partition table; it behaves like a USB Floppy. The recorded videos are stored in a subdirectory CAMERA_RECORD, with file names like RECORD000001.AVI, numbered sequentially. The pen remembers the sequence numbers even when files are erased from the memory.

The files are AVI files. The audio encoding is PCM, 8000 Hz, 16 bits; lousy but adequate-ish for speech. The video is color, in resolution of 352x288, in H.263 encoding, 12 frames/sec, about 1423 kbps. The video is playable by VLC in Windows and VLC or MPlayer in Linux with no issues.

Example file

The device is compatible with Windows. It however has some issues with Linux.

The device contains two crystals; one 12.000 MHz, one unmarked, assuming 32.768 kHz.

Setting date/time

Create a file named "SystemTime.txt", with a single line in format
yyyy-mm-dd HH:MM:SS
e.g. 2009-10-05 04:30:00
Then save it to the root directory of the spy pen.

Linux compatibility

When connected to the computer, the pen takes about 10 seconds to be registered by the kernel (Linux 2.4.21). When connected to USB2.0 connector, the operation is highly unreliable; USB packets are getting lost, the device often timeouts and then appears like disconnected. File transfers are next to impossible. When connected to an USB1.1 port, through a hub, the operation was slow but fairly reliable. Copying files both to and from the pen then worked fairly well. Other configurations weren't tried.


Inside

The heart of the pen is a board with electronics, 15x70 millimeters, with an attached USB A connector. The system battery is a single 220 mAh Li-polymer cell, with its own integrated protection circuitry.

The pen was disassembled by gently knocking the board out with a hammer aimed at the USB connector. The board is held in position by a plastic ring 4-5mm thick between the USB connector and the pen housing. The battery leads were torn during the disassembly, however their reattachment was fairly easy.

The scale grid, wherever shown, is 5x5 mm.


Spy pen

Business end

Start/stop button

USB connector

camera

Inside

System board top

System board bottom

System board side

System board side

System board top detail

System board top detail

Board top, scale grid

Board top, scale grid

Board bottom, scale grid

Technical details

mplayer

MPlayer 1.0pre6-2.96 (C) 2000-2004 MPlayer Team

CPU: Intel Pentium 4/Xeon/Celeron Foster (Family: 8, Stepping: 4) Detected cache-line size is 64 bytes CPUflags: MMX: 1 MMX2: 1 3DNow: 0 3DNow2: 0 SSE: 1 SSE2: 0 Compiled for x86 CPU with extensions: MMX MMX2 SSE

Setting up LIRC support... Playing RECORD000004.AVI. AVI file format detected. VIDEO: [H263] 352x288  24bpp 12.000 fps 1423.3 kbps (173.7 kbyte/s) Clip info: Software: ankarec

=====================================================================

Opening audio decoder: [pcm] Uncompressed PCM audio decoder AUDIO: 8000 Hz, 1 ch, 16 bit (0x10), ratio: 16000->16000 (128.0 kbit) Selected audio codec: [pcm] afm:pcm (Uncompressed PCM)

=====================================================================

[gl] Using 4 as slice height (0 means image height). SDL: Using driver: fbcon

=====================================================================

Opening video decoder: [ffmpeg] FFmpeg's libavcodec codec family Selected video codec: [ffh263] vfm:ffmpeg (FFmpeg H263+ decoder)

=====================================================================

Checking audio filter chain for 8000Hz/1ch/16bit -> 8000Hz/2ch/16bit... AF_pre: af format: 2 bps, 1 ch, 8000 hz, little endian signed int AF_pre: 8000Hz 1ch Signed 16-bit (Little-Endian) AO: [oss] 8000Hz 2ch Signed 16-bit (Little-Endian) (2 bps) Building audio filter chain for 8000Hz/1ch/16bit -> 8000Hz/2ch/16bit... Starting playback... VDec: vo config request - 352 x 288 (preferred csp: Planar YV12) VDec: using Planar YV12 as output csp (no 0) Movie-Aspect is 1.33:1 - prescaling to correct movie aspect. VO: [sdl] 352x288 => 384x288 Planar YV12

lsusb -v

Bus 003 Device 028: ID 115e:0003  (?)  (USB DISK) (200605091234)

Device Descriptor: bLength 18 bDescriptorType 1 bcdUSB 1.10 bDeviceClass 0 Interface bDeviceSubClass 0 bDeviceProtocol 0 bMaxPacketSize0  64 idVendor 0x115e idProduct 0x0003 bcdDevice 1.00 iManufacturer 1 ? iProduct 2 USB DISK iSerial 3 200605091234 bNumConfigurations 1 Configuration Descriptor: bLength 9 bDescriptorType 2 wTotalLength 39 bNumInterfaces 1 bConfigurationValue 85 iConfiguration 0 bmAttributes 0xc0 Self Powered MaxPower 500mA Interface Descriptor: bLength 9 bDescriptorType 4 bInterfaceNumber 0 bAlternateSetting 0 bNumEndpoints 3 bInterfaceClass 8 Mass Storage bInterfaceSubClass 6 SCSI bInterfaceProtocol 80 Bulk (Zip) iInterface 4 ? Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x81  EP 1 IN bmAttributes 3 Transfer Type Interrupt Synch Type None Usage Type Data wMaxPacketSize 0x0008  1x 8 bytes bInterval 10 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x82  EP 2 IN bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040  1x 64 bytes bInterval 0 Endpoint Descriptor: bLength 7 bDescriptorType 5 bEndpointAddress 0x03  EP 3 OUT bmAttributes 2 Transfer Type Bulk Synch Type None Usage Type Data wMaxPacketSize 0x0040  1x 64 bytes bInterval 0

kernel response at device insertion

Aug  8 21:41:55 hostname hub.c: new USB device 00:1d.7-6, assigned address 26

Aug 8 21:41:55 hostname Manufacturer: ? Aug 8 21:41:55 hostname Product: USB DISK Aug 8 21:41:55 hostname SerialNumber: 200605091234 Aug 8 21:41:55 hostname scsi4 : SCSI emulation for USB Mass Storage devices Aug 8 21:41:55 hostname Vendor: Model: PMP Platform OPN Rev: Aug 8 21:41:55 hostname Type: Direct-Access ANSI SCSI revision: 02 Aug 8 21:41:55 hostname Attached scsi removable disk sdd at scsi4, channel 0, id 0, lun 0 Aug 8 21:41:55 hostname SCSI device sdd: 492672 4096-byte hdwr sectors (2018 MB) Aug 8 21:41:55 hostname sdd: Write Protect is off Aug 8 21:41:55 hostname sdd:<7>usb-storage: queuecommand() called Aug 8 21:41:55 hostname unknown partition table Aug 8 21:41:55 hostname usb.c: USB disconnect on device 00:1d.7-6 address 26


If you have any comments or questions about the topic, please let me know here:
Your name:
Your email:
Spambait
Leave this empty!
Only spambots enter stuff here.
Feedback: