Georg Acher's Homepage


This is a description of a quick hack! There is now a "real" Video4Linux-compatible driver on That driver supports more Quickcams and allows the usual grabbing tools to be used (eg. camstream). The information and driver provided here are just for the curious people...

Linux driver for Logitech Quickcam Express with HDCS1000/PB0100 image sensors

Bernhard Kuhn from the Linux-Magazin donated this USB-webcam to us. Since there was no driver for Linux and (AFAIK) Logitech refuses to release the specs, I reverse-engineered the protocol with an USB-analyzer and a few hours later, I found out how to get pictures out of it.

Most of the important features and registers are now documented, however there are still some mysterious registers...

The software support is far from complete, there exists a simple kernel module that sends the isochronous data to user level. All processing and controlling is done in an user level application. There's no Video4Linux-support (but see below!) nor great adjustment options, as this was just a weekend project...

The quick-hack software allows the resolutions 176*144 and 352*288 (the camera's maximum) and works on 24Bit/16Bit Displays.

Mark Cave-Ayland ( wrote the PB0100 support, it works for his setup (TM).


The camera (P/N:861037-0000, S/N: LZ93857592) consists of an ASIC (STV0600) for USB control and a CMOS image sensor.

There are apparently two versions, my camera has the Hewlett-Packard/Agilent sensor HDCS1000, there's no datasheet available on their webpage, but I got one from Agilent, Germany (download here). The I2C-address is 0xAA.

The other sensor seems to be the Photobit PB-0100, the datasheet is on here , the I2C-address is 0xBA. The chip is packaged in a lead-less PLCC case, whereas the HDCS1000 has "gull-wing" pins.

Here are two scans of the PCB, the HP-sensor HDCS1000, and the ASIC STV0600.

The Photobit version looks different: Photobit PB-0100 sensor (28 pins!) and the ASIC STV0600.

There exists also a "LEGO-Cam" made by Logitech, using an VV6410 sensor (note the 36 pins!) by ST-VVL and the STV610 ASIC. The LEGO-Cam has also a microphone, a LED and a button built-in. This camera is not supported now, since it delivers compressed data in an unknown format!

The sensors are controlled via an I2C-bus from the STV0600, which gets the data from the PC.

Both sensors are NOT compatible (hardware and software), so the I2C control stuff in my "driver" works for the HDCS1000-sensor only!

The HDCS1000-sensor is so low-cost, that it even has no exposure control, this has to be done in software. The Photobit sensor has this capability.


Access to STV0600-Registers via CTRL-transfer:

40 04 LL HH 00 00 SS SS (DATA)

Writes SSSS bytes of data to register HHLL. SSSS is usually 1 or 2

C0 04 LL HH 00 00 SS SS ->(DATA)

Reads SSSS bytes of data of register HHLL.

The (guessed) meanings of the registers:
Address Function 
0x1410 I2C read value
0x1440 Enable ISO-streaming (1) 
0x1443 Sort of scan rate... 
0x1501 Value seems to be ignored, but set by Windows
0x1502 Value seems to be ignored, but set by Windows 
0x1503 ?
0x1504 ?
0x15c1/0x15c2 Max. ISO packet size L/H
0x15c3 Y-Control, 1: 288 lines, 2: 144 lines
0x1680 X-Control, 0xa: 352 columns, 6: 176 columns

HDCS1000 image sensor

If STV0600-address is 0x0400, then the I2C bus is accessed with a special format:

40 04 00 04 00 00 23 00 (35 Bytes of Data)
16 Bytes of I2C-Registers
16 Bytes of Values
(I2C-Address) (Number of values-1) (CMD)

CMD: 01 for I2C-write, 03 for I2C Read

 For I2C-Read the lowest bit of the I2C-address has to be set and the read value seems to be located in STV0600-register 0x1410.

The write command allows multiple registers to be written with on control transfer. For accessing the gain and shutter controls this feature is necessary, otherwise the stream gets out of sync...

The (guessed) meanings of the HDCS1000-registers:
Address Function 
06  ? !!!!!!!!
08  ? --------
0a  ? m-1-R---
0c  ? ------x-
10  ? --------
12  ADC precision mask(1-10Bit) ----bbbb 
14  Starty *4, sensor window to be read out 
16  Startx *4 
18  Height *4 
1a  Width *4 
1c  frame rate/integration time? 
1e  Gain Green1 
20  Gain Red 
22  Gain Blue 
24  Gain Green2 
26  Shutter L (larger->longer) 
28  Shutter H 
2a  Exposure L? 
2c  Exposure H? increasing causes "stripes" 
2e  ? --mmx-we 
30  ? Enable (4) -----x!! 
32  contrast/colour? !!!!!!!! 
34  ? 0------- 
36  ? ---mm!!! 
38  ? -----!!! 
(-: no change, != unknown behavior (mostly garbled screen/black), x:important, :m= some mode changes, w: switches to white) The values set in the viewer application are derived by the settings from the Windows driver...

The stream format

Both image sensors use the Bayer RGB pattern, i.e. there are only two byte values for each pixel, green and red for even rows, blue and green for odd rows. The camera does no other data compression. Each image starts with the sync values 80 02 00 00 80 01 00 00 ("VSYNC"). After that, the data is transmitted in chunks of more or less random length. Each chunk has the header 02 00 HH LL, where the data size is indicated by HHLL. After the header the HHLL bytes of data follow.

Quick hack application for demonstration

Download the quickcam-0.23.tgz-package. With make, two binaries are compiled:

 quickcamex.o: The kernel driver, it depends on USB support (>2.2.14 with USB-Backport or >2.3.99). After insmoding, install the device with "mknod /dev/quick c 180 80". The driver just outputs the data stream to /dev/quick and allows control messages to be sent to the device.

quickcam: The viewer. Without any option, the resolution is 352*288, with option "1" it displays 176*144. Only 24Bit/16Bit displays are supported, for 16Bit you may have to fiddle with the RGB ordering before set_pixel16().

Version history:

V0.23: Now the init for both sensors really works...

V0.22: Fixed reset problems

V0.21: PB0100 support by Mark, 16bit, Legocam detection, cleanups

V0.11: Fixed Photobit detection...

V0.1: Control messages that read are now implemented. They are used to discern the both sensors (I2C-address BA vs. AA) and abort if no HDCS1000 sensor is found.
Fix for 2.2.x (owner field).
Register naming now based on the HP data sheet.

V0.0: Start



Jean-Frederic Clere works on a V4L-port, look at his V4L-page.


I started the work on the Legocam, at least there's a stream coming, but it is compressed :-(

You can have a look at the init code and some pre-decoded prictures: quickcam-experimental.tgz.

Demo pictures

A picture of the camera itself, shot with a mirror:

Me and my creative chaos:

USB project at the TU München
Main page for Linux-USB
Georg Acher
Last Update: 2002-01-20