From ST2205u wiki
Jump to: navigation, search

Another photo keychain made by Innovage: shift3 Digital Photo Album with Keychain

Purchased at Benix (oddly enough, a housewares retailer) at a mall in Ontario, Canada for $15 CAD. Available online in vast quantities. eBay and other second hand sites. Also available at Shoppers Drug Mart in Ontario for $15, most stores have the newer model but some still have the old one also.

Appears that there may be two hardware versions of this product. Unknown if they are still identical on the inside.

The confirmed hackable version has a color front and a silver back half shell. Walgreens sells a "slim" version for $20. Untested. (No listings anywhere indicate that the slim comes with a CD, only eBay listing that say "Software preloaded". May be the unhackable two partition revision)

If you want a certain to be hacked version and can get a Shift3, make sure it's NOT the Slim. (Make sure it has a silver back.)



Copyright date is 2008 MerchSource, LLC. UPC Codes: 1613066 (12193) Above and 6 94202 10288 6 Below the barcode.

Blisterpack on the rear clearly shows a CD with cable, has words "PC/MAC SOFTWARE DISC AND USB CABLE INCLUDED". "60 Photo Capacity" yellow circle on front of package. Sometimes also comes in a cardboard box style packaging. As long as it has a silver back half on the keychain itself and includes a CD, it should be safe.

Confirmed Hackable (Fat Model) Packaging:

Unconfirmed, Untested and likely Unhackable Slim Model:

Device Info:

The memory chip is S29AL008D

The device reports the same USB ID as the Innovage-generic (1403:0001 Sitronix Digital Photo Frame) and the board markings are reportedly the same.


[431274.460401] scsi 9:0:0:0: Direct-Access SITRONIX MULTIMEDIA 0.09 PQ: 0 ANSI: 0 CCS
[431274.461481] sd 9:0:0:0: Attached scsi generic sg1 type 0
[431274.471341] sd 9:0:0:0: [sdb] 4096 512-byte logical blocks: (2.09 MB/2.00 MiB)
[431274.474302] sd 9:0:0:0: [sdb] Write Protect is off
[431274.474312] sd 9:0:0:0: [sdb] Mode Sense: 0b 00 00 08
[431274.474318] sd 9:0:0:0: [sdb] Assuming drive cache: write through
[431274.486299] sd 9:0:0:0: [sdb] Assuming drive cache: write through
[431274.486339] sdb: unknown partition table
[431274.522343] sd 9:0:0:0: [sdb] Assuming drive cache: write through
[431274.522385] sd 9:0:0:0: [sdb] Attached SCSI removable disk 


Bus 004 Device 007: ID 1403:0001 Sitronix Digital Photo Frame 


The script does not recognize the device as m_innovage or m_innovage2 so it won't modify the firmware, but is able to back it up and display the message "baks r ok" on the LCD.

phack -m does send text successfully.

Hack successful using

Hack also successful using


Here is the relevant file: m_shift3.tgz (Link is dead)

Here is the dump generated using (Link is active as of Nov 27 2010)

Mirror of the above attached to this post over at the dockstar hacking forums.


You must run as superuser for all of the steps!

Unzip contents of to hack directory.

Run ./ /dev/sdX in the st2205tools directory.

It should find a match in m_shift3 and prompt you to flash.


An example of the screen in action after the hack was applied, running LCD4Linux:

IMPORTANT USABILITY NOTE: The device overlays a battery indicator icon (12x24 pixels) in the lower left corner (about 5 px up & left) over anything that's displayed on the screen whenever connected via USB. In LCD4Linux, this eliminates the first 5 characters of the last 2 rows of text in the default size. (For layout, just use Row15.Col06 and Row16.Col06 to clear the battery icon for both lines)

After the custom hack was generated, the offset needed to be changed by 4 pixels for both X and Y in the spec file to remove the blue background right and bottom edges. This change does not need to be done with the firmware hack linked above called as I already edited the file myself before uploading the archive. Rat 22:20, 27 November 2010 (CET)

Personal tools