USB control messages:

- Command : (cmd << 8) | param
- Index : only set for read
- Buffer : arguments, usually in WORDs

Commandname | R/W | Code | Param | Ind. | Data | Description
Init Camera | W | 0xD7 | 1 | - | - | Send for opening the camera.
Exit Camera | W | 0xD8 | 0 | - | - | Send for closing the camera.
Select Picture | W | 0xB2 | 0 | - | WORD picnum | Select picnum picture (first is 1).
Download Image | W | 0x93 | Flags, 0x10,0x01. 0x00 works just fine. | - | - | Download selected picture by doing bulk reads (until no more data).
Download Thumbnail | W | 0x9B | 0x00 ? | - | - | Download selected thumbnail by doing bulk reads (until no more data).
Download Exif | W | 0xE5 | 0x00 | - | - | Download EXIF data for selected picture by doing bulk reads (until no more data).
Get Picture Info | R | 0xAD | 0x00 | picnum | 4 words: percentage, index number (in camera?), flags, unknown | Apparently gets image information about images in camera.
Get Picture Fileentry | R | 0xB9 | 0x00 | - | WORD check; CHAR filename[14] (byteflipped) from 2..16 DWORD filesize (32bit?), unknown(32bit?) | Gets the directory entry of the file.
Delete Picture | R | 0xBA | WORD flag; | - | WORD result; | Deletes the selected picture. Parameter might be 0x40 (delete?) or 0x00 (?).
Get Number of Pictures? | R | 0xB6 | 0x00 | - | WORD unknown WORD numpics WORD unknown DWORD freemem? | Gets several global parameters, like the number of pictures.The last 32bit appear to be free memory?