Rockbox Technical Forums
Rockbox Development => New Ports => Topic started by: aaronfg on June 08, 2006, 03:10:02 PM
-
I have no interest in this player, but did notice that anythingbutippod.com took theirs apart and posted scans of the pcb, etc.
http://www.anythingbutipod.com/archives/2006/06/toshiba-gigabeat-s30-teardown.php
So any Gigabeat users out there that may want RB on your player, some of step 1 seems to be done now.
-
There has been a start in gigabeat S hacking now:
RogerBacon has put his Gigabeat S HDD inside a iPod Video. With the iPod recoverty mode he was able to inspect the HDD. It turns out there are 2 FAT32 partitions. 1 for the firmware and 1 for the media files. I'll inspect the firmware tonight.
From fdisk:
Disque /dev/sda: 60.0 Go, 60011642880 octets
64 têtes, 32 secteurs/piste, 57231 cylindres
Unités = cylindres de 2048 * 512 = 1048576 octets
Cela ne ressemble pas à une table de partition.
Probablement vous avez sélectionné le mauvais périphérique.
Périphérique Amorce Début Fin Blocs Id Système
/dev/sda1 ? 1 151 153600 b W95 FAT32
La partition 1 ne se termine pas sur une frontière de cylindre.
/dev/sda2 151 57232 58451488 b W95 FAT32
La partition 2 ne se termine pas sur une frontière de cylindre.
-
Maybe one day guy ! I work on this (but im not a developer).
Thing i do :
-Partition information
-Extract firmware
-Read the bootsector and MBR of my Gigabeat S to my HDD.
-Read the string table
Also, Markun make a list of DLL.
Next step is open the s60 to view the component. (closer picture, trace board circuit ...)
Also, if a developer if interesting to port rockbox to the gigabeat let's me know !
EDIT : You can ask me the system file, partition table information, uncompressed .bin file (tanks to Toffe) and bootsector info/mbr.
-
I am very interested in trying to port rockbox to the Gigabeat S series. Unfortunately I am not sure if I have the time, or experience needed to do this. But I am willing to help, or try help start any attempt at this. I have done a little research. Let me put down some of the specific hardware specs I have encountered.
The Gigabeat S series runs off the Freescale i.MX31 MCIMX31 Multimedia Applications Processor(http://www.freescale.com/webapp/sps/site/prod_summary.jsp?code=i.MX31). This shows up in the Gigabeat S disassembly page:
http://www.anythingbutipod.com/archives/2006/06/toshiba-gigabeat-s30-teardown.php, and is
also confirmed on this Microsoft page :
http://www.microsoft.com/windowsmobile/media/gigabeat.mspx.
Per the Microsoft page the S series has a "2.4" QVGA (320 x 240) LCD screen". Per the rockbox Gigabeat F, Gigabeat X port page(http://www.rockbox.org/twiki/bin/view/Main/GigabeatInfo), those models use 32MB SDRAM Samsung model#K4S56163PF BG75. The pictures on the Gigabeat Teardown page Samsung model#K4M51323PC-BG75(http://www.anythingbutipod.com/archives/images/gigabeat-s/gigabeat-s-apart-front.jpg) I believe this is 512MB of memory, but to be sure the specification for this memory is here : http://www.samsung.com/products/semiconductor/MobileSDRAM/MobileSDRSDRAM/512Mbit/K4M51323PC/K4M51323PC.htm.
That is as far as I have gotten. When I get more time I will look into this further. A lot can be found by looking at the pictures of the components in the Gigabeat S Teardown web site, then hunting down the parts on the web, and probably comparing any info by the Rockbox Gigabeat F/X port page. Short of disassembling the Gigabeat, the Teardown page is the best resource at the moment. If anyone can point me in the right direct as far as how to begin porting rockbox, I'd really appreciate it. It would be interesting to find this. Whoever is porting the F/X series may want to help, or consider merging any future ports.
-
Check out the wiki page Aliask made:
http://www.rockbox.org/twiki/bin/view/Main/GigabeatSInfo
-
The Gigabeat S models are the basis for the Zune. Believe they use very similar hardware. Maybe a Zune port can be branched off of this
-
Maybe a newbie question, but has anyone tried using the Gigabeat F build on an S player? I just got an S60 for Christmas, found out about Rockbox, but don't want to do something stupid and screw it up. Extreme filetype limitations are the most annoying aspect of this thing! Almost enough to drive me crazy!
-
The firmware of the F and the S are differents. So, the bootloader too. I'm sure that we have to do modifications to boot and the buttons are not at the same place and many others thing (LCD screen, processor...)
-
From the service manual of the S30, it seems that you need a cd with the software from Toshiba.
"Ottoman.exe and the scenario file are provided on the CD-ROM
(Material No.: 360058245)"
I never find it. It must be available only to service center.
I am still trying to find it
-
Good news, the console port of the S30 is now connected and I could see the boot sequence
I still have to find the transmit, I can only see and not do any action
You can see the boot sequence on the wiki of the gigabeatS
-
Nice going Toffe!
Looks similar to other WinCE boot sequences I've seen. Perhaps we could ask for help from a team of people who are familiar with hacking that platform, such as the people who port linux to the iPaq series of handhelds? http://www.handhelds.org in case anyone is interested...
Perhaps of particular interest is the HaRET application, which is a bootloader that can be used to launch linux from within the WinCE environment : http://www.handhelds.org/moin/moin.cgi/HaRET. Clearly we won't be using it to try to launch a kernel zImage, but perhaps it can be hacked around with to make it launch a rockbox.gigabeats (should we ever produce such an image)
-
i don't know how much this will help, but there was a firmware update released for the gigabeat v.
http://www.mygigabeat.com/forum/messages.cfm?threadid=D2B6D7E9-3048-2906-EA79AEDE705156DC
-
Thank you for the help,
Perhaps we can modify the updater to load a modified firmware on the S and why not on a zune..
Wait and see ;)
-
i think its the best option we have so far, i went to look at the files that it flashes and it has the bin, so it might just need to have the default S patched binaries, unless of course the updater has different security checks
-
The updater is specific to the v30
I try it on the S30 and it say not connected
and doesn't continue .
So we have to modify the updater to work with the S
-
Hello HeaD_ShOt
We are just at the beginning.
I am going to trace the card to find all the connection, first to the jtag connector (I think it is a jtag connector)
Then from one component to another.
If the jtag exist I am going to try to connect to it and see if we can download the bootloader, modify it and reload it.
Can you help with something ?
-
how much work is involved
is it from scratch or do u just port rockbox?
-
We start from scratch as we don't know how to modify the bootloader .
We try to understand how it works and what we can do.
Do you have any knowledge on wince ?
You can go on the gigabeat irc channel so we can talk in live
-
i have cygwin
and am learning c
is there anything i can help with let me know
-
Just join us on freenode at #gigabeat
Thanks.
-
For the update:
I have a board of a S30 without component. This will allowed me to trace the signals.
At first, I will try to trace the jtag connector (hope it will be done this week)
I order an interface for the hd with zif connector so I can see the drive from my computer and copy and modify files on it (should receive it a t the end of this week).
More information a t the end of week
-
Update :
I trace the jtag connector on the S30 : it is present, just need to know if it is working.
I got a working S30 and wait for the hd interface with zif connector to try some changes in the nk.bin.
I will do it this week I think.
Can somebody analyze the recovery.bin file to see what it does actually as it can be a solution to load something on the S, a little risky because if you go in recovery mode, theer is no software available to reload something.
So if we can analyze it and try to write a software to load the firmware, it will be a first step.
-
My wife just purchased a S30 and I spotted your forum. I am really busy over the next week but I will purchase another S30 ASAP. I'll order a hd interface with zif also.
I can say the next week will be quite busy so I am not sure how much help I can be for a while. I will talk to some friends here in Australia and see who is interested in helping out. I will begin looking at firmware but I can't do too much until I have the hd interface.
I'll check in over the next week to see how things are going but I will be quite busy for a few days with work as I have to travel some 300KM away tomorrow and then back again either the next day, or day after.
-
Hello AnthraxPants
If you want more informations on the firmware, just have a look here :
http://www.rockbox.org/twiki/bin/view/Main/GigabeatSInfo
and go on the irc #gigabeat or #rockbox on freenode
-
My status update:
> ...The updater is specific to the v30...So we have to modify the updater to work with the S
> ...Perhaps we can modify the updater to load a modified firmware on the S
You only need to change one byte (hint: change the first unicode "gigabeat V" -> "gigabeat S")
Then the Japanese firmware updater can be used to re-install the firmware on the GigaBeatS !
http://www.mygigabeat.com/forum/messages.cfm?threadid=B4FB14C7-3048-2906-EA4E52CB99CE6A7E
NOTE: since there is only one official release, this is good for fixing broken S30/S60s.
It is also good for running 'homebrew' (see below) !!!
> ..and why not on a zune..
The Zune update process is different. The existing ZUNE.EXE windows app can be hacked to update the Zune device. Homebrew not (currently) possible for different reasons.
==========
re: Homebrew on the GigaBeat"S" S30 or S60 (the key to running Linux or RockBox)
The GigaBeatS uses digitally signed firmware. If you change almost any byte in the NK.BIN the SHA-1 hash changes, it fails the signature test, and the image will not be run.
Fortunately the boot loader is not very secure. With a trivial mod to the NK.BIN file, you can disable the check (BTW: 16 bytes)
NOTE: the Zune firmware (all released versions) does not have this hole so this technique won't work :-<
Long story short...17 bytes later the GigaBeatS is now an open platform for writing homebrew, porting RockBox etc.
Next to write a flexible bootloader. Will post details once that is working. I suspect it will be longer than 17 bytes ;->
To keep it non-invasive, you will have to cold boot your GigaBeatS to switch between the different OSs (another advantage of the little battery off switch).
-
You mean they don't sign the bootloader too?
-
I can confirm what Zunepet is stating is true. I have managed to get the Gigabeat V30 updater to work w/ my S30 by simply going through the updater w/ a hex editor and replacing every unicode reference w/ a "gigabeat V30" to "gigabeat S30". The udpater flashed my S30 and replaced my current firmware. The bad thing is my S30 is dead for now :\ . Great job Zunepet, and many thanks for what you have accomplished!!
edit:I've actually managed to restore my s30 firmware w/ this method.
-
> You mean they don't sign the bootloader too?
It is digitally signed and checked before it is used. That is a very good thing (otherwise my GigaBeat and ptw419's would be permanent bricks now).
During the update process it will try to reflash the ROM with the updated EBoot.bin/pmcboot_secure.bin and Recovery.bin. It will attempt a reflash only if the digital signatures are valid (that's a good thing)
Those two files you upload must be the GigaBeatS ones, unaltered -- otherwise it will wedge (temporarily, until you reformat the drive).
The NK.bin is the one we want to play with, and ideally only once. After that, new later stage bootloaders / "firmware" (eg: .rockbox\rockbox.gigabeat) should be loaded from the 2nd disk partition (the one we have semi-direct access to; what you see as "Storage" in Windows Explorer)
-
Thanks for the link toffe :)
Plenty of info provided, thank you to anyone who has helped.
Toshiba has dropped prices on S30 here in Australia. Now available for around AU$60 less in price, roughly AU$320 or US$250.
I'm still flat out working but should have a break late next week and be able to finally look at purchasing another S30 soon. I will try to make time to jump on IRC next week.
-
>The GigaBeatS uses digitally signed firmware. If you change almost any byte in >the NK.BIN the SHA-1 hash changes, it fails the signature test, and the image >will not be run.
>Fortunately the boot loader is not very secure. With a trivial mod to the >NK.BIN file, you can disable the check (BTW: 16 bytes)
How do you get round the check, would it just be a case of for every bit changed, we need to change another bit in the opposite way, in a similar place of the code? I read this can be done on the zune/something else...
would there be any other issues to prevent code from running?
-
>... would it just be a case of for every bit changed, we need to change another bit in the opposite way...
No, hash functions don't work that way (otherwise it would be too easy to crack)
The SHA-1 hash has not been cracked, it has been bipassed using a much simpler exploit (ie. a 'bug' in the loader)
> I read this can be done on the zune/something else...
Not true. The Zune has very similar SHA-1 logic, but they fixed the bugs so you can't use the same exploit. The GigaBeat "S" is wide open for homebrew, the Zune is not.
Other devices, including the iPod and some older WinCE devices, use simple checksums (for a simple checksum, it is very easy to change bits the 'opposite' way to fix up the checksum). They have been wide-open for homebrew for a long time.
> would there be any other issues to prevent code from running?
Not due to security checks. Figuring out how to directly access the hardware and port Rockbox (or Linux) is the work that must be done. So far the interest has been very low. That's probably because it is GigaBeat "S" only.
-
It's been a while since i have posted here, but I am just offering my support to this project. I'm running an S60 at the moment and am willing to help out in any way i can. I have some solid programming experience and could help out with the rockbox/linux porting. When the time comes to start porting just let me know. For now, good luck with the bootloader (wish i could assist with this, but it is not my area of expertise), I'll be checking back frequently.
-
I just wanted to inform anyone who is interested that I have managed to write to the framebuffer of the Gigabeat S. For those of you that don't know what a framebuffer is, it means that I have been able to print something to the lcd screen. So far I have been able to turn the screen to a certain colors of my choosing based on the RGB format. I was able to do this by working on top of what Zunepet had already accomplished, and by utilizing info provided to me by toffe. I will be posting code on this probably within a day or two. Rockbox on Gigabeat S just got one giant step closer :)
-
Please post code as soon as possible. So far, this project has been at a stand still since no one else has been able to contribute for lack of a way to run code on the Gigabeat.
-
I've posted the code to the gigabeat S wiki :
http://www.rockbox.org/twiki/bin/view/Main/GigabeatSInfo
under Gigabeat S Signature Disable and Framebuffer Write
-
*****IMPORTANT*******
Please also read the note under the sig disable and fb write download link. it is very important in order to be able to restore the original firmware, or try another custom firmware file.
-
Just a reminder, please don't ask things like "Are there any updates?"
Any such posts will be removed. These threads are for people to actually discuss getting work done, and are for contribution.
-
Although there has been very little activity on this thread recently, work has still been ongoing. There were some setbacks(like me burning my S again), but work was still ongoing. Currently there is some very good news. I was just able to print "Hello World!" with the Rockbox code which is a giant step towards getting a rockbox port working. If you would like to try out the sample bootloader it can be downloaded here :
http://rapidshare.com/files/42253579/gigabeatS.hello-world-rockbox.rar.html
Also, work is being done to wrap up a Gigabeat S tree. On top of that a function for scramble.c is in the works to hopefully create a custom nk.bin for rockbox instead of working on the original one. This work is being done by aliask. The text print is still a little buggy since I was just able to do it, today. From here, work on the S tree, and scramble.c might be a next target, or more than likely hard drive drivers...
Aside from that, feel free to ask if you want to see the code for hello world. I probably won't release it publicly until an S tree is working so as to provide a fully functioning and clean source tree.
-
awesome! Ive been hoping for an update. I would like to see the hello world code if possible. I plan on helping with some dev work a little later on and would like to get a jump on understanding the code if possible. E-mail or PM it if you can.
-
pics :
http://www.rockbox.org/twiki/bin/viewfile/Main/GigabeatSInfo?rev=1;filename=hello-world-gigabeats.jpg
http://www.rockbox.org/twiki/bin/viewfile/Main/GigabeatSInfo?rev=1;filename=hello-world-2-gigabeats.jpg
-
Awesome!
Congratulations guys!
-
I've just taken delivery of an S60, and am keen to pitch in on this port. Rumour has it that aliask has taken a trace of the usb traffic passed during the Gigabeat firmware update process. Anyone know if he's posted it on line anywhere useful ?
-
It is now possible to update the firmware on a Gigabeat S using the tool I just committed in SVN: utils/MTP. I'll edit the wiki soon, but the procedure is the same as with the hacked V updater.
-
Fantastic guys.......I thought the Gigabeat port was going nowhere.
I assume that the same port (or firmware) should work on another device that runs MX31, right?
(well, will get a try on our MX31 developer board and see if it works..... 8-), will try to give you an update later)
update: too bad, can't make it work on our board..... :-\ or anyone have any suggestions?
We tried to flash the nk.bin onto the board, but board still boot from the original OS, nothing is changed, ideas?
I have posted some request on another thread regarding developments of Rockbox or linux on MX31 players...........without knowing that the Gigabeat have went to this stage already!!!! Last time I check, everyone was still stuck......
http://forums.rockbox.org/index.php?topic=15873.0
-
update: too bad, can't make it work on our board..... :-\ or anyone have any suggestions?
Yes, get a developer to try this. But if you're serious, start a new port thread for your particular target and then provide a busload of more details than just "it didn't work".
-
For those people not following the recent commits to the Rockbox source tree :
mcuelenaere today commited a working version of "sendfirm" for windows - bringing this port one step closer to "supported".
All that really remains now is for power management to make it into the build, which will mean that keeping a version of the Original Firmware around to let you charge the battery will no longer be necessary.
This really is the last stumbling block, since we can't distribute the OF to allow this. Once this necessary feature has made it into the code, there will be no need for this unnecessary step to get Rockbox running on your Gigabeast, and we can offer it as a proper target.
-
Hello all,
Its been a long time since I've posted or been active towards the port. I'd like to congratulate all the dev's working on this port on the great progress. It's definitely come a long way from what it began as. I was wondering iff the current build was still using the OF
framebuffer setup and so forth. If it hasn't been done already, I've reverse engineered the part of the OF that sets this up, and this may be of help to the current dev's if they are interested. Feel free to contact me if you have any questions, even possibly about any other topics. I might have info that might not have been shared previously.
-
Yes, that info might be useful so it would be nice to have it easily accessible like in the wiki *hint* ;)
-
I'll definately update the wiki. I would have this done sooner, but after looking through my old work, it looks like I may have deleted my previous disassembly. So I'm having to go back and reverse engineer this again. I'll have it done asap.
Anyone interested might want to have a look at the function at 0x8805F3DC in eboot.bin->nk.exe.
This is where the IPU is configured it seems...
Also I do have the ROM dump that I made previously. I gave it to aliask before but I don't know if it was ever used, or is of any use now. It seems that the S jumps from 0x0 to 0xA0000000(flash mem)which then jumps to (0xA0001000) which looks like the beggining of eboot.bin in flash.
Update: I've posted some preliminary info of the graphics setup for the S in the wiki. By the end of the week I should have it done, if not before if I get more time to work on it.
-
I have a working Dual-Boot setup.
Using the method mentioned in the install page, I created a 'modified' nk.bin that seems to be working fine for dual booting.
I haven't seen the modified nk.bin posted here, so I'm not sure if I can post it or not. If I can, will someone please message me and let me know. I'll edit this to suit and post a link.
For anyone that has had trouble with the dual-booting.. Once you've made the nk.bin you can connect your Gigabeat to your PC, open up the first partition. You should see a 'nk.bin' there already. Rename this to 'nk.old' and copy your modified 'nk.bin' over.
Eject/remove your Gigabeat.. And it's a good idea to plug in the AC adapter. Then shutdown RockBox by holding the power button. Hit the power button again and quickly slide the 'hold' toggle over whilst the unit is booting. - Once booted you should be looking at the original firmware.
To boot back into RockBox, make sure hold is off. And turn the battery switch off and on again.
NOTE: If you're not plugged into AC power, the unit often powers off during the boot into the original firmware. I wouldn't worry about this too much, you can plug in and turn back on. And hey, I'm pretty dead keen on getting the power management working ASAP!
Progress by the way in the charging front. While one of my units was flat I decided to pull it apart and have a closer look at the 'dock' on the bottom. I may be wrong, but I believe there may even be a pure hardware way of charging the battery. - I cannot find any cables or docks that will work with the Gigabeat S though. But I do have access to the tools to make something pretty decent if this is the case!
-
Hello,
I have no coding or programming capabilities, but using the instructions on how to create the modified nk.bin, i had dual boot from the start without any problem and also the battery works and charges perfect in rockbox. The only problem with the battery is not to let it discharge the battery, because the rockbox drops the battery voltage at very low levels, with danger to destroy the battery. I am working rockbox since you released the rockbox bootloader and i must say i am very pleased.
-
I can assure you charging does NOT currently work under Rockbox.
-
The WIKI might be a better place for this info, but I thought I would run it by here first.
This is another method of updating the nk.bin file that is way simpler and don't require any command line.
With Zunepest's recovery software the nk.bin file can be replaced with the RB equivalent and it is used in the recovery process.
It worked for my anyway even when the other windows method didn't work for me.
any thought?
-
That is a hacked gigabeat V updater that we cannot possibly distribute. Besides, the Windows version of sendfirm was not all that long ago greatly improved and by all accounts works perfectly.
-
I can confirm the windows version of sendfirm is both easy to use, and 100% effective ;)
-
Part of the reason why I compiled the Windows version of MTP support for the Gigabeat S as a DLL was so it could be easily integrated into the (Windows version) of RBUtil; perhaps this is a solution for the 'problem' for people not familiar with CLI utilities..
-
I think software bass/treble control in sound menu is not working.
It only changes volume level. I checked with RMAA program to confirm it.
-
All that really remains now is for power management to make it into the build, which will mean that keeping a version of the Original Firmware around to let you charge the battery will no longer be necessary.
Is there anything that we (the non-developer Rockbox fans) can do to help get the power management functionality closer to completion? Hardware donation? Testing? Anything?
The Gigabeat S is an awesome target in my opinion.
-
Testing is the best thing to do now, dude. Check out Flyspray for the power management patch.
jhMikeS is about the only guy that was doing anything at this point right now, but he's been rather busy lately with other things.
-
Other than it being nice for confirmation, testing it isn't much use as it works well already and is pretty much complete :) As far as I am aware, it hasn't gone into SVN as there is talk of a big power management rewrite, and as LambdaCalculus said, jhMikeS hasn't been around much recently.
-
Thanks for bringing the Power Management Patch to my attention. I'm a gonna give it a shot ASAP!
-
Whenever I turn off the player with the battery switched on and an ac adapter plugged in, the next start, player formats everything and asks for new firmware. I also found that I can't, for the life of me, use sendfirm to install the bootloader if the battery is switched on.
I bought used so it might be an HDD issue, but it's strange that the issue only comes up under specific circumstances. I'll replace it, and reply.
-
How many times has this happened? Does it happen *every* time for you? Do you know what original firmware version is installed on your DAP?
We are trying to diagnose exactly what causes the Gigabeat to reformat :)
-
it happens EVERY time. under those exact conditions. I'll have it install w/o the battery switch on, but after the switch is flipped it'll format itself a boot later.
version 2.11 632
platform 1.2 632.4
EDIT: ahh.... It must have been some corrupt firmware I was working with. I found v1.3 nk.bin here:
http://cdgenp01.csd.toshiba.com/content/support/downloads/gbs_update_1_3_us.exe
patched it, and now I'm rockboxing.
-
is it normal that the device discharges if i don't switch the battery to off and leave it on a shelf for one day?
-
Hi...
Old thread...but just found it....
And YES...it is normal for the OF to let the battery discharge rather rapidly if you don't switch off the battery.
And yes, the OF had a tendency to reformat the disk (OF error #4 I think it was) if the battery got to zero and you turned the unit on.... Was a number of references to this on the old Gigabeat.com (private, non-toshiba) site that seemingly has gone away.
Thanks for all the hard work on this port. My S60 is fun to use again !!