Sandisk Sansa View

[crackmonkey421]

Recovery mode looks just like the e200.  [edit]First, the Sansa View has to be completely off.  To turn completely off, hold the power button for about 5 seconds instead of a quick press.[end edit]  Hold down the 'Home' button while the slider is set to 'Hold', then plug it in to your computer.  A partition named '16MB-FORMAT' comes up as a USB MSD.  Looks like you just stick the firmware on there using a mi4 file like the e200, but I didn't try it yet.

Also-- If you do the same thing but hold the middle button instead of the 'Home' button it comes up as a 'USB device', but it doesn't find drivers.

I've never contributed to a hardware project.  Is there a good place to start or should I just start searching the forums until I figure out what to do next?  I probably won't be able to do much until after the holidays.

[Bagder]

I figure the next step is to build your own mi4 with mi4tool and try to "upgrade" to that. You should probably alter some string inside etc to see that it is truly your version that runs.

If we're lucky, they have the signature-check flaw of the original e200 in there. If we're not lucky, we're facing an uphill batter. Did anyone show a fdisk -l output for a view disk when attached to a computer (ie does it show one or two partitions)?

[markys]

Hi,
Here's the output of "fdisk -l /dev/sdb"

Code:

debian:~# fdisk -l /dev/sdb

Disk /dev/sdb: 8220 MB, 8220311552 bytes
253 heads, 62 sectors/track, 1023 cylinders
Units = cylinders of 15686 * 512 = 8031232 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sdb1               1        1019     7984379    b  W95 FAT32
Partition 1 has different physical/logical beginnings (non-Linux?):
     phys=(0, 4, 11) logical=(0, 8, 27)
Partition 1 has different physical/logical endings:
     phys=(669, 23, 0) logical=(1018, 15, 2)
Partition 1 does not end on cylinder boundary.
/dev/sdb2            1019        1024       43008   84  OS/2 hidden C: drive
Partition 2 has different physical/logical beginnings (non-Linux?):
     phys=(157, 24, 1) logical=(1018, 15, 3)
Partition 2 has different physical/logical endings:
     phys=(679, 55, 0) logical=(1023, 137, 24)
Partition 2 does not end on cylinder boundary.

I hope you have what your looking for.. If not, just tell me.

[Bagder]

Ah yes, that's it. It looks like the View has the same kind of partition setup as the e200v1. If you'd make a dd dump of that second partition and make it available online, I figure we could verify to see if it is the exact same setup.

Anyway, you could start with trying to decrypt an mi4, modify a few strings, re-encrypt it and try to upgrade to that version just to verify that we know how to run our own code.

Once this works, someone could start working on writing a Rockbox bootloader. The View's bootloader is likely to be possible to extract from the hidden partition and is in fact included in the firmware upgrade package. Someone will need to disassemble that to start figuring out details on how things work on this device.

[Symbolis]

I (think!) I did a dd dump of the hidden partition. A bit chunky for the forum, though.

It should be up at

Unless I messed something up.

Lesson for today: Don't try anything when really tired and sick. It becomes a lot more complicated than it should be!

EDIT(3:20PM EST): Well, my connection's gone to crap, today. If no one else dumps it, I'll try again when the connection's better.

[markys]

Hey,

Here's the output of "dd if=/dev/sdb2 of=/HiddenPartition.img"

http://age.bdeb.qc.ca/~markys/HiddenPartition.img

Unfortunately, i can't help much more for the decrypting and programming part, but i am always willing to help the project and to learn, so if you need anything (not too complicated!) you can ask me  

Markys

[Bagder]

Yeps, it confirms that the Sansa View has the BL and OS parts in the second partition is pretty much identical how they are laid out in the e200 v1 series. It does seem to contain more segments though, which hardly is surprising...

[crackmonkey421]

OK, now that I have some free time I would like to start trying things... I've never done this before though so I'm not sure where a good place to start is.  Anyone know where I can find good information on editing a firmware?  I'd like to try changing a string and flashing as Bagder suggested.  Decrypting and re-encrypting look easy enough.  The part I'm not sure about is modifying a string.  Is there any good program for this? Suggested string to modify? or better yet, Is there a good web resource that will give me some of this information?

[zivan56]

Get a hex editor (frhed in Windows, ghex or similar in Linux).  Decrypt the main Firmware.mi4 and look for a language string.  Something like a main menu item or similar (it is near the bottom of the file).  Keep in mind strings are unicode.

[Bagder]

 Does this mean that rock box will be fairly easy to port, I mean if it has the same sort of layout and whatnot as the e200?

Oh no, it'll be a heapload of work to port Rockbox to this. A little depending on exactly how different this PP variant is - we just don't know yet.

The "same layout" part was regarding the disk layout and the seemingly similar file format for the hidden partition, so while that part is "easy" large parts of the port won't be.

[crackmonkey421]

Thanks zivan.  I tried your modified firmware and it didn't work.  I got this on my screen:

Invalid image
Object loading failed while booting
Please connect USB cable

I connected the USB cable and put the original firmware.mi4 back on and all is back to normal.  My easy success recovering makes me want to keep trying though.

Other question: What windows compiler do you use for mi4code.c?  I tried Dev C++; didn't work.  I have linux installed, but I'd rather use windows.

On another note, to get into recovery mode you have to completely shut down the sansa view first.  To do this just hold the power button for longer than usual.  I was very confused for a few minutes.

[zivan56]

Cygwin should do it (with proper development packages and libgcrypt).  Just follow the steps on the wiki for setting up a build environment (you don't have to follow the part where you run setup.exe again).  Then just run the run given on the mi4code page to compile it.

I didn't have a running Linux install, so I used the old Windows binary provided.  This might have been the reason (I didn't change the size of the binary, just letters in strings).
removed (modified string, but with latest mi4code)
removed (not modified, but decrypted and re-encrypted)

[Bagder]

Zivan's second (unaltered) image would be very interesting just to see if our "dummy-sign" approach works on the View or not.

[crackmonkey421]

Well I think this is great news: that second unaltered image works fine.  I'll be using my View at work all day today with that firmware, but I'm sure there will be no problems.

Bad news:  the modified image still doesn't work.  Same error as before.

So I guess the old signing approach still works but we got some strings modified that it doesn't like in Zivan's modified firmware.

I'm not giving up... just getting started.  I'll be making small changes and flashing.  If anyone has any other firmwares to try or a View to flash, I'd love the help.

If I have enough free time I'd also like to research the original Sansa e200 project for more ideas.

[zivan56]

I guess it may be a checksum issue?  When I did a strait decrypt/re-encrypt, it didn't change the checksum.  However, when modifying a single character it changed (for obvious reasons).  Another possibility is that is may use a second checksum somewhere else in the firmware which has not yet been discovered.