CRAIG CMP641F... Running a modified build of Rockbox?

[r00tb33r]

I recently purchased a CRAIG CMP641F player for ~$10 new.  I did it just for kicks, I wanted to see just how good/bad a device with such impressive feature claims could be...  The touchscreen is a lackluster as you might expect but the software...  I suspect that the device is running a modified/unofficial build of Rockbox.
How can I check?  It's already apparent that it plays more formats than the spec sheet claims.  I'm playing me some Rush in FLAC format, and FLAC is not mentioned in format specs.
The top bar with battery and volume, and the playback screen feel very Rockbox-like.  It's just one of those gut feelings.

[tpijag]

Mount it via your desktop and poke about. What do you find?
My gut says your gut be wrong.

[r00tb33r]

It creates 2 mount points, via the mass storage protocol (not MTP).  One is purely a data partition (initially had nothing in it) and the other I suspect belongs to the SD slot.  The player did read my 8GB card on the 2nd startup, but doesn't seem to want to create mount points when I connect to PC.

I think I'm gonna take it apart and see what kind of chips I find.  Might post board pics while I'm at it.
Post Merge: April 18, 2012, 10:18:49 PMRockchip RK2705A-B
http://www.rockbox.org/wiki/RockChip#rk270x_series
http://www.rockbox.org/wiki/Rockchip27xxPort

I suppose extracting the image is the only way to know for sure...
Post Merge: April 18, 2012, 10:28:02 PMYeah this thing is pretty much all integrated into the Rockchip.  Aside from that the only other notable chips are XPT2046 touchscreen controller, Intel flash and Samsung SDRAM.
Post Merge: April 18, 2012, 10:30:59 PMI should also note that the whole thing was hand soldered...  SMD resistors and caps are all crooked and uneven amounts of solder and "excess cones".
Post Merge: April 18, 2012, 10:45:01 PMThe SDK linked in the wiki has been removed it seems...

[wodz]

It pretty much looks like ramos T8 clone. I don't think it uses modified rockbox but it should be possible to port rb to such device with moderate amount of work. XPT2046 is connected to HSADC most probably. The very first step would be to extract firmware from the device and dissasm it to see what lcd controller is used.

[r00tb33r]

It pretty much looks like ramos T8 clone. I don't think it uses modified rockbox but it should be possible to port rb to such device with moderate amount of work. XPT2046 is connected to HSADC most probably. The very first step would be to extract firmware from the device and dissasm it to see what lcd controller is used.

My unit looks identical to the Ramos T8 you mentioned.  However I looked images of user interface and there are differences...

Anyway, how do I get the firmware image off this thing?

[wodz]

Basically there are two ways to expose firmware partition:
1) Put 'magic file' in the root of the internal data partition. The content of the file is not checked - only name is considered by OF. Unfortunately this name varies between players but 'rkusb.tag' seems to be the most universal. Then unmount the player and reboot.
2) Send vendor specific scsi request to the device. I wrote small utility to do this: http://git.rockbox.org/?p=rockbox.git;a=tree;f=utils/rk27utils/rkusbtool;h=e9cab7f47b5c1b45f566d379ca5fc8642fd4b25a;hb=HEAD
*BIG FAT WARNING* There was one report that this tool broke someones device. This was only one report but you should know...

Either way you should see another drive after connecting USB cable 60-90MB big which contains system files. The main firmware binary is  SYSTEM/BASE.RKW most probably. You can read about layout of the firmware file here: http://www.rockbox.org/wiki/RKWFileFormat

[r00tb33r]

I have placed an empty file by name "rkusb.tag" into the root of the data partition of this unit and rebooted it.  This exposed 2 more partitions on this device.  One 150MB system partition and another 20MB system partition.  I see a BASE.RKW file, its 1.72MB in size.  The other partition contains playback statistics and other application information.

So um, anyone wants the archive of files or a disk dump of the partition(s)?

I'd consider developing the port for this target if I could be sure that I could connect some physical buttons to it.  That touchscreen is very hard to use.  With buttons it would make a good car stereo though.

[wodz]

If you send me BASE.RKW I may look at it. My spare time is limited though so it may take a while.

[alphaman1101]

Would you be willing to look at my firmware as well? Im really trying to throw my own custom mix on this device. Its the same one as reported above. It responds in the exact same way with the Magic File in place. I have all the Bins and system files but i dont know how to read them. If this is in fact a rockbox, maybe all i need is the LCD driver and i can create the rest. If i need to re create this thread i will. But id rather not to save space.

[alphaman1101]

Maybe if i knew the decompiler you were using i could do this myself. (Im a program engineer anyways)

[wodz]

For quick look if this is rockbox or not objdump -D -b binary -m arm BASE.RKW should be sufficient. For more serious work IDA is the way to go unfortunately. But considering 1) player reacts for rkusb.tag 2) it has BASE.RKW and 3) BASE.RKW is 1.72MB big I bet it is not rockbox but something based on rockchip SDK. rockbox binary should be considerably smaller. As of rockbox port - it should be fairly easy but I don't have currently time to look deeper into this. You will need to write driver for lcd (you may have luck and some of our low level drivers will work but you need to disassm OF to judge that) and HSADC for touchscreen (unless they used external specialized touch controller).