Philips GoGear Ariaz /37

[touslyxid]

Update: Uploaded scans


///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////|




The 08 in SA4ARA08KF/37 denotes that this is the 8GB version, there are also 4GB(SA4ARA04KF/37) and 16GB(SA4ARA16KF/37) versions.

Supports:
[ ♫ ]Audio: MP3, WMA, AAC, FLAC, APE, WAV
[ ❦ ]Images: PNG, JPEG, BMP
[ â–¶ ]Video: MJPEG, WMV (320x240)
[⌨]Text Files: TXT
[ â—Ž ]Radio: FM, RDS
[ ✇ ]Recording: WAV

[][][]

[saratoga]

Here is a link to the actual firmware files:

http://mit.edu/mgg6/www/SA4ARA08KF_37.zip

They're STMP, so see this page for decoding them:

http://www.rockbox.org/wiki/SbFileFormat

[pamaury]

I had a look and the sad news is that both the updater and the firmware are encrypted with non-zero keys. This leaves only a few possibilities:

• brute force the key (unlikely but perhaps it is made up of ascii characters)
• find an older firmware upgrade which has updater encrypted with two keys (one zero and one non-zero)
• based on reverse engineering of other updaters and assuming they are the same, find a flaw in the upgrade procedure (hard)

The second option is clearly the one to follow.

[touslyxid]

I uploaded some pictures of the hardware, the proper way to open it is through a hidden screw under the top bar(Where the Return and Menu/Lock keys are):


The bar opens and hinges on the bottom part(So you'll try to open it from the really thin slot on the top), it also applies a force that causes it to close, so you have to sort of hold it back while you unscrew the hidden screw.

Since my scanner has problems with distant objects I needed to irreparably damage the board to get it as flush as possible with the scanner glass. I still have the board if anyone has any questions about the the small lettering that may have not come out as clear in the scans.

According to pamaury it seems the software side of this device was encrypted to such a degree as to make it infeasible to implement rockbox, at least for the foreseeable future.  My role in any potential port has come to an end, I'll take this as an expensive lesson on dropping seventy dollars on a device I don't know enough about.

Next chance I get I'm getting the Sansa clip+, it has better sound quality at half the price and its firmware is actually pretty good. (Better when accompanied with Rockbox of course )

[pamaury]

Hi,
how damaged is the board ? Maybe someone would be able to repair it with the appropriate tools ?

[touslyxid]

You can see the damage here: http://min.us/lhg7YDu3PGetY

I ripped out the USB and sound jack ports. The whole process was an amateur job, I opened it because I was willing to sacrifice this device to the music player gods, I had some serious buyers remorse with this thing. Never buying Philips again. Also I figured out the proper way to open it half way through ripping the thing apart. I did salvage the battery and screen however, perhaps it would be useful in a future project with a raspberry pi or something of the sort.

Edit: Also thanks for the help guys.

[wodz]

Please consider donating this player to the project. Judging from the pictures it should be possible to resolder usb and headphone socket. Maybe pamaury finds a way to bypass security checks and without guinea pig device this would be impossible.

[touslyxid]

My apologies, my intentions were to throw the player away after taking some scans of the insides. Since the device was cleverly designed to hide how to open it I had to bruteforce my way in starting from the top, cutting off large pieces of the case and in effect making the device unusable for regular every-day use, as a result I only have board, battery and screen, I threw everything else away, the keypad, case, and speaker. Fortunately I at least figured out the proper starting point to use when opening the device up, so if anyone in the future decides to tackle it they can be a lot more precise in the process.

In hindsight I should have just asked one of you guys for help through the whole process, as you guys know better than I do how to work with these things.

[wodz]

Working board itself is still interesting when speaking about bypassing the protection. Other then this it should be possible to  dump the content of nand chip.