Sandisk C100 series

[saioke]

hey everyone... im just wondering if rockbox plans on supporting the sandisk c140 model?

[tarsius]

For a while I have been looking for a copy of the Sansa c140 firmware so I could observe the updating process and hopefully do something simple such as swap two characters in a menu string to see if it would produce the desired result.  No luck (until today) finding the firmware because there have been no updates released on the SanDisk website.

I've also attempted to open my c140, but it was not a simple matter of unscrewing.  In the past I was afraid of breaking it, but now I am prepared to flush the investment down the toilet if something goes wrong... I'll chalk it up to an educational expense.

Now that I have the firmware, I'd like to start a port to the Sansa c100 series, but this will be my first reverse engineering project.  I have a background in software, computer engineering, and to a lesser extent, electrical engineering, so this will hopefully be a do-able task if time permits.  I'll follow the NewPort wiki page--hopefully I'll post hardware photos soon.

Question:  Does anyone already know what CPU is inside the c100 series?  I've searched everywhere to no avail, but hopefully we'll know very soon...

Steve

[tarsius]

Answer:  The c100 series uses the Telechips TCC76x or TCC77x (http://www.rockbox.org/twiki/bin/view/Main/TelechipsInfo)

[skaos]

From http://www.experts-exchange.com/Other/Miscellaneous/Q_22591475.html:

Finally I was able to dissasemble the MP3 Player. The first part that needs to be removed is the front cover, it has like 3 plastic snaps on each side. Ones this was removed there were 4 screws to remove and that was it. It's pretty simple once you know what piece to remove first.

[Bagder]

It being a Telechips, it should be worthwhile to check what particular chip it is and then see if you can do the usb-boot "trick" with tcctool as discussed in the cowon d2 thread in this forum.

We also know how to generate the checksums for the firmware images etc, and they are otherwise unencrypted so they usually are rather "easy" to disassemble. If you have the firmware image in a file that is.

[tarsius]

skaos: Thanks for the tip... I'll open it up soon.  btw: what is the attraction to experts-exchange?  I'm always frustrated to when google links me to their site and I'm not sure why it would be worth paying to use a forum or profitable to answer questions on a forum.

Bagder:  Thanks--I'm going to read more about the tcctool trick (http://forums.rockbox.org/index.php?topic=10164.msg100834)... I glanced through and saw there was some significance to the USB device ids, so for reference, my c140 has ids 140e:b021 (vendor:product) when attached in recovery mode (holding the middle "select" button while plugging in the USB cable), which appears to be a good thing.

Also, when attached in recovery mode, it is detected as "TCC77x_USB" and this website (http://forum.mp3store.pl/index.php?showtopic=14695&mode=threaded) indicates the CPU is a TCC770, so the TCC770 looks like a safe bet.

If the above website can be trusted, it also lists the following data:

Telechips TCC 77x (ARM946 120 MHz +DSP) technologia 13 mikronowa

    * iAUDIO U3 >> Telechips TCC770 + codec Cirrus Logic CS42L51
    * Cowon iAUDIO F2 > Telechips TCC773 ((codec zintegrowany >codec Wolfson WM8731L )
    * Cowon iAUDIO 6 > Telechips TCC771L (codec zintegrowany >codec Wolfson WM8731L )
    * Cowon iAUDIO 7 > Telechips TCC771L (codec zintegrowany >codec Wolfson WM8731L )
    * Cowon iAUDIO T2 > Telechips TCC772S + Wolfson WM8731LS
    * LG-FM 20 > TCC771L ((codec zintegrowany >codec Wolfson WM8731L )
    * LG-FM 30 > TCC771L
    * LG-FM 33 > TCC771L
    * Logik DAX > Telechips TCC773 ((codec zintegrowany >codec Wolfson WM8731L )
    * Teclast T29 > TCC 770 + Wolfson WM8750 (player ten w Polsce sprzedawany jest pod markÄ… VTec PRO MP640)
    * Sandisk Sansa M-240-M 260 > TCC770 + codec Texas Instruments TI TLV320AIC23B
    * Sandisk Sansa C-140-C150 > TCC770 + codec Texas Instruments TI TLV320AIC23B (http://focus.ti.com/docs/prod/folders/print/tlv320aic23b.html)
    * Samsung YP-K5 > TCC770 + Wolfson WM8956
    * Samsung YP-K3 > TCC771L ( chip zintegrowany razem z codeciem Wolfson WM8731 L)
    * iBead 700 > TCC770 + Wolfson WM8750
    * VTec PRO MP640 > TCC770 + Wolfson WM8750 ( patrz Teclast T29 )

I've tried updating my c140 with the firmware updater (bottom of http://en.wikibooks.org/wiki/Sandisk_Sansa_MP3_players/c100), but the program's "Update" bottom remains inactive even though I connected the player in recovery mode according to the instructions.  I'm running Vista Home Premium, which may be causing the problem.  I also tried to run it from virtualized XP Professional (http://www.virtualbox.org/), but I could not get the VirtualBox's USB Controller to properly communicate with the "TCC77x_USB".  Can anyone else out there try the firmware update from Vista and/or XP?

Question: In general, do mp3 players (particularly SanDisk players) prevent you from updating to a previous firmware version or to the same version?

Next, I disassembled the "player.rom" firmware file using arm-eabi-objdump.exe from devKitARM (http://www.devkitpro.org/) executing
"arm-eabi-objdump -D --target binary -marm player.rom > disasm.txt" to produce the output "disasm.txt"
I browsed the code briefly and observed that it more or less matches the "Dual CRC" format (http://www.rockbox.org/twiki/bin/view/Main/TelechipsInfo)

Code: [Select]

       0: e59ff390 ldr pc, [pc, #912] ; 0x398          <--Location of firmware begin address
       4: ffff0106 undefined instruction 0xffff0106
       8: 3a726556 bcc 0x1c99568                   ;  Data is ASCII "Ver:"
       c: 31373030 teqcc r7, r0, lsr r0               ;  Data is ASCII "0071"
      10: 2cbcbcb7 ldccs 12, cr11, [ip], #732      ;  CRC
      14: 00000000 andeq r0, r0, r0
      18: 8b803d18 blhi 0xfe00f480                 ; CRC
      1c: 0011d008 andeqs sp, r1, r8                 ; Length of firmware = 1167368
      ....
      60: eb000084 bl 0x278                  ;<-- Beginning of firmware ...
      64: eb00005c bl 0x1dc
      68: eb000042 bl 0x178
      ....
      398: 20000060 andcs r0, r0, r0, rrx    ;<-- Firmware begins at 0x20000060
**Note that 0x4 - 0x1c and 0x398 is data, so the corresponding instructions are nonsense.

Steve

[linuxstb]

tarsius,

Have you investigated the UAC (User Access Control) settings?  IIUC, that prevents applications talking directly to hardware, even when running them as Administrator.  You could either disable UAC completely, or try and configure it to give the FW updater the appropriate permissions.  google should help.

Based on your info, I've added initial support for the C100 to tcctool.  But I don't know what the value of "SDCFG" should be.   Ideally, I need someone who can successfully use the FW updater in Windows to use a USB sniffing tool to create a log of the USB traffic during such a firmware update.  I've used usbsnoop for this.

And yes, the C100 firmware definitely looks like a TCC77x device, so the work being done on other TCC77x devices will be a lot of help towards a C100 port.

[tarsius]

For reference, I couldn't get the firmware updater to run even with UAC turned off, but I did update the c140 firmware on an XP box.  It looks like the SDCFG is 0x42E97010 as shown in the screenshot.  I'll send you the log too, if you need it.

To answer my question in the my previous port, you can use the updater more than once (i did it twice)... although the tcctool will keep that from being important.

I read about the tcctool in the Cowon D2 thread, browsed the tcctool (http://svn.rockbox.org/viewvc.cgi/trunk/tools/telechips.c?view=markup) and telechips CRC code (http://svn.rockbox.org/viewvc.cgi/trunk/tools/telechips.c?view=markup), and read some background RockBox info.  My next steps will be to get a linux partition set up and checkout the RockBox code, and take apart my c140 sometime soon.  I'll test out the tcctool and if it works, we start writing a bootloader/figuring out how to communicate with the electronics, right?

Steve

[tarsius]

New Sansa c100 wiki page: http://www.rockbox.org/twiki/bin/view/Main/SansaC100Port

I opened up my c140 and took some pictures of the inside.  Warning to anyone thinking of opening a c100 series player:  you cannot do it gently and it left my player looking like a dog chewed on it.  If you do want to get inside, first find a flathead screwdriver or dull razor blade (something with a very fine, flat tip) and wedge it between the BLACK, TOP plastic cover and the MIDDLE SILVER "layer".  Be very careful to pry at SEVEN places where the tabs (extending from the silver layer to the black) are located.  If you shove your tool in too far and miss the tabs, it's very likely you'll break off a delicate surface-mount component... It's a miracle I didn't break anything.  There are SIX large tabs along the length of the player, three on each side, and a SEVENTH, very tiny tab just above the I/O connector.  After you pop the black plastic plate off of the top, you'll see four little screws at the corners of the circuit board... removing these allows you to remove the silvery-goldish plastic backing plate.  When you remove the backing plate, be careful with the battery spring... it's connected to the circuit board, but it protrudes through the black and you must gently push it out.

The following photos are posted on the wiki page:
1) Looking inside the player after removing the black cover.
2) A shot of the text on the display.
3) A view of the player with the silvery-goldish backing removed
4) Text on the three major chips inside
5) View of the smaller circuit board that I'm afraid to remove
6) Close-up of the smaller circuit board... **Note the pins from an additional chip on this board.

I've been trying to install Linux on my laptop (HP tx1000... known for Linux issues), but so far it's not working. I'm going to keep pursuing that because I'm also having trouble getting VirtualBox'd Ubuntu to recognize my Sansa in recovery mode.

Steve

[ParallaX]

Ideally, I need someone who can successfully use the FW updater in Windows to use a USB sniffing tool to create a log of the USB traffic during such a firmware update.

maybe this info will help? :

Code: [Select]

[ROM File]
File Name=player.rom
[NOR Vendor]
Target Address=1879048192
[Write Target]
Media=1
[FW_DN]
Version=1.0.5A
Harp Version=2.0.5A
Company=Telechips.Inc
[DUMP File]
NOR Dump File=mem.INI
NOR Dump Size=0
[Writer PGM]
File Name=
Default Use=1
[Option]
CheckSum=1
File Name=1
Format=0
Font Writing=1
Font File name=
Serial Number=0
Serial File Name=
Serial Count=1
Hidden Area Size=6083
Download Sample File=0
Sample File Path=
Font File Path=c:\windows\temp\sansa\firmware
Customer Number=0
PC Number=0
[SERIALNUM]
File Name=
[Auto Writing]
Enable=0
[SDRAM Information]
SDRAM Size=1
[Hidden Area Map]
Total Fragment=6
F0 Start=0
F0 Name=770Font_.TCC
F1 Start=5376
F1 Name=UNICP437.TBL
F2 Start=5380
F2 Name=UNICP932.TBL
F3 Start=5512
F3 Name=UNICP936.TBL
F4 Start=5709
F4 Name=UNICP949.TBL
F5 Start=5929
F5 Name=UNICP950.TBL
this is configuration .ini file used by FW updater.

[zivan56]

Hmm,
1879048192 = 0x70000000 (which is different from the other c100 listed in tcctool as 0x42e97010).  Perhaps this is for another version of the c100?  You can try sending the player.rom with tcctool and see if the player starts up using the above addresses.  Of course you need to find out how to get into telechips usb boot more.

[Davide-NYC]

I just bought a Sansa C140 super cheap and tore it apart.

I scanned the PCBs and posted the images on the wiki:
http://www.rockbox.org/twiki/bin/view/Main/SansaC100Port

If a developer wants the board just send me a PM and I'll send you the hardware. Well, whatever is left of it anyway.    Gone.

Tarsius: Sorry, I supplanted your pics. They are still attached to the page, just hidden. I think the devs find large PCB scans more useful.

[linuxstb]

tarsius,

Are you still interested in working on this port?

I'm working on ports to the Logik DAX and Sansa M200, which are both very similar to each other (and to the C100).  Both my devices have the same LCD and controller (a 128x64 mono LCD), so the first step in porting to the C100 will be to get an LCD driver working.  After that, most of the code I'm writing will work "as-is" on the C100.

Dave.

[tarsius]

I haven't abandoned it, but I don't have any time for it right now.  I'm hoping to continue when the semester ends.

[MarcGuay]

Hi folks,

I picked up a c150 for cheap the other day and have started poking around.  Some things I've come across that may already be known but are not explicitly mentionned either in this thread or on the port page:

1)  To access USB boot mode/Recovery mode, connect the player with the select (center) button pressed.

2)  There is a "Production Test Mode" that is accessed when the lower-volume (the leftwards one) and the "options" button (the bottom button on the circle) are held while menu is pressed for several seconds.  If we could extract and decompile the code from this mode it would provide all of the basics required to talk to the buttons, LCD, USB, etc.

3)  I tried to update my firmware using the updater available from wikibooks.org using Windows XP with admin rights, and it failed.  The current firmware on my player is 2.0.007A.  I have a feeling, based on this and an obtuse comment I found on ABI, that the firmwares which start with 1 are for the c140 and those starting with 2 are for the c150, which leads me to wonder if this implies that the hardware is different...?  (Edit:  Both of the firmware's have ASCII mentions of both the c140 and c150 so maybe I'm on the wrong track here.  Though it's strange that I can't roll back the firmware.)  Perhaps I'll crack mine open and compare it with the scans in the wiki.  I have found a copy of v2.0.008A, which I'm tempted to try and upgrade to using either tcctool or the Sansa Firmware Updater, but I'd like to back it up first.  Which leads me to...

4)  I found a Telechips service program here:  http://www.qumo.ru/programms/QUMO_SENSO_Service_programm.zip, which seems like it could be extremely useful either as a tool or simply something to learn from.  I tried to extract the firmware ROM from my device to back it up but I don't believe it is capable of recognizing my device.  I played with it rather gently and managed to extract some data but I don't believe it to be the proper ROM file.

I'm around, and am pretty keen on getting dirty with this, any advice is welcome.  In regards to writing LCD drivers, any advice on where to begin with something like this?  Is it necessary to find out the model of the screen and obtain a datasheet for it?