Sandisk Sansa View

[zivan56]

Well, if what was said by crackmonkey421 is true, then someone needs to disassemble the firmware and figure out some way to show (i.e LCD, button lights, beep) that the device in fact accepts the e200 rockbox mi4 format.  Can anyone else verify this?

[crackmonkey421]

The light for the blue ring around the wheel comes on, but that's all.  It says "sandisk sansa" as usual then the screen slowly turns green, then white, then purple and so on... the words "sandisk sansa" stay on the screen.  It's pretty, but it doesn't look like something that's intended to be that way.  I even tried with a reverse boot loader for e200 with the same results.  In high hopes, I even stuck an unencrypted View's firmware (OF.BIN) in my SYSTEM folder, so maybe the e200 rockbox bootloader would load my View's regular firmware.  Of course that didn't work.

[zivan56]

Well the screen only does the fade out once the OS stops controlling the LCD.  That means that the new firmware was indeed accepted.  Since the location for the GPIO of all the components is different, it is logical that nothing will work (buttons, lcd, etc).

[BlakeJohnson86]

Was anyone aware that UMS mode was achievable just by plugging the USB cable in and waiting a little bit?  That is, if your OS of choice does not support MTP.  I forgot to do the UMS trick yesterday, and noticed that it worked somehow.

I'm an OpenSUSE user for the record.

[Llorean]

This is not reliable though (at least on other Sandisk devices that have this feature). Depending on various factors, by the time it switches to UMS mode, you may end up with a glitchy connection. So while it works, it's still better to do the trick.

[crackmonkey421]

I have been doing a little each night, but I'm still researching.  I need to figure out where GPIO is for everything.  I'm still not completely sure how to go about getting this information, but I'll let you know when I figure it out.

[42bs]

Hi
some more info on the partition layout (at least on OF 01.02.09)
Firmware header at 0x80000: "CPUI", 0x06000000
MI4 header starts with: "PPOS", 0x0010301

BTW: Is there already a tool to extract the FW from the dump ?

[Bagder]

Sure, I'm quite sure cutit works on the View as well, mentioned and linked to on this page:

http://daniel.haxx.se/sansa/e200.html

Then you can decrypt it fine using mi4code.

[cout]

linuxstb, how did you disassemble the firmware?  I decoded the 01.02.09a firmware with -s to strip the header, then ran:

 

Code: [Select]

  arm-elf-objdump.exe --target=binary --disassemble-all --architecture=arm firmware.mi4.no_header > firmware.objdump

but in the resulting output file I see many lines like:

 

Code: [Select]

   334:       f000f000        undefined instruction 0xf000f000

and objdump segfaults when it gets to location 257a7c.

The firmware itself appears to contain C++ code, as evidenced by some of the strings found in the file:

 

Code: [Select]

  long MediaManager::getMetadataID(MediaManager::STType, const unsigned short *, i
nt, bool)
  MediaManager::mount(): storage activated - volume = %d, storageID = %08x
  10LinkedListIN9WorkQueue5EntryEE

(not sure how that's useful, except that knowing the underlying code is OO might make it easier to isolate which parts of the code are doing I/O... too bad we don't have access to the source)

Anyway, it occurred to me that to find the code that outputs to the LCD, one might start by finding a string that gets displayed on the LCD.

[crackmonkey421]

I haven't worked on this thing much at all, but I was able to get flashing successfully. I have no experience disassembling firmware, but here's the steps I've taken to get a successful flash:

Download/build latest mi4code from http://daniel.haxx.se/sansa/view.html
Decrypt using mi4code with view key (mi4code decrypt firmware.mi4 firmware.bin view)
Edit firmware.bin in unicode using a hex editor
Sign using mi4code with dummy key exploit (mi4code sign firmware.bin firmwaresigned.bin)
Encrypt using mi4code with view key (mi4code encrypt firmwaresigned.bin firmwaresigned.mi4)
Rename your firmwaresigned.mi4 to firmware.mi4 and put it in your Sansa's root folder.

Make sure the original firmware.mi4 file you use is the same version as the firmware on your View or it might not work.  I used 01.01.06.  All I did so far is change "Now Playing" to "Hello World", but I thought someone with more knowledge and/or time might benefit from this information.



I'll be trying to learn more with every flash, but who knows if I'll actually get anywhere.

Ohh.. and I just ran this this:
arm-elf-objdump -D --target binary -marm firmware010106.bin > firmware010106.objdump

And I got this:
http://rapidshare.com/files/123747988/firmware010106.objdump.html
It seemed to work fine for me. However, I'm going to have to do a lot more reading before that means anything to me. Of course I'll post if/when I actually figure anything out.

[rockfarm]

Well, As CrackMonkey421 has found, I believe that we can run our own code using a dummy sign and then encrypting with the View's key. We just need to figure out how to show that, and make a bootloader, right?

So, as cout has said, we need to find strings that are displayed to the LCD. We have found many of these strings. I just wouldn't know how to find the code that actually does the displaying.

The strings that I have found start at offset x2ada6c, and continue for about the next 8,000 or so bytes (FW 01.01.06). Also, this is for English only. Following that, the other languages are there too. I can also confirm that I have done some changing of strings and flashing thanks to (crackmonkey421), and it does work.

Maybe I'm stating the obvious, but I'm still trying to help as best as I can.

Would it make sense to look in the bootloader for strings (or the code), or would it be best to stick to the firmware.mi4?

[AeroBlue]

Hi!

I found these picture on a french website ( a high quality pictures of the sansa view )

http://img231.imageshack.us/img231/8697/image0001lm9.jpg
http://img231.imageshack.us/img231/6956/image0003zw5.jpg
http://img231.imageshack.us/img231/6971/image0002cz6.jpg

I hope they would be useful

[crackmonkey421]

Hi!

I found these picture on a french website ( a high quality pictures of the sansa view )

http://img231.imageshack.us/img231/8697/image0001lm9.jpg
http://img231.imageshack.us/img231/6956/image0003zw5.jpg
http://img231.imageshack.us/img231/6971/image0002cz6.jpg

I hope they would be useful

Those pictures came from space_ghost on this forum on this thread even.  Please read the thread before posting.
Here's where that really came from:
http://forums.rockbox.org/index.php?topic=13562.msg113697#msg113697

I'll update the View port's wiki soon if nobody else does.

Would it make sense to look in the bootloader for strings (or the code), or would it be best to stick to the firmware.mi4?

Well you certainly can explore all options, but everything we need to run code is probably in the firmware.mi4.  This device is based on the GoForce 6100 chipset which contains a 250MHz ARM1176JZ-S core.  It is believed that the GoForce 6100 is based on previous PortalPlayer products because of their firmware format, PP6110 being mentioned in the firmware, and nVidia acquired the PortalPlayer company in the beginning of 2007.  This device also contains an AS3517 chip.  So, disassembling the unencrypted firmware.mi4 with an ARM assembler will show a lot of what is going on, but knowing how to actually read what is going on is another story because I am not experienced in assembly code of any kind. Whatever documentation or SDK nVidia supplies for their GoForce 6100 would be nice to have, but I don't think we're going to be able to get those materials.  It's all about disassembling and deciphering at this point.

Maybe if we ever get this thing ported we could play with the 3D graphics engine built into it.  The OF doesn't do this hardware justice at all.

[Bagder]

I figure a sensible next step is to figure out how to use the LCD and how to read buttons.

[madnut]

Can someone post the unencripted firmware?