Sandisk Sansa View

[zivan56]

Well the Sansa View came out a short time ago, and good news:  it's PortalPlayer based (Nvidia)!  And it looks to use the same basic firmware/bootloader (rom+mi4) layout as the c200/e200.
Use the latest version of mi4code to decrypt it with the key:
70e19bda 0c69ea7d 2b8b1ad1 e9767ced (v 1.00.03)
(found via mi4code keyscan on BootLoader.rom)
Firmware is available for download from:
http://forums.sandisk.com/sansa/board/message?board.id=view&thread.id=326
Decryption works just fine, and there is a classic PPOS header in when the firmware is decoded.  There appears to be a reference to the NVIDIA GoForce 6100 http://www.nvidia.com/page/goforce_6100.html, which features, among other things, a "Dedicated high performance 250MHz ARM1176JZ-S core"

Looks to be very close to the Sansa e200/c200 series in terms of the bootloader/firmware sections.  So I would assume a properly made binary could be signed with the above key and executed on the player.

Player can be put in UMS/MSC mode via a startup hack:
Let it boot up up, put the hold switch on.  Hold down the left side of the scroll wheel and plug the usb cable in at the same time.  Keep holding it until a drive appears.  Can someone do an fdisk -l output?

Now, if someone with a View using 1.00.03 firmware could trying the decrypt/encrypt the firmware and see if it runs...

[Bagder]

I've updated my mi4 page[1] to host the mi4+BL files for the View and I'm hosting MrH's most recent mi4code version[2] with built-in keys for the View... For your pleasure, I also host a copy of the View firmware zip[3].

Oh, and I've started a wiki page[4] about it.

[1] = http://daniel.haxx.se/sansa/mi4.html
[2] = http://daniel.haxx.se/sansa/mi4code.html
[3] = http://daniel.haxx.se/sansa/sansa-view/View01.00.03.zip (5.0MB)
[4] = http://www.rockbox.org/twiki/bin/view/Main/SansaView

Enjoy!

(and the mediaproc.mi4 that is included in the View firmware zip is decryptable using the same View key as the main firmware.mi4 is)

[scharkalvin]

Here's something else about the view I saw on everythingbutipod:

It's got hw video out...
http://www.anythingbutipod.com/archives/2007/10/sandisk-sansa-view-video-out.php

[saratoga]

A PP502x would be an odd thing to have if you're also got an ARM9 core too.  Perhaps its purely 6100 based, and the 6100 is itself a new "PP" chip developed by Nvidia since their acquisition of the PP intellectual property.  

[Bagder]

I agree.

A closer inspection of the firmware reveals no mentioning of PP502x, but several of PP6110. (I compared with the most recent e200 one and it has numerous PP5022 references.)

Many other strings are identical which indicates that the firmwares share a lot.

However, it being two different mi4 files in the zip somehow indicates they might be for two different cores. And both firmware files have ARM instructions and ARM exception vectors at 0x200.

[linuxstb]

They could have taken the same route as Apple did with the ipod video - keep the existing design as close to previous models as possible, and add a second CPU for video playback.

The firmware.mi4 file contains the strings:

NVIDIA  
NV6100-06.10-PP01-06.10-PP01.00.03P-RT
2007.10.10
(Build 50.10)
Digital Media Platform
Copyright (c) 2007 NVIDIA Corporation.  All rights reserved.

Which are quite similar to the PP strings found in the E200's mi4:

portalplayer
PP5022AF-05.51-S301-00.12-S301.00.12A-D
2006.03.29
(Build 169.20)
Digital Media Platform
Copyright(c) 1999 - 2003 PortalPlayer, Inc.  All rights reserved.

whereas the mediaproc.mi4 file contains:

NVIDIA
AP10
06.10
2007.04.11
(Build 08)
Digital Media Processor
Copyright (c) 2007 NVIDIA Corporation.  All rights reserved.


A more detailed disassembly of the mi4 files should show whether its PP or not - i.e. if it's using the same registers.

EDIT: I've had a quick look at the disassembly of the firmware.mi4 file.  There are lots of familiar PP registers being used (e.g. 0xf000f000 to remap memory, and checking 0x60000000 for 0x55 to test if the code is running on the CPU or COP).  So it would seem to me that there's a PP chip in there.

[Jorge]

Here is my fdisk -l output:

Disk /dev/sda: 16.4 GB, 16441147392 bytes
64 heads, 32 sectors/track, 15679 cylinders
Units = cylinders of 2048 * 512 = 1048576 bytes
Disk identifier: 0x00000000

And here is my lsusb -v output:

Bus 004 Device 004: ID 0781:74b1 SanDisk Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x0781 SanDisk Corp.
  idProduct          0x74b1
  bcdDevice            7.20
  iManufacturer           1
  iProduct                2
  iSerial                 3
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue   128
    iConfiguration          0
    bmAttributes         0x80
      (Bus Powered)
    MaxPower              500mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk (Zip)
      iInterface              0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
can't get device qualifier: Operation not permitted
can't get debug descriptor: Operation not permitted
cannot read device status, Operation not permitted (1)


I hope this helps.

[Drkepilogue]

not sure are these useful...

[rp]

from the 1. picture i see they still use an AS3517 from AMS for audio and power management.
I guess this chip will be similar to the AS3514.

[skaos]

Drkepilogue, is there a chip behind the metal shield in the first photo? If so, is it about the same size as the nvidia goforce 6100? If there's not, then the goforce 6100 is the SoC. From the link it is based on ARM1176JZ-S; could this be nvidia's development of PP?

[saratoga]

Drkepilogue, is there a chip behind the metal shield in the first photo? If so, is it about the same size as the nvidia goforce 6100? If there's not, then the goforce 6100 is the SoC.

I don't know what you're getting at, but yes, the SoC is a goforce 6100.

From the link it is based on ARM1176JZ-S; could this be nvidia's development of PP?

Since the part number is PP61XX, this seem likely.

[cax]

Indeed, what's under the shield ? Can't you peek somehow ?
I suppose it's a chip for radio support or LCD controller there.

[Drkepilogue]

Nothing under there =]

[Bagder]

I would rather think that what needs to be figured out are:

1. Does this have a recovery mode? (and how to use it etc)

2. Disassembly. Disassembly. Disassembly. (to learn how to use lcd, read buttons, etc etc)

[Drkepilogue]

I just got one too.  So the pics in the previous replies weren't good enough?  I can crack mine open if I need too... sure would keep it beautiful if I didn't have to though  

aparently, it was my first time doing this sort of thing..

as for is there a recovery mode.... maybe someone can make a faulty firmware that causes an error and see if it has a recovery mode...?