Sandisk Sansa View

[Bagder]

When they changed the mi4 format slightly from e200 vanilla to e200R they also changed some other magic values in the (decrypted) mi4 image, it should be worth investigating those to see if they've changed again. It's great to read that the dummy-signing still works!

Since the bootloader is stored in the hidden partition, most answers is possible to extract by disassembly - that's pretty much how MrH did it in the past.

[biglou]

I have my view and linux based system setting here.  What's needed as the next step for this?

Biglou

[Bagder]

For starters, owners of Sansa Views need to start thinking by themselves. What do you think need to be done?

You could for example get the mi4code source code, decrypt the view firmware and check the magic numbers in that firmware and compare them to a e200 (and/or e200R) image and its magic numbers etc.

The bootloader is there and ready to be read. Get it, disassemble it, see if you learn something new about the start/boot process and what else around running the firmware and figuring out the hardware.

[space_ghost]

unfortunately i'm not a coder at all... the only way i'm able to contribute at the moment is by providing several high-res scans of the player's main pcb and its other inwards. feel free to include them into the wiki page. (each ~ 980kb+-)

front of main pcb
back of pcb & memory board
back of display, battery pack, wheel/button part

date of production for this unit is 2007/10/29

if you need anything else scanned please let me know.

best regards,
space_ghost

[Drkepilogue]

Nice scans, how did u do it??

[zivan56]

Can someone try the following with View 01.02.09a firmware:
(removed)
rename it to firmware.mi4

[space_ghost]

@Drkepilogue

i use a canon canoscan 5200f

unfortunately this scanner is not supported by sane under linux, which is the main reason i keep a windows xp partition on my hd... the excellent windows driver provided by canon allows for tweaking every imaginable parameter of the device and delivers some very nice quality output as you can see... i originally scanned the parts @ 2400dpi, then scaled the resulting .tif images (with the gimp) to approx. 33% to sharpen and reduce size and finally saved them as progressive .jpg files, chosing a different quality level each time to ensure the result would stay within imageshack's 1mb filesize limitation...

hope this was understandable? please excuse possible wrong use of english, i'm german...

best regards,
space_ghost

[space_ghost]

@zivan56

pm me your email adress and i'll send you the renamed file.
btw. how come you can't rename this file?? worked for me w/o probs...

[zivan56]

I am not sure what you mean.  I am trying to modify an mi4 file and verify that the bootloader can load it on a View.  I don't have a View, but I would like to see some progress made...

[space_ghost]

ohh sorry... i got you wrong.
i'd love to test it, but have to re-assemble my view first... could take half an hour or so, this one is really tricky as one has to pay special attention to not produce any short circuits as the pcb is connected to the battery pack most of the time you're working on it due to the construction of the view...

[mr_dude]

I am not sure what you mean.  I am trying to modify an mi4 file and verify that the bootloader can load it on a View.  I don't have a View, but I would like to see some progress made...

what changes have you made?

I've taken the 5 updating files and exchanged the one you posted with firmware.mi4, also changing final.mi4 to firmware.mi4.
put them on the device like normal update
Disconnected from USB
device tried to update resulting in "invalid image. object loading failed while bootin(yes, it was bootin, not booting) please connect USB cable"

I connected and reflashed it with the original 01.02.09a, no problem with the device.

----------------
Now playing: pink floyd - time
via FoxyTunes

[zivan56]

Just some strings, but with a different mi4 header.  Mi4code seems to crash when doing a verify on the file, so I am pretty much out of ideas.

[crackmonkey421]

a while back I stuck the rockbox boot loader mi4 for the e200 on my view.  It actually got farther than it did with the modified firmwares.  It accepted the firmware, flashed my device, and rebooted.  Then my screen said "SanDisk Sansa" and then the LCD slowly went purple.  I reverted back to the stock firmware and everything is back to normal now.  With the modified firmwares I get the usual invalid image errors (though the unmodified unencrypted then re-encrypted firmware works).   Just thought I'd share.

[zivan56]

Interesting, so it must accept the files that exploit the verification check on the e200.  Did any of the button lights turn on/off when the wrong file was accepted?
This means the next step is to disassemble the firmware and see what GPIO controls the LEDs on the controls.  If we are lucky, the NVidia chip is just an evolution of the PP5024 with an extra video chip.
Did Mr.X have a look at the firmware?

[BlakeJohnson86]

Alright guys, I just got a Sansa View, and I'm willing to do whatever it takes to help port Rockbox to the Sansa View, even if that means bricking my player beyond repair.
Unfortunately, I can't code, so I'm not much help in that area.

I did modify the SansaView wiki page, and added some `lsusb -v` output attachments.

EDIT: Corrected some of my wording which was a bit messed up.