Rockbox Development > New Ports
SanDisk Sansa c200v2, m200v4, clipv1, clipv2, clip+, and fuzev2
Bagder:
--- Quote from: jcollie on January 05, 2008, 03:06:49 PM ---Could the v2s have a separate flash memory area for storing the active firmware that isn't exposed by the USB interface.
--- End quote ---
It could certainly have that. Either there's a separate NOR flash for the firmware or it is simply stored somewhere on the NAND that isn't made available over usb-storage.
gletob:
here is the output of fdisk -l for my c250 v2
--- Code: ---owner@glenn-desktop:~$ fdisk -l /dev/sdf
Disk /dev/sdf: 2044 MB, 2044198912 bytes
63 heads, 62 sectors/track, 1022 cylinders
Units = cylinders of 3906 * 512 = 1999872 bytes
Disk identifier: 0x6f20736b
This doesn't look like a partition table
Probably you selected the wrong device.
Device Boot Start End Blocks Id System
/dev/sdf1 ? 199216 491461 570754815+ 72 Unknown
Partition 1 has different physical/logical beginnings (non-Linux?):
phys=(357, 116, 40) logical=(199215, 34, 11)
Partition 1 has different physical/logical endings:
phys=(357, 32, 45) logical=(491460, 44, 51)
Partition 1 does not end on cylinder boundary.
/dev/sdf2 ? 43188 538843 968014120 65 Novell Netware 386
Partition 2 has different physical/logical beginnings (non-Linux?):
phys=(288, 115, 43) logical=(43187, 17, 47)
Partition 2 has different physical/logical endings:
phys=(367, 114, 50) logical=(538842, 14, 42)
Partition 2 does not end on cylinder boundary.
/dev/sdf3 ? 478721 974376 968014096 79 Unknown
Partition 3 has different physical/logical beginnings (non-Linux?):
phys=(366, 32, 33) logical=(478720, 18, 30)
Partition 3 has different physical/logical endings:
phys=(357, 32, 43) logical=(974375, 14, 39)
Partition 3 does not end on cylinder boundary.
/dev/sdf4 ? 1 931190 1818613248 d Unknown
Partition 4 has different physical/logical beginnings (non-Linux?):
phys=(372, 97, 50) logical=(0, 0, 1)
Partition 4 has different physical/logical endings:
phys=(0, 10, 0) logical=(931189, 36, 30)
Partition 4 does not end on cylinder boundary.
Partition table entries are not in disk order
--- End code ---
and lsusb --verbose
h2gofast:
fdisk -l for an e280 v2
--- Code: ---Disk /dev/sdb: 8187 MB, 8187281408 bytes
252 heads, 62 sectors/track, 1023 cylinders
Units = cylinders of 15624 * 512 = 7999488 bytes
Disk identifier: 0x6f20736b
This doesn't look like a partition table
Probably you selected the wrong device.
Device Boot Start End Blocks Id System
/dev/sdb1 ? 49804 122866 570754815+ 72 Unknown
Partition 1 has different physical/logical beginnings (non-Linux?):
phys=(357, 116, 40) logical=(49803, 223, 11)
Partition 1 has different physical/logical endings:
phys=(357, 32, 45) logical=(122865, 44, 51)
Partition 1 does not end on cylinder boundary.
/dev/sdb2 ? 10797 134711 968014120 65 Novell Netware 386
Partition 2 has different physical/logical beginnings (non-Linux?):
phys=(288, 115, 43) logical=(10796, 206, 47)
Partition 2 has different physical/logical endings:
phys=(367, 114, 50) logical=(134710, 140, 42)
Partition 2 does not end on cylinder boundary.
/dev/sdb3 ? 119681 243594 968014096 79 Unknown
Partition 3 has different physical/logical beginnings (non-Linux?):
phys=(366, 32, 33) logical=(119680, 18, 30)
Partition 3 has different physical/logical endings:
phys=(357, 32, 43) logical=(243593, 203, 39)
Partition 3 does not end on cylinder boundary.
/dev/sdb4 ? 184696 184699 27749+ d Unknown
Partition 4 has different physical/logical beginnings (non-Linux?):
phys=(372, 97, 50) logical=(184695, 104, 25)
Partition 4 has different physical/logical endings:
phys=(0, 10, 0) logical=(184698, 243, 33)
Partition 4 does not end on cylinder boundary.
Partition table entries are not in disk order
--- End code ---
hth:
--- Quote ---Has anyone tried to scan the disk for the firmware image?
--- End quote ---
Found no firmware on the mass storage device shown by my Sansa 280v2.
Is anybody certain that the SanDisk MCU (see bottom) is an AS3525? It's labeled different, though it's also CTBGA224, 13mmx13mm with 15x15 balls and with a quick glance i found 2 usb balls of the SanDisk chip at exactly the same location as the AMS SoC.
This is the information i found out so far:
I have found no information on the flash chips, but i suppose they are 2x4G NAND flash mapped to a 8G msc device. I *guess* they reserved at least the first x MB of either one or both flash chips and put the firmware at offset 0 of the first flash (at least it'd be the easiest to implement).
Read/Write spead to device: 4MB/sec.
Best case: Flash chips are class 4 -> 8G= concatenation of flashes
Worst case: Flash chips are class 2 -> capacity by xkB striping
Also found no way to initiate a firmware recovery, yet.
Odd things:
* Files transferred in MSC mode are not seen in MTP mode and vice versa.
Note: A list of all physical paths, files and basic tag metadata is stored into MTABLE.SYS.
It appears to contain multiple "packets" of null separated, equal aligned (16-bit aligned, null-filled) data chunks. Text is stored as null terminated, variable length strings (i.e. not padded, so you cannot use offsets to calculate the position of the next record within MTABLE.SYS). Logical file location and filename are stored in UTF8 format, metadata like title, artist, album, genre are stored in either UTF16 or UCS-2.
* In MSC Mode mass storage device reported is:
* Windows XP: 8GB drive with full size 1rst primary partition mapped to logical drive; drive is not selectable by diskpart
* Windows XP: there's a second partition 0 bytes large mapped to a 2nd logical drive; it cannot be formated nor read because its too small to store a filesystem on it
* Linux: 8GB drive of the same size with invalid partition table or no partition table, fat32 filesystem on the whole drive (so physically the same)
Also tried initiating a recovery mode by overwriting the hole disc with zero (in mind: firmware must be somewhere on the flash).
After a second or so (some of first MB nulled) the display changes from "writing" to "connected", and the process on my pc writing to the sansa hangs.
After disconnecting the e280v2, it fails rereading the media database (remember: vfat is stored on the beginning of physical target). I cannot tell the exact error message i got, but it was something like:
"Unable to read media database. Need at least 90MB space.".
Exactly the time you needed reading the message, the Sansa e280v2 turns off again. After several tries to access or write to the device (with the 90MB needed error followed by auto-turnoff), i managed to format the entire 8G device with fat32. Same message with autoturnoff.
After copying a backup of all files (as shipped) on the newly formated drive again, it worked. I chose format on the e280v2, to be sure nothing is corrupted.
I then tried to find that 90MB message within the firmware, but didn't find it, yet. Four possibilities to figure out:
* some messages stored in UTF16, UCS2 or some exotic encoding like EBCDIC?
* a .bin file may contain subparts of a complete firmware?
* parts of firmware are crypted?
* error sitting in front of device :)
Does anybody have a datasheet or the exact specs for the flash chip below?
Perhaps somebody got the specs for the Sandisk MCU (i already got the AS3525 datasheet from AMS; i hope finding out some details about the bootloader code on the 1M-ROM and wether a hardware recovery mode is implemented; based on AMS datasheet chances are 1/2 and 1/2)?
--
SanDisk Sansa e280 v2 with:
MCU: SanDisk, 20-99-00112-2, S735-691106, SDC1, TAIWAN = AS3525A?
Memory: 8MB SHDR-DRAM 4Mx16, Samsung K4S641632K-UC75
Flash: 2x4096G Flash , i.e. 2xSanDisk S747118642, SDTNLLBHSM-4096, CP0086818
saratoga:
I skimmed the firmware file. Its actually quite readable, sandisk seems to have no problem with people looking at their stuff.
I think the firmware is basically a bunch of 100-200kb+ segments concatenated together. Each one starts with a header like the one Bagder found that contains a simple checksum and the length of the segment. You walk the file by reading the segment length from the header and then jumping ahead that many bytes plus however many bytes are needed so that you're 256 byte aligned. That is sometimes the start of the next header, and sometimes the start of a "DEADBEEF" section followed by the header. I'm not sure why they do that or how you know to skip over it. I did this 4 or 5 times and it worked each one, but I didn't have the patience to go all the way through the file.
Anyway, thats my quick look. Hopefully its helpful to someone.
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version