SanDisk Sansa c200v2, m200v4, clipv1, clipv2, clip+, and fuzev2

[funman]

Also I took the conversion code to translate instructions in utils/disassembler/arm/disasm_arm.c

What's the purpose of disasm_arm.c? And what did you use it for?

Well it's an ARM disassembler, I used it to modify the instructions / offsets.
Ex: +       jump = 0xEB000000 /* BL */ | (((bl_offset - (firmware_size + bootloader_size - 4) - 8 ) >> 2) & 0x08ffffff);
0xE0000000 is the condition: no condition
0x0B000000 is the instruction: BL (== CALL in i386 asm)
The last 3 bytes are the relative offset we jump to.

NOTE: I just found a bug: the offset mask should be 0x00ffffff not 0x08ffffff : this is why disassembling the patched firmware before putting it on the Sansa is important !! I will change the patch.

Also I forgot to mention that my code assumes there is no offset at the beginning of test.S, it replaces the instructions directly with relative offset.

As discussed with the hackers, it would be wise to execute our code after some stuff has been initialized.

Do you think you can access other parts of the firmware file then? Or access the buttons easier?
Hm, I'd like to understand it, could someone perhaps send me a chatlog?

I don't have the log, but according to atomik_punk the code before the first BL will setup the stack, and let us call various functions of the OF (to access buttons, exactly).
Of course it would be better to test that code on daniel's e200 since he has a recovery mode

[tobi-lu]

So the next step would be to write some code that checks for a pressed button and goes to the delay loop if it isn't pressed.

But you (atomikpunk) haven't yet found the button handling code in the e200 firmware, right?


Anyway, this idea sounds rather promising to me

[funman]

Hi all

I am still on the process on trying to unbrick my Sansa Clip, and I found the special mode mentioned by Daniel_at.

However just like atomik_punk and his m200, on the Clip you will see a 0MB partition.
Probably Sansa didn't allocate any space for this feature on some models.

Since I unsoldered the battery, the Clip is always off unless plugged on USB, so I assume it works only with device off:

1/ Bridge the PIN 17 & 18 of the NAND flash (ALE & WE# according to this standard: http://www.onfi.org/docs/ONFI_1_0_Gold.pdf

I also read http://s1mp3.org/en/docs_deadrec.php, mentioned in this thread, and bridging IO pins also work.

It looks like a generic way to enter recovery mode, not only for Sansa

2/ Plug the Clip on USB
3/ Notice a new 0MB hard disk detected
4/
5/ No profit since the Clip is still bricked

[daniel_at]

Hi all (but mostly Atomikpunk)

As you were searching for a function which loads data from the flash into ram, i had following Idea:
Because I found only one reference to the NAND_FASH-registers in the OF-Loader and further we know (USB ID and other stuff) that the AMS-SoC has a Sansa-specific PROM-Code and that the Loader in the PROM must already fetch data from the Flash, it is very likely that the Flash will be initialized by the PROM-Code.

Further it is possible to map the PROM into the Address Space, but according to the docu only starting from Addr. 0x00000000 - but maybe it is possible to "rewire" that, when Sansa build theire specific PROM-Mask.
Therefor, maybe we _cant_  find the function read_flash in the Flash-based fw-part, but it calls that function on some specific address which gets mapped into PROM.

Just a random thought.... If you happend to find some calls to addresses which look suspicous, it might be some kind of that...

Daniel

[atomikpunk]

Nothing much today except from that I'm pretty sure the LCD controller in the E200v2 devices is an ILI9222. I updated the E200v2 wiki page to reflect this. Still looking at the GPIOs for hints on buttons...

[Bagder]

Hello!

Thanks to friendly people out there, I've got a bunch of more firmware images files for Sansa v2 players and they're now so many I decided to make a separate page listing all of them:

http://daniel.haxx.se/sansa/v2fw.html

Enjoy!

[dataangel]

I'm very interested in helping getting rockbox running on my e280v2. I've been hacking C++ for years (and recently made the new dualnback plugin you can get on flyspray) but have never done any embedded stuff and never worked with ARM assembly. Is there anything I can help hack on? I'd prefer not to do anything that could brick my player but I'd gladly run any reporting utilities or if there is any coding that doesn't require a ton of ARM knowledge

[atomikpunk]

Yay, finally got my sansa v2: a 1gb clip

Now let's get back to work folks...

[Sai_Deschain]

hey folks!

First I want to say thanks for all the work you've done!
I've got a sansa e260 yesterday, of course a v2 model, and i'd really like to get rockbox running on it. i NEED it to scrobble. I haven't done anything like this before, but in school and at work i did programming in C, C++, C#, Java, Assembler, ... If there are any smaller implementing works to do, feel free to ask

ICQ # 399399688  or any other messanger which pidgin/adium is able to do

[notlistening]

Heya all,


Got a Sansa 280 v2 not done a image yet but will ASAP. I am a Real Time Systems developer with c, VHDL, FPGA, assembler, linux driver experience etc etc UK based. Lost about 80% of my vision in 2005 and I am trying to put the remaining 20% into good use.

Please contact me at thomaslloyd82 at hotmail.com MSN if you think i might be of use. I am a little rusty but with a bit of ARM assembelly I think i'll get going again.

Tom

[saratoga]

Please contact me at thomaslloyd82 at hotmail.com MSN if you think i might be of use. I am a little rusty but with a bit of ARM assembelly I think i'll get going again.

If this is your way of saying you'd like to help, I don't think its a very good way to do it.  Theres no organization here, its just people exchanging ideas and code.  Better to dig into the problem and then post once you have something to contribute.

[saratoga]

I've removed 5 pages of old posts from this thread that didn't have any useful info in them.  Hopefully this should make the volume of information here more manageable for people just joining in.

[notlistening]

Humm,

Thanks for the frosty reception, I will go off into my own little bubble and probably duplicate someone elses work.

I will check back when I've got rockbox working. Just wanted to say hi to some of the people that are working on the same project.

Llorean POSTING IN THIS FORUM « on: August 21, 2006, 03:44:51 AM » 

--------------------------------------------------------------------------------

Before posting in this forum, search (the button is at the top of the forum screen) for a topic regarding the player you're interested in.

One thread per player. This is not for requesting ports to players. This is for discussion of working on them. If there is no post for your player of interest, you may start a thread. But discussion should then be of what is necessary to make the port happen, not "how great it would be" to have that port. As well, do not post simply to ask how a port is progressing. That will be considered disruptive, as it is unnecessary.

I believe that i followed the posting guidelines, correct me if I am wrong.

Oh yeah I am actively helping out now!

T

[atomikpunk]

Hi everyone, and especially you newcomers,

I'm glad you joined the fun and have interest in a sansa v2 port. Please be sure to read this entire thread and the multiple pages on the sansa players on the wiki. I know it can't be quite harsh at first, but every captured knowledge is there. You can also send me a private message so we could share jabber (or other IM) IDs.

We already have some work done, both hardware and software. Some of it is documented but some is not too and we intend to improve on that "knowledge capture" part, mostly with the wiki but other suggestions are always welcome.

Our work should be first concentrated on:

• button handling understanding
• original firmware code insertion possibilities
• unbrick techniques (though we have some user unfriendly ideas already, maybe improve on that)
• anything related to the hardware and firmware understanding

If you need help starting up, please contact me I'll share some thoughts and techniques.

Welcome aboard.


As a side note, I said earlier that I got my v2, but I fact I got _2_ fully working clips at hand now so I'm ready to rock (pun intended).

[fml2]

Hello atomikpunk and others.

Could you please put somewhere for download the assembly text of the firmware you're trying to understand? If possible, with the comments to the things that have already been found out. I'm not an expert in assembly language but this would be a good chance for me to learn it and to (maybe) contribute to the porting of RockBox to Sansa v2.

Of course, if doing so is illegal for some reasons do not do it! (but let me know that it's illegal)

Thanks!