Rockbox Development > New Ports
SanDisk Sansa c200v2, m200v4, clipv1, clipv2, clip+, and fuzev2
atomikpunk:
--- Quote from: fragilematter on August 29, 2008, 03:31:00 AM ---It seems implausible that the m series and clips don't have a debricking method if the nand gets messed up, so maybe there is one, we just have to find it :)
--- End quote ---
Well in fact there is one, we have a plain ol' JTAG port at hand in case something goes wrong... Which is in fact better than anything else for debugging and unbricking. The downside is people need to be able (and willing) to open their device, solder some wires, wire a JTAG to parallel port adapter and hack a bit.
But I doubt sandisk made effort to implement something else for the cost of those devices. In case something goes wrong, they replace the device and throw the defunct one on ebay :D
I have something I'd like to test on the e200 series. I think that GPIO pin A3 may be the hold button. you can try that if you are comfortable with arm assembly and disassembly tools, or I can build a test firmware if you prefer. You and/or Daniel could then test it on your e200.
fragilematter:
Well, basically I should configure the pin for input at base(0xC80B0000?!)+4, read it and load the read value into a register, compare it with what we are looking for and branch if equal to the code that should indicate the successful read.
Theoretically it shouldn't be too hard, practically I don't have any experience and you haven't said if you want the code to run before the jump to the OF or after the OF initializes everything. Drop me a test.s (or whatever code you want run and where you want it) and I'll test asap! :)
philibuster:
Clip is on woot right now for 19.99+5 shipping. Granted, it's the clip so it has the small ram, but hey, it works for hacking, right?
funman:
fragilematter I checked the dump of your recovery partition and it contains the firmware, although it is a bit different:
After ~32MB the firmware is not validated by my tool, it might be because the real disk begin.
Which version of the firmware are you using? Is it available for download on the Sansa forums or anythingbutipod ?
Note: from ~17MB to ~32MB I see 0xdeadbeef padding, maybe we can insert code in this place ?
Can you modify the test.S / mkamsboot.c to use this offset instead of the end of the firmware block ?
You can calculate any offset in this area and modify mkamsboot.c to use your offset instead of reading the offset from the firmware file.
Also, the byte at offset 0x1FF is 0x46, on all other firmwares it is 0xFF, can you overwrite this byte to any value, and the corresponding byte at 0x3FF to the same value and see if the OF still boots ?
fragilematter:
Hey funman, thanks for taking the time to have a look at that stuff.
The firmware is e200pF.bin version 3.01.16, so it's the European version with FM - http://daniel.haxx.se/sansa/v2/e200/SansaE200_plusF3_01_16.7z. The last part of the dump (I haven't checked where it starts exactly) does appear to contain the music database, with file paths and tags, so it should be on the real disk.
Since it's midnight here (GMT+2), I'll work on it tomorrow as soon as I get the time. I'll try changing the bytes at 0x1FF and 0x3FF first and check the effects, than I'll go about modding mkamsboot :)
So, I'll check back tomorrow, hopefully with some results.
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version