SanDisk Sansa c200v2, m200v4, clipv1, clipv2, clip+, and fuzev2

[atomikpunk]

Hi again,

well I hacked a bit tonight on the clip buttons and found all of them. As I suspected, the clip uses a similar keypad scanning technique that was used in the M200. The principle is to rise a "column" pin, read all "row" pins, then lower the column pin, then go to the next column, etc. The clip keypad has 3 column pins (C4 to C6) and 3 row pins (B0 to B2).

So well I updated the firmware so that it will display all pressed buttons on the screen in our git repository. You can have a look at this for the buttons details and this for the sample firmware.

See ya!

[funman]

Thanks atomikpunk, I tested your code and I confirm it's fine.

I had a quick look at the FuZe firmware, and couldn't see similar code at a similar location, so maybe something else is used to get the buttons (maybe the 10 bits general purpose ADC mentioned in the AS3525 datasheet).

kugel don't hesitate to ask if you need help to understand how the buttons are read on the FuZe.

However I don't feel like reading the FuZe disassembly all night long, so I leave this task up to you

[JdGordon]

hey guys,
just joining the party and saying I have a 2gb e200v2 which im looking forward to hacking... I cant do much untill after my exams (mid november) but if anyone has something they want tested on it let me know.

[funman]

Hello, some news about the SD:

I have some code but I don't get past the initialization procedure (card power up, aka acmd41).
The acmd41 response is 0xFF8000 : it contains the supported voltages (all), but the bit31 is unset, which means that the card is not ready.

I tried issuing a cmd8 before acmd41 (it is required for SDHC cards) but I receive "command response timeout", which would mean this command is not supported.

EDIT: I removed the answer to the post that was just deleted - I don't think an offer to help is spam...

[jesterday]

Hi,

i have not read the whole thread, in fact i wouldn't understand half of it :-) .

Maybe this is already know in the meantime (have not found anything by using the search) or completely useless at this state, but switching on a e260 holding power button, forward and rewind simultaneously (state of lock button is of no importance) lead to a screen asking "Erase Firmware? Press center Button to confirm". Any other button press switches off the device.

[andva]

Nice find, jesterday! I can confirm that the message pops up on my e280. I'd expect that pressing Center will put the player in some kind of rescue mode. If the player accepts unsigned firmwares in that state, then life is beautiful I wasn't courageous enough just yet to hit the Center button, though; anybody with the possibility of shorting the NAND pins (in case everything gets broken) volunteering out there?

A word of warning: I remember reporting that the "erase firmware? press center button to confirm" message is present _in_ the firmware file, which means that this recovery mode might be dependant on an original firmware being present on the player. So if you ever uploaded a 'broken' firmware (or, God forbid, a homebrew one), you would be deprived of this easy way out. Retarded, you know, but... worse things have been seen.

[mike16889]

got the same message on my e260v2 but hold had to be on. not game enouth to oress the center button cuz i still want to use my player...

[Hillshum]

I just pushed it to erase, but it seems to work normal.

[saratoga]

Spacing on the presumed fuze JTAG connector is much smaller then the M200, so 30 gauge wire probably isn't going to work.  I'll have to try and find some smaller wire.

[daniel_at]

The "reset firmware"-mode: Have tried the center-button, device switches off, after power on it stuck after showing the sansa-logo, after some power-cycles it booted normal into the OF without any restore-action taken.

@jesterday, How did you find that mode? By accident, or is there something about it on the net already?

@saratoga, Try to find a so-called "enameled wire" (it can usually be found in transformers and inductivities). There exists different, very thin copper wires of that type. I often use them to connect to small pads. Like here, i connected a serial interface to a destroyed iPaq-Connector: http://danyserv.selfip.org/pic/displayimage.php?album=21&pos=1

Use a very small solder-iron tip. You can also make a homebrewn solder tip by wrapping around a ~2mm thick copper-wire around your existing solder tip and file it very pointed and use that for soldering. Sorry, hard to describe, i hope you understand what i mean, cant currently find a picture of it.

[edit]
The Masked ROM-Image: uploaded the completed version of the dump (merged four reads into one, so that missed addresses get completed) to the git:
merged_dump.bin.bz2 at http://gitorious.org/projects/rockbox_sansa_v2/repos/mainline/trees/master/hacking/bits

Daniel

[jesterday]

@daniel_at:
not by accident and not bv webfind :-). I just played around cause i read about the special mode on the m-series. I watch this thread for 1 or 2 month, so i think maybe i could do something useful ;-)

@mike16889:
interesting! I've tested it several times, on my player it works with or without the hold button. Maybe you haven't accidently not all the button all the time?

[atomikpunk]

Very nice finding everyone. Daniel, I had a look at the ROM binary disassembly yesterday night and well, as funman said some of it looks very familiar with the OF but it is no surprise in my opinion. I don't know much about it yet, but a quick look at the contained strings, I can easily find the "M200Plus" string we saw when using the "recovery" mode...

Use a very small solder-iron tip. You can also make a homebrewn solder tip by wrapping around a ~2mm thick copper-wire around your existing solder tip and file it very pointed and use that for soldering. Sorry, hard to describe, i hope you understand what i mean, cant currently find a picture of it.

If you guys can get a hand on "flux", it _really_ ease soldering small parts and wire. It should be quite easy to get at a specialized electronics distributor and/or reseller. You just put a lot of it on the part to solder, use a standard to small soldering tip and stain will glue to the pads. Just as an example, I can solder very small packages (with <= 0.5mm pads pitch) with a >2mm tip (yes, the tip is really bigger than the pads)... Just be sure to clean the PCB region afterward if the flux is not self-cleaning.

[jesterday]

I seems to me this "reset firmware"-Mode does nothing :-(. If i hit the center, it, as reported before, simply switches off. I even can't see that switching on again takes any longer as normal.

So i tested around a little bit.
Only thing i discovered is, that if you plug in the e260 in this mode, a new usb device is found which can't be enumerated. Same can be archived if you connect first the device, then switch off and on again with the know button combination. Difference is, that no answer is displayed this way, only the logo.

Linux output of dmesg is:

[ 3049.972884] usb 4-2.3: new full speed USB device using uhci_hcd and address 11
[ 3065.048437] usb 4-2.3: device descriptor read/64, error -110
[ 3080.227910] usb 4-2.3: device descriptor read/64, error -110
[ 3080.419764] usb 4-2.3: new full speed USB device using uhci_hcd and address 12
[ 3095.495317] usb 4-2.3: device descriptor read/64, error -110
[ 3110.674790] usb 4-2.3: device descriptor read/64, error -110
[ 3110.866645] usb 4-2.3: new full speed USB device using uhci_hcd and address 13
[ 3115.882837] usb 4-2.3: device descriptor read/8, error -110
[ 3120.998952] usb 4-2.3: device descriptor read/8, error -110
[ 3121.193803] usb 4-2.3: new full speed USB device using uhci_hcd and address 14
[ 3126.209994] usb 4-2.3: device descriptor read/8, error -110
[ 3131.326111] usb 4-2.3: device descriptor read/8, error -110

still got the feeling this thing is no help anyway... :-)

[mike16889]

i re tried and it douse work regardless of weather the hold is on or off.

@jesterday. did you have an updated (or custom) version of firmware running when you hit the center button? maybe it reloads the stock firmware?

[tobi-lu]

I tried it on my e250, and it doesn't seem to work at all, regardless of the "hold" state. I have a custom firmware (compressed OF + 5sec delay). It always loads normally.

I'm pressing the back, forward and power button at the same time, is this correct?



edit: Aaah nevermind, it just worked, dunno why

edit2: OK, I just didn't hold the buttons long enough.
But there's nothing happening... no matter which button I press, the player just turns off and everything is like it was before.