Rockbox Development > New Ports
iPod Classic and iPod Nano 3G, 4G
mirreke:
Hi all,
I would like to help in unravelling the mysteries of the 3rd gen ipod, to make it possible to run rockbox on it. I'm not good with soldering irons, but could do some c programming :)
I investigated a bit on what is on my ipod (after I filled it with music using libgpod and gtkpod on debian linux).
Fdisk partition info has been posted before.
I find the different physical/logical partition beginnings/endings weird, but this may be caused by the device being solid state storage, and not a physical spinning disk with heads and cylinders and sectors.
I did a "find ." on the mounted partition, and found the same folders that were posted before. The "Calendars", "Contacts", and "Recordings" folders are empty, "Photos" just contains an empty subdirectory "Thumbs", and "Notes" contains a 14 byte file Instructions containing the string "<INSTRUCTIONS>" without line terminator.
The "iPod_Control" folder contains the data:
droef:/mnt/ipod# ls -l iPod_Control/
total 32
drwxr-xr-x 2 mirjam mirjam 4096 2008-03-12 22:24 Artwork
drwxr-xr-x 2 mirjam mirjam 4096 2008-05-17 14:35 Device
drwxr-xr-x 3 mirjam mirjam 4096 2007-12-01 22:01 gamedata_RW
drwxr-xr-x 4 mirjam mirjam 4096 2007-11-29 21:34 Games_RO
drwxr-xr-x 3 mirjam mirjam 4096 2007-12-01 22:01 gamestats_WO
drwxr-xr-x 2 mirjam mirjam 4096 2008-05-10 15:49 iTunes
drwxr-xr-x 16 mirjam mirjam 4096 2007-11-29 21:33 Music
drwxr-xr-x 2 mirjam mirjam 4096 2000-02-22 01:30 Tones
iPod_Control/Music contains 13 subdirs, which contain .mp3 files.
iPod_Control/Device seems interesting:
droef:/mnt/ipod# ls -l iPod_Control/Device/
total 36
-rwxr-xr-x 1 mirjam mirjam 8 2008-04-28 22:42 alarms
-rwxr-xr-x 1 mirjam mirjam 32 2000-02-22 01:30 clock
-rwxr-xr-x 1 mirjam mirjam 84 2007-12-14 19:47 PlayCounts
-rwxr-xr-x 1 mirjam mirjam 2952 2000-02-22 01:30 Preferences
-rwxr-xr-x 1 mirjam mirjam 50 2008-03-30 14:37 SysInfo
-rwxr-xr-x 1 mirjam mirjam 11081 2008-05-17 14:35 SysInfoExtended
-rwxr-xr-x 1 mirjam mirjam 107 2007-12-01 22:01 Users
droef:/mnt/ipod# file iPod_Control/Device/*
iPod_Control/Device/alarms: shell archive or script for antique kernel text
iPod_Control/Device/clock: data
iPod_Control/Device/PlayCounts: data
iPod_Control/Device/Preferences: data
iPod_Control/Device/SysInfo: ASCII text
iPod_Control/Device/SysInfoExtended: XML
iPod_Control/Device/Users: data
droef:/mnt/ipod# cat iPod_Control/Device/SysInfo
ModelNumStr: xA980
FirewireGuid: 000A27001A80AAE1
I put up the XML data file for download at:
http://koos.idefix.net/~mirjam/SysInfoExtended
Hope this helps....
atomikpunk:
Well from what I've read, no one actually knows what's under the hood of the encrypted OF, so until someone somewhere is able to extract the internal ROM content, or otherwise crack the encryption, no one will be able to do anything...
Nonetheless, you can count me in too for I've a 3rd gen. nano. I'm good at software/hardware understanding/disassembling, embedded systems and software development... For those interested, here is a link to the linux4nano group who are putting efforts into breaking that encryption for another project (ipodlinux in fact). If you can contribute, please talk to them. If you can't, please don't bother them ;D
GodEater:
Well have *you* contacted them and got a dump of the ROM they extracted ?
atomikpunk:
Hi again,
yes I have contacted them but what they have in the moment is a dump of the external flash, which is actually encrypted using the algorithm (almost certainly) present in the internal SoC ROM. I've got it here (the flash, not the internal ROM) and I can ask them if they mind me sharing it. But obviously, one can't do much with the encrypted firmware until someone somewhere finds the encryption key to be able to decrypt the firmware.
So if anyone here is an electronic expert that could help extract internal ROM content from a SoC, please, oh please get in touch with them :)
atomikpunk:
Well on the linux4nano site linuxstb is referring to, there are some documentation, mail archives and stuff. I've gone through most of it and apparently, RC4 was their first hypothesis but from what I understand, it was discarded after some encryption analysis... Have at look at this report for more details.
It seems that until someone somewhere with enough knowledge (and talent) is able to tap himself on the processor chip and get the content of its internal ROM (JTAG, hardware programming protocol or something else), we are stuck...
Owh and by the way, why not stick with this thread instead of starting a new one every now and then ;)
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version