Rockbox.org home
Downloads
Release release
Dev builds dev builds
Extras extras
themes themes
Documentation
Manual manual
Wiki wiki
Device Status device status
Support
Forums forums
Mailing lists mailing lists
IRC IRC
Development
Bugs bugs
Patches patches
Dev Guide dev guide
Search



Donate

Rockbox Technical Forums


Login with username, password and session length
Home Help Search Staff List Login Register
News:

Rockbox Ports are now being developed for various digital audio players!

+  Rockbox Technical Forums
|-+  Rockbox Development
| |-+  New Ports
| | |-+  Phillips Go Gear Vibe /17
« previous next »
  • Print
Pages: [1]

Author Topic: Phillips Go Gear Vibe /17  (Read 17272 times)

Offline ATTIKIT

  • Member
  • *
  • Posts: 6
Phillips Go Gear Vibe /17
« on: April 06, 2010, 11:02:51 AM »
 Hey guys as some of you might know my sansa clip V2 broke and I could not find a new one so I got a Philips Go Gear and I am starting to research the FW.I found a verification key in the FW using a hex editor (HxD).Just wanted to say I am going to try to port rockbox to this mp3/mp4 player.Any help is appreciated.

Edit: 4/7/10

The FW is loaded from the FLASH

Edit: 4/9/10

built in memory is  NAND Flash

Edit: 4/27/10


I will scan the PCB when I have time

Edit: 4/28/10

I got the FW files and I will post them here

info.dat

Code: [Select]
[FIRMWARE]
FWTYPE=0
MAJORVER=0
MIDVER=6
MINORVER=39


fwaretoc.dat
Code: [Select]
CFG_NUM_FIRMWARE_FILES=6
FILE1_DESCRIPTION=Janus Drive
FILE1_FORMAT_TYPE=2
FILE1_NAME=
FILE1_TAG=11
FILE2_DESCRIPTION=Persistent Data
FILE2_FORMAT_TYPE=2
FILE2_NAME=settings.bin
FILE2_TAG=12
FILE3_DESCRIPTION=Application Image 1
FILE3_FORMAT_TYPE=1
FILE3_NAME=firmware.sb
FILE3_TAG=80
FILE4_DESCRIPTION=Application Image 2
FILE4_FORMAT_TYPE=1
FILE4_NAME=firmware.sb
FILE4_TAG=96
FILE5_DESCRIPTION=Application Image 3
FILE5_FORMAT_TYPE=1
FILE5_NAME=firmware.sb
FILE5_TAG=112
FILE6_DESCRIPTION=Updater
FILE6_FORMAT_TYPE=1
FILE6_NAME=updater.sb
FILE6_TAG=255

signature.dat
Code: [Select]
Philips GoGear Recovery
Philips GoGear Vibe

Edit: 4/29/10

 I found this in the "STDBSTR.DAT" that is hidden on the player in MSC Mode @ Offset 116204                                  
Code: [Select]
...ROCKBO~1/CODECS/WAV64~1.COD.ÿÿÿÿÿÿÿÿÿ
and this @ Offset 116A01

Code: [Select]
...ROCKBO~1/CODECS/COOK~1.COD.ÿÿÿÿÿÿÿÿÿ
along with many other codecs looks like philips might use your codecs
« Last Edit: April 29, 2010, 11:45:22 AM by ATTIKIT »
Logged

Offline GoGearVibe

  • Member
  • *
  • Posts: 2
Re: Phillips Go Gear SA1VBE04K/17
« Reply #1 on: April 11, 2010, 08:58:52 AM »
hey man i found in my Phillips go gear vibe a data file its named:

 Devlcon.fil
i tryed to delete this ,but with the next start it was there again......

what is this???ß



« Last Edit: May 13, 2010, 06:19:53 PM by GoGearVibe »
Logged

Offline ATTIKIT

  • Member
  • *
  • Posts: 6
Re: Phillips Go Gear SA1VBE04K/17
« Reply #2 on: April 11, 2010, 11:09:33 AM »
um if its just me then don't expect this for a while because I go to school and work on this in my spare time
Logged

Offline szczepan2

  • Member
  • *
  • Posts: 1
Re: Phillips Go Gear Vibe /17
« Reply #3 on: May 24, 2010, 10:17:37 AM »
How to get a Philips GoGear Vibe SA1VBE04K/17 to MSC mode? I can test your programmed firmware. Lucky porting.
Logged

Offline ATTIKIT

  • Member
  • *
  • Posts: 6
Re: Phillips Go Gear Vibe /17
« Reply #4 on: May 24, 2010, 10:45:20 PM »
Quote from: szczepan2 on May 24, 2010, 10:17:37 AM
How to get a Philips GoGear Vibe SA1VBE04K/17 to MSC mode? I can test your programmed firmware. Lucky porting.

Go to Settings/PC Conection

and thx wil be a bit longer school is a bitch
Logged

Offline Chronon

  • Rockbox Expert
  • Member
  • *
  • Posts: 4379
Re: Phillips Go Gear Vibe /17
« Reply #5 on: May 25, 2010, 07:28:10 AM »
You should start a wiki page to collect your findings and post its location in this thread.
Logged
Sansa e280, Gigabeat F40, Gigabeat S60, Sansa Clip+, iPod Mini 2g

Offline saratoga

  • Developer
  • Member
  • *
  • Posts: 8963
Re: Phillips Go Gear Vibe /17
« Reply #6 on: December 12, 2013, 09:56:04 PM »
Here is a link to the firmware file if anyone is still interested:

http://web.mit.edu/mgg6/www/SA1VBE04K17.7z

It is an STMP format firmware, so probably STMP3700 given the age of the player.  sbtoelf is not able to fully decrypt the file for what its worth.
Logged

Offline pamaury

  • Developer
  • Member
  • *
  • Posts: 508
Re: Phillips Go Gear Vibe /17
« Reply #7 on: December 13, 2013, 05:36:45 AM »
For your information, there is page http://www.rockbox.org/wiki/PhilipsGoGear to sumarise the SoC inside some philips players. The SA1VBE04K_17 is of STMP37xx family but it's unclear which one, in particular it could be the STMP3770 which will be hard to port.
The major problem though is that Philips uses an unknown encryption key. It is unfeasible to brute force it and I know for sure that they don't use special keys. We are left with basically three options, all of them are realistic:
  • attack on recovery mode: some philips players comes with both a firmware (firmware.sb) and a recovery (recovery.sb) and in the past, Philips made the mistake of encryption the recovery with two keys, including the zero key. When done this way, there is a (relatively) easy way to craft a special firmware to send in USB recovery mode to execute arbitrary code and dump the key
  • attack on USB vendor SCSI: most STMP based players are based on the SDK from Sigmatel/Freescale which contains a fatal flaw in its handling of vendor SCSI, leading to remote crashes from the host. I think that by a careful study of how the crash happen, it is possible to take advantage of it to run any code and/or dump the whole firmware (unencrypted)
  • attack on virtual memory: here again there is a fatal flow in the firmwares of the STMP because the data section are unencrypted and accessible even without the key. On of them (the pvmi) contains most of the firmware when virtual memory is used (which is very often the case), thus easy to modify. The issue of course is that any modification will make the firmware invalid but with proper SCSI one can write the firmware in a way to bypass any signature check and the ROM doesn't check global validity of the file. Thus allowing to run potentially any piece of code, by proper modification of the virtual memory content.
Clearly the first one is the easiest, but it has very strong requirements. The second one is second easiest if a flaw is found because everything can be done remotely. The last one is the most promising but means some RE and a lots of trial and failures. All of them require physical access to the device.

As a proof of concept, I will try to apply the second or third method to the SA1VBE04K_17 if any of you has the device to test and/or can send me a device to test.
A disassembly of the device with pictures would be most useful too.
Logged
Please don't PM me, use our IRC channel instead.

Offline pamaury

  • Developer
  • Member
  • *
  • Posts: 508
Re: Phillips Go Gear Vibe /17
« Reply #8 on: December 13, 2013, 05:45:59 AM »
I just checked and the SAVBE04K_17 satisfies the requirement of the first method: it has an updater.sb encrypted with key 0, so it's possible to craft it. So it is possible to retrieve the key using linux and by compiling a few tools. Anyone with the player feels like doing so ?
Logged
Please don't PM me, use our IRC channel instead.

Offline Songs0fFailure

  • Member
  • *
  • Posts: 19
Re: Phillips Go Gear Vibe /17
« Reply #9 on: December 13, 2013, 06:00:44 PM »
«Magnavox is currently a brand for products made by Funai under license from trademark owner Philips.»
http://www.m4c.magnavox.com/files/s/ == http://download.p4c.philips.com/files/s/
+Indexes
For newer players 'Device Manager Installer' - must be InstallShield 16, but IsXunpack\UniExtract can't unpack it.
And firmware updates in .exe -  smtn named as "PdmFwExe MFC Application". %)
Logged

Offline kevinv710

  • Member
  • *
  • Posts: 3
Re: Phillips Go Gear Vibe /17
« Reply #10 on: February 28, 2018, 01:29:57 AM »
Hi pamaury!
i have some GoGear Vibe and Raga from 2G 4G 8G, if you need some of them for project porting let me know, i will send you some of them as gift. Let me know!
Kevin
Logged

Offline rendiok

  • Member
  • *
  • Posts: 1
Re: Phillips Go Gear Vibe /17
« Reply #11 on: April 09, 2018, 07:54:40 AM »
Quote from: pamaury on December 13, 2013, 05:45:59 AM
I just checked and the SAVBE04K_17 satisfies the requirement of the first method: it has an updater.sb encrypted with key 0, so it's possible to craft it. So it is possible to retrieve the key using linux and by compiling a few tools. Anyone with the player feels like doing so ?

Hello,

I have a go gear vibe sa4vbe08kf/12 and I'm a Linux User. If anyone tells me what i have to do I could try to help.

Regards,
Logged

Offline pamaury

  • Developer
  • Member
  • *
  • Posts: 508
Re: Phillips Go Gear Vibe /17
« Reply #12 on: April 09, 2018, 02:05:36 PM »
Hi,
I haven't worked on Philips targets for a long time and I do not really plan to work on them anymore since those are old players now.
Furthermore, some of those Philips players use the STMP3770 which Rockbox cannot support (because it does not have enough RAM).
If you are a programmer, I can walked you through some of the steps (better come on the IRC channel then) but you'll have to do most of the work.
Logged
Please don't PM me, use our IRC channel instead.

  • Print
Pages: [1]
« previous next »
+  Rockbox Technical Forums
|-+  Rockbox Development
| |-+  New Ports
| | |-+  Phillips Go Gear Vibe /17
 

  • SMF 2.0.17 | SMF © 2019, Simple Machines
  • Rockbox Privacy Policy
  • XHTML
  • RSS
  • WAP2

Page created in 0.169 seconds with 21 queries.