Sansa Fuze+

[metaphys]

I 'm starting on a port for Sansa Fuze+

http://www.rockbox.org/wiki/SansaFuzePlus

For the moment there is only PCB scans and a few info about components

Futher info to come... to be continued

[pamaury]

I have been able to decrypt the Fuze+ firmware. The sbinfo program in the SVN is nearly complete now and allows to retrieve the code in an decrypted form, even though it would be better to rebuild an elf file out of it to work on it.
I would be quite interested in helping the port if possible.

[metaphys]

Please do!  
Actually i'm learning C by now and will not be able to contribuate to the port before i'm done with it (I'm starting this port from scratch with no other knowledge than my will to learn.... I don't know how long it'll need before I'll could write anything valuable. I just though I would do whatever I could (scanning pcb, open a new wiki, for exemple...) and then start to learn before to continue on contribuing.

I'm really impressed on the rapidity people did start to find and give information about it  . If you need more info, or someone to test your program in the case you don't own a fuze+, I still can help.  

Correct me if i'm wrong but with the firmware being decrypted, I suppose the next level should be to make a fake very close from the original and try to update the device with it... isn't it?

ps: I updated my profil's page so that you can email me if you need to.

[bertrik]

A few of the things I wonder about the fuze+:
1) how does the whole booting of this thing work? (important to know at what point during the boot process we can make it start running rockbox code)
2) does it have some kind of recovery mode? (very important once we start trying to run our own possibly buggy code)

Could you (for example) try to figure out if there is some kind of special boot or recovery mode?
Very often a special boot mode is started when holding a specific button during power-up (or perhaps a combination of buttons).
Sometimes these boot modes don't show anything on the screen but you can recognise them because they act as a USB device, possibly with a different USB vendor/product id than it shows normally.

Does it have a reset button (reachable only by a paperclip possibly)?

[metaphys]

concerning 1) i'm really not competent - or is there any test I could perform that might helps you to figure it out?
as far as I understand it: there are 3 different boot mode:
- normal:
          - boot
          - then screen change to some sandisk turning logo asking to wait (probably rescaning of tag info or updating already saved library)
- USB mode MTP
- USB mode MSC

note that there is an optionnal menu in the original firmware to choose between the two USB mode, note also the following hints to force MSC mode...

2)
a) There is a reset fonction mentionned in the manual by hold on/off button for 20 sec.
see: http://forums.sandisk.com/t5/User-guides-Firmware-Software/User-Manuals-for-all-Sansa-Products/td-p/185344 on p. 10 (I suppose some kind of hard reboot)

b) on: http://forums.sandisk.com/t5/Fuze/Sansa-Fuze-Firmware-01-29-03/td-p/207292
 the former firmware update mentionned the implementation of a new fonction:
"Force device into MSC mode using key combination (Device OFF press & hold Volume down Button and connect device to PC)"

But as it comes as a firmware update I suppose we can count that out to recover after changing the firmware.

c) As I mentionned on the port page (see remarks's section), after being disconnected from battery for a long time (2 or 3 days) the player wouldn't start anymore. After connecting it to the computer it start again and after being unplugged it showed the message: "firmware succefully updated" allthrough I didn't put any firmware files on its root.
It seems like a saved-firmware-automatically-recovered-mode to me... but again I'm just starting about all those stuff, what do you think about it?

[pamaury]

Hello,

Indeed the manual mentions this reset (we should have had a look at it before !) but what you describe is a bit strange. So perhaps there is a firmware in ROM or an hidden part of the nand of whathever.

I'm trying to disassemble what looks like the boot code so perhaps I'll find something.

[metaphys]

Hello,

If its helps You can find different version of the firmware on sansa forum (go http://forums.sandisk.com/t5/Fuze/bd-p/Fuzeplus and look older pages), so that you could actually compare them to each other? Or perhaps you already did? or pehraps it's useless?
(I nearly don't understand what your are doing and the page you made about the firmware is like foreign language to me - by the way is there anything I could read to learn about it and being able to understand it?)

[casainho]

We at Lyre project are using a Open Source board/hardware using i.MX233 just like Sansa Fuze+ AND we are starting the port of Rockbox.

We have already working code for blink and LED on our board and initialise and test the 32MBytes SDRAM -- on our SVN. i.MX233 is booting from uSDCard.

We are using JTAG to debug the firmware. Read more here: http://lyre.sourceforge.net/?q=blog

[metaphys]

oh I didn't get that i.MX233 and STMP37XX where the same. So I've just add its datasheet to the port page

[casainho]

oh I didn't get that i.MX233 and STMP37XX where the same. So I've just add its datasheet to the port page

Yeah. Luckily, knowing this, everyone can develop the Rockbox port code for Sansa Fuse+, using Lyre project i.MX233 board, or Chumby hacker board. On both boards, there are available JTAG for debug/run program from SDRAM, which boost of 1000X for development.

There are examples codes for i.Mx233, there are Linux and Android port for it :-)

[pamaury]

Hi,
I'm still working on the Fuze+ firmware. Since I had a little disk problem I had to restart everything from scratch so I lost quite a bit of time. I will thus stick with my current firmware revision because it shouldn't change anything for the hardware and I would have to restart from scratch again.

[pamaury]

For those who are interested, I'm still working on the disassembly of the OF. There is still lot of work to be done but I now have a good knowledge of the threading/interrupt code. And I hope to be able to get gather some hardware information soon.
I already found pretty much everything which is LCD related but the OF has a number of init paths for it and I don't really know which one is selected for now.
As a side note, I also have found some code for the debug uart, so it's well possible that there are some uart pins somewhere on the board.

[lugu]

Hi,

Does anyone have information regarding JTAG and sansa fuze+?

Many thanks!

[pamaury]

Hi,
I personally don't have any information about it. But I'm in the process of (finally !) buying a Fuze+. I hope I'll be able to start a new port based on the disassembly I've done (and not finished). However, the OF seems to have support for ETM (by configuring some ports for it when something goes bad) so perhaps there are some debugging pins somewhere on the PCB.

[metaphys]

Is there a quick way I could test this ?