Sony Walkman NWZ-S545 [New Port]

[Mirceam94]

Hey guys, I just got a new Sony Walkman NWZ-S545 mp3 player, and am going to try porting Rockbox to it. I've used Rockbox in the past on a 2nd gen ipod nano, and loved every bit of it. I have experience working with electronics, and doing both low-level and high-level programming, so I don't see this port as being an impossible task; except I don't really know where to start.

The walkman is brand new, and since I got it as a gift, I want to avoid bricking it at all costs. So, I'm starting slowly. Before I even try to disassemble it, I want to try and see if I can flash modified firmware onto it. Since I haven't seen any low-level info on Sony walkmans yet, I think there's a chance the firmware will be unencrypted.

My problem is, I have no idea where to start disassembling the firmware. I want to begin by finding where the firmware resides in memory, but yet again, I have no idea where to start looking. I'm new to this whole reverse-engineering thing, so any help/tips would be greatly appreciated =]

I'm also refraining from making a wiki page until I make at least a tiny bit of progress.
Post Merge: November 10, 2011, 04:39:18 PMWell, I'm obviously extremely new to this; just found this useful page - http://www.rockbox.org/wiki/SbFileFormat

So, the firmware is encrypted xD At least I have an idea of where to start now.

[saratoga]

I downloaded the firmware update from Sony and then pulled out the firmware.sb.  Its definitely an STMP series.  I guess the next step is to figure out if its the same STMP processor as the Fuze+.

[Mirceam94]

I figured that out right after finding the wiki page. I've even managed to pull some un-encrypted PNG images out of it, but they're just icons for the NWZ-S545 and previous Walkman-series players.

I guess the next step is to figure out if its the same STMP processor as the Fuze+.

Since the service-manual is near-impossible to find, do I have to disassemble it? I've been googling for a few days now to find some definitive specs, but with no luck. I'm about to go to sleep, but I'll take a screwdriver to it in the morning and post pictures. I'll get started on the wiki page afterwards as well.

[saratoga]

Since the service-manual is near-impossible to find, do I have to disassemble it?

That is up to you to figure out.  But since you probably have to disassemble it anyway . . .

[pamaury]

If the device uses an STMP, you might want to try out the tools in our SVN: utils/imxtools/ to extract the code from firmware.sb. The file can be encrypted so try out the zero key first. If it's using another key, it will be more difficult.
I any case I strongly advise you to open it to have a look at the hardware. Also try to find some sort of recovery mode by plugging in usb from power off state holding a button, if it's the same SoC as in the fuze+, it will show up as an hid device (066f:3780).

[saratoga]

If the device uses an STMP, you might want to try out the tools in our SVN: utils/imxtools/ to extract the code from firmware.sb. The file can be encrypted so try out the zero key first.

The zero key does in fact work.

[Mirceam94]

Well, I just found out that I don't have a screwdriver small enough to open it, so that'll have to wait until tomorrow. I already looked at imxtools last night; is there a set of pre-compiled binaries for windows of that folder anywhere? I was having trouble compiling sbtoelf last night on my win7 installation, but I'm about to boot up Ubuntu and give it a try there.

I'll test for a recovery mode in a few minutes.

[pamaury]

The imxtools will probably not build under windows because they use libusb by default to support on-device crypto. I'll try to fix the Makefile so that the OS independent part compiles under windows too. Otherwise there are the freescale tools available on their website which work under windows.

[robertdundee]

In order to extract the firmware upgtool must be used