Tatung Elio

[LordOfThePings]

Hi, i have a 20GB Hdd Mp3-Player (TPJ-1022/P772) from tatung/elio. It is similar to the newer ipods, and the iriver H10 (it uses the pp5020 chip, has a 220x176 color lcd, a sd-reader, usb otg, a remote connector similar to the ipod mini's one (4 pin) and a (bigger) connector on the bottom, for which i haven't found a pinout yet).
The firmware is divided into a flash part, and a part on the hdd, which is a .mi4 (encrypted) file.  It can go to usb disk mode, even when a corrupt firmware is on the hdd.
Is there any possibility I could try to run rockbox (maybe the ipod port?) and then help to port it fully to this player?
I have some experience in C/C++, but unfortunately none in linux kernel development    (but I'm able to compile one).
Is there any way I can run rockbox with the original bootloader, so i don't have to reflash it? (I don't want to brick it...)

[Llorean]

Well, a few bits of information I can offer you:
-Rockbox isn't Linux based, so lack of linux experience is not a handicap.
-Rockbox on iPod is loaded by way of the built in flashed bootloader. We put ours on disk where it loads from. It loads ours, ours loads either Rockbox or the Retail OS depending.

The first thing you'd need to figure out is how to encrypt a firmware file so that the built in loader will load it, I imagine. As well you'd need to document any hardware a Rockbox driver doesn't already exist for so drivers can be created, as the iPod port has a decent enough chance of not working at all without at least some modifications.

Other useful info may be found here, as well: http://www.rockbox.org/twiki/bin/view/Main/NewPort

[LordOfThePings]

ok, so i will first try to get some informations the "soft" way (I didn't manage to open the player yet... it's quite sealed).
I know the lcd is a 16-bit (5r, 6g ,5b) 220x176 one, and will try to get more infos about the other internals later.
Apparently the H10 uses a encrypted .mi4 firmware as well, but the tools i found could not decrypt this one...
The stock firmware itself has a 67 byte "header", followed by 0s until 512 bytes, where another 224 byte block of strings is, after that it's binary code...
I will try to find a disassembler/decoder for it, then post my experiences back here.


edit: I know how to open it now... (it's back is very tightly hold in place by plastic clips, bit of the ipod style).
I'll try to find something about the internals next.

[LordOfThePings]

AH. The d**n forum login timeout got my message killed... I will retype the chip informations later...

Can anyone identify this logo?
www.dboys.de/lord/chip1.png
I know i've seen it before, but don't remember which company it belongs to. The chip may be the LCD controller. The sticker on it doesn't come off easily, and I don't want to ruin the chip...

Anyway, the bigger problem will be the encrypted .mi4 file (the iriver H10 port has the same problem, it's the same style of firmware, but not compatible)

[Scimmia]

Looks like an AMD logo to me 

[Llorean]

Yeah, definitely looks like an AMD logo. Odd. http://www.amd.com/images/hd_amd_lg.gif

[LordOfThePings]

OK, I have created a wiki page to gather infos about the player (Should i link it to the ports page yet? I don't know if I'm able to get this working...), and finally got the sticker off the chip. It is really an AMD, it's the flash.

http://www.rockbox.org/twiki/bin/view/Main/ElioTPJ

[tucoz]

Funny. That player looks exactly what I thought to be a Norwegian Mp3-player called Asono Elio.

[LordOfThePings]

the asono elio is the same player, but with a fm-radio built in... it's from a company called tatung (elio is some kind of series-brand, i think)

[mememe]

About the Firmware. I've been able to decrypt the Firmware with the mi4code utility. Maybe it's possible to use the iRiver H10 port or fork from it.

In order to decrypt it, get the Firmware from support.eliohome.com, extract the executable with 7-Zip.
Now to get the key use the bootloader.rom in the keysearch:

Code: [Select]

./mi4code keyscan -v pp5020.mi4 bootloader.romThen decrypt with the key:
 

Code: [Select]

mi4code decrypt  pp5020.mi4  pp5020.raw <key>

[Bagder]

If you have the mi4 + BL for this and can provide it to me, I'd like it for my mi4 collection and possibly include the key for it in upcoming mi4code releases...

(I'm also interested in mi4+BL pairs for the other Elio players in case anyone happens to have them)

[linuxstb]

I bought one of these players yesterday and have made a little progress on a Rockbox port.  With the help of mi4code.c, I can compile my own test programs and run them on the player.

I've been compiling a cut-down version of the ipod bootloader, and then encrypting it using:

../tools/mkmi4.sh h10_5gb bootloader/bootloader.bin test.mi4

You then need to copy test.mi4 onto your Elio, renaming it "/system/pp5020.mi4"

I've managed to access the hard drive from my test program and write a file on disk.  I've also tried dumping the GPIO ports and it seems that at least some of the buttons are attached to GPIO pins - making at least a partial button driver easy to implement.

Next stage will be to try and figure out the LCD.  

[LordOfThePings]

ok, thanks to linuxstb's pm, i'm back here....

to the lcd: the info that was on the lcd itself is posted in the wikipage, the toppoly part is, according to the company's webpage the lcd driver chip. http://www.toppoly.com/toppoly/Product/SB_Phone_T.asp+Toppoly+TD022SREA1
www.toppoly.com/toppoly/Product/SB_Phone_T.asp+Toppoly+TD022SREA1
(try looking in the google cache or at archive.org for that one, it's apparently offline)

on the lcd module, there are these labels:

TD022SREA1 442T0MA0000503
M479844911.34

apart from the lcd module (it has two chip in it, without any labels), i can see no chip, that seems to be connected with the lcd.

the portalplayer 5020d  has a lcd controller built in, so maybe that is used for the elio.


@Badger: the other tatung/elio firmwares can be downloaded at their support site as well.

and @linuxstb: which one do you have? the tatung elio, or the asono? they use different firmwares that are not compatible (possibly due to the radio chip and/or different encryption keys)


and a final advise: do not take the player apart, if you don't have to... it's difficult to do without breaking some of the plastic clamps that hold it together...

[barrywardell]

The iriver H10 uses the same address for the LCD interface as the colour iPods (0x70008a0c) so that would be a good place to start. You could even just try using the H10 or one of the iPod LCD drivers and see if it works.

[linuxstb]

The iriver H10 uses the same address for the LCD interface as the colour iPods (0x70008a0c) so that would be a good place to start. You could even just try using the H10 or one of the iPod LCD drivers and see if it works.

I did quickly try both the H10 and ipod drivers - but with no success.  Although I will probably try again more carefully, just to make sure.

I've also been searching the firmware disassembly for references to the 0x70008a0c (and related) addresses, but can't find any.  However, address 0x70003000 (the LCD_BASE for the greyscale ipods) is being used.