Fiio X3

[undersys]

Hi All,

You may not know but James of Fiio has released a tool to unpack the x3's firmware (to a certain level)
http://www.head-fi.org/t/684793/diy-your-own-theme-for-your-lovely-x3

I've done a very high level peek at the f/w :

File list :

Code: [Select]

DIR   - fonts
DIR   - litegui
FILE -  logo.bmp
DIR   - str
FILE - sys.bin
DIR   - system_attribute
DIR  - unicode

Contains some gzip'ed data :

Code: [Select]

binwalk --dd=gzip:gz:2 sys.bin 


DECIMAL   	HEX       	DESCRIPTION
-------------------------------------------------------------------------------------------------------
728086    	0xB1C16   	gzip compressed data, ASCII, has CRC, was "]O\342\326qe\327\344%\270}\213\251\213(\260\235\243\247\255\263\265\277\301\305\307\323\337\343\345\351\357\021\004\274 \031\017\244\266\003%\214\230)=\373\376Q]\341wN\375\373\177mG\223\225\243\245?", last modified: Thu Jul  4 01:41:03 2002

This extracts "B1C16.gz , size 3520386"

Strings does not show up anything useful and I can not as of yet extract the gzip'ed data.

This is not a request for a port...

Just what I've found and hope its helpful for myself and others

The x3 uses the JZ4760B CPU so thats also helpful given there is a port in progress for that.

[wodz]

Does strings on pure sys.bin show anything useful?

[wodz]

And BTW. James says they have no time to do rockbox (not we don't want to do so). If you are interested in port I would start with contacting company if it is willing to disclose information allowing rb community to do the port (and maybe donating 1-2 units for developers)

[undersys]

Hi wodz,

Strings gives me nothing useful sadly.

James has been asked about giving out info to make rock box possible , this was a stern no.
So we are on our own

[Songs0fFailure]

X3 must be really good "new target".

information allowing rb community to do the port

I found datasheets and "programming manuals" for jz4760\jz4760B, ingenic u-boot patches, firmware updates for X3, looks like it IHFS - http://www.rockbox.org/wiki/ChinaChip#IHFS_file_system_format

Ingenic FTP ftp://ftp.ingenic.cn/
this summer a lot of useful info were removed from ftp, but i found ftp-mirror with all old docs, tools, source, e.t.c

[Songs0fFailure]

upd. New Fiio X5 and Hidizs AP100 based on same soc - JZ4760b and use same firmware format.
and it's not Ingenic µC/OS-II or Android, probably ChinaChip rtos ?

+ there is available tool from FiiO for packing\unpacking firmware, current version IHFSsplit can't unpack FiiO firmwares.

[Bundi]

http://www.prplfoundation.org/members/ list ingenic as a member so maybe dev tools / docs will be made available (again?) at some point.

[De_Cadanz]

HiFiMan HM-701 based on 4760B too.

Do you try Binwalk to analyze firmware?

I have a X3 and Rockbox will be great on it!

[Songs0fFailure]

HiFiMan HM-701 based on 4760B too.
Do you try Binwalk to analyze firmware?

HM-701 ? HM-700  based on STMP3770 http://www.head-fi.org/t/681370/two-new-hifiman-players-announced-hm700-and-hm802/210#post_10266609
X3 firmware ? nope.

[De_Cadanz]

Sorry, my mistake.

[Bundi]

It seems that there is a mirror of ingenic ftp site here ftp://94.23.144.183/mirror/ftp.ingenic.cn/ Including all the 4760B docs / dev tools e.t.c. The folder called "NDA" seems empty.

[Bundi]

http://www.gcw-zero.com/develop These people maintain an SDK for a jz4770 handheld with GCC 4.9.1

The handheld runs OpenDingux http://www.treewalker.org/opendingux/ Linux distro.

What's needed after that? Drivers for the LCD, USB and DAC chips?

Ram init values? What am I missing? (I'm not a programmer but I can take my X3 apart and report on chip ID numbers, I found a datasheet for the hynix Ram already somewhere.)

[saratoga]

What's needed after that? Drivers for the LCD, USB and DAC chips?

Eventually, someone interested in porting to the X3.  But in the meantime, I don't even think there is a wiki page setup for the X3 or any scans of the boards posted.  Take a look at the NewPorts wiki page?

[aires317]

Quote from: wodz on October 08, 2013, 02:16:38 AM

    information allowing rb community to do the port

I found datasheets and "programming manuals" for jz4760\jz4760B, ingenic u-boot patches, firmware updates for X3, looks like it IHFS - http://www.rockbox.org/wiki/ChinaChip#IHFS_file_system_format

Looks like, but not exactly in Fiio Xn series.

I was programming on a tool about pack/unpack x3.fw on linux,

It mostly follow IHFS file format, but there is a 4-bytes data at the file tail.

That causes X3 prompt "Update file corrupted" when updating .fw file.

try this (x3.fw Version 3.0) :

Code: [Select]

hd -s 0x2488400 x3.fw

You can find that 4bytes data is not in the table.

I speculate that is some kind of value to verify IHFS file table is fine.

If any who read Chinese, you may check my article at fiio official forum.
http://www.fiio.pw/forum.php?mod=viewthread&tid=49549&extra=page%3D1

[ScaV]

Hm.. Only differences with http://www.rockbox.org/wiki/ChinaChip#IHFS_file_system_format i found are:

Header:
1. Instead of 476 bytes of zeros there is "0000 0200 0000 0000 0000 0000 0000 0000 0000 7833" sequence, where 7833 == "x3" string, and then 458 bytes of zeros.
2. Instead of  0xfffff000 bytes with offset 0x000c, there is 0x00000000

File:
3. Instead of padding to sector with 0xff, there is padding with 0x00 (maybe in cause of paragraph 2 of this list).

And 4 bytes tail.
This tail i found in fiio x5 firmware file too.