New cheap portable player in the market

[pmp4]

Around 12$

You can find it by "portable mp4 player student". Brandless.

It supports mp4 video (real mp4, h264 and aac, without conversion, up to 320x240).
It has a screen of 1.77" (160x128 pixels).
It has Bluetooth (not only audio, it can send/receive files too).

I dont have a clue about the manufacturer or the SoC used, so even less about if someday Rockbox could run on it, but it would be great due to his very low price. I think the hardware must be powerful enough if it can play mp4 videos (unlike another brandless portable players that doesnt support real mp4 video).

The very little information I achieved to get was:
SoC: The chip has the next data printed:
QA
2100
2021AD003C

The USB data when you connect to PC is:
idVendor           0x1782 Spreadtrum Communications Inc.
idProduct          0x4d01
bcdDevice            0.01
iManufacturer           1 Spreadtrum
iProduct                2 Generic Disk1.0

When you start it, the clock is set to 2021/01/01, so must be a new device.

The box where it come from is very like a BenJie devices clone, it has printed "Audio Play-er" in different colors than BenJie boxes but similar design.

Someone has more information about it?

Best regards.

[saratoga]

The features of the stock firmware aren't too important. Instead it mostly comes down to what CPU it's using and how much RAM there is. Do you have pictures of the board or a firmware file?

[Bilgus]

  a link and or a picture of the device would help too

[pmp4]

This is the device:

https://www.aliexpress.com/item/1005003708199722.html

https://www.walmart.com/ip/Portable-Music-Players-Student-Bluetooth-compatible-E-book-MP3-MP4-Black-Without-TF-Card/814076107

Almost every brandless portable player that I've seen with 160x128 lcd was using Actions Semiconductor SoC, but this is different. And certainly is not a Actions SoC because it can play real h264/mp4 videos (Actions based players uses MJPEG to play videos).

Unlike others devices, this is multitask, it allows to read txt/view jpg/play snake game while you are listening music (mp3/aac format), so I guess must be faster than other brandless similar devices.

By the USB interface info, the manufacturer could be UNISOC (former Spreadtrum Communications).
https://en.wikipedia.org/wiki/List_of_UNISOC_processors

But I didn't find what is the SoC.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
I got some news.

Definitely it's a UNISOC Spreadtrum device.

Firstly I put the exact title string of the device name here, because if someone google it the name searching info, this thread can be reached:
Aliexpress: Music Players Student Bluetooth-compatible E-book Sport Video MP3 MP4 Radio Support Replacement for Windows XP/VISTA/Windows 8
Walmart: Portable Music Players Student Bluetooth\-compatible E\-book MP3 MP4 Black Without TF Card
 
I searched for feature phones using old Spreadtrum SoC chipset processors, one of most sold was: SC6531 - ARM 9 processor 312 Mhz and 32 MB RAM.
I found some feature phones that use it with 128x160 pixels lcd, and the GUI of snake game and FM radio is the same than in this portable mp4 player.
That means nothing, because obviously portable player must use another SoC without GSM communications, but at least, it's some little clue of what kind of device is.
The Operating System used by those devices is called MOCOR (but there are several versions, absolutely differents between them).

Then I tried to get information about how to read the firmware of UNISOC Spreadtrum devices.
And I found this very useful url: https://chronovir.us/2021/12/18/Opus-Spreadtrum/
Warning: Use only as source of information and DON'T use the software of that web with this portable player, because you can brick it, it's not designed for this device, and you can lock it even only trying to read the firmware.

The previous url explains how to access generically to firmware of UNISOC devices (usually phones).
You must plug USB and you must hold pressed some key (different in every device) when you start the device, and if you are doing correct, you will get the device USB with the next ID 1782:4d00.
0x4d00 is the ID of special USB mode in the device when enter to access/modify firmware. (in a normal file transfer usb mode, this device has 0x4d01 usb id).
I got the key in the portable player, it's the UP (M) button. You hold that button, and click in the RESET hole (right lateral of portable player) and the device will reset in that firmware access mode.

Well, that's all until now. I almost blocked my device doing tests, but finally I got recover it  .

If I get some more information I will post in this thread, but until now, the open source tools that I found are not suitable to get the firmware of this device.

Open source tools for access firmware of anothers UNISOC devices (DONT use with this portable player, it wont work and you can brick it, only I put here as source of information of how works similar devices):
https://gitlab.com/suborg/uniflash
https://github.com/JiaDuo/yuanxinos_usb

[Bilgus]

pmp4 nice progress 

-------------------------------------------------------------------
Friendly warning about walmart third party sellers

WM gives no fucks about third party sellers on their platform nor any fraud that takes place buyer beware
--------------------------------------------------------------------------------------------------------------------------------------------

I ordered two of these from ebay looks to be the same device

Update in a week

https://www.ebay.com/itm/403723608332

[pmp4]

I put here the eBay name of the product to make the thread easily reachable:
Mini Portable Bluetooth MP3 MP4 Music Player FM Radio Hi-Fi Media Lossless Sound

And I put a image of player too, to make the thread easily identificable for the people who enter in it (menu icons images are different from "official" product images, but it's the same product, so at least must be two versions of the original firmware).

I have some news, SC6531 SoC operating system is MOCOR, but MOCOR is based in ThreadX operating system. So maybe another ThreadX RTOS devices experience can be useful in here (I saw Sansa Fuze + original firmware is based in ThreadX too).

Here the output of binwalk opening the firmware of a SC6531 based feature phone (with a 128x160 screen): (Firmware size 4.2 MB, 0x400000 bytes)

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
62844         0xF57C          Unix path: /source/src/c/sci_mem.c
66668         0x1046C         Unix path: /source/src/c/threadx_os.c
77644         0x12F4C         Unix path: /source/src/c/threadx_appmem.c
235336        0x39748         Unix path: /Layer1/source/c/datacnfproc.c
330384        0x50A90         Unix path: /Layer1/source/c/systeminfo.c

Anyway, as I said before, that means nothing, because UniSoc Spreadtrum SC6531 is not the SoC of this portable player, but must be something similar.

[Bilgus]

First day with these devices and I already had one stop enumerating as USB and now won't even turn on that was before I started messing with getting into boot mode 
taking it apart it has the same QA 2100 but with 2022ad005c
the back side of the board is marked j01 wb vl1 210315

The second one I have managed to brick and disconnecting power / reconnecting brought it back luckily
also no need to use the reset button simply turn player off (long press play/pause) then hold M while plugging USB
i then enumerates as 4d00

[Bilgus]

Unfortunately I think without having a upgrade file for the firmware or at the very  least some idea of the internal chip and its layout
we are never going to be able to do anything with this player

I was hoping there was jtag on the device that might allow some probing but it appears everything is done with the USB to me

maybe some deal with the chinese manufacturer and a SDK but where to start without knowing who that is IDK

[speachy]

The real question is how much onboard RAM this SoC contains.

The various Actions Semi SoCs found in most of these shovelware players contains only a couple hundred KB, for example.  Even the higher-end rockchip ones have less than half the RAM for rockbox to be minimally viable.

[pmp4]

First day with these devices and I already had one stop enumerating as USB and now won't even turn on that was before I started messing with getting into boot mode 
taking it apart it has the same QA 2100 but with 2022ad005c
the back side of the board is marked j01 wb vl1 210315

The second one I have managed to brick and disconnecting power / reconnecting brought it back luckily
also no need to use the reset button simply turn player off (long press play/pause) then hold M while plugging USB
i then enumerates as 4d00

My experience is the next:

Boot mode always works, but device normal start up can be blocked doing tests.

To restore normal mode start, I use the SC6600 fdl file, with this command: uniflash.py -t sc6600l_generic dump test.bin
(using the Uniflash soft) and the portable player comes back to life. The file can't read the flash, but can come back to life a blocked device, I dont know why.

The problem with Spreadtrum SoC is that is needed a file (different for every soc) to read the firmware of the device (the file is called "nor" or "fdl", "nor" by the kind of memory to boot I guess, nor flash memory).

If we can read the firmware, things will be easy.

Here is a more complete list of fdl files than that it come with uniflash soft: http://chomikuj.pl/hubertus/Serwis+GSM/boxy/GPG+Dragron+3.55/55/GPG+Dragon+v3.50c+Crack+Download+Link+*26+Enjoy+!!/system/spreadtrum

Note: To use those files with UniFlash you must rename correctly and put in fdls folder, because UniFlash take params from the fdl filename, like the memory address to load the file.

I dont have tested all fdls that I got yet, and I can't guarantee than some fdl wont block forever the player.

[pmp4]

The real question is how much onboard RAM this SoC contains.

The various Actions Semi SoCs found in most of these shovelware players contains only a couple hundred KB, for example.  Even the higher-end rockchip ones have less than half the RAM for rockbox to be minimally viable.

I got several Actions based players and they are different. They can't even browse files when they are playing music.

This player can. It's like a feature phone without phone. It's not related to actions based players.

[bahus]

Here is a more complete list of fdl files than that it come with uniflash soft: http://chomikuj.pl/hubertus/Serwis+GSM/boxy/GPG+Dragron+3.55/55/GPG+Dragon+v3.50c+Crack+Download+Link+*26+Enjoy+!!/system/spreadtrum

Note: To use those files with UniFlash you must rename correctly and put in fdls folder, because UniFlash take params from the fdl filename, like the memory address to load the file.

Another link to download all those files at once (see system\spreadtrum\ folder in archive):
http://www.mediafire.com/file/0fcqdgcyk2ymqjo/Dragon_V3.53-MobileRdx.com.rar/file

[Bilgus]

@bahus nice

Note: To use those files with UniFlash you must rename correctly and put in fdls folder, because UniFlash take params from the fdl filename, like the memory address to load the file.

the uniflash script takes commands for the address and type from the file name by default

ex. sc6600l_generic_0x34000000_single.bin


can be overridden on cmd line
'-sfdl','--single-fdl-file'
'-saddr','--single-fdl-addr'

maybe the address space could be scanned repeatedly and get lucky enough to find the proper offset

[pmp4]

I got it!
Thank you very much to Bahus for the rar.

The file that works is 6531A_Write_Full_Flash_1.bin and the load address is 0x34000000

[pmp4]

Here is my firmware.

https://www.mediafire.com/file/uk6slle39r7b3fo/portable+player+firmware.bin/file

And here the results of binwalk:

DECIMAL       HEXADECIMAL     DESCRIPTION
--------------------------------------------------------------------------------
62848         0xF580          Unix path: /source/src/c/sci_mem.c
66516         0x103D4         Unix path: /source/src/c/threadx_os.c
77484         0x12EAC         Unix path: /source/src/c/threadx_appmem.c
235040        0x39620         Unix path: /Layer1/source/c/datacnfproc.c
330092        0x5096C         Unix path: /Layer1/source/c/systeminfo.c
1893852       0x1CE5DC        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes
3215524       0x3110A4        LZMA compressed data, properties: 0x5A, dictionary size: 16777216 bytes, uncompressed size: 4096 bytes

---

Reading in a hex editor, the firmware contents some info from my device (my bluetooths devices scanned), so it's not "clean" from factory, it's modified with the scans and the current config of the device.