New cheap portable player in the market

[pmp4]

Here the firmware uncompressed/splitted using bzpwork (in the files res.bin ps.bin kern.bin usr.bin)

https://github.com/ilyazx/bzpwork

https://www.mediafire.com/file/qsuoqkevd42wtel/portableplayer.zip/file

And here a little demo extracting res.bin using binwalk: The image of welcome when start the device.

[pmp4]

Some info from a strings kern.bin:

Platform Version: MOCOR_12C.W13.04.23.BTDialer.20_Release
Project Version:   6531E_PCB_V1.0
A80_MK_220_21KEY_LCD(XXTCTC7735S_SJCTC9106_JLCTC3021_XXT9108BOE)_V1.0
BASE  Version:     BASE_SVN
HW Version:        6531E_PCB_V1.0
11-29-2021 22:09:15

[Bilgus]

Pmp4 awesome work

[Bilgus]

I'm on mobile atm but if that's right here is a datasheet https://datasheetspdf.com/mobile/1455703/Spreadtrum/SC6531E/1

It says 32Mbits nor flash and 32Mbits pSRAM internal that's 4 megabytes
Each which is not a whole lot

But it does say up to 128 Mbits is supported embedded
Which is 16 megabytes but don't know yet I'd assume 4megabytes

[pmp4]

could rockbox run in a 4 MB ram device?

[saratoga]

The sansa clip has about 2.3MB, although it helps that it's a monochrome display. 4 MB should be ok for a color screen.

[Bilgus]

note he didn't say the clip+ that was the original clipv1
I seem to remember ARM922T where as this is the ARM926E

it will be  a slightly limited experience but yes rockbox should run on it!!

ARM926EJ-S with ARM Jazelle technology, which enables the direct execution of 8-bit Java bytecode in hardware, and an MMU
Support 32-bit ARM and 16-bit Thumb instructions

[saratoga]

Yes the original clip has 2MB of SDRAM vs. 8 MB of SDRAM on the Clipv2 and plus.  Both have additional SRAM.  The processors are quite similar except for performance, with the 9E processors having the faster multiplier and the v5E DSP extensions, which a few of the codecs use to save power. 

[Bilgus]

Unfortunately outside of baidu and cdsn (need wechat to download) I can't seem to find any headers so I guess one of the first orders of business will be going through that datasheet and grabbing all the hardware registers and offsets and start building up a toolchain for it

Pmp4 have you verified that you can repackage the extracted bins and write back to the device?

[bahus]

Unfortunately outside of baidu and cdsn (need wechat to download) I can't seem to find any headers

Not sure if it's useful but some Spreadtrum 6531 related sources can be found here:
https://cloud.mail.ru/public/8EPC/b3kQ4AuRf

Mirror: https://mega.nz/file/cf5BXBoT#_5onK5_GHdjcykgo47AmtmTdgT7aWWO-GJWYri_jHa8

[pmp4]

Pmp4 have you verified that you can repackage the extracted bins and write back to the device?

I didnt try to flash anything yet.

I'm trying to understand firmware structure first.

I found this url with "Spreadtrum Research Download Tool" source code (2.9.7007 version)

https://files.elektroda.pl/798976,researchdownload_r2.html

I'm dont know yet if it can be useful.

"Spreadtrum Research Download Tool" uses another format of firmware, in .pac files.

Once I understand it better, I'll try a flash, it would be cool change intro/end logo or menu icons.

If it's possible I'd like to keep using open source free tools like bzpwork and uniflash software.
uniflash allows flash write, and bzpwork allows lzma compress.

[Bilgus]

bahus yes that appears to contain the headers
It was quite a large amount of files but I think I have the relevant part contained here
http://www.mediafire.com/file/j4e6xx28fhbrzg2/6531_chip_drv.zip

there appear to be several versions of each with different base addresses so might still need some figuring

[pmp4]

Not sure if it's useful but some Spreadtrum 6531 related sources can be found here:

Huge find.

It seems almost the same version firmware than player complete source code, with a lot of extra tools.

with the tool /MOCOR_12C.W13.04.23.BTDialer.20_Source/tools/DEBUG_TOOL/ResOver/Bin/ResOver.exe I can view the res.bin file (and it can modify too).

As example I put here the first 4 menu icons, extracted from res.bin using ResOver.exe

[Bilgus]

just an update

I haven't been able to flash the dump i made back onto the device thus far

the -wf switch just results in a timeout

I'm not sure if it needs a different command or just needs a lomger timeout
but i'll keep trying

[bahus]

I found this url with "Spreadtrum Research Download Tool" source code (2.9.7007 version)

That's some outdated version. Latest version can be downloaded from official web-site https://spdflashtool.com/category/research-tool. Tutorial how to use it: https://spdflashtool.com/tutorial/use-spd-research-tool

I also saw instruction how to flash FullFlash .bin file with this tool (by default it requires .pac) https://4pda.to/forum/index.php?showtopic=625677&st=20#entry61083373
Though it's in Russian (Краткий гайд по прошивке китайских телефонов на базе SpreadTrum SC6531) - let me know if you need it and have any translation troubles.