SAMSUNG YH-920

[funman]

Improve your skills by looking at it !

Nobody will do it for you, so your best bet is take confidence and continue what you started.

[pyro_maniac]

Should it be standard like all PortalPlayers?

[Bagder]

Since it uses a portalplayer chip it certainly shares all the portalplayer-specific details with the other portalplayer-based devices. But there's a selection of additional hardware that may or may not be similar to what other Rockbox targets already use.

[pyro_maniac]

But to find that out i need to go on modifying the iriver build to get loaded on my device, right?

[saratoga]

But to find that out i need to go on modifying the iriver build to get loaded on my device, right?

I don't think you'll have any use for the iriver build itself, just its source code if it does share some hardware in common.  The first thing to do is begin reverse engineering the hardware, and working on drivers for it.

[pyro_maniac]

Hi, i m again!

I changed my strategy. i red out the mbr of the player and run objdump on that. Is there an other step that i can make with it or is the assembly the end?

EDIT:

1. I red out the MBR and run arm-elf-objdump on that.
2. I cut off the header of my firmware and run arm-elf-objdump on that too.

Is there a arm disassembler or what can i make with that code?
how did you made it on other devices?

[pyro_maniac]

No comment?

[funman]

2. I cut off the header of my firmware and run arm-elf-objdump on that too.

Is there a arm disassembler or what can i make with that code?

objdump is a dissasembler, you can use the -D flag.

example: arm-elf-objdump -b binary -m arm -D myfile.bin

[Bagder]

and there's no point in disassemblying the MBR, you should decrypt the mi4 and disassemble or you should disassemble the bootloader (which usually is unencrypted thumb ARM on the PP devices)

[pyro_maniac]

objdump is a dissasembler, you can use the -D flag.

example: arm-elf-objdump -b binary -m arm -D myfile.bin

Ok thats the way  i made it. I thought there is an other step to get C code out of that. Is there a datasheet for the commands?

and there's no point in disassemblying the MBR, you should decrypt the mi4 and disassemble or you should disassemble the bootloader (which usually is unencrypted thumb ARM on the PP devices)

I said it befor, i can t find any bootloader. Thats my problem and the reason why i red out the MBR. Also in the other files were no bootloader found. Are there other possibilitys?

[Llorean]

On several players the bootloader (or firmware image itself) is stored in a separate flash ROM, and there's no way to access it via the disk.

[pyro_maniac]

That is only accessable in a special player mode or with JTAG?

[Llorean]

It depends entirely on how they've designed the hardware. There's no guarantee that it's externally accessible at all without coming up with a way to directly read such a chip yourself.

Or it may just be somewhere you haven't looked yet.

There's really more or less unlimited flexibility in how they can design such a device, so you want to try not to have too many expectations in where you'll find it based on previous devices.

[pyro_maniac]

That sounds very difficult to me. So i have only the chance to run my own firmware with that bootloader. That makes me a very sad.

[funman]

That sounds very difficult to me. So i have only the chance to run my own firmware with that bootloader. That makes me a very sad.

That's already a good start !

What do you need to see that is in the bootloader and would not be in the firmware file?

Now I think you must disassemble the firmware and look for known PP registers to find what could be access to the buttons, LCD .. and try to reproduce the behaviour in your own (C / assembly) code.

I'm not familiar with PP, but I would start looking at the files firmware/export/pp*.h