SanDisk Sansa m200 series (v1)

[travishayes89]

Try setting up a Rockbox development environment and then doing:
arm-elf-objdump -D -m arm -b binary firmware.rom | more
where firmware.rom is the name of the .rom file

Do you mean using "cygwin"?

Edit, cygwin's objdump doesn't recognize the sansa m240 firmware rom file.

[Bagder]

Do you mean using "cygwin"?

Let me repeat what he said, with a little emphasis added:

"Try setting up a Rockbox development environment and then doing:"

... as you will of course need an objdump built for ARM. You can do that with cygwin or otherwise, as is described fine on the rockbox site.

[maxkelley]

OK, I connected my Sansa m240 in MSC mode, here's fdisk -l:

Code: [Select]

Disk /dev/sda: 1016 MB, 1016856576 bytes
32 heads, 61 sectors/track, 1017 cylinders
Units = cylinders of 1952 * 512 = 999424 bytes

   Device Boot      Start         End      Blocks   Id  System
Are there any flags that will show hidden partitions or something? Also, there are two hardware revisions of this player that I have seen. One hardware revision is revision 4, the other is 1.30. The usb id's of these two are 0781:7431, and 0781:7401, respectively. I did the above fdisk listing using a revision 4 model, which has an improved (brighter) backlight and graphics (some fonts are different as well) over the revision 1.30. There are isn't really a way to tell which is which, having them side-by-side.

Code: [Select]

[18957561.368000] usb 5-7: new high speed USB device using ehci_hcd and address 25
[18957561.508000] usb 5-7: configuration #1 chosen from 1 choice
[18957561.512000] scsi20 : SCSI emulation for USB Mass Storage devices
[18957561.512000] usb-storage: device found at 25
[18957561.512000] usb-storage: waiting for device to settle before scanning
[18957566.516000] usb-storage: device scan complete
[18957566.520000]   Vendor: SanDisk   Model: Sansa m240        Rev: v4.0
[18957566.520000]   Type:   Direct-Access                      ANSI SCSI revision: 00
[18957566.544000] SCSI device sda: 1986048 512-byte hdwr sectors (1017 MB)
[18957566.544000] sda: Write Protect is off
[18957566.544000] sda: Mode Sense: 04 00 00 00
[18957566.544000] sda: assuming drive cache: write through
[18957566.564000] SCSI device sda: 1986048 512-byte hdwr sectors (1017 MB)
[18957566.564000] sda: Write Protect is off
[18957566.564000] sda: Mode Sense: 04 00 00 00
[18957566.564000] sda: assuming drive cache: write through
[18957566.564000]  sda:
[18957566.568000] sd 20:0:0:0: Attached scsi removable disk sda
[18957566.568000] sd 20:0:0:0: Attached scsi generic sg0 type 0
[18957567.968000] FAT: utf8 is not a recommended IO charset for FAT filesystems, filesystem will be case sensitive!
Strange thing about it is that it runs firmware version 4.0.44A, where the latest on the Sandisk site is something like 3.0.2, where my 1.30 runs 3.2.8A. Sandisk needs to fix their firmware updates..
I hope this helps somewhat.
Edit: Ok, here's a longer lsusb with -v:

Code: [Select]

Bus 005 Device 026: ID 0781:7431 SanDisk Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x0781 SanDisk Corp.
  idProduct          0x7431
  bcdDevice            4.0e
  iManufacturer           1 SanDisk
  iProduct                2 SanDisk Sansa m240
  iSerial                 3 4014E30F0117B3930000000000000000
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          4 config1: Mass Storage only
    bmAttributes         0xc0
      Self Powered
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk (Zip)
      iInterface              5 ms ifac 1 (SCSI::BULK_ONLY)
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0001
  Self Powered
Edit some more:
Ok, here's some more help. I got the roms from the firmware update, not sure if this will help:

American Version: http://maxkelley.be/sansaroms/SANSM200_American.rom
Asian Version: http://maxkelley.be/sansaroms/SANSM200_Asian.rom
European Version: http://maxkelley.be/sansaroms/SANSM200_European.rom

[fiveofoh]

Hey, sorry if I'm bringing up an old thread, but I've got an m250 (the 2GB version of the m240) and am wondering if a rockbox port would be
a) feasible
b) reasonable
I own it, and I'm willing to take it apart and mess with it, I've got decent electronics skills (and am majoring in EE/CS).  I don't have a lot of time right now, but I may in the near future, and would like to take a stab at it if it meets the two requirements above.

Edit:
After re-reading the New Ports section on the wiki, I'll add a couple things:
1) I am wiling and expecting that if anything gets done, I'll be the one doing it - I just want to know if it's worth my effort.
2) I will have access to the EE lab at college come late September, I have my own basic stuff (multimeter, soldering iron, etc) but I'm guessing there's probably a BDM/JTag emulator somewhere around the labs
3) I have tinkered with assembly, and am learning C++, hopefully C won't be too difficult to pick up
4) The Sansa m200 seems like a decent target, firmware is loaded from disk/flash, I have it.

[Bagder]

a) feasible

Sure, why not?

b) reasonable

Sure, why not? I don't think this target is much less reasonable than other similar targets that we already support.

Start working on a wiki page with PCB scans, figure out upgrade file format etc etc

[fiveofoh]

Hmm, I guess I forgot to post here...I put up a wiki page for it with scans:
http://www.rockbox.org/twiki/bin/view/Main/WebHome?topic=SansaM200Port
And whatever info I've gathered.  Kr4t05, we may be able to use yours, but I've gotten mine apart to take scans and such, so if I don't have to do anything crazy like ripping the screen off I'll probably be fine.  But thanks, I'll let you know

[alsaf]

I would be grateful if they following questions can be answered.

1) In the fdisk -l summary of M240, there is a difference of about 17Mb between  the Disk and Units. Would I be correct in assuming this is a hidden partition where the firmware/bootloader is stored and therefore the M240 will be easy to upgrade?
2) Dan_a mentioned using arm-elf-objdump for debugging. Would I be correct in assuming that  ARM (arm-elf) will be used for this player as it is telechips based?
3) I've got Usbsnoopy installed on windows and managed to install a sniffer on another player. I haven't tried it on my M240 yet. Would I be correct in saying that it would have to get a log dump when I am trying to upgrade the firmware? Can this only be done once when the firmware is being upgraded or can I do it afterwards when the Installer is checking firmware upgrade?
4) I found a link to rom files (http://files.zefie.com/PMP/sansa/m200/firmware/), I'm sure I got link from here. I assume this is the firmware rom file that needs disassembled?


Apologies if I am totally on the wrong track here but I have no experience of reverse engineering USB devices. I would say my experience using the C language is intermediate and currently swotting up on ASM (I've got a tutorial on 80386 which will give me an idea of the language, hopefully the ARM version isn't too different?).

[Bagder]

1: It depends a lot on how that partition is hidden and how you acccess it etc.

2: Yes, as the CPU core in the telchips is ARM

3: Yes, but the common telechips firmware format is already "cracked". Isn't this working for the m200 series? Also, you should be able to work with this target using tcctool which thus allows you to run and test stuff on target entirely without flashing or risking to brick it etc.

4: Yes

[alsaf]

Thanks for getting back to me so quickly Badger.

From my understanding of point 3, I can plug my m240 to my laptop and 'run code' right now. This will help me get my head round the embedded programming part. I've noticed there are a few current porting efforts that use the telechips so I'll look at them to get more info.

Unfortunately I need to 'walk before I can run' so please don't expect too much from myself.  If I can keep the motivation up I'll get there eventually.

[Bagder]

Just allow me to point out that there seems to exist two different m200 models as well, and if you're having the newer one, it seems it isn't Telechips anymore but AMS:

http://daniel.haxx.se/blog/2007/11/25/has-sandisk-gone-ams/

[alsaf]

I opened up my m240 earlier on and went onto IRC. One of the chaps on IRC said he didn't recognise the chipset.

Unfortunately I only have a mobile phone to scan the player. Not sure if the resolution will be good enough.

Don't have time to do it now but will look into it tomorrow.

[alsaf]

Tried using mobile phone to scan but resolution wasn't good enough.

Took details of some chips on back. The details are as follows:
-----------------------------------------
C70218301
SDTNKLAHSM-1024
CP0032854
CHINA
-----------------------------------------
20-99-00122-2
5654-6910511
SDC1
TAIWAN

From this link http://forums.rockbox.org/index.php?topic=12906.msg102855#msg102855 the c240 has similar chip markings.

There is nothing on packaging or player that says it is v2. It just says model: m240.

[skaos]

alsaf, which firmware version does it have? There should also be some silkscreen marking on the circuit board itself, something like "M200+ V4.1" in this photo (upper right): http://www.rockbox.org/twiki/pub/Main/SansaM200Port/m240back.jpg

[alsaf]

It says SANSA M200+ v4.1 on the circuit board.

The Firmware version on machine is 4.1.08E

[Bagder]

That's the one I call "v2", and it uses AS3525. The same one the v200 v2 uses and most possibly also the c200 v2.

And we have no ports or any started work on Rockbox for this SoC.