SanDisk Sansa c200 Series

[zefie]

went into manufacturing mode and loaded the rom

... I take it you meant "recovery mode" there! ;-)

No, I meant what I said.
Recovery mode did not work.

I went into manufacturing mode and ran "./e200tool recover pribootLoader.rom", then while it was writing the addresses I quickly unlocked the lock switch. Then it booted into the firmware. From there I copied the pribootLoader.rom into the root folder and let it reflash.

Edit: another note, attempting to read 0x70000000 seems to crash the device.

[Bagder]

I don't see why you need to fiddle with .rom files at all. If you stay with testing mi4 files only, you should be fine with "simply" using recovery mode to go back.

But it is great to see that the e200tool works this great for you!

[zefie]

I don't see why you need to fiddle with .rom files at all. If you stay with testing mi4 files only, you should be fine with "simply" using recovery mode to go back.

But it is great to see that the e200tool works this great for you!

Yeah I know, I was just experimenting. But it is nice to know how to unbrick them

I wish I knew assembly perhaps I could be of actual help instead of having to ask for others to help in the porting process. What I am aiming for at the moment is to figure out the specs of the device, and the simularities (and differences) from the E200 (aside from the obvious smaller screen and no scroll wheel).

If it is simular enough, we may be able to simply port this by creating small patchs for the existing E200 project.

Edit: Interesting:
http://zefie.com/files/sansa/c200/docs/c200_firmware_paths.txt

Notice "pp7002_5022_color".. is PP7002  a new PortalPlayer CPU? Also notice all the references to e200...

There seem to be 4 types of firmware for the device:

http://zefie.com/files/sansa/c200/docs/c200_blrom_strings.txt

BootROM (not the bootloader, probably lower level, breaking this would probably kill manufacture mode even)
PRIMARY BOOTLOADER (what we get with the updates)
SECONDARY BOOTLOADER (no idea)
Main image (the "firmware")

Filenames (guess from blrom strings):
Bootrom: sdbootrom.rom
Primary BL: pribootLoader.rom
Sec. BL: ? secbootLoader.rom maybe?
Main image: firmware.mi4

Unknown strings hanging around the area where the filename strings are for recovery mode:
FONT
FORMAT (maybe something simular to sansa.fmt?)

I'd like to figure out the hw address for the BootROM so I can read that using e200tool and maybe get some more hardware info.

[linuxstb]

PP7002 appears to be a PortalPlayer Windows application:

http://216.239.59.104/search?q=cache:3KbP4O7w_Q0J:www.portalplayer.com/products/platforms_musicjukebox.html+pp7002+portalplayer&hl=en&gl=uk&ct=clnk&cd=1&client=firefox-a

That page mentions it in conjunction with the PP5002, but looking at a disassembly of the bootloader, I'm almost certain it's a PP502x device.

[zdezi]

SoC = PP5022BF + NAND FLASH MEMORY.

>>[http://jiangmen.yesky.com/cseek/gd/gdsm/108/2664608_2.shtml

(automatically translated)

In all these chips, the most attention to the needs of this chip SanDisk iNAND, In fact, it was a Flash and the integration of the ARM chip. iNAND is a high-speed NAND FLASH MEMORY sequence controller in a single device combining a complete subsystem. iNAND can save CPU and the main system memory buffer random. ensure a high degree of reliability and provides a complete disk-file management structure.
Chip is very likely to listen to him after such a trend,
Recently, the S10 can iriver is an example of the application of this chip, without sacrificing function of the circumstances,
 Volume also can be further reduced.
Infineon chip is the first in the lower-right panel of 16 MB of SDRAM 1.8V voltage. This product should be used in the cache to use it.

 Middle and below the chips .IC is AustrianMicroSystems produce. It is AS3514 models, as the first product designed specifically for low-power portable audio audio encoder, It can not only achieve high-quality intervals, and at the same time also supports stereo FM recorded.

From the above one can see. While on the surface it seems to strengthen customs c200 does not seem particularly remarkable about. But it did little sloppy internal However, the chip but it has not unique.
Or in the future, we will see more use iNAND chip products
 

[maxkelley]

I'm not sure how I can help, but I know basic C and know the syntax well.. I also can provide an objdump'ed firmware file for the c200 series: http://www.maxkelley.com/sansa/firmwaredump_c200.txt
Cheers.

[Bagder]

Note that this objdump still has a 0x200 bytes mi4 header. At 0x200 you see the exception vectors that goes to location 0x0.

[maxkelley]

Would it help if I mi4code decrypted it? Here it is, if it helps: http://maxkelley.com/sansa/firmware_decrypt_dump_c200.tar.gz (tar-gz with textfile inside)

[Bagder]

It simply has to be a PP5021C, see the http://www.rockbox.org/twiki/bin/view/Main/SansaC200Port page now.

[maxkelley]

So, instead of patches to the e200 port, patches to the nano port? That should make it fairly easier, figuring that the Nano port is more complete.

[saratoga]

Its more like the e200.  It doesn't share much with the nano, except the PP CPU.  

[Bagder]

MrH said something like this to me:

"I took a brief look at the c200 BL and it also seems to have the SD protocol routines, so the NAND in it might still be an emulated SD card."

Which is somehow weird in my view since I thought the PP5021 in the nano had some kind of ATA interface to the NAND.

[dan_a]

MrH said something like this to me:

"I took a brief look at the c200 BL and it also seems to have the SD protocol routines, so the NAND in it might still be an emulated SD card."

Which is somehow weird in my view since I thought the PP5021 in the nano had some kind of ATA interface to the NAND.

But the c200 does have an SD slot - they may be to support that (thought I don't know why the routines would be in the bootloader.)

My advice to zefie would be to test the Elio bootloader build and see if that creates files.  If not, modify it to use the E200 flash driver and see if that creates the files.

[saratoga]

The pp5021 has an ATA controller, but I suppose theres no reason they have to use it.  They may have wired it up like the 5024 to resuse code or something.

[zefie]

MrH said something like this to me:

"I took a brief look at the c200 BL and it also seems to have the SD protocol routines, so the NAND in it might still be an emulated SD card."

Which is somehow weird in my view since I thought the PP5021 in the nano had some kind of ATA interface to the NAND.

But the c200 does have an SD slot - they may be to support that (thought I don't know why the routines would be in the bootloader.)

My advice to zefie would be to test the Elio bootloader build and see if that creates files.  If not, modify it to use the E200 flash driver and see if that creates the files.

I'll do what I can soon, when I get my new computer. Right now I'm roughing it on old computers that don't want to cooperate