Sandisk Sansa e200R

[Llorean]

This thread is for discussion of the problems still preventing Rockbox from running on the Sansa e200R.

[dan_a]

There was talk about this on IRC - see this link (the conversation between Bagder and donvito)

[donvito]

Hey guys,

Basically what we were working on was to get the original bootloader to load, just to do a kind of "proof of concept" test with it.  

It's kind of boiling down to the signing and the "all plaintext" not working with the new BL...

[Bagder]

The main obstacles seem to be:

* signing the mi4 with the "dummy" digital signature doesn't work. This implies that they fixed this flaw in the BL code. This is the exploit we've been using that has made it possible for us to load custom code without having to patch any existing firmware code since we cannot sign the mi4 with a legitimate key since it is 160 bit DSA and cracking that is time consuming beyond manageable.

* it looked like donvito could "upgrade" to the BL image we extracted from another R model. This proves that we have the right file name and the right image. However, when he modified a single byte in the BL image, it would no longer get recognized and upgraded to by the firmare. I guess this implies some kind of checksum/signature within the BL image that we can't worked out...

[Bagder]

I got this amusing idea!

(warning warning warning this may harm your sansa quite a bit)

1. Boot your R model into manufacturing mode.
2. use e200tool to restore a vanilla e200 BL image

This might effectively turn the R model sansa into a vanilla model sansa.

3. Put a non-R model mi4 file on the device while in recovery mode.
4. Reboot and see if things still run.
5. Report the outcome here. If things go terribly wrong, try to recover the original R-model BL using e200tool. Don't blame me for any problems you may end up in.

[timmeh87]

How long would it take to crack a 160-bit DSA? This might be a crazy idea but what about making some sort of distributed computing effort? I seem to recall that dovoto or someone working on the Nintendo DS did the same thing to crack the encryption on the games...

Programming it is beyond my capability though

[Bagder]

How long would it take to crack a 160-bit DSA?

It would take so insanely long time there's no need to waste brains on it. Compare with the 72bit RC5 challange on distributed.net . They have 7000 active hosts (but over 75000 over time) that's been cracking for 1500 days and they're reaching 0.4% of the total key space now!

I don't think I need to explain how much larger key space 160 bits is compared to 72 bits...

[Bagder]

Dan A, me and MrH have been poking around (well I mostly talk while they poke) and we have been making some fun progress and have been able to convert a vanilla e200 to a e200R and back...

So, if we're lucky we might soon be able to replace the BL in e200R models with out custom-patched version, that will accept dummy-signed mi4 files.

[donvito]

Bagder,

...AWESOME...

That is really good news, I will be on IRC for awhile this afternoon, maybe I'll catch you on there and we can talk.

As I've said, I'll be a "guinea pig" for this, because I am confident that I'll be able to unbrick.

donvito

[Downsider]

I would test it, im DYING to get it to work on my e200r

[Destroyer14094]

Is there any way to get some kind of sansa e200r emulator that will run the firmware on windows and let me change that around so I don't end up bricking my sansa in the process of trying to get rockbox to work properly?

[saratoga]

Is there any way to get some kind of sansa e200r emulator that will run the firmware on windows and let me change that around so I don't end up bricking my sansa in the process of trying to get rockbox to work properly?

Thats a good question.  Toni's emulator has been able to run the retail firmware for a good while now, but I believe hes only tried it on the non-R model.  Might be worth looking into:

http://www.rockbox.org/tracker/task/6524

[Bagder]

Is there any way to get some kind of sansa e200r emulator that will run the firmware on windows and let me change that around so I don't end up bricking my sansa in the process of trying to get rockbox to work properly?

The problems we have to get Rockbox on the R models aren't really related to the firmware, but rather to the differences in the pre-bootloader. At least two people have already run the R model firmware on a vanilla e200 player.

Our problem is that we haven't yet managed to get an R model to load the rockbox bootloader and accept it as a fine mi4.

[DWHippster]

Dan A, me and MrH have been poking around (well I mostly talk while they poke) and we have been making some fun progress and have been able to convert a vanilla e200 to a e200R and back...

So, if we're lucky we might soon be able to replace the BL in e200R models with out custom-patched version, that will accept dummy-signed mi4 files.

That sounds great! All I have to offer though is my best wishes on success.
And...thanks for yours and everyone else's efforts!

[eric_leseur]

I tried to replace the firmware on an e250r with the firmware of an e250, but i just got "load main image failed." the easy fix is to just drag the old e250r firmware back to the player in recovery mode.