Sandisk Sansa e200R

[Bagder]

I tried to replace the firmware on an e250r with the firmware of an e250, but i just got "load main image failed." the easy fix is to just drag the old e250r firmware back to the player in recovery mode.

Let me repeat known facts:

1 - The R models have a different mi4 encryption key.

2 - The R models have fixed the digital signature flaw we exploit in the vanilla version so we can't sign the mi4 files to be accepted by the BL.

3 - The R models don't allow the BL to be updated in recovery mode.

4 - The R model mi4 files have different embedded magic numbers.

So blindly trying things won't do much good.

[xhozt]

hmm can i toss something up here ...the R version has real/rhapsody helix drm in it and not just in the firmware from what real has told me . If its part of the hardware  helix drm is VERY open as far as licenceing and such .. could this be the slight diffrence that is preventing the bootloader from working ? ,,, ps im still willing to use my R as test fodder...

[Bagder]

the R version has real/rhapsody helix drm in it and not just in the firmware from what real has told me .

I don't understand. You mean that there's a DRM key stored somewhere in the player, like in one of the flashes? I would actually assume something like that. Compare with the US iriver H300 models.

If its part of the hardware  helix drm is VERY open as far as licenceing and such ..

I don't understand this point.

could this be the slight diffrence that is preventing the bootloader from working ? ,,,

Please read my previous post in this thread. It detailed several aspects to why our bootloader doesn't work on the R model yet. If you can think of other reasons, please give us details.

im still willing to use my R as test fodder...

What are you waiting for exactly?

[xhozt]

the R version has real/rhapsody helix drm in it and not just in the firmware from what real has told me .

I don't understand. You mean that there's a DRM key stored somewhere in the player, like in one of the flashes? I would actually assume something like that. Compare with the US iriver H300 models.

If its part of the hardware  helix drm is VERY open as far as licenceing and such ..

I don't understand this point.

could this be the slight diffrence that is preventing the bootloader from working ? ,,,

Please read my previous post in this thread. It detailed several aspects to why our bootloader doesn't work on the R model yet. If you can think of other reasons, please give us details.

im still willing to use my R as test fodder...

What are you waiting for exactly?

Sorry for not being clear

A. per Real/rhapsody there is DRM info stored on the actual hardware not just the firmware on the player

B. The diffrent DRM used on the R is called Helix and Its quite open source "helixcommunity.org"  this portion of the DRM may be the thing that diffrent about the pre/bootloader and more than likely we can get some help from the helix community if this is the case .

C. I think the helix DRM may be the diffrence thats causing the plaintext trick not to work

D. I have and will keep on trying any new firmware on my E250R and if any one has a idea they want to try on my player that may help get us moving along I will gladly use my player to get us there .


Better???

[Bagder]

A. per Real/rhapsody there is DRM info stored on the actual hardware not just the firmware on the player

"DRM info" as in a unique key used for DRM purposes is most likely stored in one of the flash memories, yes.

B. The diffrent DRM used on the R is called Helix and Its quite open source "helixcommunity.org"  this portion of the DRM may be the thing that diffrent about the pre/bootloader and more than likely we can get some help from the helix community if this is the case .

I don't understand why you believe the DRM implementation has anything to do with the problems we have to run our bootloader on the R models. I've told you several matters that we have problems with. Can you please tell me how the particular DRM implementation changes any of that?

C. I think the helix DRM may be the diffrence thats causing the plaintext trick not to work

No. Go back and read up on what the "plaintext trick" is. It has nothing to do with DRM.

D. I have and will keep on trying any new firmware on my E250R and if any one has a idea they want to try on my player that may help get us moving along I will gladly use my player to get us there .

Here's a few ideas to start with:

1 - dump a boot rom from an R model
2 - compare the boot roms we have and figure out what the differences are
3 - figure out how you can convince your R model to accept a custom-patched version of the BL to force it to accept the "plaintext" trick again (we have such a one to test with)
4 - bring your own ideas and research and figure out how to run custom code

[Wyldfire]

SNIP/

No. Go back and read up on what the "plaintext trick" is. It has nothing to do with DRM.

/SNIP

OK... Ive searched the forums... where is the info on the "plaintext trick"?  I can't seem to find it anywhere.

[Bagder]

Ive searched the forums... where is the info on the "plaintext trick"?  I can't seem to find it anywhere.

See http://daniel.haxx.se/sansa/mi4.html check the description of the mi4 header at index 0x18

[xhozt]

Ive searched the forums... where is the info on the "plaintext trick"?  I can't seem to find it anywhere.

See http://daniel.haxx.se/sansa/mi4.html check the description of the mi4 header at index 0x18

Ok after taking a break to clear my mind on working on this . I started over with this in mind

{0x18   32bit length of the plaintext part. The YH-920 mi4 file has zero there. Every other file has it 0x200. Most bootloaders seems to be OK with this value being the entire file's size and thus effectively removing encryption.}}

now i am thinking i see were the diffrences in the R may make this tricky {this is per a email chat i am having with a person over at real about the player he wants rockbox on the R also . } what we are thinking will need to be done is to try and find a way to trick the player into thinking its a regular e2XX , then it will  take the plaintext trick . but as has been said before without help from some one with a R with more experance than me in coding this is gonna take a good long time ..

[Bagder]

now i am thinking i see were the diffrences in the R may make this tricky {this is per a email chat i am having with a person over at real about the player he wants rockbox on the R also . } what we are thinking will need to be done is to try and find a way to trick the player into thinking its a regular e2XX , then it will  take the plaintext trick . but as has been said before without help from some one with a R with more experance than me in coding this is gonna take a good long time ..

To "trick" an R model to become a vanilla model you need to flash a vanilla bootloader to it, and since the R models don't allow upgrading the bootloader you would need to use the e200tool approach or similar to attempt to do it.

Once we can put a custom bootloader there, we can put the regular R model bootloader there but with the key signing check patched out (we have such a binary lying around) and we should be able to boot Rockbox.

So again, this is all known facts to us. The problem we're facing is how to put a new bootloader on the R models.

[killermusic900]

i'm about to get my sansa returned, so i was just screwing around with it, and if you format the 16mb drive in recovery mode, it says LUN0 unlocked. does that mean anything?

[killermusic900]

sorry for double-posting, but can anyone get me a copy of their 250R's .txt file, the one you can access in recovery mode, with the version info and all that? I wanna try something.

[Avenged_One]

Of course.

Here's a copy of the text within the file

Version Info: Product Rev.: PP5022AF-05.51-S301-01.01-RN01.02.165-D
Base Code: 05.51-S301-01.01-RN01.02.165-D
ODM Ver.: S301-01.01-RN01.02.165-D
OEM Ver.: RN01.02.165-D
Build Type: -D
Build Date: 2007.04.27
Build Number: (Build 32.10)                                                                                                                                                                                                                                                                            

[zajacattack]

OK, I want to legitimately try something. Since it is possible to extract the R series bootloader with e200tool using this:

e200tool init
e200tool read bl.rom 0x10600000 391512

Could I flash a vanilla bootloader to it with this:

e200tool init
e200tool write bl.rom 0x10600000 392888

[GodEater]

http://forums.rockbox.org/index.php?topic=9263.msg79083#msg79083

In this post, Bagder states very clearly that we have no idea how to do what you're asking about. Why do you keep asking the same question ? Especially since saratoga already warned you not to?

[Bagder]

0x10600000 is SDRAM...