Rockbox Technical Forums
Rockbox Development => New Ports => Topic started by: undersys on October 08, 2013, 02:46:29 AM
-
Hi All,
You may not know but James of Fiio has released a tool to unpack the x3's firmware (to a certain level)
http://www.head-fi.org/t/684793/diy-your-own-theme-for-your-lovely-x3 (http://www.head-fi.org/t/684793/diy-your-own-theme-for-your-lovely-x3)
I've done a very high level peek at the f/w :
File list :
DIR - fonts
DIR - litegui
FILE - logo.bmp
DIR - str
FILE - sys.bin
DIR - system_attribute
DIR - unicode
Contains some gzip'ed data :
binwalk --dd=gzip:gz:2 sys.bin
DECIMAL HEX DESCRIPTION
-------------------------------------------------------------------------------------------------------
728086 0xB1C16 gzip compressed data, ASCII, has CRC, was "]O\342\326qe\327\344%\270}\213\251\213(\260\235\243\247\255\263\265\277\301\305\307\323\337\343\345\351\357\021\004\274 \031\017\244\266\003%\214\230)=\373\376Q]\341wN\375\373\177mG\223\225\243\245?", last modified: Thu Jul 4 01:41:03 2002
This extracts "B1C16.gz , size 3520386"
Strings does not show up anything useful and I can not as of yet extract the gzip'ed data.
This is not a request for a port... :)
Just what I've found and hope its helpful for myself and others
The x3 uses the JZ4760B CPU so thats also helpful given there is a port in progress for that.
-
Does strings on pure sys.bin show anything useful?
-
And BTW. James says they have no time to do rockbox (not we don't want to do so). If you are interested in port I would start with contacting company if it is willing to disclose information allowing rb community to do the port (and maybe donating 1-2 units for developers)
-
Hi wodz,
Strings gives me nothing useful sadly.
James has been asked about giving out info to make rock box possible , this was a stern no.
So we are on our own :)
-
X3 must be really good "new target".
information allowing rb community to do the port
I found datasheets and "programming manuals" for jz4760\jz4760B, ingenic u-boot patches, firmware updates for X3, looks like it IHFS - http://www.rockbox.org/wiki/ChinaChip#IHFS_file_system_format (http://www.rockbox.org/wiki/ChinaChip#IHFS_file_system_format)
Ingenic FTP ftp://ftp.ingenic.cn/ (ftp://ftp.ingenic.cn/)
this summer a lot of useful info were removed from ftp, but i found ftp-mirror with all old docs, tools, source, e.t.c
-
upd. New Fiio X5 and Hidizs AP100 based on same soc - JZ4760b and use same firmware format.
and it's not Ingenic µC/OS-II or Android, probably ChinaChip rtos ?
+ there is available tool from FiiO for packing\unpacking firmware, current version IHFSsplit can't unpack FiiO firmwares.
-
http://www.prplfoundation.org/members/ (http://www.prplfoundation.org/members/) list ingenic as a member so maybe dev tools / docs will be made available (again?) at some point.
-
HiFiMan HM-701 based on 4760B too.
Do you try Binwalk to analyze firmware?
I have a X3 and Rockbox will be great on it!
-
HiFiMan HM-701 based on 4760B too.
Do you try Binwalk to analyze firmware?
HM-701 ? HM-700 based on STMP3770 http://www.head-fi.org/t/681370/two-new-hifiman-players-announced-hm700-and-hm802/210#post_10266609
X3 firmware ? nope.
-
Sorry, my mistake.
-
It seems that there is a mirror of ingenic ftp site here ftp://94.23.144.183/mirror/ftp.ingenic.cn/ Including all the 4760B docs / dev tools e.t.c. The folder called "NDA" seems empty.
-
http://www.gcw-zero.com/develop These people maintain an SDK for a jz4770 handheld with GCC 4.9.1
The handheld runs OpenDingux http://www.treewalker.org/opendingux/ Linux distro.
What's needed after that? Drivers for the LCD, USB and DAC chips?
Ram init values? What am I missing? (I'm not a programmer but I can take my X3 apart and report on chip ID numbers, I found a datasheet for the hynix Ram already somewhere.)
-
What's needed after that? Drivers for the LCD, USB and DAC chips?
Eventually, someone interested in porting to the X3. But in the meantime, I don't even think there is a wiki page setup for the X3 or any scans of the boards posted. Take a look at the NewPorts wiki page?
-
Quote from: wodz on October 08, 2013, 02:16:38 AM
information allowing rb community to do the port
I found datasheets and "programming manuals" for jz4760\jz4760B, ingenic u-boot patches, firmware updates for X3, looks like it IHFS - http://www.rockbox.org/wiki/ChinaChip#IHFS_file_system_format
Looks like, but not exactly in Fiio Xn series.
I was programming on a tool about pack/unpack x3.fw on linux,
It mostly follow IHFS file format, but there is a 4-bytes data at the file tail.
That causes X3 prompt "Update file corrupted" when updating .fw file.
try this (x3.fw Version 3.0) :
hd -s 0x2488400 x3.fw
You can find that 4bytes data is not in the table.
I speculate that is some kind of value to verify IHFS file table is fine.
If any who read Chinese, you may check my article at fiio official forum.
http://www.fiio.pw/forum.php?mod=viewthread&tid=49549&extra=page%3D1
-
Hm.. Only differences with http://www.rockbox.org/wiki/ChinaChip#IHFS_file_system_format i found are:
Header:
1. Instead of 476 bytes of zeros there is "0000 0200 0000 0000 0000 0000 0000 0000 0000 7833" sequence, where 7833 == "x3" string, and then 458 bytes of zeros.
2. Instead of 0xfffff000 bytes with offset 0x000c, there is 0x00000000
File:
3. Instead of padding to sector with 0xff, there is padding with 0x00 (maybe in cause of paragraph 2 of this list).
And 4 bytes tail.
This tail i found in fiio x5 firmware file too.
-
Yeah! I know, how to calculate this checksum)
I disassemble and decompile the "packtools" from Fiio, and wrote a code that are able to append a valid 4-byte checksum at the end of the firmware file.
Pastebin:
http://pastebin.com/TXxT7157
-
Yeah! I know, how to calculate this checksum)
I disassemble and decompile the "packtools" from Fiio, and wrote a code that are able to append a valid 4-byte checksum at the end of the firmware file.
Amazing! What is the next step?
Unfortunately, i'm not a programmer, and i can only help with disassembling player and making HD photo of components.
And, of course, testing.
-
Yeah! I know, how to calculate this checksum)
I disassemble and decompile the "packtools" from Fiio, and wrote a code that are able to append a valid 4-byte checksum at the end of the firmware file.
Amazing! What is the next step?
Unfortunately, i'm not a programmer, and i can only help with disassembling player and making HD photo of components.
I suggested above that someone make a wiki page for the X3 and post scans of the boards and a list of components.
-
I will try to scan a board. But it can be problematic, because of too bulging details, such as 3.5 jacks.
-
Good photo is probably better.
-
I suggested above that someone make a wiki page for the X3 and post scans of the boards and a list of components.
How I can create wiki page?
-
I disassemble my X3 and check it's components:
Relay - HFD4/5-S1
Power controller - AXP192
Amplifier - AD8692
Op-amp - AD8397
DAC - WM8740SEDS
Thermostat - LM26
RAM - HYNIX H5PS1G63EFR
ROM - NCTSTM16-08G
LCD - DL240QV018T-44A V1.0
Vol\Tone controller - NJW1194
Photo (not my):
(http://soundnews.ro/wp-content/uploads/Fiio-X3-naked-1-of-1.jpg)
-
Hi,
I recently got interested into the Fiio X1. Although the hardware is a bit different (and the X3 too expensive for me), the SoC is the same and the firmware upgrade format is the same. I'm wrote anopen source version of the unpacker and I figured out the scrambling on the "sys.bin" file (I think). Here is the link to both tools:
http://gerrit.rockbox.org/1165 (http://gerrit.rockbox.org/1165)
We are still undecided on whether we will attempt the port or not, more information is needed. Anyway, I think it would be a good thing that people with the players post the photos and hardware description of the Fiio on the wiki, or contact me if you don't want to create an account so I can do it for you.
NOTE: I don't own any of the Fiio players !
-
We are still undecided on whether we will attempt the port or not, more information is needed. Anyway, I think it would be a good thing that people with the players post the photos and hardware description of the Fiio on the wiki, or contact me if you don't want to create an account so I can do it for you.
NOTE: I don't own any of the Fiio players !
THX for interesting! Please, make wiki page!
Can you compile your tools for Windows and give link to download?
-
If you just need compiled tool, you can use official fiio packtools.
-
Hi,
My tools probably doesn't compile for Windows, best is probably to use the original tool here:
https://www.dropbox.com/s/j1plyerdqakn3sz/FirmwareTools-EN-Unix-windows.zip (https://www.dropbox.com/s/j1plyerdqakn3sz/FirmwareTools-EN-Unix-windows.zip)
For the wiki, read this:
http://www.rockbox.org/wiki/WebHome (http://www.rockbox.org/wiki/WebHome)
the procedure is written at the top of the page. I created a stub page here:
http://www.rockbox.org/wiki/FiioX3 (http://www.rockbox.org/wiki/FiioX3)
-
pamaury, I can send you my FiiO X3, if it will help the development of RockBox for this player!
-
Hi kochegin,
that's a very nice proposal :) What I suggest is that we first port Rockbox to the Fiio X1, because I have it and it's presumably the simplest of them.
And when the port is in shape, you can send me yours so that (hopefully), the X3 port is done swiftly.
-
All right. Keep me posted. I am willing to help any way I can. If that write me an email kochegin@gmail.com
-
If this will help - i can upload somewhere firmware backup from internal memory
-
Has anyone made progress on this port? Fiio uses the same SOC across their DAP range. I assume making rockbox run on X3 will also open the door for the port on other Fiio DAPs.
-
No. pamaury is very busy with RealLife (tm).
-
If I were able to get funding for this, would it help speed things along?
If so, please give me an idea (you may PM me privately) the kind of sums that might be sufficient. Thanks.
I just got an X5II and wouldn't mind seeing a rockbox on it, it's good hardware and decent price. Replaced the rockboxed ipod classic for me.
-
If I were able to get funding for this, would it help speed things along?
Usually not because the going rate for firmware and mobile developers is very, very high so its not really feasible to pay someone for their time unless you were going to spend a very large sum of money. However, since the X5 is pricy and a little niche, its possible someone might be interested in a donated player or something like that.
-
The problem is time and skilled, motivated developers. pamaury which is more then skilled to do the port has X1 but has no time. I did some basic RE research like finding lcd init sequence, gpio touched etc but have no time and hardware to proceed further.