Recent Posts
1
Hardware / Re: New cheap portable player in the market
« Last post by Bilgus on Today at 09:16:41 PM »I might have to dig out a windows machine to try the spreadtrum flasher or my dev machine so I can run a windows vm
I get to
FDL running, may start interacting with flash memory
with two of the bins but the norss one never gets to that point
I read through your instructions and already had an incantation but unfortunately they never get past the command to enable flash write
I get to
FDL running, may start interacting with flash memory
with two of the bins but the norss one never gets to that point
I read through your instructions and already had an incantation but unfortunately they never get past the command to enable flash write
Code: [Select]
uniflash.py flash ./oldbin.bin -wf -nr -s 0x80000003 -t 6531A_norss2
Hardware / Re: New cheap portable player in the market
« Last post by bahus on Today at 08:29:46 PM »Maybe write address is different, I dont know.From instruction I posted earlier the following addresses are used:
FDL: 0x34000000
Firmware: 0x80000003
FDL file: https://mega.nz/file/RX4GRKjR#Dm79NZVtZxqmmrStJvOgasF8rzPyW2D3xHj-zcD7tKU
3
Hardware / Re: New cheap portable player in the market
« Last post by Bilgus on Today at 07:29:57 PM »Quote
fdl is just for read the flash and another values (kind of cpu and so on), but write flash can be done just with the boot mode, without fdl.
judging by the way the script is laid out I don't think that is the case but it's not working for me so far so I too could be misunderstanding it
4
Hardware / Re: New cheap portable player in the market
« Last post by pmp4 on Today at 04:38:57 PM »QuoteMaybe write address is different, I dont know.
this is my guess as well, as I get to 'FDL running, may start interacting with flash memory'
but a timeout once the write flash command is sent
Ive tried all three 6531A bins so at least none of them have bricked the device
Even if it's the command was ok, we can't know if the flash really works until we have a different firmware, because we got just one firmware, and we will see no changes in the device if the flash write response is ok.
That's one reason because I'm trying to modify res.bin, it's the best way to know if write flash really works, changing gui appearance. (the another reason, it's because I dont like MOCOR standard GUI
)As I read in the Luxferre blog (the UniFlash author), write flash doesnt need fdl. Maybe I misunderstood it.
fdl is just for read the flash and another values (kind of cpu and so on), but write flash can be done just with the boot mode, without fdl.
Write flash is like upload a fdl, but instead in the ram address, in the nor flash address.
5
Hardware / Re: New cheap portable player in the market
« Last post by Bilgus on Today at 04:25:52 PM »Quote
Maybe write address is different, I dont know.
this is my guess as well, as I get to 'FDL running, may start interacting with flash memory'
but a timeout once the write flash command is sent
Ive tried all three 6531A bins so at least none of them have bricked the device
6
Hardware / Re: New cheap portable player in the market
« Last post by pmp4 on Today at 02:57:13 PM »Yeah, but the version I posted has the source code, unlike other last versions.Latest source for all their tools is also posted on their website https://spdflashtool.com/source/spd-tool-source-codeMy current target is modify res.bin, recompress (using bzpwork) and write using UniFlash in .bin format.Ok but it seems Bilgus has troubles writing using UniFlash. So maybe ResearchTool would still be required.
I can't confirm it, I didn't test write yet.
Maybe write address is different, I dont know.
As general advice, sometimes it's faster see USB traffic than see source code, to do reverse engineering to a usb driver.
In linux it's easy thanks to usbmon kernel module.
Just run windows over virtualbox in linux, load modprobe, and see the trafffic with tcpdump like if usb was a network interface.
something like this:
modprobe usbmon
tcpdump -i usbmon1 -s 65535 -n -q -w test.pcap
and open test.pcap with WireShark. Change usbmon1 by the number of USB bus (see with lsusb).
7
Hardware / Re: New cheap portable player in the market
« Last post by bahus on Today at 11:30:27 AM »Yeah, but the version I posted has the source code, unlike other last versions.Latest source for all their tools is also posted on their website https://spdflashtool.com/source/spd-tool-source-code
My current target is modify res.bin, recompress (using bzpwork) and write using UniFlash in .bin format.Ok but it seems Bilgus has troubles writing using UniFlash. So maybe ResearchTool would still be required.
8
Hardware / Re: New cheap portable player in the market
« Last post by pmp4 on Today at 11:13:44 AM »I found this url with "Spreadtrum Research Download Tool" source code (2.9.7007 version)
That's some outdated version. Latest version can be downloaded from official web-site https://spdflashtool.com/category/research-tool. Tutorial how to use it: https://spdflashtool.com/tutorial/use-spd-research-tool
I also saw instruction how to flash FullFlash .bin file with this tool (by default it requires .pac) https://4pda.to/forum/index.php?showtopic=625677&st=20#entry61083373
Though it's in Russian (Краткий гайд по прошивке китайских телефонов на базе SpreadTrum SC6531) - let me know if you have any translation troubles.
Yeah, but the version I posted has the source code, unlike other last versions.
Anyway, the same source code can be found in the very useful complete zip you posted.
Same source code, same version in: /MOCOR_12C.W13.04.23.BTDialer.20_Source/tools/DEBUG_TOOL/ResearchDownload/Source
(I think that was the original source of the leak).
But since I saw that zip you posted, I've left the target of study research download and pac files, I'm not interested in that anymore.
My current target is modify res.bin, recompress (using bzpwork) and write using UniFlash in .bin format. Once I can flash a modified MOCOR firmware (different res.bin) without destroy the player, the next target will be a rockbox "hello world", that will be more than enough for me by now.
Resources (res.bin) structure file can be found in the file "mmi_resource_def.h" of the zip.
ResOver.exe is useful as test, but it's incomplete, it can't extract all the resources of res.bin (like animated GIF and all text strings).
I ordered another portable player because I only got one, and I think it can be bricked in my tests
.I dont know yet, but I suspect the boot mode is always on, even if you flash the wrong firmware, I will confirm that in the future.
I ordered a slightly different model, with different button, I think it's the same, from the same manufacturer. The only difference is the button design, and that it has several submodels, with internal nand memory of 8/16/32 GB and without nand memory (I ordered without NAND).
https://www.aliexpress.com/item/1005004543172464.html (exactly 12.19 EUR, ship included, around 12 USD too)
In the pics appears differents icons, but I think it can't be trusted, and maybe it's the same firmware than the other player, because I've seen it in videos:
https://shopee.com.my/2022-New-Mini-Bluetooth-Mp3-Mp4-Music-Player-Fm-Radio-Hi-Fi-Media-Lossless-Voice-E-Book-Reader-i.513952359.14130839607
https://play-ws.vod.shopee.com/c3/98934353/103/AnoyQ3IANMHcnQUhGAIBAEY.mp4
BTW I've seen a similar player from the same manufacturer (I guess) and similar firmware, but in touch version. Same box, similar GUI design but with touchable screen, without buttons:
https://shopee.com.my/2.0-Mini-Touch-Screen-Bluetooth-MP3-Player-Portable-Audio-Music-Video-Player-with-Built-in-Speaker-FM-Radio-Recorder-Ebook-i.694651067.15656407769
9
Rockbox General Discussion / iAudio M5 - trying to resurrect
« Last post by Barbakane on Today at 09:22:31 AM »Before I spend time on this, just thought I'd check to see if anyone knows if I'm wasting my time on this little project or if I should persevere. My brother gave me his pristine iAudio M5 many, many years ago and it's been sitting in a drawer ever since. I have a similar vintage G3 that's starting to play up, but I love the audio quality of these old iAudio units so I'd love to get the M5 working again before spending cash on something new that might not sound anywhere near as good as an M5 ;-)
I have a few questions that some people on here might be able answer:
Most serious of all is that I do not have the original subpack connector so that might mean this project is a complete non-starter. I only have the unit itself and don't have any of the bits and pieces that would have come with it when purchased. Is there any way around this?
Assuming I can get around the above issue, it appears that I can still source a replacement battery on EBay so that's good, but I'd love to replace the original Zif drive with a solid-state solution. The Zif drive must be at least 16 years old now so I'm asuming it most likely won't be working now - although it was only used for the first two years of it's life and has had zero use since then. I've read a few old posts (circa 2010 I'm afraid) where people said they had been successful in using CF and, even better, SD cards. I have lots of reasonably new CF and SD cards that are still working fine, but the links for the adapters that people used back then are now dead - can anyone confirm if such adapters are still available?
Any light that anyone can shed to help would be much appreciated, even if it's to confirm the sad news that I'd be advised to bin said M5 unit :-(
Regards
Barbakane
I have a few questions that some people on here might be able answer:
Most serious of all is that I do not have the original subpack connector so that might mean this project is a complete non-starter. I only have the unit itself and don't have any of the bits and pieces that would have come with it when purchased. Is there any way around this?
Assuming I can get around the above issue, it appears that I can still source a replacement battery on EBay so that's good, but I'd love to replace the original Zif drive with a solid-state solution. The Zif drive must be at least 16 years old now so I'm asuming it most likely won't be working now - although it was only used for the first two years of it's life and has had zero use since then. I've read a few old posts (circa 2010 I'm afraid) where people said they had been successful in using CF and, even better, SD cards. I have lots of reasonably new CF and SD cards that are still working fine, but the links for the adapters that people used back then are now dead - can anyone confirm if such adapters are still available?
Any light that anyone can shed to help would be much appreciated, even if it's to confirm the sad news that I'd be advised to bin said M5 unit :-(
Regards
Barbakane
10
Hardware / Re: New cheap portable player in the market
« Last post by bahus on Today at 07:15:41 AM »I found this url with "Spreadtrum Research Download Tool" source code (2.9.7007 version)
That's some outdated version. Latest version can be downloaded from official web-site https://spdflashtool.com/category/research-tool. Tutorial how to use it: https://spdflashtool.com/tutorial/use-spd-research-tool
I also saw instruction how to flash FullFlash .bin file with this tool (by default it requires .pac) https://4pda.to/forum/index.php?showtopic=625677&st=20#entry61083373
Though it's in Russian (Краткий гайд по прошивке китайских телефонов на базе SpreadTrum SC6531) - let me know if you need it and have any translation troubles.