SanDisk Sansa c200v2, m200v4, clipv1, clipv2, clip+, and fuzev2

[funman]

Hello guys

I bricked my 2nd Clip this night :/
I flashed a firmware with a bad recovery mode: my 2nd stage code was written at 1st stage also and it assumes the 1st stage will make the return to OF, I should have disassembled the file before flashing it ..;

I will look at getting a new one, and I'll share my patches tomorrow after some cleaning so you can try the code (I look at e200 owners here).

kugel: the amsinfo.c assumes well formed library blocks, but it may be confused by a padding block and try to read/print its string description at wrong address => segfault.

I attach the tool I use (it will dump a file for firmware and each library block so you may want to run it in an empty dir) so you can check your firmware with it.

[atomikpunk]

Bhaaaa not again :'(

If you want to try JTAG, be sure to let me know if I can help... Soldering is a bit tricky, but for the rest, its quite easy...

As for the NAND interface, I'm not very far in it as of today, but I found a (quite big) piece of code that refers to the NAND enable bits in CGU_IO and other registers like that. I'm still not able to understand how exactly the NAND is accessed and to have commands samples, but I hope to find it in a "not-so-far" future... Oh and it seems like many functions are indeed from the segger embfile library as we suspected

I hope that comparing with the embfile library doc will make analysis easier and quicker... But as I suspected, it seems like the NAND library is quite big

[kugel.]

Guys, it'd be nice if you were in IRC so that we can talk about this port faster.

Anyway, I want to start hacking my Fuze. What do you recommend doing first? I think it'd be helpful too see if the Fuze has this "recovery mode" too. What would I need to do to find out?

[atomikpunk]

Hi kugel and others,

Well I get on IRC #rockbox but being GMT-4 surely doesn't help if you're in europe since I only log in after supper, that is around midnight for europeans.

Well first, for the "recovery mode", you will need to open your player and see if there are some particular you can short. Honestly, I wouldn't recommend to try this unless you feel quite comfortable with the fact that you will break your warranty and that you are quite comfortable with electronics in general.

As for trying hacked firmwares, for the moment I would recommend against trying that out, we have enough bricked players already :'(

But, you may want to try to look at the firmware and help understand it. We are currently looking at the NAND interface so that we can get an easy (and safer!) way to load custom firmwares. If we could find the NAND interface initialization routine and data access routines, we would be in a good shape to build our own NAND driver.

Other than that, I'm beginning to think that there are a lot of information we haven't written to the wiki so if someone with decent writing skills, I feel it would be very beneficial if someone could volunteer so that we "dump" our info to him and he takes care of keeping the wiki up-to-date... Anyone?

[kugel.]

Bad news. The scrollwheel isn't working anymore.

[funman]

Maybe you can still use it although it's not as user friendly as before ?

Could you take photos of how you broke it so that other people do not repeat it please?

Thanks for the sacrifice of your scroll wheel !

I got another clip and I could finish writing clean & tested 2 stages bootloader.

The gpio checks the mapping for the Clip (hold & usb aka pin A3 and A6) and uses D7 as output to blink the led.

e200 mapping matches (A3 is usb and D7 is the led) but don't try it if you have another model before the mapping is figured out.

I attach diff to rockbox to use this bootloader (you only have to modify stage2.S).

Note: you better should disassemble the produced firmware before flashing it, and make a diff between it and the OF to be sure stage1 & 2 have been written correctly and the offsets are correct (they should ^^)

EDIT: add forgotten patch for find-offset.c, apply both diffs
EDIT2: as found by fragilematter, use ./find-offset instead of find-offset in the Makefile (. is not necessarily in the PATH)

[kugel.]

This is my dmesg output after inserting the Fuze with shorted NAND:

[32319.420338] usb-storage: device found at 10
[32319.420344] usb-storage: waiting for device to settle before scanning
[32324.420507] usb-storage: device scan complete
[32324.422625] scsi 9:0:0:0: Direct-Access     UNDEF    storage          1.0  PQ: 0 ANSI: 0
[32324.423736] scsi 9:0:0:1: Direct-Access     UNDEF    storage          1.0  PQ: 0 ANSI: 0
[32324.452564] sd 9:0:0:0: [sdb] 1 512-byte hardware sectors (0 MB)
[32324.454302] sd 9:0:0:0: [sdb] Write Protect is off
[32324.454312] sd 9:0:0:0: [sdb] Mode Sense: 00 00 00 00
[32324.454318] sd 9:0:0:0: [sdb] Assuming drive cache: write through
[32324.459838] sd 9:0:0:0: [sdb] 1 512-byte hardware sectors (0 MB)
[32324.460589] sd 9:0:0:0: [sdb] Write Protect is off
[32324.460612] sd 9:0:0:0: [sdb] Mode Sense: 00 00 00 00
[32324.460618] sd 9:0:0:0: [sdb] Assuming drive cache: write through
[32324.460639]  sdb:<6>sd 9:0:0:0: [sdb] Sense Key : No Sense [current]
[32324.462710] sd 9:0:0:0: [sdb] Add. Sense: No additional sense information
[32324.462928]  unknown partition table
[32324.463739] sd 9:0:0:0: [sdb] Attached SCSI removable disk
[32324.466375] sd 9:0:0:0: Attached scsi generic sg1 type 0
[32324.477270] sd 9:0:0:1: [sdc] Attached SCSI removable disk
[32324.477356] sd 9:0:0:1: Attached scsi generic sg2 type 0
[32324.840031] sd 9:0:0:0: [sdb] Sense Key : No Sense [current]
[32324.840044] sd 9:0:0:0: [sdb] Add. Sense: No additional sense information
[32325.003649] sd 9:0:0:0: [sdb] Sense Key : No Sense [current]
[32325.003662] sd 9:0:0:0: [sdb] Add. Sense: No additional sense information
[32327.374550] sd 9:0:0:0: [sdb] Sense Key : No Sense [current]
[32327.374568] sd 9:0:0:0: [sdb] Add. Sense: No additional sense information

This is lsusb -v of my Fuze

Bus 004 Device 010: ID 0781:6200 SanDisk Corp.
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  idVendor           0x0781 SanDisk Corp.
  idProduct          0x6200
  bcdDevice            4.02
  iManufacturer           1 SanDisk
  iProduct                2 M200Plus
  iSerial                 3         i 0744703011
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          4 config1: Mass Storage only
    bmAttributes         0xc0
      Self Powered
    MaxPower                0mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass         8 Mass Storage
      bInterfaceSubClass      6 SCSI
      bInterfaceProtocol     80 Bulk (Zip)
      iInterface              5 ms ifac 1 (SCSI::BULK_ONLY)
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x81  EP 1 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0
  bDeviceProtocol         0
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0001
  Self Powered

fdisk -l doesn't work.

The weird thing is: I get 2 new devices upon connection (sdb and sdc).

Doesn't look like being recovery mode, does it?

[fragilematter]

kugel: in fact it does, but it looks like the unusable one from the clips (it probably wasn't implemented by sandisk in the same way that it was on e200s)...

funman: your makefile tries to compile find-offset.c, but you haven't included it in the diff.

[kugel.]

What do you mean?

[fragilematter]

The clips show the recovery disk, but its 0MB in size and you can't write to / read from it. It looks like the fuze has the same behaviour. Check the older posts for more info

[kugel.]

Yea I udnerstood that. But this does mean, there's no such recovery mode (unusable is basically the same),doesn't it?

[fragilematter]

For the e200s that is the recovery mode... The other v2's can probably use jtag, but it's simpler to test any code on someones e200 to make sure it's safe.

[saratoga]

If you're going to return devices you broke, you probably should not discuss it on these forums since I really doubt Sandisk allows that, and it might be considered fraud by some.

[Hillshum]

I have the writing skills and the will to be the 'wiki man', but I may need some explanation of terms (IRC). Also, soon I may not have the time.

[funman]

Thanks

You can /query me (funman) on freenode if i'm not on #rockbox

I'm here 9AM to 6PM (CEST = GMT+2) and often on the evening