Merged firmware => ADFU mode.

Hardware hacks, chipset information and other hardware related topics.

Merged firmware => ADFU mode.

Postby alduath » Sun Aug 22, 2010 3:26 am


I've been trying to upload a firmware to the MP3 that works.
Since I destroyed it the first time I tried to update the firmware, I had to find a way to fix it. (I destroyed it by changing an AP file in a dump that wasn't repaired :P ).

The fix procedure that I used involved using the "T18.bin" original firmware, and then uploading the original dump made with s1fwx.
I uploaded that dump, because the T18.bin file is not enough: the resources are for a MP4 (or something like that, it has big-colour bmps, and my mp3 player has monochrome and small ones). But uploading a dump file with s1fwx after flashing makes it work just fine.

So. My goal is to modify some z80 asm code to start doing weird stuff, but first I'm trying to make a new firmware that works with MP3 Update Tool.

I did this:
    - Uncompressed a repaired dump.bin
    - Uncompressed FWIMAGE.FW from that dump
    - Uncompressed T18.bin (the original firmware of the mp4)
    - Uncompressed FWIMAGE.FW from T18
    - Generated a script file, both AFI and FW, for each one.

Then, I created a "merge" directory with the T18 files, and copied the dump files, overwriting. I also merged all the scripts.

Finally, I created a FWIMAGE.FW from the merged script, and then a new .bin file from the merged script aswell.

That merged firmware works with MP3 Update Tool, but after upgrading with the Update Tool, the player starts in ADFU mode.

My guess is that BROM (or BREC?) decides to start in ADFU mode because it finds something bad in that new firmware. But I don't understand what could possibly be wrong... bad checksum maybe?. I don't know how to debug the BROM/BREC.

btw, s1giveio works, loadram works but the LCD pins/port are not ok, and the LCD_Detect doesn't work :(.

Any ideas? I just need that new firmware working to start modifying AP files :S.

Posts: 2
Joined: Sun Aug 22, 2010 2:56 am

Re: Merged firmware => ADFU mode.

Postby alduath » Mon Aug 23, 2010 7:29 pm

Seems like my mp3 doesn't like the FWIMAGE.FW generated by s1fwx and that's it.

The workaround was to merge only AFI, w/o uncompressing FWIMAGE.FW (and using the FWIMAGE.FW in dump.bin).
I discovered that using the batch script found at viewtopic.php?t=1589, so thanks to JedOi 'bout that :).

In order to apply FWIMAGE.FW patches, what I'm doing is to edit FWIMAGE.FW with an hex editor, and substituting the existing code that I want to change, with the modified code. And of course I need to balance the checksum later on.

For example, if I want to modify FMRADIO.AP, instead of uncompressing FWIMAGE.FW and replacing FMRADIO.AP, I just open FWIMAGE.FW, search for a pattern that identifies FMRADIO.AP (just copy/paste a large portion of FMRADIO.AP and search it in FWIMAGE.FW, make sure it's the only occurence), then I apply the modification. Now FWIMAGE.FW will have a bad checksum on FMRADIO.AP, so then I patch FWIMAGE.FW with the right checksum for FMRADIO.AP (I find the correct value by debugging s1fwx, just breakpoint on the instruction that outputs "<-- invalid checksum" and the correct value will be around).

That's enough for me.. I'll automate that later.

Thanks anyway :)
Posts: 2
Joined: Sun Aug 22, 2010 2:56 am

Return to Hardware (Hacks, information, fixes)

Who is online

Users browsing this forum: No registered users and 1 guest