BROM extractor
From S1MP3 Wiki
This simple application allows the extraction of BROM from the s1mp3 player.
Contents |
Download
sample BROM image extracted using this technique
Archive Content
The above BROM extractor archive contains the following files:
- hello.c - source code
- VOICE.AP - compiled application
- asd.txt - file container for BROM
- CreateContainerFile.xls - macros which allow to create blank 'file container'
- Readme.txt - brief explanation
How to compile with s1mp3demo
Download S1mp3demo: http://www.s1mp3.org/files/3rdpary_software/s1mp3demo_v1.0.7z
1. Install Cygwin
Install cygwin and ensure that the "make" utility has been installed, it may not be installed by default.
You can check it by starting the cygwin shell and typing "which make" e.g.
Aaron@AaronsVaio /cygdrive/c/project/s1mp3demo $ which make /usr/bin/make
Which shows that it has found the make command.
If you don't have cygwin correctly configured you will get the following:
Aaron@AaronsVaio /cygdrive/c/project/s1mp3demo $ which make make: Command not found.
2. Install and configure Z88dk
Download and install the Z88dk windows installer from sourceforge.net: http://sourceforge.net/project/showfiles.php?group_id=2917
Use the default installation directory or prepare yourself to go to edit the makefiles to get it working!
Unzip the s1mp3demo.zip file into the directory you would like to build in (e.g. c:\project)
(All the following instructions will reference this location, so change them as required for your layout)
Edit c:\projects\s1mp3demo\fw\image\Makefile and change the directory if you haven't used the same directory as above.
Edit c:\projects\s1mp3demo\S1MP3\Makefile.inc and change the directory if you haven't used the same directory as above.
Copy C:\project\s1mp3demo\z88dkconfig\s1mp3.cfg to C:\Program Files\z88dk\lib\config\s1mp3.cfg
Copy C:\project\s1mp3demo\z88dkconfig\s1mp3_crt0.asm to C:\Program Files\z88dk\lib\s1mp3_crt0.asm
Copy C:\project\s1mp3demo\z88dkconfig\s1mp3_crt0.opt to C:\Program Files\z88dk\lib\s1mp3_crt0.opt
Your computer should now be ready to do a build!
3. Building
Using cygwin, go into the c:\projects\s1mp3demo\S1MP3 directory and type "make"
You should hopefully get no errors, and you will see the following files have been created:
$ls -al -rwxr-xr-x 1 Aaron None 6592 Feb 11 18:03 record.ap -rwxr-xr-x 1 Aaron None 13986 Feb 11 18:03 record.map
record.map contains the location in memory of the S1MP3 where all the functions are that you have just built (Well it will be when you download it).
In this example record.ap will be replaced. If you want to replace a different ap then edit c:\projects\s1mp3demo\S1MP3\Makefile and change all occurances of record.ap to whatever you would like.
4. Creating the download file
You will only need retrieve the binary image from the S1MP3 player once, and to do that plug the S1MP3 player into your PC and type "make retrieve", this will use the s1fwx program to download the current MP3 player firmware so we can modify it. (Thanks to wiRe, else none of this could be done!)
Aaron@AaronsVaio /cygdrive/c/project/s1mp3demo/S1MP3 $ make retrieve s1fwx v2.6 - copyright (c) 2005 wiRe (http://www.s1mp3.de/) dump s1 firmware from flash into file...
As usual download the firmware by typing in the drive letter of the S1MP3 player when requested, after the firmware is retrieved the script will break down the firmware and create all the build scripts required to rebuild the image with the new record.ap.
Now that you have the correct S1MP3 firmware you can copy over the new record.ap file by typing "make install". This copies record.ap from the S1MP3 directory into the c:\projects\s1mp3demo\fw\image\ directory and also appends 0's to the file to make it up to the size that it originally was. It then uses s1fwx to rebuild the image and fix any errors in it.
Aaron@AaronsVaio /cygdrive/c/project/s1mp3demo/S1MP3 $ make install
and if every thing has gone well you should see no errors, just a lot of text scrolling past the screen and the final few lines will be like:
| MAIN.AP | | 10kb | | 6F43A79A | | STANDBY.AP | | 7kb | | BEA195D9 | | USBDISK.AP | | 17kb | | 176D7BC8 | | MUSIC.AP | | 62.5kb | | DBD82026 | | RECORD.AP | | 23kb | | D6E80305 | | VOICE.AP | | 33kb | | 05AAD4C1 | | SETTING.AP | | 13.5kb | | B9B9E498 | | FMRADIO.AP | | 14.5kb | | 04DACCC1 | | CONFIG.AP | | 6kb | | 16CB5435 | | TESTER.AP | | 3kb | | AF2B5025 | | FMRECORD.AP | | 23kb | | 24A0117F | | TELBOOK.AP | | 11.5kb | | 7C287CB7 | | CHECKFM.AP | | 6kb | | E46C0823 | +--------------+ +----------+ +----------+ make[2]: Leaving directory `/cygdrive/c/project/s1mp3demo/fw/image' make[1]: Leaving directory `/cygdrive/c/project/s1mp3demo/fw' Aaron@AaronsVaio /cygdrive/c/project/s1mp3demo/S1MP3 $
Where you can see record.ap is still in there and also the original size.
5. Downloading
Use the MP3 player update tool to download this file to the MP3 player: c:\projects\s1mp3demo\fw\fw.bin
6. General use
If you want to rebuild everything from scratch again type the following in c:\projects\s1mp3demo\S1MP3
make clean make make install (and download the bin file)
If you have only done a couple of changes then you could just
make make install
(and download the bin file)
If you have modified header files then the dependencies will not be tracked so it is best to do a "make clean" first
And Finally...
There are some definitions in crt0.asm which control what happens when control is passed over to this new application, namely defined heap space is cleared and probably stack as well. If your program goes over the 0x1FFF boundary then whatever is over this will be cleared! You'll need to play with the values to allow a larger code area. If for some reason your program doesn't seem to work, check its size!! (From the map file - and if it is too big make it smaller, or increase the size of the program memory area)
Disclaimer
This build environment has worked well over the last couple of months, there are no problems currently by using it, but in the past some players got destroyed through silly mistakes. Use this at your own risk, if it does ruin your MP3 player then tough luck!
How to compile with s1sdk
How to operate:
Open a console window and move to examples/[name of the example]/
Use:
- "zmake retrieve" : dump the flash (if you haven't done that yet during the installation).
- "zmake clean" : clean all files up.
- "zmake all" : build the example.
- "zmake complete" : build the example then move the created file (RECORD.AP) to the fw directory
and rebuild the firmware file for re-flashing purposes.
- "zmake install" : Just move and fix the file without re-creating it and rebuild the firmware file.
- Flash the "current_fw.bin" file located in fw directory with rdiskupdate, the usual way.
Note: if you which to restore your original firmware, just flash the "original_fw.bin" file also located in fw directory.
How to extract BROM
- Compile hello.c and make the .ap binary file
- Reflash it into player using the proper tool
- format the player at low level using RdiskUtility.exe (WARNING! All data will be lost!)
- Upload to the player the file container named asd.txt
- Start BROM.extrctor "Voice.ap"
- Press 'mode' key to enter into "main" menu
- Choose "Find" Menu and press 'mode' key
- Wait some time (about 3-5 minutes), the extractor will save the BROM image and will exit back to the "Find" Menu
- Restart Player
- Download file 'asd.txt' to your computer
The content of such file will be the BROM plain dump from address 0x8000
System requirements
HandFlash with 528(512+16) byte per page, and 16384 byte per block
What's new
There is new code (see void WriteBlock(void)) to write in Flash using DMA1 control, it is more fast than the method used on S1SDK!
