BROM extractor

From S1MP3 Wiki
Jump to: navigation, search

This simple application allows the extraction of BROM from the s1mp3 player.

Warning: This page may contain information which is out of date.

It is much simpler to extract the BROM using s1giveio.This page is kept here for historical reference only. See the BROM page for the other method.


BROM extractor

sample BROM image extracted using this technique

Archive Content

The above BROM extractor archive contains the following files:

  • hello.c - source code
  • VOICE.AP - compiled application
  • asd.txt - file container for BROM
  • CreateContainerFile.xls - macros which allow to create blank 'file container'
  • Readme.txt - brief explanation

How to compile with s1mp3demo

Download S1mp3demo:

1. Install Cygwin

Install cygwin and ensure that the "make" utility has been installed, it may not be installed by default.

You can check it by starting the cygwin shell and typing "which make" e.g.

Aaron@AaronsVaio /cygdrive/c/project/s1mp3demo

$ which make


Which shows that it has found the make command.

If you don't have cygwin correctly configured you will get the following:

Aaron@AaronsVaio /cygdrive/c/project/s1mp3demo

$ which make

make: Command not found.

2. Install and configure Z88dk

Download and install the Z88dk windows installer from

Use the default installation directory or prepare yourself to go to edit the makefiles to get it working!

Unzip the file into the directory you would like to build in (e.g. c:\project)

(All the following instructions will reference this location, so change them as required for your layout)

Edit c:\projects\s1mp3demo\fw\image\Makefile and change the directory if you haven't used the same directory as above.

Edit c:\projects\s1mp3demo\S1MP3\ and change the directory if you haven't used the same directory as above.

Copy C:\project\s1mp3demo\z88dkconfig\s1mp3.cfg to C:\Program Files\z88dk\lib\config\s1mp3.cfg

Copy C:\project\s1mp3demo\z88dkconfig\s1mp3_crt0.asm to C:\Program Files\z88dk\lib\s1mp3_crt0.asm

Copy C:\project\s1mp3demo\z88dkconfig\s1mp3_crt0.opt to C:\Program Files\z88dk\lib\s1mp3_crt0.opt

Your computer should now be ready to do a build!

3. Building

Using cygwin, go into the c:\projects\s1mp3demo\S1MP3 directory and type "make"

You should hopefully get no errors, and you will see the following files have been created:

$ls -al

-rwxr-xr-x   1 Aaron None  6592 Feb 11 18:03 record.ap
-rwxr-xr-x   1 Aaron None 13986 Feb 11 18:03 contains the location in memory of the S1MP3 where all the functions are that you have just built (Well it will be when you download it).

In this example record.ap will be replaced. If you want to replace a different ap then edit c:\projects\s1mp3demo\S1MP3\Makefile and change all occurances of record.ap to whatever you would like.

4. Creating the download file

You will only need retrieve the binary image from the S1MP3 player once, and to do that plug the S1MP3 player into your PC and type "make retrieve", this will use the s1fwx program to download the current MP3 player firmware so we can modify it. (Thanks to wiRe, else none of this could be done!)

Aaron@AaronsVaio /cygdrive/c/project/s1mp3demo/S1MP3

$ make retrieve

s1fwx v2.6 - copyright (c) 2005 wiRe (

dump s1 firmware from flash into file...

As usual download the firmware by typing in the drive letter of the S1MP3 player when requested, after the firmware is retrieved the script will break down the firmware and create all the build scripts required to rebuild the image with the new record.ap.

Now that you have the correct S1MP3 firmware you can copy over the new record.ap file by typing "make install". This copies record.ap from the S1MP3 directory into the c:\projects\s1mp3demo\fw\image\ directory and also appends 0's to the file to make it up to the size that it originally was. It then uses s1fwx to rebuild the image and fix any errors in it.

Aaron@AaronsVaio /cygdrive/c/project/s1mp3demo/S1MP3

$ make install

and if every thing has gone well you should see no errors, just a lot of text scrolling past the screen and the final few lines will be like:

| MAIN.AP      | | 10kb     | | 6F43A79A |

| STANDBY.AP   | | 7kb      | | BEA195D9 |

| USBDISK.AP   | | 17kb     | | 176D7BC8 |

| MUSIC.AP     | | 62.5kb   | | DBD82026 |

| RECORD.AP    | | 23kb     | | D6E80305 |

| VOICE.AP     | | 33kb     | | 05AAD4C1 |

| SETTING.AP   | | 13.5kb   | | B9B9E498 |

| FMRADIO.AP   | | 14.5kb   | | 04DACCC1 |

| CONFIG.AP    | | 6kb      | | 16CB5435 |

| TESTER.AP    | | 3kb      | | AF2B5025 |

| FMRECORD.AP  | | 23kb     | | 24A0117F |

| TELBOOK.AP   | | 11.5kb   | | 7C287CB7 |

| CHECKFM.AP   | | 6kb      | | E46C0823 |

+--------------+ +----------+ +----------+

make[2]: Leaving directory `/cygdrive/c/project/s1mp3demo/fw/image'

make[1]: Leaving directory `/cygdrive/c/project/s1mp3demo/fw'

Aaron@AaronsVaio /cygdrive/c/project/s1mp3demo/S1MP3


Where you can see record.ap is still in there and also the original size.

5. Downloading

Use the MP3 player update tool to download this file to the MP3 player: c:\projects\s1mp3demo\fw\fw.bin

6. General use

If you want to rebuild everything from scratch again type the following in c:\projects\s1mp3demo\S1MP3

make clean


make install

(and download the bin file)

If you have only done a couple of changes then you could just


make install

(and download the bin file)

If you have modified header files then the dependencies will not be tracked so it is best to do a "make clean" first

And Finally...

There are some definitions in crt0.asm which control what happens when control is passed over to this new application, namely defined heap space is cleared and probably stack as well. If your program goes over the 0x1FFF boundary then whatever is over this will be cleared! You'll need to play with the values to allow a larger code area. If for some reason your program doesn't seem to work, check its size!! (From the map file - and if it is too big make it smaller, or increase the size of the program memory area)


This build environment has worked well over the last couple of months, there are no problems currently by using it, but in the past some players got destroyed through silly mistakes. Use this at your own risk, if it does ruin your MP3 player then tough luck!

How to compile with s1sdk

How to operate:

Open a console window and move to examples/[name of the example]/


  • "zmake retrieve" : dump the flash (if you haven't done that yet during the installation).
  • "zmake clean" : clean all files up.
  • "zmake all" : build the example.
  • "zmake complete" : build the example then move the created file (RECORD.AP) to the fw directory
                    and rebuild the firmware file for re-flashing purposes.
  • "zmake install" : Just move and fix the file without re-creating it and rebuild the firmware file.
  • Flash the "current_fw.bin" file located in fw directory with rdiskupdate, the usual way.

Note: if you which to restore your original firmware, just flash the "original_fw.bin" file also located in fw directory.

How to extract BROM

  1. Compile hello.c and make the .ap binary file
  2. Reflash it into player using the proper tool
  3. format the player at low level using RdiskUtility.exe (WARNING! All data will be lost!)
  4. Upload to the player the file container named asd.txt
  5. Start BROM.extrctor "Voice.ap"
  6. Press 'mode' key to enter into "main" menu
  7. Choose "Find" Menu and press 'mode' key
  8. Wait some time (about 3-5 minutes), the extractor will save the BROM image and will exit back to the "Find" Menu
  9. Restart Player
  10. Download file 'asd.txt' to your computer

The content of such file will be the BROM plain dump from address 0x8000

System requirements

HandFlash with 528(512+16) byte per page, and 16384 byte per block

What's new

There is new code (see void WriteBlock(void)) to write in Flash using DMA1 control, it is more fast than the method used on S1SDK!