From S1MP3 Wiki
Jump to: navigation, search

This wikipage will explain in details in what we will be working with.


We work with hardware generically known as "mp3 player", or "mp4 player". These are very cheap media players, that share a very similar 8-bit hardware layout, and are manufactured in China or Hong Kong, by several different brands. We call these media players "s1mp3s". If you have a cheap audio player device, chances are it's an S1mp3.

The NanoComputer

The NanoComputer is a special type of S1mp3. It's a stardard hardware sold by FlyingElectron. It has the added benefit of being "standard" (all the NanoComputers share the same hardware design.

Manufacturer's Firmware

The manufacturer firmware is an important resource to understanding how the S1mp3 hardware works. Check all that is known about it on the Manufacturer's Firmware page.


The S1mp3's core is a SoC (System om Chip). Usually it is a chip from the ATJ family. The most commmon is the ATJ2085. They include :

  • Z80 core and DSP co-processor.
  • Different battery type accounts for most differences.
  • Different choice of cap for PAVCC.

A full Port map is available.

For informations on the different chips, check the Actions SoC Family

For a datasheet, go to the page related to your processor ATJ2051, ATJ2073, ATJ2075, ATJ2085, ATJ2087, ATJ2089, ATJ2091, ATJ2093. ATJ2097.

Watch Dog

We have a H/W WD. We know the register has 8 bits:

  • Bit 7: Watch Dog enable.
  • Bit 6-4: Watch Dog timer clock select.
    • we know the frequency can be set from 1Hz->180s to 1KHz->172ms. thats 3 bits longer so it can't follow regular steps.
    • we found something like 1-2-4-8-32-128-512-1024Hz but its not confirmed.
  • Bit 3: Set it to 1 to clear watchdog
  • Bit 2-0: Reserved(it means "maybe reserved, maybe we just dont know")


The MCU's digital signal processor, used to encode/decode audio streams. See DSP


There are different types of Random Access Memory available:

  • ZRAM1: 16kb, accessible by the Z80 processor
  • ZRAM2: 4kb, accessible by the Z80 processor
  • IPM: 3*16kb, DSP program memory, accessible by the Z80 and the DSP processor
  • IDM: 3*16kb, DSP data memory, accessible by the Z80 and the DSP processor

See the Memory map for any further details.


There are two Read-Only Memory's available, each located inside the MCU:

  • BROM, contains the 1st-stage bootloader
  • TROM, currently we dont now what this one contains


Backlight circuitry varies with backlight type. OLED displays need a special driver chip to power them and will use a single GPIO to turn the backlight on or off. LCD displays with multicolour LED backlighting use 1 GPIO per LED - there will be either 1, 2 or 3 (R,G or B.) The backlight is usually connected to GPIO_An, and sometimes driven directly by the GPIO line, or driven by a transistor. The actual mechanism by which the backlight is powered is of no concern to the programmer who will only have to turn on or off a GPIO - the difficulty will be in identifying which GPIO.

Differences Firmware Considerations
Arbitrary use of GPIO lines  ???
Backlight may be active high or active low  ???


Circuit depends totally on battery type. AAA is simplest, but uses a DC-DC convertor. LiIon requires smart-charging circuit to protect battery from deep discharge. All of this circuitry has to be working before the MCU can even execute code, and so is of little concern from the programmer's perspective. Recharge mod describes how to make those batteries recharge while the player is plugged on the USB port.


If FM is present it will be controlled by GPIO_Cn acting in I2C mode. Another GPIO controls a transistor that gates power to the FM chip.

Headphone Connection

The connection between ATJ2085 MCU and the headphone socket. There isn't much room for variation in the design here. This circuit will be almost identical in all players. There are no considerations to be made for the firmware programmer, as this circuitry is entirely passive.

  • Inductors block any 100Mhz signals (FM band) from reaching the ATJ chip, allowing the headphone wire to get used as an antenna. Not required if not using FM, or using separate antenna?
  • There may be a connection for 1 wire remote control, in-line with headphones. See LRADC.


The I²C bus controller.


Usually 7 or 5 buttons. A hold switch might also be present. These are the connections for the hardware buttons. They will be mapped differently in all players (sometimes very different.) Most configurations use GPIO_Bn for most of the buttons. HOLD may or may not be on GPIO_G0 (see USB.) The two most common configurations are a key matrix (up to 9 buttons) or individual use of the GPIO lines, along with pulling two GPIO lines toguether. Also, some buttons are mapped by a variating resistor connected to lrdac. Open firmware will have to overcome this, somehow, perhaps with a button calibration mode?


A list of interrupts and a description of the ATJ's interrupt controller can be found here.




Always wired differently, although the LCD controller is probably always connected to the same MCU pins. It uses the same external memory bus as the NAND chip. One can use the Screen detector program to find out how id the display mapped. For more information, see Display.

Microphone Connection

As with the headphone connection, this circuitry is entirely passive and so is of no concern to the firmware programmer. Any differences between players will be minimal.


Main Article : NAND

Nand Flash Storage memory is wired to the MCU's 8 bit bus along with the display controller. The MCU has three CE (chip enable) lines, which are used to select the desired device for the current operation. Wiring is always the same with the only difference being in the choice of decoupling capacitors.

Flash chips with sizes 32Mbyte-2Gbyte (and probably larger as/when they become available) are supported. Some chips appear logically as two chips, having a second CE line on pin 10.

Differences Firmware Considerations
Flash memory byte size  ???
One flash chip or two The primary flash chip on CE1- must always be present. The second chip on CE2- is optional.
Flash memory block/page size When erasing the old firmware, in preparation to write a new firmware, the correct size erase operations must be used.

Hynix is amongst others brands a rather popular choice for the NAND Flash inside s1mp3 devices. Look at the hynix flash part number decoder pdf to know what type of flash chip is used on your player: http://www.hynix.com/inc/pdfDownload.jsp?path=/upload/products/gl/products/dram/down/NAND%20Flash.pdf

USB controller

The Chip is equipped with a USB controller. See ATJ209x USB