Manufacturer's firmware file structure

From S1MP3 Wiki

Jump to: navigation, search

The firmware file structure

Files in bold text indicate a file-set - a file-set gets flashed to the NAND memory chip - non bolded files are present in a FULL firmware file. Different file-sets are flashed depending on the results returned by HWSCAN.BIN.

Note that this is only a representative example of what may be found inside a firmware fileset. Many variations on the files contained exist across different firmware versions.

  • ADFUF321.AP
  • ADFUF641.AP
  • ADFUF644.AP
  • ADFUS.BIN
  • BRECF321.BIN <------ flash bootrecord file (2nd-stage bootloader)
  • BRECF641.BIN <------ flash bootrecord file (2nd-stage bootloader)
  • BRECF644.BIN <------ flash bootrecord file (2nd-stage bootloader)
  • ERAF.BIN <---------- erase flash
  • FWSCF321.BIN
  • FWSCF641.BIN
  • FWSCF644.BIN
  • HWSCAN.BIN
  • RCSL7502.BIN
  • RCSE7502.BIN
  • WELCOME.BIN
  • FWIMAGE.FW

FWIMAGE.FW contains ...

  • (unnamed) <------- 512-bytes header with basic information
  • FONT_GB.$$$ <----- Font display characters bitmap (language variations)
  • FONT_B5.$$$ <----- Font display characters bitmap (language variations)
  • FTBL_GB.$$$
  • FTBL_B5.$$$
  • CHECKFM.AP
  • CONFIG.AP <------- Gets called from MAIN.AP as the first application
  • FMRADIO.AP <------ The FM radio player (started by the MAIN.AP)
  • FMRECORD.AP <----- The FM radio recorder
  • MAIN.AP <--------- The main menu application
  • MUSIC.AP <-------- The music file player (started by the MAIN.AP)
  • RECORD.AP <------- The voice recorder (only records, doesn't play) (started by MAIN.AP)
  • SETTING.AP <------ Settings application
  • STANDBY.AP <------ The 'Standby' application (this runs while the player is switched off and 'listens' to the PLAY button)
  • TELBOOK.AP <------ The Telephone-Book application (stated by MAIN.AP)
  • TESTER.AP <------- Some test application, accidentally left inside the firmware
  • USBDISK.AP <------ The USB Disk application that runs while the device is plugged into a PC USB socket
  • VOICE.AP <-------- The voice recorder player (only plays, doesn't record) (stated by MAIN.AP)
  • ADFUS.BIN <------- Enter ADFU mode
  • ASCII.BIN <------- ASCII (and extended) display characters bitmap
  • L1251CEZ.BIN
  • TEL_SAVE.BIN
  • U1250.BIN
  • WMATABLE.BIN <---- WMA decoder table
  • FS_FAT16.DRV <---- Filesystem driver -- FAT16
  • FS_FAT32.DRV <---- Filesystem driver -- FAT32 (some versions only)
  • KY_HARD.DRV <----- Keyboard driver
  • SD_FF321.DRV <---- SD card (different flash types)
  • SD_FF644.DRV <---- SD card (different flash types)
  • UD_FF321.DRV <---- USB disk (different flash types)
  • UD_FF641.DRV
  • UD_FF644.DRV
  • UD_SF321.DRV
  • UD_SF641.DRV
  • UD_SF644.DRV
  • UI_B0724.DRV <---- High-level display driver (different language variations)
  • UI_J0724.DRV
  • UI_K0724.DRV
  • UI_L0724.DRV
  • UI_S0724.DRV
  • UI_T0724.DRV
  • VM_NANF.DRV <----- VM NAND driver
  • ADPCMENC.DSP <---- WAV (ADPCM) encoder
  • AG8DEC.DSP <------ Probably used to play recorded files
  • AG8ENC.DSP <------ Probably used to encode from radio and microphone
  • OGGDEC.DSP <------ DSP code: OGG decoder
  • OGGTABLE.BIN <---- DSP data: OGG related data
  • MP3DEC.DSP <------ DSP code: MP3 decoder
  • PCMDEC.DSP <------ DSP code: PCM decoder
  • WMADEC.DSP <------ DSP code: WMA decoder
  • UI30.RES <-------- Resource file (large collection of graphics/icons & multi-language menu text list)
  • LOGO.RES <-------- Resource file (boot-up logo or animation bitmaps)
  • PICGRP_0.RES <---- Resource file (menu navigation/option logos or animations)
  • PICGRP_1.RES <---- Resource file (menu navigation/option logos or animations)
  • PICGRP_2.RES <---- Resource file (menu navigation/option logos or animations)
  • BYBYLOGO.RES <---- Resource file (log-off logo or animation bitmaps)
  • GROUND.RES <------ Resource file (background bitmap for certain function screens)
  • SYSBNKA.SYS <----- Gets loaded by the SYSCFG.SYS module, ACTOS "Bank A" code
  • SYSBNKB.SYS <----- Gets loaded by the SYSCFG.SYS module, ACTOS "Bank B" code
  • SYSCFG.SYS <------ Gets loaded by the 2nd-stage bootloader, main resident ACTOS code

FWIMAGE.FW File Format

A firmware image can be up to 8MB in size and two copies are stored at logical sector addresses 0000 and 4000 in the flash, such that the two are immediately adjacent. Each firmware image consists of a 512-byte header, 7680-byte (7.5KB) directory block, and the remaining portion from 8MB is the file area.

The header structure is as follows: 

struct _fwimage_head {
 word sig1;          /* 0xAA55 */
 word sig2;          /* 0x0FF0 */
 long version;       /* e.g. 0x90, 0x51 for 9.0.51.0000 */
 byte date[4];       /* BCD date, e.g. 2006-01-04 is { 0x20, 0x06, 0x01, 0x04 } */
 word usb_vid;       /* 0x10d6: ACTIONS */
 word usb_pid;       /* 0x1101: seems to be common amongst their players */
 long dir_cksum;     /* low and high words of directory checksum */
 byte fw_desc[44];   /* "............SDK-ITEM/ACTIONSGongee.ZH" description */
 byte fw_manf[32];   /* "Wilson Co. Ltd." --- manufacturer's name? */
 byte fw_name[32];   /* "S1 Mp3 Player" --- name of device/firmware? */
 byte reserve0[128]; /* supposedly reserved, but there's nonzero data here. */
 byte usb_ver[8];    /* "USB 2.0 " */
 byte usb_typ[16];   /* "(HS) Flash Disk " */
 byte usb_pvr[4];    /* "1.00" */
 long reserve1;
 byte usb_desc[48];  /* string descriptor USB, usually "USB 2.0 (HS) Flash disk" */
 byte defaults[32];  /* some default settings are stored here */
 byte mfr_len;       /* the following are for MTP mode */
 byte mfr_info[32];
 byte prod_len;
 byte prod_info[32];
 byte ver_len;
 byte ver_info[16];
 byte sn_len;
 byte sn[16];
 word mtp_vid;
 word mtp_pid;
 byte reserve2[38];
 word head_cksum;    /* checksum of the header */
};

The following 7680 bytes contain up to 240 directory entries of 32 bytes each: 

struct _fwimage_dirent { 
 byte filename[11];  /* in typical 8.3 format */
 byte attr;          /* attributes, not used, nearly always 0 */
 byte reserve0[2];   /* 0 */
 word version;       /* nearly always 0 */
 long offset;        /* in 512-byte sector units, relative to the firmware header (0) */
 long size;          /* in units of bytes */
 long reserve1;      /* 0 */
 long cksum;         /* file checksum */
};

struct _fwimage_dirblk {
 struct _fwimage_dirent[240];
};

The remaining 8380416 bytes are available for storing files, with each starting on a 512-byte-aligned boundary as necessitated by the storage in the directory.

Retrieved from "http://wiki.s1mp3.org/Manufacturer%27s_firmware_file_structure"
Personal tools
about this site
Advertisement