1 - To load a older version of the firmware on the device because it has features the newer version does not.
2 - To set the player up as a multi-boot (U-boot). key press for original OS or my custom compiled linux OS.
mp3 player based on mx23 from Freescale, mmc/SD storage 8GB, USB, 4“ LCD, UART.
I have 3 of the players and as far as I can tell the hardware is the same between the players. (LCD, MMC, UART, etc)
OTP eFuse sets the boot mode as SD_MBR_BOOT—SD Master Boot Record (MBR) mode. They do NOT use Boot Control Block (BCB). (see question)
On one of the players I have soldered to the UART test pads and with a buffer connected to a PC serial port. I will call this the TEST player, and the other 2 that do not have the UART soldered I will call DONOR-1 and DONOR-2.
The TEST player has the newer firmware that I would like to replace with the older firmware. DONOR-1 and DONOR-2 both have an older firmware version.
I also have a firware-update.SB file that is the newer version.
I have 4 unique firmware.SB files all different versions. Two of them contain the feature I want.
What I have done so far:
With a custom compiled linux, I have made an image of the original OS from the mmc using dd. Image is in 3 parts due to 3G limit of fat32. This has been done for all 3 players. I load linux using the HID recovery mode.
I am able to dd the TEST image to the TEST player without any problems.
If I replace any of the SB files with the other 3 the player will not boot. The LCD back light does come on.
If I dd the whole image from the DONORs the player will not boot. The LCD back light will come on.
I have decrypted the recovered SB file from the images with sbtoelf (Rockbox). I have done the same with my image that has u-boot and linux in it as a comparison.
The firmware SB files have 8 sections in them. 3 bootable and 5 clear text.
My SB file has 1 section. Bootable.
I have used ‘arm_disass’ to disassemble the ELF files. My knowledge here is weak, but I dont think that the disassemble program catches when the code switches between 16bit Thumb2 instructions and 32bit ARM instructions...
In short I am not able to get any firmware to boot on the TEST device except the one that originally came from it.
The partition tables does not make sense to me.
sectors = 512
p1* 193406 15859711 7833153 1 FAT12 p2 4 126207 63102 53 OnTrack DM6 Aux p3 189310 191357 1024 1 FAT12 p4 191358 193405 1024 1 FAT12
DONOR-1 is similar but not exact
The players have a FAT32 partition that is larger that 7GB when it is plugged into a computer. Shows up as a mass storage device. This is where the media lives. Notice the missing blocks.
The firmware includes the MBR_SIGMATEL_ID after the MBR signature (55AA).
MBR and MBR_SIGMATEL_ID of TEST
Working with the TEST player and its good image:
I have removed the MBR_SIGMATEL_ID and there is not change in the way the player boots or does not boot.
- Moved the boot flag from P1 to P2: Does not boot.
- Moved the boot flag from P1 to P3: Starts to boot then crashes.
- Moved the boot flag from P1 to P4: Starts to boot then crashes.
- Removed the boot flag: Starts to boot then crashes
I am not sure what to do next. Any suggestions?
STMP3780 “Safe Binary” u-boot linux-fslc mx23 imx233 ARMv5