Jan 15, 2014

How to: extract firmware of your player using the S1fwx tool

Here are the instructions on how to extract the firmware of your MP3/MP4 player using the S1fwx tool.

Note: This is NOT fully supported for 9.x.x firmwares as it is not able to extract your firmware fully. Please make sure your player's firmware version is 3.x.x for this to work properly.

The S1fwx tool can be downloaded here. This will only work for ACTIONS chipset players (ones that play .AMV video files).

1. Connect the player to your computer with the USB cable. Make sure your computer detects the player and a drive letter is allocated to your player from My Computer.

2. Download the S1fwx tool here. There is no installation required, just extract it to a folder.

3. Go the the folder that you extracted the S1fwx files.

4. Double click on the "extract.bat" file.

5. Press [enter] to let the software scan for your drive.

6. You will see the following screen below. Check the line that says "detected drives" and confirm that it's the same drive as your MPx player.


7. Press the drive letter that corresponds to your MPx player that is detected by the program. In this example, it's letter

8. After you press the drive letter of your player, you will see th following screen:


9. The S1fwx program will now read the flash:


10. Once the S1fwx program finishes extracting the firmware, you will see the following:


Press the [enter] button to close it.

11. Then the "unsafe removal of device" message comes up.


Press the [OK] button.

12. Go back to the folder that the S1fwx program is stored and you will now see a "dump.bin"
file stored there.


13. Now run the "repair.bat" file to prepare the file so it can be uploaded back into your player.


NOTE: If you do not run the "repair" on the your "dump.bin" file after extracting it using the S1fwx tool, then you will get ERRORS when trying to upload it to your player.

14. Go back to the folder that the S1fwx program is stored and you will now see another new file, "dump.bi$". The "dump.bi$" file was the original "dump.bin" file from step #12. The NEW "dump.bin" file is now repaired and ready to be modified and uploaded back into your player.


15. This new dump.bin is the backup of the firmware for your player, so keep it in a safe place. The dump.bi$ is not needed.

16. Once you have extracted your firmware, you can read this Knowledge Base - How to: Modify your firmware using s1res tool to modify the firmware with your own images.

MKVtools 3

OK. With the release of MKVtools 3, this is where it starts to get confusing, especially for users of previous versions of MKVtools. That version has been split into three new applications, all version 3. (See here for a list of the new apps and the reason for the split).

This is a new and improved version of MKVtools, which will focus on what the original version of MKVtools was not very good at - the creation and editing of MKV files. It will not, however, create MP4 or AVI files. As the name might imply, MK4tools is a graphical interface for a variety of tools useful for processing video files.

If you have found yourself here looking for MKVtools to convert videos to either MP4 or AVI videos, then you should download either M4tools or AVItools, not MKVtools. If you are a user of the original version of MKVtools and are looking for updates, see here.

Features:
  • Convert from a variety of video file formats like MKV, MP4, OGM and AVI into MKV videos..
  • Can convert most videos without having to re-encode the video track and/or the audio track, so processing takes minutes instead of hours and no quality is lost.
  • Simplified, intuitive user interface that takes the guess work out of processing MKV videos.
  • Ability to convert various surround sound audio to 5.1 AC3 or 5.1 AAC.
  • Intuitively select desired video, audio and/or subtitle tracks to process, with the ability to verify the selections using video preview.
  • Define presets for one step automated encoding and track selections settings.
  • Burn (i.e., hard code) subtitle tracks into the video, or mux (soft subtitles) from internal tracks or from external subtitle files commonly found on the internet.
  • Control the font, size and positioning of the embedded subtitles.
  • Split MKV videos into segments of a specified file size or by start/end time.
  • Turn off an MKV video's header removal compression to allow more compatibility with playback and editing.
  • Join MKV videos.
  • Extract the selected tracks from MKV videos as individual video and/or audio files.
  • Add jobs to a queue either individually or in batches via drag and drop so you can process multiple files overnight (registered copies only).
  • Apply one setting to a group of files for easy batch creations (registered copies only).
  • Enter a "Watch Mode" for which MKVtools will process all videos place in a defined folder (registered copies only).
System Requirements

MKVtools is Intel-only and requires Mac OS X 10.7.x or later. It has been tested on a MacBook Pro and a Mac Pro with no known issues.

MP4Tools

MP4tools is the part of the VIDEOtoolbox Suite of Applications used for the creation and editing of MP4 videos. It was primarily designed for processing videos files for use in hardware capable of playing MP4 or M4V videos, such as the iPhone, iPad, Apple TV and PS3. As the name might imply, MP4tools is a graphical interface for a variety of tools useful for processing video files.

Features:
  • Convert from a variety of video file formats like MKV, MP4, OGM and AVI into MP4 videos.
  • Can convert most videos without having to re-encode the video track and/or the audio track, so processing takes minutes instead of hours and no quality is lost.
  • Simplified, intuitive user interface that takes the guess work out of processing MP4 videos.
  • Ability to convert various surround sound audio to 5.1 AC3 or 5.1 AAC.
  • Intuitively select desired video, audio and/or subtitle tracks to process, with the ability to verify the selections using video preview.
  • Use presets for one step encoding for playback on common hardware such as the iPhone and Apple TV.
  • Define presets for one step automated encoding and track selections settings
  • Burn (i.e., hard code) subtitle tracks into the video, or mux (soft subtitles) from internal tracks or from external subtitle files commonly found on the internet.
  • Control the font, size and positioning of the embedded subtitles.
  • Split MP4 videos into segments of a specified file size or by start/end time.
  • Adjust the Pixel Aspect Ratio of MP4 videos.
  • Join MP4 videos.
  • Extract the selected tracks from MP4 videos as individual video and/or audio files.
  • Add jobs to a queue either individually or in batches via drag and drop so you can process multiple files overnight (registered copies only).
  • Apply one setting to a group of files for easy batch creations (registered copies only).
  • Enter a "Watch Mode" for which MP4tools will process all videos place in a defined folder (registered copies only).
System Requirements

MP4tools is Intel-only and requires Mac OS X 10.7.x or later. It has been tested on a MacBook Pro and a Mac Pro with no known issues.

AVItools

AVItools is the part of the VIDEOtoolbox Suite of Applications used for the creation and editing of AVI videos. It was primarily designed for processing videos files for use in DivX enabled DVD players, though the AVI videos it creates are also playable on hardware like the PS3 and Xbox 360. As the name might imply, AVItools is a graphical interface for a variety of tools useful for processing video files.

Features:
  • Simplified and intuitive user interface that simplifies the processing of AVI videos.
  • Convert from a variety of video file formats like MKV, MP4, OGM and AVI into AVI videos.
  • Ability to convert various surround sound audio to 5.1 AC3.
  • Intuitively select desired video, audio and/or subtitle tracks to process, with the ability to verify the selections using video preview.
  • Define presets for one step automated encoding and track selections settings for playback on common hardware.
  • Burn (i.e., hard code) subtitle tracks into the video from internal tracks or from external subtitle files commonly found on the internet.
  • Control the font, size and positioning of the embedded subtitles.
  • Split AVI videos into segments of a specified file size or by start/end time.
  • Join AVI videos.
  • Extract the selected tracks from AVI videos as individual video and/or audio files.
  • Add jobs to a queue either individually or in batches via drag and drop so you can process multiple files overnight (registered copies only).
  • Apply one setting to a group of files for easy batch creations (registered copies only).
  • Enter a "Watch Mode" for which AVItools will process all videos place in a defined folder (registered copies only).
System Requirements

AVItools is Intel-only and requires Mac OS X 10.7.x or later. It has been tested on a MacBook Pro and a Mac Pro with no known issues.

CompuApps OnBelay 2.0

Powerful solution for Data Backup, Data Recovery & Formatting for Flash Media.
CompuApps Inc., leader in Data Management solutions, is the pioneers of Flash media maintenance and recovery tools. Our new, improved version OnBelay V2 further strengthens the capabilities of the retrieving valuable data from the Flash media.


What's New in OnBelay V2?

New and improved support for enhanced recovery technologies for FAT and FAT32 File systems.

Inside Info Never before known information about your digital photographs. This information provides details on when the picture was taken, the Model and Make of the Digital Camera used, etc.

Product Description:

CompuApps, Inc is pleased to announce the release of OnBelay V2, a revolutionary recovery solution.

OnBelay V2 features innovative media recovery algorithms & advanced digital media recovery technology. We use patent pending algorithms to dig deep into the media to recover lost files.

CompuApps OnBelay V2 (Digital Photo and Data files Recovery Edition with Backup, Restore and Format options) is useful for Photographers, News agencies, Journalists, Security Specialists, Physicians, Corporations or individuals who use a Digital Camera or Camcorder, Notebook, Palmtop, PDA, Cellular phone, Digital Recorder, Portable Medical Equipment, Data Logger etc.

12 Solutions in 1 Product:
  • Backup
  • Duplicate
  • Digital Image Recovery
  • Professional RAW Digital Image Recovery
  • Digital Movie/Video Recovery
  • Digital Audio Recovery
  • Digital Data Recovery
  • Formatting*
  • Low-level recovery for SmartMedia, xD and Memory Stick*
  • Low-level backup for SmartMedia, xD and Memory Stick*
  • Low-level formatting for SmartMedia, xD and Memory Stick*
  • Panoramic Mode formatting support for SmartMedia*
* Requires CompuApps Recovery Pro V2 or any supported devices.

Safe And Easy: OnBelay can backup, duplicate, recover files & format Cards from many types of flash media that have been lost due to system or battery failure, format or deletion or corruption caused by hardware or software malfunction.

OnBelay for everyone: OnBelay is simple to use (designed for novice and expert) and can help recover your data using just a few clicks.

Risk Free: CompuApps OnBelay V2 (Digital Photo and Data files Recovery Edition with Backup, Restore and Format options) is risk free since it does not modify or write back to recovery media; it rescues your data and writes to a different location specified.

Download CompuApps OnBelay 2.0 here

VaioSoft Recovery Manager 1.5

This program restores valuable content. Recovery Manager can backup, duplicate, recover files, & format cards from many types of flash media that have been lost due to system or battery failure, format or deletion or corruption caused by hardware or software malfunction. Recovery Manager software can recover data from Digital film cards such as CompactFlash, SmartMedia, Memory Stick, MultiMediaCard (MMC), Secure Digital card (SD), IBM Microdrive, ATA PC card, Hard drives, ZIP, & Jazz drives. Digital Image Recovery.


It provides backup, duplicate, image recovery, audio and video recovery, formatting, and low-level recovery options for SmartMedia and MemoryStick cards. It supports removable devices connected to your IDE, PCMCIA, USB, FireWire, parallel and SCSI ports. It also supports recovering RAW files.

Download VaioSoft Recovery Manager 1.5 here

Understanding Flash Memory Cards

Removable Flash Memory Cards

There are a few reasons to use flash memory instead of a hard disk:
  • It has no moving parts, so it's noiseless.
  • It allows faster access.
  • It's smaller in size and lighter.
So why don't we just use flash memory for everything? Because the cost per megabyte for a hard disk is drastically cheaper, and the capacity is substantially more.

The solid-state floppy-disk card (SSFDC), better known as SmartMedia, was originally developed by Toshiba. SmartMedia cards are available in capacities ranging from 2 MB to 128 MB. The card itself is quite small, approximately 45 mm long, 37 mm wide and less than 1 mm thick.

As shown below, SmartMedia cards are extremely simple. A plane electrode is connected to the flash-memory chip by bonding wires. The flash-memory chip, plane electrode and bonding wires are embedded in a resin using a technique called over-molded thin package (OMTP). This allows everything to be integrated into a single package without the need for soldering.

The OMTP module is glued to a base card to create the actual card. Power and data is carried by the electrode to the Flash-memory chip when the card is inserted into a device. A notched corner indicates the power requirements of the SmartMedia card. Looking at the card with the electrode facing up, if the notch is on the left side, the card needs 5 volts. If the notch is on the right side, it requires 3.3 volts.

SmartMedia cards erase, write and read memory in small blocks (256- or 512-byte increments). This approach means that they are capable of fast, reliable performance while allowing you to specify which data you wish to keep.They are less rugged than other forms of removable solid-state storage, so you should be very careful when handling and storing them. Because of newer, smaller cards with bigger storage capacities, such as xD-Picture Cards and Secure Digital cards, Toshiba has essentially discontinued the production of SmartMedia cards, so they're now difficult to find.

CompactFlash cards were developed by Sandisk in 1994, and they're different from SmartMedia cards in two important ways:
  • They're thicker.
  • They utilize a controller chip.
CompactFlash consists of a small circuit board with flash-memory chips and a dedicated controller chip, all encased in a rugged shell that is thicker than a SmartMedia card. CompactFlash cards are 43 mm wide and 36 mm long, and come in two thicknesses: Type I cards are 3.3 mm thick, and Type II cards are 5.5 mm thick.

CompactFlash cards support dual voltage and will operate at either 3.3 volts or 5 volts.


The increased thickness of the card allows for greater storage capacity than SmartMedia cards. CompactFlash sizes range from 8 MB to as much as 100GB. The onboard controller can increase performance, particularly in devices that have slow processors. The case and controller chip add size, weight and complexity to the CompactFlash card when compared to the SmartMedia card.

Flash Memory Stick Formats

Types of Flash Memory Sticks

There are a number of Flash memory card formats listed on this page, under their common standard or specification name.


The devices listed on this page are removable flash cards as opposed to simple Flash Memory devices [IC's] which are listed on another page.

The Flash Memory cards listed here differ in physical size and transfer speed. In most cases the size as little impact on storage space, as more memory devices reduced in size to fit available spaces. How ever the protocol or number of transfer pins does play a major role in data transfer rate. Transfer rates may vary widely between the different Flash Memory Cards, and may also vary as the different revisions are released.

Refer to each link for a more detailed description of the interface card [Flash Card].

CompactFlash Card A Mass Storage removable Flash Memory card operates like an ATA drive using Flash memory devices about 1/3 the size of a Type II PC Card.

DataFlash Card Mass Storage removable Flash Memory card. One of a number of removable Flash Memory cards.

e-MMC, Embedded MultiMediaCard [eMMC] uses reduced voltages and a different package size than MultiMedia-Card. eMMC is defined by JESD84-A44. The mechanical standard [JESD84-C43] defines a 153 and 169 BGA and 10 interface lines; Clock [CLK], Command [CMD] and 8 data lines [DAT 7:0].

Memory Stick Flash is another flash memory card format type. The Memory Stick size is 50 mm x 21 mm x 2.8 mm.

Memory Stick Pro Duo - Same as Multimedia Card listed below

microSD Card

MiniSD Card - Memory Stick Micro {developed by Sony and ScanDisk}

MMC - Same as Multimedia Card listed below.

MSMicro - Memory Stick Micro {developed by Sony and ScanDisk}

Multimedia Card {Multimedia Card [MMC] is another flash memory card format type. The device size is 32 mm x 24 mm x 1.4 mm}

M2 - Memory Stick Micro {developed by Sony and ScanDisk}

PC Card is one of a number of different card formats from PCMCIA which may differ in size and speed.

Reduced Size Multimedia Card Reduced Size Multimedia Card [RS-MMC] is another flash memory card format type, the smaller version of MMC. The device size is 24 mm x 16 mm x 1.4 mm

SD Card [Secure Digital] Card. A stamp-sized flash memory card which is removable. The Dimensions are 32 mm [height] x 24 mm [width] x 2.1 mm [thick] for an SD Card.
While the miniSD Card is only 21.5 mm [height] x 20 mm [width] x 1.4 mm [thick]. There is also a MicroSD card format.

SDIO Card [Secure Digital I/O] Card. A stamp-sized flash memory card which is removable.
The Dimensions are 32 mm [height] x 24 mm [width] x 2.1 mm [thick] for an SD Card.

Secure Digital Card SD Card. A stamp-sized flash memory card which is removable. The Dimensions are 32 mm [height] x 24 mm [width] x 2.1 mm [thick] for an SD Card. While the miniSD Card is only 21.5 mm [height] x 20 mm [width] x 1.4 mm [thick].

SmartMedia is a flash memory card format type. The device size is 45 mm x 37 mm x 0.76 mm.
SmartMedia cards operate using either 3.3 volt or 5 volt supplies.

SpringBoard - modules are another style of removable flash memory card, in addition to being used for other functions like modems.
The SpringBoard module was developed by Handspring, but are no longer manufactured by Handspring.
The SpringBoard modules were developed for Handheld computers [palm computer].

SSFDC Bus [Solid State Floppy Disk Card], is a Removable NAND-type small flash memory card [45mm x 37mm x 0.76mm].
Developed by Toshiba Corp. SSFDC is the old name for SmartMedia.

SxS [S-by-S] a flash memory card standard based on ExpressCard.
SxS was developed by Sony and Scandisk, used with Sony camcorders.
SxS has a transfer speed of 800 megabits per seconds.
SxS uses the ExpressCard 3/4 format; width: 34mm, height: 5mm, length: 75mm

UFS Bus {The Universal Flash Storage card is an external Flash card with a planned speed of 3Gbps (per lane).
The release date for the UFS specification is set for mid 2010.}

USB Bus The Universal Serial Bus provides two-way communication between the PC and peripheral devices, over a Differential serial interface cable. A Slow-Speed mode of 1.5Mbps is used for devices such as mice. Full-Speed mode is used by most devices and allows a transfer rate of 12Mbps. High-Speed mode [defined by USB 2.0] allows rates of 480Mbps.
Page gives a description, connector pin out and Equipment Manufacturer links.

xD Picture Card - [eXtreme Digital] Flash Memory card from Fujifilm for digital cameras introduced in 2002.

This format may not be available on Personal Computers. The card size is 20mm x 25mm x 1.7mm

SmartMedia Card Pinout Assignment

SmartMedia Description and Pin Out


SmartMedia is another type of Removable NAND-type small flash memory card format. The SmartMedia device size is 45 mm x 37 mm x 0.76 mm [thick]. SmartMedia cards operate using either 3.3 volt or 5 volt. Solid State Floppy Disk Card [SSFDC] is the old name for SmartMedia, which was changed in 1996. SSFDC was Developed by Toshiba Corp. Current SmartMedia storage format include 16-Mbit, 32-Mbit, and 64-Mbit NAND-type flash memory chips. The SmartMedia card does not use a connector, instead it uses a contact area as shown in the graphic below.

The graphic also defines the pinout or pin locations.


SmartMedia Pinout
Pin # Pin Name Signal Function
1 Vss Ground
2 CLE Command Latch Enable
3 ALE Address Latch Enable
4 WE Write Enable
5 WP Write Protect
6 I/O1 I/O Data Line 1
7 I/O2 I/O Data Line 2
8 I/O3 I/O Data Line 3
9 I/O4 I/O Data Line 4
10 Vss Ground
11 Vss Ground
12 Vcc 3.3v +/- 0.3 volts
13 I/O5 I/O Data Line 5
14 I/O6 I/O Data Line 6
15 I/O7 I/O Data Line 7
16 I/O8 I/O Data Line 8
17 PD Vcc Power Detect Vcc
18 GND (optional on 32Mbit) Ground Level Input
19 RY/BY Ready / Busy (Open Drain)
20 RE Read Enable
21 CE Chip Enable
22 Vcc Voltage Supply

When the card notch is on the left side the card uses 5 volts, when it's on the right side the card uses 3.3v +/- 0.3 volts. The graphic below provides a comparison of the different Removable memory Card standards. Many of the different Memory Card standards have descriptions listed on this web site. The different standards based on card size are provided. Refer to the Personal Computer Buses page for more information for different memory types, as listed here.


Refer here for a list of different Flash Memory Stick Formats.

xD Picture Card Pinout Assignment

xD-Picture Card is a flash memory card format, used mainly in digital cameras. NAND Flash, with additional ID commands.


xD cards are used in a select number Olympus and Fujifilm digital cameras and Olympus digital voice recorders but are now being phased out by both companies.

The memory format used by xD cards is not well-documented. It is difficult to study it directly, since most camera devices and most USB card readers do not provide direct access to the flash memory. Since the cards are controller-less, cameras and card readers must perform wear leveling and error detection themselves, and they normally hide the portion of the memory which stores this information (among other things) from higher-level access.


Because of its higher cost and limited usage in products other than digital cameras, xD has lost ground to SD, which is broadly used by PDAs, personal computers, cellular phones, digital audio players and most other digital camera manufacturers.

1 mm pin pitch.
3.3V power.
Standard NAND-Flash command set, plus additional

18-pin Flash Card

Pin
Name Direction Description
18 GND Ground (+Presence detect)
17 R/-B Ready/-Busy (Open-drain)
16 -RE Read Enable
15 -CE Card Enable
14 CLE Command Latch Enable
13 ALE Address Latch Enable
12 -WE Write Enable
11 -WP Write Protect
10 GND Ground
9 D0 Data0
8 D1 Data1
7 D2 Data2
6 D3 Data3
5 D4 Data4
4 D5 Data5
3 D6 Data6
2 D7 Data7
1 Vcc Power

How-To Read Embedded NAND Flash Chips

NAND flash chips are used in all sorts of electronics for storing information/firmware etc. If you are interested in trying to get the information out to study, then I may have something useful for you. This is how I read the flash chip without removing it from the device.


DISCLAIMER- Not an easy task, and not foolproof either. This procedure can be rough on both the device you are trying to read, and the reader used. NAND chip specs are also changing all the time, and so are card readers, so there is no real way of knowing if this pertains to “ALL” NAND Flash and “ALL” readers. This has been used successfully on Samsung small block flash using a Dazzle SmartMedia/xD reader.

First, you’ll need to get a Smartmedia/xD card reader. The reason for this is Smartmedia and xD flash cards are basically just NAND flash chips in a friendly, removable card. Other types of flash media also use NAND, but have a controller in them that handles the interfacing between the flash chip and the host, be it a camera, cell phone, card reader, etc. This controller gets in the way or reading data off embedded chips, because they are looking for partitions/files in a particular formats (FAT16 for example) that embedded flash rarely uses. Typically, we’d be trying to get the raw data off the embedded NAND to study.

Knowing that Smartmedia/xD cards are basically straight NAND chips, we can connect the card reader directly to the NAND chip by cross-referencing the chip pin out to Smartmedia/xD card reader. You can get the card pinouts here.
Note- These pin outs are for the cards themselves, not the readers.

An example for wiring to a Smartmedia reader is pictured below. Pin one of the reader is at the top of the picture, and the pin out is as follows.

Pin 1 — Vcc (+)
Pin 2 — Vss (ground)
Pin 3 — I/O 5
Pin 4 — not used
Pin 5 — I/O 6
Pin 6 — I/O 4
Pin 7 — I/O 7
Pin 8 — I/O 3
Pin 9 — I/O 8
Pin 10 – I/O 2
Pin 11 – not used
Pin 12 – I/O 1
Pin 13 – not used
Pin 14 – WP
Pin 15 – RY/BY
Pin 16 – WE
Pin 17 – RE
Pin 18 – ALE
Pin 19 – CE
Pin 20 – CLE
Pin 21 – not used
Pin 22 – not used

The battery select is dependent on your NAND chips voltage (either 3.3 or 5 Volts) and the write-protect switch is used if needed.


Connecting the reader to the chip can be the hardest part. The chips I have done have all been TSOPs, which are surface-mount chips with .5mm pitch. Quite small! I have done it several different ways. First way was to use some 30 gauge Kynar (used for wire-wrapping), soldering a wire from each pin on the NAND chip to its corresponding pin on the reader. An old IDE hard drive cable can provide wire of a similar size. It was doable with an extremely fine-tipped soldering iron and plenty of patience, but was by no means easy. Depending on the device, you may be able to trace out some alternative points to solder to, instead of directly to the NAND chip. It gets pretty tight trying to solder to 4 of those tiny pins in a row without bridging anything with solder!

Another approach used some flexible ribbon cable. The wire in the cable had the same pitch as the chip, making it easier to keep all the wires aligned while soldering to NAND chip. A few places sell this cable, such as Mouser and Digikey, but you may also be able to scrounge some from an old DVD player or drive, or even possibly old CD drives. They are used to connect the laser assembly to the main board.


If you have some .5mm TSOP/TSSOP prototyping boards around, this can be the easiest. Cut down to size, and beveled where they will meet the chip, you can make a set of wedges that will solder up fairly easy. Just line them up, and drag some solder from the board down to the chip to solder in place. A little flux will help, but you won’t have to use any additional solder, just what is already on the prototype board. Once you are done, a little wiggle will free the board from the chip without damage. No need to desolder anything, either. The following pics should clarify this.

Once you have the NAND chip hooked up to your reader, you have to get the data off it. Leaving power to the device you are trying to read OFF (preferably Batteries out, unplugged, etc.), plug in your reader to you computer. Depending on your OS, you can get the data off a couple of ways.


Linux users can mount the card reader and use dd to dump an image of the Flash chip. The resulting image can the be studied with the hex editor of your choice.

For Windows, I used a product called OnBelay by Compuapps. A very similar (identical?) product is Recovery Manager by Vaiosoft. Both these will work the same way. The main screen has a list of drives it can access, choose the one that corresponds to your reader. The program probably won’t recognize the file structure of the flash, so it says “no media present” or something to that effect. Along the top of the screen are tabs, one of them is labeled “Tools”. When you click on that, you’ll have the option to back up your media. Press it and it will allow you to back up the chip to a specified folder. I also check the box to backup both used and unused space. The backup image is in .FMB format, which can be browsed with any hex editor and studied.

Hope this can be of use to someone!

via uC Hobby

Jan 7, 2014

MP3 Player Recovery and Hacking

Loading New Firmware:

The first step to loading new firmware into the MP3 player, or doing a firmware dump from the player, is to set the device into loader mode. In some cases, where the firmware is intact on the device, new firmware can be loaded without setting the device into loader mode.

There are a variety of ways to set the device into loader mode. The most definite, guaranteed to work method is to short a number of the I/O pins of the flash chip with the battery removed, while connecting the player to a free USB port. If the device has two flash chips, the I/O pins on the first chip (closest to the CPU) are the ones to short. While this method should work for pretty much any similar device, it can cause problems, especially if you short the wrong pins.


The safer method for forcing the device into loader mode is to hold down the R/V (recorder mode/volume control) button with the battery removed, while connecting the player to a free USB port.


When the player is plugged into a free USB port while in loader mode, a new device will be detected as "ALi USB 2.0 BOOT LOADER". The LCD and backlight will both not illuminate when this is successful.

Should neither method work in setting the player into loader mode, it is possible that the player itself is damaged, and it may not be possible to recover it.

Useful Software:

Finding software capable of loading firmware to this brand of player was quite challenging, given the similarities between ALi chipset players and S1MP3 players, and that many manufacturers were based in China. This is where the entries on the Polish forums on elektroda.pl were most useful. From rough translations, there were a few software packages that could read and write firmware images to the flash memory.


One such tool is a program called MPTool, which appears to be designed to be used as a factory firmware loader. With minimal documentation available, it is difficult to determine what all the features are used for without risking further damage to the player, however it would appear that the software can be used to change USB vendor and product IDs, reformat the flash memory used for storing MP3s, and changing the inbuilt serial number. This software does not seem to be able to create actual firmware images from scratch, and is not able to dump existing firmware from the device to disk.


A potentially more useful program is the M566x ISP tool. This program is capable of uploading firmware binaries to devices, and is also capable of dumping the current contents of the flash memory to disk. The function of particular interest is the "Save PM" function. This function appears to dump the complete operating system image to disk as a file called PM.bin. At the moment, there is no obvious way of converting this file back to a broken down set of binaries or Cabinet archive as required for loading into a device.

Before you can use the M566x ISP tool to dump firmware images, it is necessary to identify what type of flash memory is used in the player. In most cases this should be printed quite clearly on the flash chip itself, but if it has been rubbed off, or you do not want to open the case of the player, the "Auto ID" button will in most cases identify the type of flash memory used in the player. Clicking "OK" will start the firmware loading process, allowing you to select multiple binary files to be loaded as firmware. If there is a problem with any of these binaries, in most cases it will either crash the program, or cause the write process to fail. This does not seem to destroy the player, but as always be very careful when loading new firmware.


MPTool can be found in many different distributions of firmware updates for ALi chipset MP3 players, and under a wide variety of names. One of the more common names for the MPTool executable is "Factory4.exe". A quick hunt on Google will find many sites with this file, and a zipped barebones copy is available, although this does not include any firmware files. M566xISP (known as the M5661 ISP tool or M566x ISP tool) is considerably harder to find, but can be found within some firmware distributions, most notably within the firmware package of the Z-cyber Zling T-Nax. The tool itself is also available for download below, but again does not include firmware files for any player. If possible, it is best to download these files elsewhere, as the bandwidth of this server is very limited.

Want to help me maintain this server? Donate some BitCoins to: 1FZFrGTAdnQzUD9y5AkvqS6WY18m9vcMyH

MPTool.zip (485k)

M566xISP.zip (1354k)

The Firmware Itself:

In my case, it took many weeks of on-and-off searching to finally find a firmware image that was compatible with my device. Given the number of M566x based MP3 and MP4 devices out there on the market, it is very easy to find firmware images that may seem right, only to load them and find that the display and controls do not work. Eventually, I found a firmware set that did work for my player, a firmware package built for a Typhoon 1GB MP3 player (obviously another rebrand of the same device sold by Egoman and Yuraku). Within the firmware package for this MP3 player is a file called IEOA_FW16.13.11_060617.CAB. This file contains 94 small binary files, the structure of which are discussed in more depth later on.

While this firmware package did work, it did not have the original "Ministry of Sound" introduction screen which I had grown quite fond of. In order to recover it, I needed a copy of the firmware dumped from a working "Ministry of Sound" branded player of similar design, while the flash memory size was largely irrelevant, the device needed to have the same type of LCD and controls.

Fortunately, I was able to acquire a similar player from a friend who had purchased the 2GB version. Using the M566x ISP tool, I saved a copy of the PM from it to disk and loaded it up in a hex editor. Before I continue however, below is a brief discussion of what I have found out about the firmware files used by the loader software.

It would appear that single file firmware images used by MPTool are Microsoft Cabinet archives of a large number of binary files. Each binary filename starts with a number and usually has a limited text description following it, such as 000INIT.BIN, or 005PLAY.BIN. The number would appear to signify what order in which the overall firmware is to be assembled and where in the memory each section of code is to be stored. The name of the binary file itself after the initial three digits seems to be irrelevant other than describing the purpose of each to developers, and is not stored in the overall firmware image when loaded into the player. The M566x ISP tool does not use Cabinet packed archives of these binary files when loading them into a device, rather it allows you to select the individual binary files for loading. Size of each of these binary files seems to play a role, as it is not possible to load a single large binary file, however the size of each of the binary files is able to be varied.

The saved PM.bin file appears to be a concatenated set of each of the binary files, each padded with some extra bytes which are often null.

From the various firmware files I had found and discovered not to work on my player, I noticed that in many cases the basic files such as (in some cases) 000INIT.BIN were very similar, despite the differences in the players, which meant that the original "Ministry of Sound" firmware loaded on the player must have had a similar structure to the Typhoon firmware that worked when loaded onto the player. It was possible to find the "Ministry Of Sound" introduction animation by finding the end and beginning of the surrounding binaries, which in this case were collections of strings. The data between the end of one string binary and the beginning of the next were copied to a new file, where the padding data was removed, then was loaded in with the working firmware image. - source

Jan 1, 2014

@Pakitong Paypal Donations, Thank You

A many many thanks to those who came to my Blog and donated for a cup of coffeebean at starbucks, I can not name you all guys or mentioned you one by one you, long live for you.


This just a few of screenshot taken recently, including last month this year 2014.



Again, I salute you all there is no reason for me to stop posting article on this little blog of your not mine. Guest readers you are all my inspiration on keep going. many many thanks!