Advanced guides

Site Map > Guides > Advanced guides

1. s1fwx guideback to top

(Adapted from http://www.stud.uni-karlsruhe.de/~uwa8/s1mp3/?Tools.s1fwx)

Description and basic usage:

s1fwx (s1 firmware extractor) is a free commandline tool (public domain) which lets you extract the original firmware from your s1 mp3 player device.

Additional features support operations on the firmware files like decrypt, extract and archive. This way you could investigate all the files included in any fw file, change their content and put them back together.

There are two known archive formats for the firmware files:

  • AFI: these archives include files needed to flash the device. A minimal set may consist of an BRECFxxx.BIN (the bootloader) and a FWIMAGE.FW file (see below)
  • FW/FWI: firmware image files include all firmware files needed during runtime.

Commandline usage:

 usage:
  s1fwx {i|x|s|a|l|f|r} {filename{:[afi|fw|enc]}}
  
  examples:
  display file info                s1fwx i fname.ext
  extract firmware file            s1fwx x fname.ext
  generate script from file        s1fwx s fname.ext > new.script
  create firmware file by script   s1fwx a new.fw:fw < def_fw.script
  create afi file by script        s1fwx a new.bin:afi < def_afi.script
  list entire content of any file  s1fwx l *.bin
  extract firmware from player     s1fwx f dump.bin
  repair dumped firmware files     s1fwx r dump.bin 

How to extract and repair firmware:

Extracting your player's firmware is a good thing to do, since it makes you a backup of your original firmware files. You can't be absolutely sure you will be able to backup your player after some bad firmware update, but at least you have some more possibilities.

First download the newest version(Wire's tools) of s1fwx and extract the 7zip archive. Then connect your mp3 player device to your computer's USB port and wait until it gets detected. Now double click the extracted file "extract.bat" or run

s1fwx f dump.bin from the windows commandline console. Skip the disclaimer by pressing space and select the drive your player gets mounted to. (eg. if detected drives displays " <x> " then choose drive "x:" by pressing "x"). Now s1fwx should start extracting your firmware, it may take around 10 seconds. If all went well and no error gets displayed, it will display the content of the extracted firmware file as it was read from your player.

Before you can update your player with this firmware file using the "Mp3 Player Update Tool", you will first have to repair it. Start "repair.bat" or type

s1fwx r dump.bin

A backup will be saved at "dump.bi$" automatically and the repaired file is now available as "dump.bin". Notice that its not possible to do a firmware recovery with this file, or flash at ADFU mode, (it will do only regular firmware updates) since there are missing files needed by the "Mp3 Player Update Tool" recovery mode.

Since this files couldn't be found on your player you will need to get them from some official firmware file which is known to work with your player's hardware. Either you first could recover to this known working firmware before updating to "dump.bin", or you could insert the needed files from the original AFI file into "dump.bin" using s1fwx. The original firmware has to support your flash chip(s). It doesn't matters if its just using different backlight or key-mapping.

Extract Firmware Files

Here some example how to extract the whole content of the AFI file "firmware.bin".

Place firmware and s1fwx in one folder, open commandline console (run "cmd") and go to the folder containing the files. To extract the AFI and the firmware files, type:

s1fwx x firmware.bin
md fw cd fw
../s1fwx x
../fwimage.fw

Now you should have extracted all the files usually included in some general firmware file.

Archive Firmware Files

To modify files in a firmware you will have to extract, modify and then archive the files back together to one AFI file.

First generate the script from the firmware file "firmware.bin", using:

s1fwx s firmware.bin >firmware.bin.script

Then extract the files and modify their content if you want. if you want to add or remove files or change file specific parameters edit the generated script using an usual text editor (i think the syntax is self explaining).

To archive the files back together type:

s1fwx a new_firmware.bin:afi < firmware.bin.script This could also be used to archive firmware files like "fwimage.fw". In this case use: s1fwx a fwimage.fw:fw < fwimage.fw.script

Recover To Extracted Firmware Files

Flashing your player with an extracted firmware file is a very simple procedure, just take care you repaired the extracted file (see above) and use the latest "MP3 Update Tool" available at the download section.

This works good until the day we flash our player with some partial corrupted firmware (a total corrupted firmware will damage the player permanently) and the update tool tells something about recovery mode and just opens an open-dialog. (maybe you will have to open your player and short some pins to get to this point, read Wire's tools for further instructions).

If you select an extracted firmware file now, it just displays "Invalid upgrade firmware file". This isn't a bug of s1fwx! The problem is that recovering needs some extra files included inside our AFI-file that isn't needed for simple flashing. This files couldn't be found on the players flash, the only source is to look for them inside some original firmware files.

There are two methods to solve this problem and each of them expects you could find some original firmware file which is compatible to your players hardware and extracted firmware.

[Method 1]
  • - recover using some official firmware
  • - format the player (with the "MP3 Player Disk Tool")
  • - finally update to the extracted firmware file
[Method 2]
  • - extract the extracted and the official firmware file using s1fwx (only the AFI part)
  • - generate a script for both files ("s1fwx s dump.bin >dump.script")
  • - merge the scripts to some new script file using a text editor
  • - build a firmware using the new script ("s1fwx a new.bin:afi < new.script")

Both methods should have the same effect, give it a try!

2. s1res guideback to top

(taken from http://www.stud.uni-karlsruhe.de/~uwa8/s1mp3/?Tools.s1fwx)

s1res (s1 resource editor) is a free win32 gui licensed as public domain.(Wire's tools)

To change graphics or text on the S1 MP3 Player, just extract and repair your firmware using s1fwx. Then run s1res and edit the extracted firmware file directly. Save the file and upload it using the original MP3 Update Tool.

3. How to fix button configurationback to top

(Written By Ian_Hawdon ; original post)

0)Preparations

This is a lengthy procedure; it will make you wonder why you tried to upgrade the thing in the first place!!!

Anyway here we go :)

The story so far:

You have just killed your player, and the only firmware that will work, is one with the buttons in the wrong order!
Important: all the buttons have to be there, but in wrong order

The tools you will need:

  • Z80 Simulator IDE (the trial will do)
  • 2085RES (from our yahoo page or here)
  • S1FWX (Wire's tools)

Ok, we are now ready to reprogram!

1) Firstly, check if the firmware you flashed (and worked) is encrypted.

You can tell because the encrypted version took about 3 minutes to flash and the non encrypted version took about 3 seconds!!! If it is NOT encrypted, skip to step 2.

If it IS encrypted, use S1FWX to decrypt it:

C:\S1FWX>s1fwx l xxxxxxxx.bin

This should create a file called xxxxxxxx.bi~ . Rename this file so it ends with .bin

2) Using S1FWX, unpack the firmware:

C:\S1FWX>s1fwx x xxxxxxxx.bin
(...)“After it has finished”
C:\S1FWX>s1fwx x FWIMAGE.FW

3) Open Z80 Simulator IDE and choose “Tools” --> “disassemble”

When the window opens, choose “file” --> “select program”.

Select the file “KY_HARD.DRV” (you will need to change the file types on the bottom to “All Files (*.*)”

Then “Tools” --> “Disassemble”

Save the file then use notepad to open it.

4) Look from about line 0500

From there you are looking for references like:

0550   0256 3E 01               LD A,01H

The “LD A,01H” is a button (to be more precise: “LD A,xxH” is a button!)

The reference of that button is at 0257 (256 with one added because that line shows two references and we are interested in the second one)

Using the table below, figure out what your buttons are and what they should be, and their reference number (the second number on that line plus 1 (P. S. it is in hexadecimal [i.e. 0 1 2 3 4 5 6 7 8 9 A B C D E F]))

+-----------------+
| Number | Action |
+--------+--------+
|   01   |  Play  |
|   03   |  Vol - |
|   04   |  Vol + |
|   05   |  Prev  |
|   06   |  Next  |
|   10   |  Mode  |
|   11   | A/B rec|
|   12   | Enter  |
+-----------------+

P. S. I STILL DON’T KNOW THE HOLD SWITCH NUMBERS YET (AS I DON’T HAVE A PLAYER WITH ONE!!!) IF ANYONE CAN FIGURE IT OUT, EMAIL ME AT ian <dot> hawdon <at> gmail <dot> com

5) Next, fire up 2085RES

Press “tab” then hit “enter” this should open a “Open File” dialogue, open your firmware (the .bin file).Choose FWIMAGE.FW then KY_HARD.DRV

6) Find the reference number to your code.

E.G. if the line said: 0550   0256 3E 01               LD A,01H

You would look for number 0257

Scroll down to 0x250 and count each two digit number from left to right up to 7 remember, the first number is 0 (0x250)

You should reach a two digit number called “01”

That means the button is currently assigned to “Play”, with the help of your player and the table, find out what it is meant to be.

Change the number in 2085RES

Continue to do that for the rest of the buttons and then when you are finished, go to were it says the version number (usually 3042) and use the “back tab” function. (SHIFT + TAB, then press ENTER).

Make a file name.

7) Flash it

Open your player, put it on dead recovery guide( Put device on recovery mode (short-circuit) ).

Then flash your new firmware. All the buttons SHOULD work now.

4. How To fix the restarting issueback to top

LCD board isolation

The restart issue is caused by static. To minimize/solve the restarting, you should completely isolate your player from the exterior.

This is a hard thing to do, because the case has a metallic part which keeps the USB plug and the microphone in contact with the exterior and thereby allows static electricity to "enter" the device and zap it.

You have to open up the player and isolate the parts. If you don't know how to open your player, check Dissassemble the s1mp3 .

To isolate those parts, you can use ordinary sticky tape, or any insulator think material.

I have isolated the boards, the screws, the USB plug, the microphone, and the metallic part that touches it.

To check if it worked, you can put your player near a monitor/TV and see if it zaps. Keep the monitor/TV on for a while, turn it off and then imediatly make contact between the screen and the s1mp3 case. You can check if you isolation is good by using a multimeter.

If you are completly SURE that this steps will not work, remove the screws and see if it solves. If it does you can use glue to fix your board to the case. If it does not work, you migh need to unsolder and then resolder your main flash memory chip.

USB isolation Mic isolation Screws isolation
Meet us at the mail list
Protected by the FreeBSD Documentation License - click for details