PMP Firmware Progress

[ShamrockMan]

Well, today I managed to get into the serial port of the PMP. This is promising, since now I can load custom firmwares, and command the PMP to do stuff other than what iRiver intended.

If any of you want to repeat what I did, it would be wise to put a "voltage translator" in between your computer and the PMP, so you dont fry anything. The computer uses 12v for comm, the PMP uses 1.6 and 3.3v.

Make sure your comm program is set to 115200 baud. Then to access rrload, hold down "enter" before turning the PMP on. Now enjoy.

Here are some pictures as proof:

[Astec]

As of this post this is for official PMP firmware release data. Please visit the discussion thread here. ANYBODY THAT POSTS HERE WITHOUT ONE OF MOD/ADMIN/Shamrockman's PERMISSION WILL HAVE THAT POST DELETED. No one will move them, they will be binned. No questions asked.

Pmp ShamrockMan Firmware Discussion
Go here for the discussion/questions/ideas thread.

A

[ShamrockMan]

Here is a simple hack to explore the firmware of the pmp. It does not require you to open up your pmp and modify anything, nor flash any peice of hardware.

Download this file and place it in the /iRiverSys/etc folder. Now goto the file brower, and switch views.

Now on to figure out howto read bits of the /proc folder in the text editor...

(the secret is opening up this file, and changing the path from /mnt/Root/bla to /mnt/Root/../../)

[ShamrockMan]

This is shaping up to be a productive day.

I finally found the location of the check-sums in the iRiver firmware, so now I can make modifications at will.


EDIT:I would advise against this, since it killed my pmp.

[ShamrockMan]

Well, while I'm awaiting funds to repair my pmp, I have found out what exactly killed it, then fixed the problem (little/big endianness trouble). I'm not going to upload the new firmware until I have some first hand proof that it works.

[ShamrockMan]

A link to the source was posted in the forum elsewhere, but I do have a mirror on my personal computer that you can download, if its online. (ftp://shamrockman.myvnc.com)

[ShamrockMan]

Make sure you turn off all error correction and flow control. Make sure you are @ 115200 baud.

I'll make a special pre-alpha version of the firmware foryou that you can load over the serial port (loads strait to ram, no flashing needed). If it works, then I can figure out how to incorperate that into the firmwareupdate file for the alpha testing team to see if there are any bugs.

[Z80]

Hi SRM
Doesnt work,something is wrong could you make some pictures of connected wires to TXD,RXD screwdriver gaps on PMP for me(iam not sure that i have it right)? Which protocol could i use on terminal?(VT100,ANSI or another?).Which terminal program you use ? ...

[ShamrockMan]

ANSI or VT100 will work fine. For terminal programs, I used HyperTeminal, and minicom(linux).

This is a diagram on where you should connect your computers wires:

(you dont have to connect to the gnd shown. There is a closer gnd that might work better)

Hopefully that will clear things up for you.

[sielaq]

Hello all,

I found (in allimg.hex)the bit which is related to setting the language after upgreade the firmware :address: #010974

for ex :
02 - is Korean
03 - is Japan and so on...

Now we dont have to change it manually.

ps. ShamrockMan , why in your allimg.hex bit #051 is changed ?
As far as I know the checksum is between #008 - #010 , isn't it ?

[ShamrockMan]

I prob. modified the 2.04US firmware, so that byte could be set to US. I practically have all versions that you can download, so I can compare them.

[sielaq]

Dear all,

Second day of my work:

- I got information from ShamrockMan about the CRC summing, know I can make good checksum (after 16 byte)(4*1024*1024). Tommorow I will add it on wiki.

- I started to look better for allimg.hex :

We can find with the strings whats inside:

sielaq@router:~$ strings -t d allimg.hex | grep rom1fs
1835040 -rom1fs-
sielaq@router:~$ losetup -o 1835040 /dev/loop0 allimg.hex
sielaq@router:~$ mount -t romfs /dev/loop0 /mnt/pmp

Now we can check what is on the disk !!
As we can see linux on PMP is very poor, it's kind of "ARM-no-MMU" uClinux.
- mplayer will not work on it
- not so easy to create own programs YET

What I found, IT IS POSSIBLE to enable two CONSOLE on TTY, so ShamrockMan if You can confirm this it will be great.
(
#console:vt100:/sbin/getty 115200 console
#ttyS1:vt100:/sbin/getty 115200 ttyS1
#ttyS0:vt100:/sbin/getty 115200 ttyS0
)
ShamrockMan did you found 2'nd port on hardware?

oki in my time it's after 3am so I'm going sleep. Tomorrow I will tell some more.

[ShamrockMan]

Cant find a second serial port, they have a few, special "developers" PMPs that have a few extra features, which could explain the second serial port. By using my IRV hack, you can browse /dev, and /proc on the pmp.

All we need to do is remove thoose hash marks, and then we can get full access to the linux that runs underneath. We only need one port, two would just be nice. And, we can change the line in inittab from echo " hddfreespace check" to /mnt/Root/run_dis_scrpt.sh so we can run code without the need to reflash the pmp.

Finally found the remote code, they refer to it as "remocon", a place that makes wireless remotes, which is kinda odd, since the PMP does not have any wireless capiblities.

[sielaq]

Here You have code for CRC calculate:
http://vic.magusz.net/pmp/checksum.c
(I added it on wiki)
So now every change in allimg.hex is easy.

ShamrockMan, I read about games for uClinux http://www.linuxdevices.com/news/NS8241260316.html
http://ipodlinux.org/Game
however this is for iPod version, but I think it could be easy to transport it for PMP, it seems to be very similar. I think it is a matter of time now

I'm afraid only of flashing my PMP with my own firmware, Shamrok is it easy to repair it after wrong firmware flashing?

[ShamrockMan]

The difficulty of the repair depeneds on how bad the flash screws up. If it screwed up like mine did, then it can be quite hard. But if you are still able to access the bootloader, you can 'easily' recover from the bad flash.

[ShamrockMan]

Annoucement: I have finalised the changes to the iRiver firmware, and am looking for 2 nice logos to be included in the firmware build. What I need now, is for all the photoshop geniuses out there to submit some nice eyecandy for the project.

The requirements are:

1. 320x240, 256 color
2. The two loading screens share a palette, the hold/low battery dont
3. (optional) Come up with a cool name (PMPLinux will do if you cant think of anything)

I'll leave submissions open for about 2 days, then I will put all submitted artwork up in a poll.

Submit your pictures here

[Z80]

Some missing files from firmware sources to succesfully compile rrload.rr and linux.rr .I hope that is usefful ...

[Astec]

Thread cleaned up AGAIN!!! Please refer to my point at the start about what this thread is for. If you want to contact SRm regarding this do so in the discussion thread or in a PM, anyone else that posts in this thread stuff that is not meant to be here will get a toe in the hole from me. If you are helping on the firmware then you may post provided it is useful and not asking how to connect or what needs doing, all of that can take place in the discussion thread.

A

[ShamrockMan]

Right now I'm waiting on my new PMP to arrive, since there are a few things I need to test before I can even release a alpha version of the firmware.

[ShamrockMan]

Well, I found a few work-arounds that may let me release a alpha version before I am able to get a new PMP.

What to expect in the alpha:

1. No GUI or video support (need a PMP for that)
2. Playback of a MP3 via MadPlay*
3. Launching of the normal iRiver Firmware AFTER user specified programs are run.
4. Only need to flash the PMP with my firmware once, then all upgrades will run off the HD.

*: You have to edit a file to change the song. (And no guarantees that it will work right on the first try)