Looking for firmware: SUNPLUS spca536

[sirAlex]

First of all - sorry for my English
I have (had) PMP based on SUNPLUS spca536 processor.
There are a lot of bug in it's firmware and I cant use this thing in normal case.
So I want to test other firmwares or combine original and other firmware or correct disassembled code myself.
First of all I need to know - how I can reanimate killed player. I filled in my pmp other firmware using ISP_v5.2.2 tool. Firmware filled ok but player is now dead. I was ready for this. There are some instructions on chinese sites that explain how to fill firmware to dead spca536 based player. You need to short SDRAM pins 28 and 34 to block DRAM and player can be detected by pc. After it you can use ISP program again. So bootloader in spca536 always alive, but player still dead. I filled original *.bin, dumped bin, bins of other manufactures. Nothing helps me. So I need info about typical firmware organization for devices like my and memory addresses. My device is common mpm - mp3, asf player with camera, FM and SD slot.
Also I know one site (in russian) where do the reverse engeneering of firmware one player like mine.
There are emulator and disassembler but problem of flashing dead player is unsolved.

[AleMaxx]

Hi Alex,

ive got a spca536 based player too but i cannot flash the player with the ISP-Tool thats on the CD so mine is still working ;-). Anyway, since im more intersted in reversing it then watching movies on this small 2.5" display i disassembled one of the rom files which is supposed to contain the isp-/boot-loader. i found sth. that looks like UART init code at least it uses a value of 115200 (most probably this refers to the speed of 115200 baud) and it seems like the software expects the cpu to run at a speed of 48MHz. Furthermore i found a few potential intersting memory addresses:
0xAC700000 - r3000 memory address where this code is mapped to
0xD0004010 - start of DRAM (either that or this its a pointer)
0xB0000010/21/22/23 - location of UART registers ???

you mentioned a russian page dedicated to reversing spca536, do you have a link or sth (I dont understand russian though). Ive put the disassembly and the rom file here: http://mitglied.lycos.de/luluba/spca536/

btw, since you mentioned that you were able to flash your player, i found a dll called usb_cam.dll/lib (which is used by CutImage soft) which offers promising interface routines towards developing a flash utility for downloading the firmware like for example:
ISP_Dnload(char *,ulong,ulong,ulong,int,void (*)(char *))
- have a look at the exports of the dll.

regards

[paulareno]

So you say that we that need a sunplus firmware may have hope after all?