FW 4 iPod Nano 3G clone -ZX-6302L-TLSTK V2.0 ACU7515

systembug · #1 (**permalink**) 2nd Mar 2009, 4:37 am

Hi all!

I have a "iPod Nano 3rd Generation" clone with strange features:

CPU: ACU7515
Flash: Samsung K9HCG08U1M-PCB0
Radio: SP3767AHN
MB: ZX-6302L-TLSTK V2.0 2007-09-21 MAIN HY
LCD (lateral): GXBL177-008-BL1023-08-10-21
LCD (flat cable): JYD GA177-0001FPC-A
LCD (under battery): JYD5056-081018-0011-B1-991

I have already tried all these firmware:

S1fw.com - Mp3|Mp4|Mp5|PMP|Player Firmware!

S1fw.com - Mp3|Mp4|Mp5|PMP|Player Firmware!

But none of these will work, the screen is always white!

Moreover:

1) I've found that this firmware does not work:

http://www.s1fw.com/Actions-AK102X/A...113-IPODM.html

The rar file contains a .fw file that is inconsistent (editing it with an HEX editor will show an header NewEncipheu and no other readable data: maybe it's encrypted? How?)

2) The flash memory is 8GB, as seen on Samsung site:

SAMSUNG's Digital World

But with all other firmwares, the memory is seen as 2GB only!

Can you help me?
Greetings!

matteo123 · #2 (**permalink**) 2nd Mar 2009, 9:40 am

hi,
the flash memory is real 2GB...

systembug · #3 (**permalink**) 2nd Mar 2009, 11:04 pm

Quote:

Originally Posted by matteo123";p=&quot

the flash memory is real 2GB...

Hi matteo123,

The Samsung's site report this memory as 64G bit density in an 8x organization, so it should be 8G bytes total...

http://www.samsung.com/global/busine...d=672&sht_id=1

Apart from the memory (2GB would be nice too), my problem is that I can't find a full firmware that is compatible with the LCD, that this is why the display still white...

Greetings!

matteo123 · #4 (**permalink**) 5th Mar 2009, 6:51 am

Ciao systembug ,

anche io ho lo stesso problema di driver video e non riesco a trovere nessun firmware combatibile con il mio mp4. fin ora avro provato 100 fw ma senza risultati...

lolita · #5 (**permalink**) 5th Mar 2009, 10:38 pm

s1fwx can decrypt NewEnciphe format of firmware file.

Decrypted format has "AFI" in header and you can see the directory entries of all the files in it.

systembug · #6 (**permalink**) 9th Mar 2009, 11:48 pm

Quote:

Originally Posted by lolita";p=&quot

s1fwx can decrypt NewEnciphe format of firmware file.

Decrypted format has "AFI" in header and you can see the directory entries of all the files in it.

Hi lolita,

I have tried with s1fwx v3.3, but it seems to not work...
I have renamed the file as 6302C.fw and tried to list the firmware content with these commands:

s1fwx.exe l 6302C.fw

Code:

s1fwx v3.3 - copyright (c)2005-2008 wiRe (http://www.s1mp3.de/)

---[ info ]--------------------------------------------------------------------
filename = '6302C.fw'
filetype = unknown
md5 = 08502184FEF9A41417A8290DC05F0D58

s1fwx.exe l 6302C.fw:afi (it hangs)

Code:

s1fwx v3.3 - copyright (c)2005-2008 wiRe (http://www.s1mp3.de/)

---[ info ]--------------------------------------------------------------------
filename = '6302C.fw'
filetype = afi (overwritten)
md5 = 08502184FEF9A41417A8290DC05F0D58

---[ info:afi ]----------------------------------------------------------------
invalid checksum, file header maybe damaged
file id = 'NewE' (unknown)
vendor id = 0x636E
product id = 0x7069
version = 6.8.65
date = 23/17/0709

+---filename---+ +---size---+ +-type-+ +---+ +--chksum--+
| â↕ü¸→\b.►☺$ | | 2873.40mb| | KX↓f | | ' | | 00000000 |  <- invalid checksum
| õ×Èh{¨g▓.`Ôb | | 828.32mb | | :♀â‼ | | Ä

s1fwx.exe l 6302C.fw:fw (it hangs)

Code:

s1fwx v3.3 - copyright (c)2005-2008 wiRe (http://www.s1mp3.de/)

---[ info ]--------------------------------------------------------------------
filename = '6302C.fw'
filetype = fw (overwritten)
md5 = 08502184FEF9A41417A8290DC05F0D58

---[ info:fw ]-----------------------------------------------------------------
invalid checksum, file header maybe damaged
file id = 0x4577654E (unknown)
vendor id = 0x0907
product id = 0x1723
version = 6.14.63
date = 75/1A/6865
info = 'â↕ü¸→\b►☺$'═¾9;2♂Æà~hû│KX↓f↔¢$'
manufacturer = 'õ×Èh{¨g▓`ÔbÄéiwïÌÔê∟}‼┼3:♀â‼ÊHb+'
device name = '►×r╣a*êxDvÓÏâ╗D$ªÙ6▲q┤gTÎ█ì_Ý°Ê┐'
usb attr = '*¨♣▼Úc╔°'
usb ident = 'ƒ└<4↨ñ8Ê┐ï%lq¼Wÿ'
usb rev = '╦^Ïä'
rtc rate = 0x7131
display contrast = 3
light time = 213
standby time = 159
sleep time = 128
language = unknown (0x81)
replay mode = 0x68
online mode = 0x03
battery type = unknown (0x15)
radio/fm support = no

+---filename---+ +---size---+ +--chksum--+
| ÷N┬5¨ Z┌.ADë | | 2152.81mb| | 00000000 |  <- invalid checksum
| ⌂÷─Ë═*?¶.üòÚ | | 2925.50mb

s1fwx.exe l 6302C.fw:enc

Code:

s1fwx v3.3 - copyright (c)2005-2008 wiRe (http://www.s1mp3.de/)

---[ info ]--------------------------------------------------------------------
filename = '6302C.fw'
filetype = encoded (overwritten)
md5 = 08502184FEF9A41417A8290DC05F0D58
decrypting file...

---[ info ]--------------------------------------------------------------------
filename = '6302C.fw'
filetype = encoded (overwritten)
md5 = 08502184FEF9A41417A8290DC05F0D58

Can you upload in this thread (or rapidshare, megaupload or other) an uncrypted version of this firmware? 1000 Thanks! :roll:

@matteo123: anche tu gabbato da eBay? :evil:

lolita · #7 (**permalink**) 10th Mar 2009, 9:45 pm

I will try decryption once download complete (~500 bytes per second from s1fw.com server, this may take a long time.)

Could you provide high-resolution pictures of the LCD assembly, showing the part numbers and the whole module clearly? I may be able to determine more information from that.

systembug · #8 (**permalink**) 11th Mar 2009, 12:31 am

Quote:

Originally Posted by lolita";p=&quot

I will try decryption once download complete (~500 bytes per second from s1fw.com server, this may take a long time.)

Could you provide high-resolution pictures of the LCD assembly, showing the part numbers and the whole module clearly? I may be able to determine more information from that.

Yeah lolita! You are really kind! :wink:
Here there are some pics of the player taken at 6Mpix (about 1Mb each):

PCB CPU side: http://img16.imageshack.us/img16/6179/dsc0383.jpg
PCB LCD side: http://img8.imageshack.us/img8/6514/dsc0385b.jpg
PCB serial no: http://img6.imageshack.us/img6/5854/dsc0386y.jpg
LCD upper side: http://img14.imageshack.us/img14/4336/dsc0387rmy.jpg
LCD and flat: http://img16.imageshack.us/img16/3936/dsc0390f.jpg

1.000.000 thanks!!!

ops:

lolita · #9 (**permalink**) 11th Mar 2009, 1:34 am

That sanded NAND chip looks suspicious... might be a remarked one (K9LAG rubbed off and changed to K9HCG.)

This is decrypted firmware:
http://rapidshare.com/files/20784846...1113_IPODM.zip

It's for a player with the LCM on CE4, which is rare, and also now we know GXBL177 LCM uses a Renesas/Hitachi HD66789 or compatible controller, which is also very rare. But judging from those pictures, your player has external memory expansion which may explain why the LCM got moved to CE4 from its usual place on CE3. The display is definitely the right one for your player, but the connectivity might not be correct...

FWDBINFO for your player, just for record-keeping purposes.

Code:

DESC="ping guo san dai"
ID="ZX-6302L-TLSTK V2.0"
CPU=ACU7515
LCM=[
 ID=GXBL177-008-BLL023
 CONTROL=HD66789
 WIDTH=160
 HEIGHT=128
 CE=4
 RST=A1
 CD=A2
 BL=B5
]

systembug · #10 (**permalink**) 11th Mar 2009, 6:07 am

Quote:

Originally Posted by lolita";p=&quot

That sanded NAND chip looks suspicious... might be a remarked one (K9LAG rubbed off and changed to K9HCG.)

This is decrypted firmware:
http://rapidshare.com/files/20784846...1113_IPODM.zip

I have tried the firmware that you have uploaded and Product Tool 4.19 upload it without problems.
After the flash I remove the usb cable, wait about 20 seconds, then replug the usb cable: the display make a white blink, then off (also the LEDs) for about 15 seconds, then... white screen!!! :cry:
Windows XP and MP3 Player Disk Tool recognize (and format) it as 2Gb, so your and matteo123 assumption about the flash chip seems to be real

(@matteo123: avevi ragione, mi sa che ti devo una birra... :roll: ).

Quote:

Originally Posted by lolita";p=&quot

It's for a player with the LCM on CE4, which is rare, and also now we know GXBL177 LCM uses a Renesas/Hitachi HD66789 or compatible controller, which is also very rare. But judging from those pictures, your player has external memory expansion which may explain why the LCM got moved to CE4 from its usual place on CE3. The display is definitely the right one for your player, but the connectivity might not be correct...

FWDBINFO for your player, just for record-keeping purposes.

Code:

DESC="ping guo san dai"
ID="ZX-6302L-TLSTK V2.0"
CPU=ACU7515
LCM=[
 ID=GXBL177-008-BLL023
 CONTROL=HD66789
 WIDTH=160
 HEIGHT=128
 CE=4
 RST=A1
 CD=A2
 BL=B5
]

So, if I good understand, my player have the LCD of one player and the mainboard of another player... right?
Theoretically I need to extract all files from this firmware and "merge" the display files into the right firmware for my mainboard... mmmh, it seems to be VERY difficult... :?

Lolita, can you explain me what are CE3/CE4?

However, many many thanks for your support!