Sunplus SPMP3050A
 

Hello , Bonjour


Like everybody I bought a PMP for my son , I 've taken in Rue Montgallet :

http://www.westrend.com/products/adm...2343187813.jpg

It' an WESTREND GAME-800
It's great !! :D

I've extracted the firmware by FRM Pro , and now I would like making a new GOOD translation in french ..

Help ! Thanks

Re: Sunplus SPMP3050A - General
 

RTC parece activar el reloj del MP4; si no tienes reloj no funcionará y cada vez que lo reinicies volverá a 00:00.
SKIN parece cambiar entre diferentes modos de skin, activando la radio y otro modo llamado "VideoRec".

(talking about userconfig.bin)
RTC seems to activate the MP4 internal clock; if it doesn't have any clock it sticks at 00:00.
SKIN seems to change between different skin modes, activating the FM Radio (useless without onboard radio) and a not working mode "VideoRec".

reno7: Could you upload somewhere the firmware (AIMG, BIMG, DefaultFW.bin) so we can investigate?

Re: Sunplus SPMP3050A - General
 

In my device I try to change the FW but could not put some of those that are available whenever the program I threw error "SIZE TOO BIG" so I determined that my device has a memory ROM with a size of at least 20 MB and which exceeds there can not be installed. I think I am going to buy a GameKing II :twisted:

Hi reno7,

To make translations you have to mount the firmware file called AIMG or extract the contents with MagicISO then you'll find a file in the folder: ro_res\language\. You can modify that file with a hex editor, although I do not recommend it.

Oh, and please go to www.rapidshare.com and upload your player's firmware, as zenitraM suggested. This way we can increase the collection and help others when they brick the player (and also make research).

A COOL thing i found in sunplus players: You can fast forward and rewind at 2,4,6 and 8X speed!!! Just hold left/right and when it starts to forward, release the button and press it again a few times. It will then skip much much faster :).

Hi , my firmware ...
Thanks

Thank you very much!

alex2pb, thanks for uploading your firmware, but it didn't work either (it shuts down after menu appear). Anyway, somebody has to have my player, it's only a matter of time ;)

Re: Sunplus SPMP3050A - General
 

Strange thing, my player shuts down too with Reno's firmware. I guess the board serial must be the same to get it working.

Indeed, i'm sure you'll have it recovered in no time. These players are very popular. May I suggest you to find a program called File Scavenger on the web and try to undelete the original firmware ? :)

pmp back up-need
 

hello to all
excuse me...
I need bcak up file for my pmp to upgrade that.
that is china sunplus::
spmp3050A
sd-ram
1gig
board license : pmp-704
i need original AIMG and BIMG and FW
when i push power main menu come up then after a few second will turn off
plzzzzzzzz help me... :cry:

im also trying to upgrade mine.
my player is just like the one in:
http://www.dealextreme.com/details.dx/sku.9504
but has no time, calendar and no fm.
it has a blue background.
i tried firmwares that i found on the net but they didn't work as well.

can you guys help me?

Here they leave a frankenstein of mp4 of the photo of the first post for which they died as my guard and did not amiss but at least you can listen to music, watch Films, take Photos and filming jejeje if someone who understands more than I would modify and make it work is perfect Or whoever has the original which posteen.
And this may prove mahmoodhassani could see you walk because it is the firmware and the images of the disk of your device with some modifications

Mi ingles es horrible jaja :lol:

PD: si no funciona con SPMP3050A.BIN prueben solo actualizando el firmware con el DefaultFw.bin

la url para descargar
http://rapidshare.com/files/103412518/Firmware.rar.html

Re: Sunplus SPMP3050A - General
 

hi
thanks my mp4 image is like below:::::>
[align=center]http://blurried.free.fr/PMP/SPMP3050A.jpg
hellp---i just need orginal files

Re: Sunplus SPMP3050A - General
 

Para los que tengan este pmp muerto aca esta la solucion

http://blurried.free.fr/PMP/SPMP3050A.jpg

http://www.psicofxp.com/forums/gadge...mwares-10.html

Hola yo tambien tengo este mismo reproductor (el que parece "psp").
al tratar de montarle otra imagen u otro firmware me pasan dos cosas

1 se queda atorado (supongo que por incompatibilidad)
2 o enciende bien pero cuando ya esta en el menu principal no me funciona ningun boton

si alguien sabe como solucionar el problema porfavor ayudenme
gracias
--------------------------------------------------------------------------------------
(sorry for my English)

hi I also have this player (the one that is like a psp)
when i try to mount other image or firmware, i have 2 problems

1 it dont work(i spouse that is because a incompatibility)
2 the player turn on but when it is in the main menu the buttons don't work

if someone knows haw to solve the problem, please help me
tnx

hi guys.... pls help

my mp4 player is not detected by my pc...

this is what my player looks like

http://i6.photobucket.com/albums/y20...2/Img00000.jpg

what button do i hold to make it as a webcam

Reflashing is unlikely to fix the detection problem. I had the same problem and it's caused by non-standards compliant usb chip used on the device or by bad initialization of this usb chip. You can still access files stored on internal flash if you connect it to an usb 1.1(not usb 2.0) capable pc. You should also be able to access sd cards on any pc if you have one. This "bug" is does not affect firmware upgrading so you should be able to do that on an usb 2.0 pc.

Anyway, here are couple ways around this problem:
- use your device on an usb 1.1 capable pc
- go get a sd card and put your files there(your pmp has menu option to select active "drive")
- somehow remove usb 2.0 support from your system making act like usb 1.1 (should work in theory) *
- use usb 1.1 only capable usb hub between your device and pc (again, should work in theory)
- fiddle with your pc's bios settings in hopes of being able to affect usb timing. fsb(Front side bus) speed is the one you could try changing.

If you re-read this thread, you should find two firmwares for this device, along with description of where the "webcam button" is. These firmwares are incompatible as far as I can tell. fw posted by me is older and less capable.


* usb 1.1 is also known as ohci(Open Host Controller Interface) or uhci(Universal Host Controller Interface ) and usb 2.0 as ehci(Enhanced Host Controller Interface)

can i upgrade my mpx player by putting the files in the sd card then running the upgrade on the tools menu?

I haven't tried. I wouldn't try it without a backup of firmware because of the high risks involved. Both of these firmwares might be incompatible with your device and you might never be able to get a working firmware again. And it probably wouldn't do any good since you probably already have latest compatible firmware anyway. You can check the firmware version from menu and compare it with ours.

Anyway, SPMP3050A based devices only support usb 1.1 so transfering files to/from device is slow as hell. sd is faster if you have a decent usb sd card reader and memory.

my players version is v4.01.080319. would you by chance know its "webcam button"???

thanx for the help

http://blld.org/spmp305x/pmp_button.jpg
Its in line in. Multimeter lead I have in that picture is ideal for the job.

Your firmware version is newer than zerdrakon's (V4.01.070910-b) and mine (v4.01.071023-d).

Can you upload it somewhere so we can test it? :)

can i have the aimg bimg and fw for the mpx player shown here
http://www.dealextreme.com/details.dx/sku.10238
... my technician just fucked up my mpx without backing up the files... the jerk...

the aimg im looking for doesnt have dictionary, no calendar, no fm radio, no alarm clock... and its default language is english...

i have flashed my mpx player now but the screen is flickering. the main menu is present but when is turn the mpx on... it loads the main menu with a short beep sound... i cant access any of the menus by pressing ok... i can just browse through the menu...

i used the aimg, bimg and fw found in here...
http://www.mympxplayer.org/dead-pmp-...de-vt9087.html

kyur4 th ich, try http://www.megaupload.com/?d=FINFQ4EZ . http://mp4.itram.es/wiki/spmp305x/firmwares has couple others too.

Re: Sunplus SPMP3050A - General
 

@Heru Er

I have the same pmp you posted with 2gb memory (same as picture at first post and as mahmoodhassani -apart from memory...)

It did not last an afternoon!! Sometime suddenly, when I saw empty folders, I pressed the reset key and from then it is dead completely :(
Only the two lights turn on....

You posted a link in spanish, but cannot read it!!

I managed to install drivers for FRM pro, tried to backup firmware, but I faced problems...
(failed with AIMG and BIMG and stuck for hour with DefaultFW.bin) It created 1.85 GB file with DefaultFW.bin and I manually stopped it!!!

can you (or someone) help me please??

Suicidal hardware is always fun. Or maybe flash signed off.

Just go to http://rapidshare.com/files/103412518/Firmware.rar.html , click "free", click "Download via xxx" etc. , extract and burn.

Re: Sunplus SPMP3050A - General
 

thanks aapot for reply...

actually, I had it downloaded, the exact file you proposed to me!

by experimenting, now I managed to flash only with ISP 5.2 the DefaultFW.bin, but this did not fix my mp4 player... :(

the problem is that the PC recognises the mp4 as a webcam ONLY if I plug it in a new USB port!! so I think I am running out of USB ports to test again... any solution on this :?:

the FRM pro (which I think I cannot use..) gives me this log:

How can I flash AIMG and BIMG only ? The guide (posted here http://www.mympxplayer.org/dead-pmp-...te-vt9087.html ) is not clear on this...

please help..!!

Trying with another pc might help if theres some problem with usb.

Sure you selected working folder from advanced tab?

"RSV Only" option flashes only disk images.

Re: Sunplus SPMP3050A - General
 

I had some success :o after lots of experiments...

about usb, I realised that I dont have to re-install the driver all time,
I just have the mp4 turned off, and plug in to PC when I press the X button at the same time...

FRM pro works now, I used "Firmware/ Set file " but still cant figure this about the whole AIMG + BIMG..

BUT still the only best firmware from all I tried is this one
http://www.4shared.com/account/file/...P_SUNPLUS.html

The mp4 recovered from the dead, but with a lot of bugs:
The screen is mirrored from right to left (!!) :shock:
the screen flashes all the time, the sound is terribly LOW!!
the menu has FM radio, while my mp4 didnt have it (it doesnt work though!)
the camera, game, DV dont work as well
usb (u-disc working mode..) doesnt work
keys are all good :lol:
I am sure my initial firmware had more items at Tools (like upgrade!) so I look forward for someone to share the original firmware (AIMG+BIMG).. :!:

Slide Panel Firmwares
 

Hello, I've have the slide panel pmp too.


http://www.dealextreme.com/details.dx/sku.9504

I've back up the Aimg and Bimg, but I forgot back up the file DefaultFw.bin, then i downloaded the firmware from the download section. But now, with this firmware, i can't play games, because when i try it, the mp4 get frozen.

When I compare between my back up Aimg and the downloaded Aimg, I realize that, the size between them are diferent, 49152 KB and 48898KB.

Any Idea or firmware to do my mp4 work again?

Thanks.
---------------------------------------------------------------------------------------
Hola, Yo también tengo el mp4 slide panel

Cuando intenté acutalizarle hice copia de AIMG y de BIMG, pero olvidé hacerlo de DefaultFw.bin, entonces descargué el firmware de la sección de descargas, pero ahora , con este firmware, no puedo jugar a juegos, debido a que se me queda bloqueado cuando lo intento.

Si comparo entre mi backup de Aimg y el descargado veo que hay una diferencia entre ambos de tamaño, 49152KB y 48898KB.

Alguna idea de como hacer funcionar correctamente mi mp4?

Gracias.

Re: Sunplus SPMP3050A - General
 

Hi. Can you please help me about my digital mp4 player... I bought this player without any installation CD on it......

This is my mp4 player:

http://i116.photobucket.com/albums/o...Picture001.jpg

sunplus SPMP 3050

I have downloaded the FRM pro software/driver at this website but it can't detect my player..... Is there a USB driver for this installer??? If there is can you share it to me or please post a site where I can get it, or a thread here in the forum where I can find it..... Thank you for your help!!!!

USB Driver
 

Yo need this driver:

http://www.4shared.com/account/file/...SP_driver.html

Once you extracted your firmware, you could post it on this page, (I make an
update and now i can´t play nes games :( , my plate board is sk613l instead sk613b, the firmware that is in the download section).

Thanks.

i have recovered my mp4 player...

ill be uploading my firmware files soon...

my internet connection is very slow...

thanx to aapot for his time...

btw, can I put snes, gb and/or gba emulators on my mpx player?

Re: Sunplus SPMP3050A - General
 

I've recently been reverse-engineering parts of the JXD201 firmware. So far, I've managed to create a custom firmware that will accept binary format executables over the serial port, and run them.

A dump from my serial terminal:
Unfortunatly, I havn't been able to find the memory locations for the GPIO pins, nor for the display. I have been able to determine that the original firmware for this device is most likely an RTOS. It uses a function call very similar to: add_thread(void (*ft_pointer)(), char* stack, stack_sz, int priority, char* threadname); to add a shitload of background threads, like KeyDriver, FileSystem, BackGround, GAME_CTL, etc.

I'm willing to share my custom firmware, if anyone wants it. You need a serial link soldered to your PMP, and you need to know your way around C and GCC (I use devkitARM).

What I was wondering was wether there was anyone also involved in reverse engineering these devices, that maybe has some information to share?

Damn, in the time it took me to set up an account here someone else posted a nice nugget of reverse-engineering-info here :) And he's Dutch too :P

I myself have made some progress on reverse engineering the .bin-format game-files. They're basically 128 byte headers, with the arm machine code to be loaded at adress 0x24C00000 directly after it. The machine code can then use a standardized OS function table to let the OS do stuff like play midi, display gfx, etc.

I have just finished setting up a wiki and a mailing list for more spmp305x-reverse-engineering. They can be found at http://spmp305x.spritesserver.nl/ . While my main use was to dump info for game-files inthere, I can't see why delicious info like io-mappings can't go in there too, so you're welcome to edit it in.

And to show what I've done up till now: You can download a small demo here: http://spmp305x.spritesserver.nl/demo/demo-0.1.bin
It doesn't do that much (play a midi until a key is pressed) but it's enough to show there's potential, I hope.

Erant: I've been wondering over the display subsystem too. I haven't actually seen any framebuffer-like bit of memory containing the current image in main RAM. Perhaps there's a second bit of memory somewhere inside the sunplus chip?

Re: Sunplus SPMP3050A - General
 

Nice to see you getting in on this as well Sprite :) I've been looking at the MMU setup, and you're right. There are some important memory locations but none of them seem like framebuffer material. The only memory region that's marked as non-cacheable is 0x3C... which is later marked as a mirror for the 0x24... memory range. Which is just RAM.

On a different note, I managed to find the offset the 3050ABin0.bin is loaded at. 0x241606E0 (yeah, way to go for logical offsets). If you want to reverse engineer this, I suggest you just stick on the end of the main firmware in IDA, it uses a lot of the firmware's functionality.

Anyway, I've got some information as far as the memory map goes, and stuff like that. I'd love to post it on the wiki, but it doesn't seem to be online yet?

What I did is create a game to read out the complete 24000000 range out of the serial port, and stick IDA to that. You can then even see what value variables have at the moment the game loads :) Contact me if you want the code for it, I should have it still lying around.

Mmmm, 0x3c = non-cachable 0x24? I should keep that in mind.

The wiki should be online, but it could take a day or two for the dns-entry to propagate. You should be able to access it now or tomorrow.

I started reversing in a different place then you did (or rather, from the other end). I patched the firmware, and added a small bootloader (check the wiki, I'll upload it soon) that accepts binary files through XModem. I also added some memory stuff. You should check out the 0x2D... memory range, or at least the first few kb of it. It contains some executable data that I can't find back from the main firmware (probably embedded in the CPU somewhere),and is marked as the iTCM region. (Tightly Coupled Memory, read the ARM926EJ-S documentation). 0x2E is the dTCM region that goes with it.

Edit:

I've been trying to trace back the get_keys OS call to the IO register, without much luck.

I've gotten it down to:
*((int*)0x24287138) = *((int*) *((int*)0x24286130) + 4)

With 0x24287138 being the address the keys are stored for the get_keys call. Unfortunatly, I don't have a running dump, and tracing back the 0x24268130 address is almost impossible. You wouldn't happen to be able to trace this back to a 0x100... address, would you?

Seems the addresses 0x1000110X have something to do with the keys. As far as I can see in my code, it's an interface which should be modified bytewise (ldrb/strb).

About the iTCM/dTCM: I've seen it being used for a bootloader, perhaps Sunplus has done the same here. If I have time and feel like it, I'll read it out, but I don't think the data there is of much consequence.

I came to the same conclusion quite a while ago about those keys, but havn't been able to get anything out of it. Might've made a mistake somewhere though.

I dumped the iTCM a while ago,and didn't find anything massively interesting, it doesn't actually seem to do much, but I thought I'd mention it.

I added you on MSN btw.

Re: Sunplus SPMP3050A - General
 

Wow.. the way to homebrew has just begun :D

Well, I created before a Wiki for Sunplus studies (and open to other chipsets), it's located at http://mp4.itram.es/wiki/spmp305x/start

If you want to use it, feel free to do it.