Sunplus SPMP3050A - General
 

Hello there !

Like everybody I bought a PMP on Ebay and I received two of these :http://blurried.free.fr/PMP/SPMP3050A.jpg

Actually I just managed to extract the Firmware file and to copy on my hard drive the 2 virtual disks the player uses.

I create this topic to discuss with interested persons on working on the 8-Bit games emulator built in it. The manual says that the pmp can play 8-bit NES games and even 16-bit SNES games with a firmware upgrade. However the game emulator is located in a separate file from the firmware one that is called 3050ABin0.bin in the Resource folder of the first virtual disk.

I actually use IDA Pro Disasembler to understand the working of the pmp software and Hex Workshop to examine the files. To manage the work with the pmp I use the FRM PRO tool that I found in the download section of this forum.

Maybe this pmp has similar structures than other or maybe someone have some extra info for me.

Let's break this chinese trick !

:wink:

So the NES emulator ain't working from the get go eh? I don't think it'd be hard to hack, but there are just too many models out there and too few interested people that have programming knowledge as well as time and players. :P

I would've loved to have a hack at this device if i had one, but unfortunately i don't have one, and i also have to "hack" a bit at people if you know what i mean.

Re: Sunplus SPMP3050A - General
 

Hey, thanks for your reply "The Unique" !
I was sad that nobody took care of my post !

I think the emulator is the same between the different pmps that use a SUNPLUS chip. I have progressed a little, but I'm still trying to understand if the corean engineers who made this device used an existing emulator they get to work on a sunplus cpu or if they made it especially for it.

So if you have a pmp wich emulates NES games, please share your knowledge !

I can even send you the firmware I've extracted from this SPMP3050A !

Let's break the chinese emulator !!

Assuming by the amount of microshite code they use, i'd say they just ripped it off a PC emu. Have no idea which one though, sorry.

it uses a older sunplus chip and that type of player you have is a bit notorious for being unreliable quality wise.

Good luck with breaking the code and improving the firmware - there are newer plauers with an improved sunplus chip, which handle NES emulation better.

Re: Sunplus SPMP3050A - General
 

Hi,
I've have a device based on SPMP3051A. I believe it's practically identical to SPMP3050A.
I'm interested in getting alternative os(probably Linux or maybe something lighter if ram is not enough) running on this.

I have collected some pieces around the net and have pin layouts of the chip and description of the USB interface(comes with frm pro also). As well as some interesting code that pokes the device through USB.

My plan would be to get modified Nintendo ds emulator to run the firmware and then use the emulator to reverse engineer rest of the chip. I am not interested in working to extend the supplied firmware.

I have mostly concentrated on reverse engineering Ati 3d cards and dvb-t sticks so far so this is a bit difficult thing to do just by myself.
Having someone with ARM9/7 assembly knowledge would help with this a lot.

I use Linux to do my coding so ideally Nintendo ds emulator used for the task should be Linux based.

my SPMP3051A is dead pls help me
 

i normaly firmware with DEFAULTFW but now my mp4 is dead and shining a diod but dont work usb pls HEEEELP

Re: Sunplus SPMP3050A - General
 

Hi Aapot,
I'm interested on using Linux on these pmp too, and your skills in reverse engineering are welcome ! :twisted:

So to use linux on this we have to use the image loader the sunplus chip uses to load his firmware. Basically, when power comes ON the spmp loads a short hex asm to load the firmware image and access to the 2 images the system uses. To use Linux on it we have to study the work of this loader to make it load our boot... :roll: many other things to do !

All your documentation is welcome !
Sunplus documentation is hard to find so I'll share it with you !

:P

I also have a Sunplus SPMP3050A, from DealExtreme. How did you get to extract the firmware? I might help - as mine, for some reason, also has a GB/GBC emulator :D

What model?

This one: http://www.dealextreme.com/details.dx/sku.9504

Mine has a different firmware than another ones, and is slightly different but can play GB, GBC games and also a strange format of games (came with 3 on the memory) made by Sunmedia that seem to be made for the player - look at the forum on that page for more info.

The nes emulator in 3050a/3051a must be exclusive for the chip (remenber is a ARM CPU class) in some model run slow in other in 100%, the roms maps are not all compatibles (is similar to nesticle nes emulator for DOS).

In upgrade firmware option inside menu is the key for enter to pmp hardware/software, is need get:

*SUNPLUS 3050A especs...
*Memory space...(Hex)
*Languaje (probably C...or ASM for that CPU)

In PMP there is almost the next code:

*Codecs
*Emulator
*Viewer
*Player

The "OS" size probably is around 2/4Megabytes (or more!)...sorry for my english...i'm from venezuela!

+ Info please to:

joel.zerpa@gmail.com

I also have this one: http://www.dealextreme.com/details.dx/sku.9504

But with the Sunplus 3052A.

I've tried to use the sunplus FRM Tool, but it doesn't found the device.

Any idea? Do I need some driver??

-------------------

[es]
Yo también tengo este PMP, al igual que zenitraM:
http://www.dealextreme.com/details.dx/sku.9504

Pero mi chipset es Sunplus 3052a.

Quisiera modificar su firmware (actualmente V. 3., y creo que hay una v. 4 pero no se donde consegirla). He intentado hacerlo con la utilidad Sunplus FRM Tool, pero me dice que no se encientra el dispositivo.

¿Alguna idea? ¿Debo instalar algún driver antes?

Mine doesn't have that option. When plugged while pressing the UP key, it's detected as a webcam, but i can't seem to find the drivers for it to work on FRM Pro.

El mio no tiene esa opcion, si lo enchufas al USB mientras pulsas el boton de UP lo detecta como una webcam pero no encuentro los drivers..

3052A? On DealExtreme forum someone who opened it said it was a 3050A.. have you opened yours? I haven't..

Does your firmware have a blue background on the menu? Or is it like the pictures shown on DX?

---

3052A? En DealExtreme alguien que lo abrió dijo que era un 3050A.. has abierto el tuyo? Puede que esa sea la razón del firmware distinto.

Tu firmware tiene un fondo azul en el menu? O es como el que aparece en DealExtreme?

Si quieres agregame al MSN y lo miramos.. yosoyzenitram en gmail

You need this driver: http://light.dnsprotect.com/~blld/sp...50a_driver.zip

Be sure to backup A, B drives as well as firmware and all numbers from "RSV info" before you do any modifications. Also know that these RSV parameters might change unexpectedly erasing/invalidating all content you have saved on the flash. RSV is something like partition table.

The "good stuff" isn't in Default.fw, it's in AIMG.
AIMG and BIMG are normal fat partitions which can be mounted under linux with "mount -o loop AIMG /media/foo". I don't think you can do this with windows.
Nero or some other program specialized in cdrom images and the like might be able to open these.
VirtualBox + damn small linux might be a good combo for this also.

Once mounted, you can find the "good stuff" in .bin files at root folder.

It is my belief that this kind of firmware upgrade can be used to de-brick devices. (I messed up the RSV once and got it back by reflashing).

On some devices you might also need to bring you device to a special state that allows firmware updates.
In this mode you should not see any picture from the screen.
On my device identical to uxcell cyclone (http://www.dealextreme.com/details.dx/sku.10238),
I found a hidden button at the line in connector.
This device is based on spca3052a.
I'd think spca3050a and spca3052a are mostly compatible.

Re: Sunplus SPMP3050A - General
 

Hello, to extract the firmware, you need (on the pmp i have) to push the down button before plugging the usb cable. Windows finds the webcam spca536, but you can access the firmware using FRM Pro Tool. You need to create a working directory for frm pro where he can put the fw image, plus the two virtual disks images A & B .

Re: my SPMP3051A is dead pls help me
 

Details of this device would be useful.
Where did you get it? What does it look like? Pictures? Number of buttons? What did you upload to it? How did you flash it?

Try to get as much stuff backed up with frm pro before you attempt to de-brick it. It might prove useful later on.

All right, I managed to connect my MP4 (as I don't know its model or anything, i'll refer to it as 9504, item number on DealExtreme).

Mine does have a different Sunplus firmware from the rest. It's got a blue background and well, it emulates GB/GBC and this strange game format I talked about before, .BIN, games on that format seem to be made by Sunplus and I only have found the 3 ones that came on my player's memory, you can download them from here: http://uploaded.to/?id=yn9jon&setlang=en

I'm now uploading the firmware and the disk A and B images for you to test them. Upload all the firmwares you have so we can test if they're compatible between players and if we can find any extra features.. Skinning is quite easy, just requires modifyng the .jpg's. I think there's no risk of bricking the device, as the FW download feature isn't dependant on the firmware itself (at least while pressing a key when plugging the USB port, only way for me).

Upload the diska and diskb images too, I think they're also needed (I downloaded the .bin firmware from the download section, but the screen showed gray and the unit hanged, maybe because of those images being not compatible).

BTW you may need to modify the USB device ID on the .inf file of the driver so it detects your device. When on this firmware mode it detects as a MMCatch Multimedia Device or something similar (not as a storage device).

Oh, and looking at the images, it seems there's a scientific calculator somehere on the firmware.. but I can only access a simple calculator..

NES and GB emulators are called, according to the hex editor, N1 and G1 respectively.

Edit: Here you have the firmware: http://zen.itram.es/files/PMP_DX_sku...background.rar

No luck.

I always used "Program All", "Read Verify" and "Disk Img mode". Each flashing caused error
"Read verify error: 3050Abin0.bin". But since got my original fw+a+b updated properly like this, I guess this doesn't
mean anything. Strangely "F/W Only" and "RSV Only" combined takes less time than Program All.
Not sure if flash erase alone explains this.
Your AIMG is alot bigger than mine. Can be explained by differences in skins.

Using PMP_DX_sku9504_blue_background.rar
Here are my results with sku 10238:
DefaultFw.bin + AIMG + BIMG = 1.
DefaultFw.bin + original AIMG + original BIMG = 1.
original DefaultFw.bin + AIMG + BIMG = 2.
original DefaultFw.bin + original AIMG with SPMP*.BIN replaced + BIMG = 3.
original DefaultFw.bin + original AIMG with *.BIN replaced + BIMG = 2.


Results:
1. White screen, little pop from the speaker(sound card init).
Can be shut down by pressing and releasing power button. Reset just starts the device again.
Could in theory mean that it works just doesn't drive screen properly. I have disabled key sounds so no audio
feedback.
2. Blue screen with text "Loading...", little pop from the speaker(sound card init).
Cannot be shut down with power button. Reset shuts down the device permanently.
3. Starts properly but doesn't recognize .gba nor .gbc files in game directory.

It seems that user preferences aren't saved in any of the files we have seen since key sounds were enabled by default.
This didn't change after flashing. My guess is that small amount of flash has been reserved for this. I've seen similar
solutions on openwrt devices. Also, according to my calculations based on flash size, RSV params and drive size visible to
windows, there should be plenty of free space at the beginning of flash area.

Examining the native games you posted earlier didn't really reveal anything interesting.
Texts "__bss_start" and "__bss_end" suggest that it was compiled with gcc.
Apparently one of the games was built on "May 19 2007 14:08:24". Text "SPCA556" appears in the header of game files.
Checked if file program under linux would recognize how it has been packed (offsets from 0 to 320 bytes) with no
obvious results. There are .wav(RIFF) and .mid files in those files. Im wondering if theres some sort of container or if they
are embedded in assembly. All of the three files seemed to have roughly same content in the first 320 bytes.

Checked DefaultFw.bin earlier and I think found some symbol suggesting BSD based operating system.

Try adding on case 3 the .bin files on the A partition (SPMP_G1_12M.bin, SPMP_N1.bin, SPMP_N1_12M.bin, SPMP_25MN1.bin). The emulators are stored on these.

Oh, the firmware I uploaded has got key sounds disabled (forgot to reset to defaults..). My fault.

So.. why don't you upload your MP4's firmware so we can test it?

Games aren't .gba, only .gb and .gbc. And I think the config is stored on USERCONFIG.BIN..

Re: Sunplus SPMP3050A - General
 

Googling I found this other firmware: http://rapidshare.com/files/67557866/backup_jxd_661.rar

The only way I've been able to make it work was using my DefaultFW + its AIMG + my 3050ABin0.bin. And it only shows the JXD logo, a clock/battery level (my MP4 doesn't have internal clock :roll:), and the menu title. Choosing any option crashes the player (can be powered off by the Reset button). I'll keep testing..

BTW this one also seems to have GB+NES emulator.

Re: Sunplus SPMP3050A - General
 

hello boys, somebody have the drivers for upload in the download section? cause the page referenced is not available now. and someone can tell me which software use to backup and upload the firmware?

Thanks al lot

Hi Everybody and sorry I'm late to the party :-)

I got my PMP from here: http://www.geeks.com/details.asp?invtid=PMP-GAMEKING-II

Screen shots here:
http://mysite.verizon.net/dbg4870/GameKingII/index.html

It has a SunPlus 3052A chip in it...guts pics here:
http://mysite.verizon.net/dbg4870/In...gII/index.html

Drivers now here:
http://mysite.verizon.net/dbg4870/SPCA3050 ISP driver.zip

And firmware extracted here:
ftp://dbg4870.dyndns.org/ (SPMP3052A.zip in the SPMP3052A folder)

Mine also came with a CD-R full of over 1,200 NES game roms and 20 .bin games (in the GAME-CDR folder at the ftp site)

Mine plays GB, GBC, and NES games no problem BUT you can't control the volume in the games. Does anybody know how to fix that?

Hi Again,

I see that some people are downloading the 1.56 and 1.57 firmwares from my ftp site. I just want to make sure you know those are not from my device. I believe those go to the S210C01 ARM based devices. Again, the firmware extracted from my device in zipped up in SPMP3052A.zip in the SPMP3052A folder. I don't mind if you take the others, just so you know the difference.

Also, if you are just looking for individual files the AIMG and BIMG are extracted in the AIMGFiles and BIMGFiles folders.

Thank you so much, but I think the link of the drivers is failing.

Thanks again.

That is just because of the spaces in the file name.

http://mysite.verizon.net/dbg4870/SP...P%20driver.zip

or here

ftp://dbg4870.dyndns.org/CD/SPCA3050%20ISP%20driver.zip

(Sorry for my english i from Venezuela)

My device is similar to this:

http://www.dealextreme.com/details.dx/sku.10238

How use as webcam? I press UP nothing...press DOWN nothing...A, B, LEFT, RIGHT, i go to menu CAM, too DV, but nothing...at connect USB cable ever is FlashDrive never CAM or some.

Upgrading firmware in this devices is posible? Is 3052 no 3050, the nes emulation is very good, but NOT HAVE GB/GBC EMULATOR...Information please!!!

Ah! NOT INTERNAL CLOCK, NOT FM RADIO, NOT DICTIONARY, NO SPANISH, ONLY ENGLISH AND CHINESSE...

Firmware version is: V4.01.070910

Try with ESC.
If you want you can add me to my MSN and I can try to help you.. yosoyzenitram at gmail.com

Download Links:

Hi All, I need to update the links to my files:

I got my PMP from here:
http://www.geeks.com/details.asp?invtid=PMP-GAMEKING-II

Screen shots here:
http://mysite.verizon.net/dbg4870/GameKingII/index.html

It has a SunPlus 3052A chip in it...guts pics here:
http://mysite.verizon.net/dbg4870/In...gII/index.html

Drivers here:
http://rapidshare.com/files/90955156...river.zip.html

And firmware extracted here:
http://rapidshare.com/files/90955155/SPMP3052A.zip.html

Mine also came with a CD-R with 20 .bin games:
http://rapidshare.com/files/90955157/BIN_GAMES.zip.html

Mine plays GB, GBC, and NES games no problem BUT you can't control the volume in the games. So I'm looking for a game emulator that does have volume control. Thanks!

Hi! dbg4870, how play the .bin games? In GAMES folder? I wil test this games on my devices today...after my comments!

Yep, on my device you just put them in the games folder.

NOT PLAY .BIN GAMES!!! NOT .GB/GBC!!! ONLY .NES, upgrading my Firmware this will change? I think change for dbg4870 firmware but is a risk...how i may backup my firmware? And how i may install that dbg4870 FW?

Hi!.Ordered two devices probably similar to Game King II with SunPlus 3052A chip from eBay some days ago,for my son and his friend.My function will be to keep these filled up with games and YouTube videos,I think.Therefore thank you to you people in this thread for posting pictures / work / experiences.When the gadgets arrive I will try running neo geo games to see if the emulator support this.

Instructions are here:
http://gameking2.wikispaces.com/Modding3

I have already tried all firmwares posted to this thread on this device without success. Same results as before. As I said earlier, this device has a hidden button in "LINE IN" connector. Firmware is at http://blld.org/spmp305x/fw/pmp_dx_sku10238.zip
Also tried poking "LCM" value in USERCONFIG.BIN in AIMG as it looked like something that could have something to do with screen type. I also noticed that screen saver activates after a while and the screen doesn't turn back on when normal keys are pressed. Pressing power brings it back though. So I'm thinking sku10238 fw doesn't read key presses correctly. sku10238 fw seems rather old compared to others.

My device is quite good and the sound is much better than some that I have tried and MP4 had. I fail to make it work as a webcam, testing with the team off and try pressing keys also placing mode camera and not achieving anything, I think that this team does not support doing so if somebody has done me explain ...

For now I think I am well, NES games are not state, so I forget ZELDA. The games with extension. Bin Nor are executed. Any novelty here (joel.zerpa at gmail.com) please!

Try adjusting volume from video player. Works for me.

You need to press the hidden button.

My firmware creates .sav files so I'm guessing zelda state saves might work with firmware I have.
My firmware version: v4.01.071023-d

Wonder if those last numbers are built date... If so, maybe they maintain two versions.

My player at least has some problems starting nes games if you have already player couple other games before. Apparently nes emulator always complains "File type error" even though the game file itself is ok. Anyway, you should try restarting your pmp before concluding that the game you tried doesn't work at all.

Also, for instance, I was able to get battle toads working although EU and USA versions didn't.