Onda VX747

Port status

• LCD is working
• Backlight is working
• Keys are working
• Touchscreen is working
• RTC is working
• Interrupts are working
• System reboot works + system shutdown
• NAND flash driver is working, but flash layout hasn't been figured out yet

How to upload Rockbox to SDRAM

• Download usbtool from SVN and read the README.
• Download these files and unzip them somewhere
• Compile Rockbox as a Bootloader
• Copy build/rockboot.vxv747 to [EXTRACT_FOLDER]/onda.bin
• In [EXTRACT_FOLDER] do usbtool 10 (for help just run usbtool)

Information

Images

• Player disassembled by mcuelenaere
• Player disassembled by v15i.com

Components

	Ingenic Jz4732 chipset Markings on backside of the board: SG301H V2 0801172010P2 More: 94V-0 E305905 0608
	Truly Semiconductor (Catalog) 3,0" touchscreen (400x240) Markings: A0533B On back: TC300-6-C-P4-J-E S80130173A On connector: Y080309-AB3 TFT9K0259FPC-B1-E TRULY-C 0805 Custom LCD design, based on TFT-G240400RTSW-3W-TP-E LCD Driver IC: Renesas R61509
	Power Tech International PL043759P Other device yields: TS-043759 RSD8J20A
	Samsung 749 K9HBG08U1M 2/4/8GB NAND flash (containing bootloader + firmware) Result of NAND_ID: 0xECD7
	2x Hynix HY57V281620FTP-2 16MB RAM 747A HY57V281620FTP-2
	Unknown FM chip
/	RTC is onboard but apparently not used?

GPIO configuration

• GPIO_PXPIN(3) ^ (1 << 27) => VOL DOWN button
• GPIO_PXPIN(3) ^ (1 << 0) => VOL UP button
• GPIO_PXPIN(3) ^ (1 << 1) => MENU button
• GPIO_PXPIN(3) ^ (1 << 16) => HOLD switch
• GPIO_PXPIN(3) ^ (1 << 29) => OFF button

Firmware upgrade

Holding the MENU button down while resetting the device boots it into "Jz4740 USB Boot Device" (VID=601A, PID=4740) which is the same as the information provided by Ingenic's USBboot tools.

OEM USB upgrade

The protocol should be compatible with/the same as usbboot-v1.3.zip provided by Ingenic.

Jz4740USBtool is available at utils/jz4740_usbtool in SVN which can upload data from and to the device.

Official flash recovery

Using this program (from MP4Nation) you can always recover from a bad flash.

Recovery procedure:

• hold MENU button while resetting your player
• start the program and press the second top left big button
• press it again after a (Chinese) message appears on your player
• reset your player while holding VOL DOWN
• upload your firmware named as SG301.HXF to the root
• reset your player while holding VOL DOWN

VX747writer's workflow is available here, an older version is below.

• do these steps with log_first.bin, log_second.bin, log_third.bin, log_fourth.bin and log_fifth.bin:
  1. do a VR_GET_CPU_INFO (returns JZ4740V1)
  2. (after uploading log_first.bin): do a VR_FLUSH_CACHES
  3. do a VR_SET_DATA_ADDRESS with value = 0x80000000
  4. upload log_X.bin to EP1
  5. do a VR_SET_DATA_LENGTH (returns length of upload)
  6. download log_X.bin from EP1 (and verify if it's correct)
  7. do a VR_PROGRAM_START1 with value = 0x80000000 (executing the uploaded code)
  8. do a VR_SET_DATA_ADDRESS with value = 0xB3020000 = DMAC_DSAR(0)
  9. do a VR_SET_DATA_LENGTH (returns length = 4 = int32)
  10. read 4 bytes from EP1
  11. ... (do some checking?)
• put the device somehow in USB UMS (probably through log_fifth.bin) and erase the NAND
• wait for instructions:
  • NAND needs to be formatted as FAT32
  • FW image needs to be uploaded as SG301.HXF

Probably ChinaChip modified the standard USBtools a bit (e.g. making VR_SET_DATA_LENGTH some kind of VR_GET_DATA).
Also VR_FLUSH_CACHES clears the current code running the USB tool mode, so you'll want be sure there's other code on the device too which can be runned.

Conclusions after some RE / Port status:

• ChinaChip has used the Ingenic USB boot tools (including the source to be runned on the device itself) for stage 1 at least
• unverified: the initial boot code is get from some ROM place, copied to the 16kb cache and run from there (address unknown, perhaps 0x80000000)
  • the stage2 takes over the USB functioning
  • the flush caches command kills the initial USB code in cache so if there isn't any replacement code available the player will need to be reset

Links

• Forum thread
• Manufacturers site
• Firmware archive
• Firmware format

Attachment	Action	Size	Date	Who	Comment
Log_Files.rar	manage	73.8 K	23 Jun 2008 - 14:31	MaurusCuelenaere	Log files
TLB_dump.txt	manage	5.6 K	23 Aug 2008 - 02:48	MaurusCuelenaere	TLB dump
log.htm	manage	44.0 K	20 Jun 2008 - 23:01	MaurusCuelenaere
rom_dump.bin	manage	16.0 K	23 Aug 2008 - 02:45	MaurusCuelenaere	On-chip Boot ROM dump