Information
ChinaChip is a company who's software is commonly used by several Chinese DAP manufacturers.
Their firmware is based on the µCosII BSP provided by Ingenic.
Firmwares can be recognized by the following strings in it:
- WADFxxxxxxxxxxxxxxxx
- ChinaChip PMP firmware V1.0
File format
Main firmware (package)
//--------------------------------------
//--- 010 Editor v2.1.3 Binary Template
//
// File: HXF template
// Author: mcuelenaere
// Revision: 0.1
// Purpose:
//--------------------------------------
typedef struct
{
CHAR Main_Header[20];
UINT Size;
UINT Checksum;
UINT Unk;
CHAR Other_Header[32];
} HEADER;
typedef struct
{
UINT NameSize;
if(NameSize>0)
{
CHAR Name[NameSize];
CHAR Padding;
UINT ContentSize;
if(ContentSize>0)
UCHAR Content[ContentSize];
}
} BLOCK;
HEADER header;
while(!FEof())
BLOCK block;
There are several HXF tools in SVN (utils/jz4740_tools/).
The checksum is calculated like this:
local uint chksum = ReadUInt(0x18); /* actual checksum */
local uint chk = 0; /* calculated checksum */
FSeek(0x40);
while(!FEof())
{
chk += ReadUInt(FTell());
FSeek(FTell()+4);
}
*.dl file
//--------------------------------------
//--- 010 Editor v2.1.3 Binary Template
//
// File: DLTemplate
// Author: mcuelenaere
// Revision: 0.1
// Purpose:
//--------------------------------------
typedef struct
{
CHAR Name[4];
DWORD Type;
DWORD Offset;
DWORD Size;
UCHAR Date[16];
} HEADER;
typedef struct
{
UINT String_Offset;
UINT Padding;
UINT Unk;
UINT Symbol;
} SYMBOL;
typedef struct
{
while(ReadByte(FTell())!=0 || ReadByte(FTell()+1) == 0)
UCHAR Val;
FSeek(FTell()+1);
} STRING;
typedef struct
{
UINT symbol_total;
UINT padding[3];
local int i;
for(i=0;i<symbol_total;i++)
SYMBOL symbols;
for(i=0;i<symbol_total;i++)
STRING strings;
} HEADER1;
HEADER headers;
while(headers.Name[0] != 0)
HEADER headers;
FSeek(headers[1].Offset);
HEADER1 Import;
FSeek(headers[2].Offset);
HEADER1 Export;
ccpmp.bin
CCPMP.bin (China Chip Portable Media Player) contains the firmware's main code.
The code is loaded at 0x80004000.
The bootloader who loads and starts this code gives three (unknown atm) argumens: $a0, $a1 & $a2.
CCPMP.bin does memcpy(0x802DE1A0, $a1, 0x14), memcpy(0x802DE180, $a2, 0x14) & stores $a0 in 0x801E7CF8 (these values probably differ along firmware versions; all of them are in the 'Padding' area).
The format is like this:
UINT Unk; /* Start address? */
UINT End_Addr;
UCHAR Code[End_Addr-8];
UCHAR Padding[0x500000-End_Addr-8]; /* Filled with 0xFF */
IHFS file system format
IHFS is a file system format used by
ChinaChip players. It is basically a header, a file table and concatenated file contents, so it is only suitable as a read-only file system.
The file system is divided into 512-byte sectors and is laid out as follows:
Header |
File table |
Data area |
- Header: 4 sectors, starting from sector 0
Offset |
Length |
Contents |
0x0000 |
4 |
Signature: 0x49484653 == "IHFS" This is stored in the byte order of the device, and all other data are stored in the same byte order |
0x0004 |
4 |
File system size in sectors (0x0001f200 == 127488) |
0x0008 |
4 |
Unknown (0x00000004); it might probably be the size of the header in sectors |
0x000c |
4 |
Unknown (0xfffff000); it might be a bitmask of something |
0x0010 |
12 |
Firmware timestamp string formatted as YYYYMMDDHHMM (e.g. "200805081100") |
0x001c |
4 |
Number of files in the file system |
0x0020 |
476 |
Zeros |
0x01fc |
4 |
End-of-header marker (0x55aa55aa) |
0x0200 |
1536 |
Filler: 0xff bytes |
- File table: 256 sectors, starting from sector 4
The file table consists of 2048 entries of 64 bytes each, as shown below.
Note 1: the number of files is known in advance by reading the header (see above)
Note 2: unused entries are zeroed out
Offset |
Length |
Contents |
0x00 |
56 |
Full path name of the file, e.g. "game\snake\common\1shenti1 normal_s.s3dtex" Note 1: space characters are not escaped Note 2: the path name is padded with zeros to 56 bytes Note 3: the directory separator is "\" |
0x38 |
4 |
Absolute sector number of the start of the file data, i.e. relative to the start of the file system Note: File data always starts at sector boundaries |
0x3c |
4 |
File size in bytes |
- Data area: starts from sector 260 to the end of the file system
The data area contains raw file data.
Note 1: every file starts on a sector boundary
Note 2: every file that is not a multiple of the sector size is padded to a sector boundary with 0xff bytes or big-endian 0xdeadface values
C source code for splitting an IHFS image is in utils/jz4740_tools/IHFSsplit.c (SVN).
HXF firmware file format
HXF most probably stands for "华芯飞", which is the Chinese name of
ChinaChip Ltd. It is the file format used in firmware distribution. This file format is just a header followed by concatenated file entries, so we can say it's an archive format.
Offset |
Length |
Contents |
0x0000 |
4 |
Signature: 0x46444157 == "FDAW" This is stored in the byte order of the device, and all other data are stored in the same byte order |
0x0004 |
4 |
Unknown ("0100") |
0x0008 |
12 |
Firmware timestamp string formatted as YYYYMMDDHHMM (e.g. "200805081100") |
0x0014 |
4 |
Archive size in bytes |
0x0018 |
4 |
Checksum Note: this is obtained by treating the concatenated file entries (below) as an array of 32-bit integers and adding up all the array elements |
0x001c |
4 |
Unknown (0x00000000) |
0x0020 |
32 |
Identifier: "Chinachip PMP firmware V1.0" padded with zeros to 32 bytes |
- File entries: starts from byte 64 to the end of the archive
The file entries are concatenated together with no padding in between. Each file entry is a consists of five concatenated sections as shown below.
Note: the end-of-entries is marked by a zero value in place of the path length
Path length |
Path |
File type |
File size |
File data |
Section |
Explanation |
Path length |
A 32-bit integer containing the size of the next section Note: If this value is zero, then there are no more entries beyond this |
File path |
Full file path, e.g. "game\snake\common\1shenti1 normal_s.s3dtex" Note 1: space characters are not escaped Note 2: there is no NULL byte at the end of the string Note 3: the directory separator is "\" |
File type |
An unknown 8-bit value, might be used to describe the file type Note: so far, this value is either 0x20 or 0x21 |
File size |
A 32-bit integer containing the size of the next section (the file data) |
File data |
File data Note: this is not padded |
C source code for splitting an HXF firmware file is in utils/jz4740_tools/HXFsplit.c (SVN).
ChinaChip DAP's
Used chipsets
These chipsets are used by some China Chip players:
External links
Copyright © by the contributing authors.