ChinaChip < Main

Downloads
release
dev builds
extras
themes
Documentation
manual
wiki
device status
Support
forums
mailing lists
IRC
Development
bugs
patches
dev guide
Donate
Wiki > Main > ChinaChip
---+!! ChinaChip

%TOC%

---++ Information

[[http://www.chinachip.cn/][ChinaChip]] is a company who's software is commonly used by several Chinese DAP manufacturers.

Their firmware is based on the µCosII BSP provided by Ingenic.

Firmwares can be recognized by the following strings in it:
   * WADFxxxxxxxxxxxxxxxx
   * !ChinaChip PMP firmware V1.0

---++ File format
---+++ Main firmware (package)
<verbatim>
//--------------------------------------
//--- 010 Editor v2.1.3 Binary Template
//
// File: HXF template
// Author: mcuelenaere
// Revision: 0.1
// Purpose:
//--------------------------------------

typedef struct
{
	CHAR Main_Header[20];
	UINT Size;
	UINT Checksum;
	UINT Unk;
	CHAR Other_Header[32];
} HEADER;

typedef struct
{
	UINT NameSize;
	if(NameSize>0)
	{
		CHAR Name[NameSize];
		CHAR Padding;
		UINT ContentSize;
		if(ContentSize>0)
			UCHAR Content[ContentSize];
	}
} BLOCK;

HEADER header;
while(!FEof())
	BLOCK block;
</verbatim>

There are several HXF tools in SVN (utils/jz4740_tools/).
The checksum is calculated like this:
<verbatim>
local uint chksum = ReadUInt(0x18); /* actual checksum */
local uint chk = 0; /* calculated checksum */
FSeek(0x40);
while(!FEof())
{
	chk += ReadUInt(FTell());
	FSeek(FTell()+4);
}
</verbatim>

---+++ *.dl file
<verbatim>
//--------------------------------------
//--- 010 Editor v2.1.3 Binary Template
//
// File: DLTemplate
// Author: mcuelenaere
// Revision: 0.1
// Purpose:
//--------------------------------------

typedef struct
{
	CHAR  Name[4];
	DWORD Type;
	DWORD Offset;
	DWORD Size;
	UCHAR Date[16];
} HEADER;

typedef struct
{
	UINT String_Offset;
	UINT Padding;
	UINT Unk;
	UINT Symbol;
} SYMBOL;

typedef struct
{
	while(ReadByte(FTell())!=0 || ReadByte(FTell()+1) == 0)
		UCHAR Val;
	FSeek(FTell()+1);
} STRING;

typedef struct
{
	UINT symbol_total;
	UINT padding[3];
	local int i;
	for(i=0;i<symbol_total;i++)
		SYMBOL symbols;
	for(i=0;i<symbol_total;i++)
		STRING strings;
} HEADER1;

HEADER headers;
while(headers.Name[0] != 0)
	HEADER headers;

FSeek(headers[1].Offset);
HEADER1 Import;

FSeek(headers[2].Offset);
HEADER1 Export;
</verbatim>

---+++ ccpmp.bin

CCPMP.bin (China Chip Portable Media Player) contains the firmware's main code.%BR%
The code is loaded at 0x80004000.

The bootloader who loads and starts this code gives three (unknown atm) argumens: $a0, $a1 & $a2.%BR%
CCPMP.bin does memcpy(0x802DE1A0, $a1, 0x14), memcpy(0x802DE180, $a2, 0x14) & stores $a0 in 0x801E7CF8 (these values probably differ along firmware versions; all of them are in the 'Padding' area).

The format is like this:

<verbatim>
UINT Unk; /* Start address? */
UINT End_Addr;
UCHAR Code[End_Addr-8];
UCHAR Padding[0x500000-End_Addr-8]; /* Filled with 0xFF */
</verbatim>


---+++ IHFS file system format

IHFS is a file system format used by ChinaChip players. It is basically a header, a file table and concatenated file contents, so it is only suitable as a read-only file system.

The file system is divided into 512-byte sectors and is laid out as follows:

%TABLE{ databg="none" sort="off" cellpadding="4"}%
|  Header  |  File table  |  Data area  |

   * Header: 4 sectors, starting from sector 0

%TABLE{ databg="none" sort="off" }%
| *Offset* | *Length* | *Contents* |
|  0x0000  |  4  | Signature: 0x49484653 == "IHFS"%BR%This is stored in the byte order of the device, and all other data are stored in the same byte order |
|  0x0004  |  4  | File system size in sectors (0x0001f200 == 127488) |
|  0x0008  |  4  | Unknown (0x00000004); it might probably be the size of the header in sectors |
|  0x000c  |  4  | Unknown (0xfffff000); it might be a bitmask of something |
|  0x0010  |  12  | Firmware timestamp string formatted as YYYYMMDDHHMM (e.g. "200805081100") |
|  0x001c  |  4  | Number of files in the file system |
|  0x0020  |  476  | Zeros |
|  0x01fc   |  4  | End-of-header marker (0x55aa55aa) |
|  0x0200  |  1536  | Filler: 0xff bytes |

   * File table: 256 sectors, starting from sector 4%BR%The file table consists of 2048 entries of 64 bytes each, as shown below.%BR%Note 1: the number of files is known in advance by reading the header (see above)%BR%Note 2: unused entries are zeroed out

%TABLE{ databg="none" sort="off" }%
| *Offset* | *Length* | *Contents* |
|  0x00  |  56  | Full path name of the file, e.g. "game\snake\common\1shenti1 normal_s.s3dtex"%BR%Note 1: space characters are not escaped%BR%Note 2: the path name is padded with zeros to 56 bytes%BR%Note 3: the directory separator is "\" |
|  0x38  |  4  | Absolute sector number of the start of the file data, i.e. relative to the start of the file system%BR%Note: File data always starts at sector boundaries |
|  0x3c  |  4  | File size in bytes |

   * Data area: starts from sector 260 to the end of the file system%BR%The data area contains raw file data.%BR%Note 1: every file starts on a sector boundary%BR%Note 2: every file that is not a multiple of the sector size is padded to a sector boundary with 0xff bytes or big-endian 0xdeadface values

C source code for splitting an IHFS image is in utils/jz4740_tools/IHFSsplit.c (SVN). 

---+++ HXF firmware file format

HXF most probably stands for "&#21326;&#33455;&#39134;", which is the Chinese name of ChinaChip Ltd. It is the file format used in firmware distribution. This file format is just a header followed by concatenated file entries, so we can say it's an archive format.

   * Header: 64 bytes

%TABLE{ databg="none" sort="off" }%
| *Offset* | *Length* | *Contents* |
|  0x0000  |  4  | Signature: 0x46444157 == "FDAW"%BR%This is stored in the byte order of the device, and all other data are stored in the same byte order |
|  0x0004  |  4  | Unknown ("0100") |
|  0x0008  |  12  | Firmware timestamp string formatted as YYYYMMDDHHMM (e.g. "200805081100") |
|  0x0014  |  4  | Archive size in bytes |
|  0x0018  |  4  | Checksum%BR%Note: this is obtained by treating the concatenated file entries (below) as an array of 32-bit integers and adding up all the array elements |
|  0x001c  |  4  | Unknown (0x00000000) |
|  0x0020  |  32  | Identifier: "Chinachip PMP firmware V1.0" padded with zeros to 32 bytes |

   * File entries: starts from byte 64 to the end of the archive%BR%The file entries are concatenated together with no padding in between. Each file entry is a consists of five concatenated sections as shown below.%BR%Note: the end-of-entries is marked by a zero value in place of the path length

|  Path length  |  Path  |  File type  |  File size  |  File data  |

%TABLE{ databg="none" sort="off" }%
| *Section* | *Explanation* |
|  Path length  | A 32-bit integer containing the size of the next section%BR%Note: If this value is zero, then there are no more entries beyond this |
|  File path  | Full file path, e.g. "game\snake\common\1shenti1 normal_s.s3dtex"%BR%Note 1: space characters are not escaped%BR%Note 2: there is no NULL byte at the end of the string%BR%Note 3: the directory separator is "\" |
|  File type  | An unknown 8-bit value, might be used to describe the file type%BR%Note: so far, this value is either 0x20 or 0x21 |
|  File size  | A 32-bit integer containing the size of the next section (the file data) |
|  File data  | File data%BR%Note: this is not padded |

C source code for splitting an HXF firmware file is in utils/jz4740_tools/HXFsplit.c (SVN).

---++ !ChinaChip DAP's
   * [[AinolV2000SE][Ainol V2000SE]]
   * [[OndaVX747][Onda VX747(+)]]
   * Onda VX757(+)
   * [[OndaVX767][Onda VX767]]
   * [[OndaVX747][Onda VX777]]
   * Onda VX979+
   * JXD 302
   * KNC M-730
   * Dingoo A320
   * ...
   * all other Chinese players whose firmware update extension is HXF

---++ Used chipsets
These chipsets are used by some China Chip players:
   * [[IngenicJz47xx][Ingenic Jz47xx]]

---++ External links
   * [[http://bbs.imp3.net/viewthread.php?action=printable&tid=415099][Firmware info by a Chinese user]] ([[http://google.com/translate?u=http%3A%2F%2Fbbs.imp3.net%2Fviewthread.php%3Faction%3Dprintable%26tid%3D415099&hl=en&ie=UTF8&sl=zh-CN&tl=en][Translated]])
   * [[http://svn.rockbox.org/viewvc.cgi/trunk/utils/jz4740_tools/][Jz4740 Tools in Rockbox SVN]]
   * [[http://code.google.com/p/dingoo-linux/wiki/DualBoot][some information regarding the NAND boot process]]
   * [[https://github.com/mthuurne/opendingux-kernel/commit/f2a4e73d3618fc5ff8d9872ef804e01481e5f182][ChinaChip FTL information (read-only Linux kernel driver)]]
I	Attachment	Action	Size	Date	Who	Comment
zip	dlldr.zip	manage	34.4 K	10 Sep 2008 - 18:34	MaurusCuelenaere	IDA CCPMP .dl loader
txt	tree.txt	manage	24.3 K	24 May 2008 - 13:06	MaurusCuelenaere	Firmware tree (from Ainol V2000SE?)
r17 - 30 Nov 2010 - 01:16:29 - MaurusCuelenaere