dev builds
themes manual
device status forums
mailing lists
IRC bugs
dev guide

Search | Go
Wiki > Main > FiioX3

Fiio X3


This is the page for the Fiio X3 port. This player shares some similarity with the FiioX1. For the 2nd generation of this device, refer to FiioX3Gen2.

Port Status

See FiioX3Port?

Main Features

  • Capacities: 128M internal Flash
  • TFT screen (320 x 240, 30 FPS) LCD screen
  • Headphone output
  • Lineout/spdif output
  • 24-bit/192KHz DAC + amplifier
  • Hi-speed micro-USB 2.0 port
  • Expandable microSD card slot and microSDHC card slot

Recovery mode

Check this. The JZ4760 chip has a usb recovery mode documented in the datasheet. The Fiio X1 can be put in this mode by the following procedure:
  • Turn off the device
  • Push the select button
  • While holding the select button down, plug in the USB cable
  • The screen will stay black and the device will then register itself as a Ingenic device: 601a:470 Ingenic Semiconductor Ltd.

When in recovery mode, the device uses a custom protocol documented in the datasheet. There is a tool in the rockbox repository to send commands to the device.

Boot Procedure

Extrapolated from X1, this might not be accurate. On boot, the cpu will either enter recovery mode or boot from the NAND. When booting from NAND, the CPU will load 8KB of code to the cache and execute them (see bootloader_stage1.bin attached to this page). This first bootloader (IPL) initializes the RAM and loads a secondary bootloader (SPL) at 0x80600000. The SPL is at offset 0x400 (in pages, or 2MiB in bytes). The SPL initializes the LCD and displays an animation while loading the main firmware. Early analysis of the SPL suggest it can flash the firmware from SD even if the main firmware is dead, by holding the shortcut button (top left) when booting, so the device can be easily unbricked (in theory). The bootloader also has a "factory" boot where a file called factory.x1 is loaded from the SD card and executed.

Factory boot

Extrapolated from X1, this might not be accurate. By holding the shortcut button, the device will enter recovery mode and check for factory.x1. If this file exists, it will load it to memory, unscramble it (using the same scrambling algorithm as for FiioFirmware sys.bin) and run it at address 0x80001000.

Upgrade procedure

Extrapolated from X1, this might not be accurate. By holding the shortcut button, the device will enter recovery mode and check for x1.fw to perform an upgrade. The file must use the FiioFirmware format. The exact way the upgrade procedure works is unclear.

Flash format

Extrapolated from X1, this might not be accurate. The first 2MB are reserved for the IPL, containing many copies of it, as described in the datasheet. The SPL is at 2MiB and of size 1MiB. More investigation are needed to understand the structure of the flash file system and how does it compare to the upgrade file.

Firmware Files

See FiioFirmware for an analysis of the Fiio firmware format.


  • Ingenic JZ4760B?: basically a JZ4760 with a few modifications. See IngenicJz47xx
  • DL240QV018T? or TF24013A? (ILI9341 driver): LCD
  • WM8740SEDS?: DAC 24-bit/292kHz
  • 2x Hynix H5PS1G63EFR?: 1Gb DDR2 gives 256MB RAM
  • NCTSTM16-08G: 8GB eMMC
  • AD8397: pre-amplifier
  • AD8692: headphone amplifier
  • NJW1194: volume/tone control
  • AXP192: PMU
  • HFD4/5-S1: relay

PCB Scans

-- AmauryPouly - 06 Apr 2015

8f1a98e3_bottom.jpeg cd00f07a_top.jpeg
I Attachment Action Size Date Who Comment
8f1a98e3_bottom.jpegjpeg 8f1a98e3_bottom.jpeg manage 199.3 K 16 Apr 2016 - 11:19 AmauryPouly  
cd00f07a_top.jpegjpeg cd00f07a_top.jpeg manage 162.3 K 16 Apr 2016 - 11:19 AmauryPouly  
r4 - 16 Apr 2016 - 11:20:12 - AmauryPouly

Copyright by the contributing authors.