ChinaChip

Information

ChinaChip is a company who's software is commonly used by several Chinese DAP manufacturers.

Their firmware is based on the µCosII BSP provided by Ingenic.

Firmwares can be recognized by the following strings in it:

• WADFxxxxxxxxxxxxxxxx
• ChinaChip PMP firmware V1.0

File format

Main firmware (package)

//--------------------------------------
//--- 010 Editor v2.1.3 Binary Template
//
// File: HXF template
// Author: mcuelenaere
// Revision: 0.1
// Purpose:
//--------------------------------------

typedef struct
{
   CHAR Main_Header[20];
   UINT Size;
   UINT Checksum;
   UINT Unk;
   CHAR Other_Header[32];
} HEADER;

typedef struct
{
   UINT NameSize;
   if(NameSize>0)
   {
      CHAR Name[NameSize];
      CHAR Padding;
      UINT ContentSize;
      if(ContentSize>0)
         UCHAR Content[ContentSize];
   }
} BLOCK;

HEADER header;
while(!FEof())
   BLOCK block;

There are several HXF tools in SVN (utils/jz4740_tools/). The checksum is calculated like this:

local uint chksum = ReadUInt(0x18); /* actual checksum */
local uint chk = 0; /* calculated checksum */
FSeek(0x40);
while(!FEof())
{
   chk += ReadUInt(FTell());
   FSeek(FTell()+4);
}

*.dl file

//--------------------------------------
//--- 010 Editor v2.1.3 Binary Template
//
// File: DLTemplate
// Author: mcuelenaere
// Revision: 0.1
// Purpose:
//--------------------------------------

typedef struct
{
   CHAR  Name[4];
   DWORD Type;
   DWORD Offset;
   DWORD Size;
   UCHAR Date[16];
} HEADER;

typedef struct
{
   UINT String_Offset;
   UINT Padding;
   UINT Unk;
   UINT Symbol;
} SYMBOL;

typedef struct
{
   while(ReadByte(FTell())!=0 || ReadByte(FTell()+1) == 0)
      UCHAR Val;
   FSeek(FTell()+1);
} STRING;

typedef struct
{
   UINT symbol_total;
   UINT padding[3];
   local int i;
   for(i=0;i<symbol_total;i++)
      SYMBOL symbols;
   for(i=0;i<symbol_total;i++)
      STRING strings;
} HEADER1;

HEADER headers;
while(headers.Name[0] != 0)
   HEADER headers;

FSeek(headers[1].Offset);
HEADER1 Import;

FSeek(headers[2].Offset);
HEADER1 Export;

ccpmp.bin

CCPMP.bin (China Chip Portable Media Player) contains the firmware's main code.
The code is loaded at 0x80004000.

The bootloader who loads and starts this code gives three (unknown atm) argumens: $a0, $a1 & $a2.
CCPMP.bin does memcpy(0x802DE1A0, $a1, 0x14), memcpy(0x802DE180, $a2, 0x14) & stores $a0 in 0x801E7CF8 (these values probably differ along firmware versions; all of them are in the 'Padding' area).

The format is like this:

UINT Unk; /* Start address? */
UINT End_Addr;
UCHAR Code[End_Addr-8];
UCHAR Padding[0x500000-End_Addr-8]; /* Filled with 0xFF */

IHFS file system format

IHFS is a file system format used by ChinaChip players. It is basically a header, a file table and concatenated file contents, so it is only suitable as a read-only file system.

The file system is divided into 512-byte sectors and is laid out as follows:

Header

File table

Data area

• Header: 4 sectors, starting from sector 0

Offset	Length	Contents
0x0000	4	Signature: 0x49484653 == "IHFS" This is stored in the byte order of the device, and all other data are stored in the same byte order
0x0004	4	File system size in sectors (0x0001f200 == 127488)
0x0008	4	Unknown (0x00000004); it might probably be the size of the header in sectors
0x000c	4	Unknown (0xfffff000); it might be a bitmask of something
0x0010	12	Firmware timestamp string formatted as YYYYMMDDHHMM (e.g. "200805081100")
0x001c	4	Number of files in the file system
0x0020	476	Zeros
0x01fc	4	End-of-header marker (0x55aa55aa)
0x0200	1536	Filler: 0xff bytes

• File table: 256 sectors, starting from sector 4
  The file table consists of 2048 entries of 64 bytes each, as shown below.
  Note 1: the number of files is known in advance by reading the header (see above)
  Note 2: unused entries are zeroed out

Offset	Length	Contents
0x00	56	Full path name of the file, e.g. "game\snake\common\1shenti1 normal_s.s3dtex" Note 1: space characters are not escaped Note 2: the path name is padded with zeros to 56 bytes Note 3: the directory separator is "\"
0x38	4	Absolute sector number of the start of the file data, i.e. relative to the start of the file system Note: File data always starts at sector boundaries
0x3c	4	File size in bytes

• Data area: starts from sector 260 to the end of the file system
  The data area contains raw file data.
  Note 1: every file starts on a sector boundary
  Note 2: every file that is not a multiple of the sector size is padded to a sector boundary with 0xff bytes or big-endian 0xdeadface values

C source code for splitting an IHFS image is in utils/jz4740_tools/IHFSsplit.c (SVN).

HXF firmware file format

HXF most probably stands for "华芯飞", which is the Chinese name of ChinaChip Ltd. It is the file format used in firmware distribution. This file format is just a header followed by concatenated file entries, so we can say it's an archive format.

• Header: 64 bytes

Offset	Length	Contents
0x0000	4	Signature: 0x46444157 == "FDAW" This is stored in the byte order of the device, and all other data are stored in the same byte order
0x0004	4	Unknown ("0100")
0x0008	12	Firmware timestamp string formatted as YYYYMMDDHHMM (e.g. "200805081100")
0x0014	4	Archive size in bytes
0x0018	4	Checksum Note: this is obtained by treating the concatenated file entries (below) as an array of 32-bit integers and adding up all the array elements
0x001c	4	Unknown (0x00000000)
0x0020	32	Identifier: "Chinachip PMP firmware V1.0" padded with zeros to 32 bytes

• File entries: starts from byte 64 to the end of the archive
  The file entries are concatenated together with no padding in between. Each file entry is a consists of five concatenated sections as shown below.
  Note: the end-of-entries is marked by a zero value in place of the path length

Path length

Path

File type

File size

File data

Section	Explanation
Path length	A 32-bit integer containing the size of the next section Note: If this value is zero, then there are no more entries beyond this
File path	Full file path, e.g. "game\snake\common\1shenti1 normal_s.s3dtex" Note 1: space characters are not escaped Note 2: there is no NULL byte at the end of the string Note 3: the directory separator is "\"
File type	An unknown 8-bit value, might be used to describe the file type Note: so far, this value is either 0x20 or 0x21
File size	A 32-bit integer containing the size of the next section (the file data)
File data	File data Note: this is not padded

C source code for splitting an HXF firmware file is in utils/jz4740_tools/HXFsplit.c (SVN).

ChinaChip DAP's

Used chipsets

These chipsets are used by some China Chip players:

• Ingenic Jz47xx

External links

• Firmware info by a Chinese user (Translated)
• Jz4740 Tools in Rockbox SVN