release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Wiki > Main > ChinaChip (compare)

Difference: ChinaChip (r16 vs. r15)

ChinaChip

Information

ChinaChip is a company who's software is commonly used by several Chinese DAP manufacturers.

Their firmware is based on the µCosII BSP provided by Ingenic.

Firmwares can be recognized by the following strings in it:

  • WADFxxxxxxxxxxxxxxxx
  • ChinaChip PMP firmware V1.0

File format

Main firmware (package)

//--------------------------------------
//--- 010 Editor v2.1.3 Binary Template
//
// File: HXF template
// Author: mcuelenaere
// Revision: 0.1
// Purpose:
//--------------------------------------

typedef struct
{
   CHAR Main_Header[20];
   UINT Size;
   UINT Checksum;
   UINT Unk;
   CHAR Other_Header[32];
} HEADER;

typedef struct
{
   UINT NameSize;
   if(NameSize>0)
   {
      CHAR Name[NameSize];
      CHAR Padding;
      UINT ContentSize;
      if(ContentSize>0)
         UCHAR Content[ContentSize];
   }
} BLOCK;

HEADER header;
while(!FEof())
   BLOCK block;

There are several HXF tools in SVN (utils/jz4740_tools/). The checksum is calculated like this:

local uint chksum = ReadUInt(0x18); /* actual checksum */
local uint chk = 0; /* calculated checksum */
FSeek(0x40);
while(!FEof())
{
   chk += ReadUInt(FTell());
   FSeek(FTell()+4);
}

*.dl file

//--------------------------------------
//--- 010 Editor v2.1.3 Binary Template
//
// File: DLTemplate
// Author: mcuelenaere
// Revision: 0.1
// Purpose:
//--------------------------------------

typedef struct
{
   CHAR  Name[4];
   DWORD Type;
   DWORD Offset;
   DWORD Size;
   UCHAR Date[16];
} HEADER;

typedef struct
{
   UINT String_Offset;
   UINT Padding;
   UINT Unk;
   UINT Symbol;
} SYMBOL;

typedef struct
{
   while(ReadByte(FTell())!=0 || ReadByte(FTell()+1) == 0)
      UCHAR Val;
   FSeek(FTell()+1);
} STRING;

typedef struct
{
   UINT symbol_total;
   UINT padding[3];
   local int i;
   for(i=0;i<symbol_total;i++)
      SYMBOL symbols;
   for(i=0;i<symbol_total;i++)
      STRING strings;
} HEADER1;

HEADER headers;
while(headers.Name[0] != 0)
   HEADER headers;

FSeek(headers[1].Offset);
HEADER1 Import;

FSeek(headers[2].Offset);
HEADER1 Export;

ccpmp.bin

CCPMP.bin (China Chip Portable Media Player) contains the firmware's main code.
The code is loaded at 0x80004000.

The bootloader who loads and starts this code gives three (unknown atm) argumens: $a0, $a1 & $a2.
CCPMP.bin does memcpy(0x802DE1A0, $a1, 0x14), memcpy(0x802DE180, $a2, 0x14) & stores $a0 in 0x801E7CF8 (these values probably differ along firmware versions; all of them are in the 'Padding' area).

The format is like this:

UINT Unk; /* Start address? */
UINT End_Addr;
UCHAR Code[End_Addr-8];
UCHAR Padding[0x500000-End_Addr-8]; /* Filled with 0xFF */

IHFS file system format

IHFS is a file system format used by ChinaChip players. It is basically a header, a file table and concatenated file contents, so it is only suitable as a read-only file system.

The file system is divided into 512-byte sectors and is laid out as follows:

Header File table Data area
  • Header: 4 sectors, starting from sector 0
Offset Length Contents
0x0000 4 Signature: 0x49484653 == "IHFS"
This is stored in the byte order of the device, and all other data are stored in the same byte order
0x0004 4 File system size in sectors (0x0001f200 == 127488)
0x0008 4 Unknown (0x00000004); it might probably be the size of the header in sectors
0x000c 4 Unknown (0xfffff000); it might be a bitmask of something
0x0010 12 Firmware timestamp string formatted as YYYYMMDDHHMM (e.g. "200805081100")
0x001c 4 Number of files in the file system
0x0020 476 Zeros
0x01fc 4 End-of-header marker (0x55aa55aa)
0x0200 1536 Filler: 0xff bytes
  • File table: 256 sectors, starting from sector 4
    The file table consists of 2048 entries of 64 bytes each, as shown below.
    Note 1: the number of files is known in advance by reading the header (see above)
    Note 2: unused entries are zeroed out
Offset Length Contents
0x00 56 Full path name of the file, e.g. "game\snake\common\1shenti1 normal_s.s3dtex"
Note 1: space characters are not escaped
Note 2: the path name is padded with zeros to 56 bytes
Note 3: the directory separator is "\"
0x38 4 Absolute sector number of the start of the file data, i.e. relative to the start of the file system
Note: File data always starts at sector boundaries
0x3c 4 File size in bytes
  • Data area: starts from sector 260 to the end of the file system
    The data area contains raw file data.
    Note 1: every file starts on a sector boundary
    Note 2: every file that is not a multiple of the sector size is padded to a sector boundary with 0xff bytes or big-endian 0xdeadface values

C source code for splitting an IHFS image is in utils/jz4740_tools/IHFSsplit.c (SVN).

HXF firmware file format

HXF most probably stands for "华芯飞", which is the Chinese name of ChinaChip Ltd. It is the file format used in firmware distribution. This file format is just a header followed by concatenated file entries, so we can say it's an archive format.

  • Header: 64 bytes
Offset Length Contents
0x0000 4 Signature: 0x46444157 == "FDAW"
This is stored in the byte order of the device, and all other data are stored in the same byte order
0x0004 4 Unknown ("0100")
0x0008 12 Firmware timestamp string formatted as YYYYMMDDHHMM (e.g. "200805081100")
0x0014 4 Archive size in bytes
0x0018 4 Checksum
Note: this is obtained by treating the concatenated file entries (below) as an array of 32-bit integers and adding up all the array elements
0x001c 4 Unknown (0x00000000)
0x0020 32 Identifier: "Chinachip PMP firmware V1.0" padded with zeros to 32 bytes
  • File entries: starts from byte 64 to the end of the archive
    The file entries are concatenated together with no padding in between. Each file entry is a consists of five concatenated sections as shown below.
    Note: the end-of-entries is marked by a zero value in place of the path length
Path length Path File type File size File data
Section Explanation
Path length A 32-bit integer containing the size of the next section
Note: If this value is zero, then there are no more entries beyond this
File path Full file path, e.g. "game\snake\common\1shenti1 normal_s.s3dtex"
Note 1: space characters are not escaped
Note 2: there is no NULL byte at the end of the string
Note 3: the directory separator is "\"
File type An unknown 8-bit value, might be used to describe the file type
Note: so far, this value is either 0x20 or 0x21
File size A 32-bit integer containing the size of the next section (the file data)
File data File data
Note: this is not padded

C source code for splitting an HXF firmware file is in utils/jz4740_tools/HXFsplit.c (SVN).

ChinaChip DAP's

Used chipsets

These chipsets are used by some China Chip players:

External links

IAttachmentActionSizeDateWhoComment
dlldr.zipzipdlldr.zipmanage 34.4 K 10 Sep 2008 - 18:34MaurusCuelenaere IDA CCPMP .dl loader
tree.txttxttree.txtmanage 24.3 K 24 May 2008 - 13:06MaurusCuelenaere Firmware tree (from Ainol V2000SE?)

r17 - 30 Nov 2010 - 01:16:29 - MaurusCuelenaere

Revision r16 - 20 Jun 2009 - 22:10 - MaurusCuelenaere
Revision r15 - 02 Feb 2009 - 16:03 - MaurusCuelenaere
Copyright by the contributing authors.