7 tactile buttons and a touchpad (directions).
Dedicated hold switch
SoC: Sigmatel STMP360(B)
Screen resolution: 128 x 160 (RGB) [there are 2 LCD variants, see below in the hardware section]
Radio (where present): Philips TEA5767
Nand: 1 - 2 - 4 GB splitted in various logical partitions (see under)
Hardware variants: from the bootloader I understood that there are at least something like 8 HW revisions. Of course these revisions are not very different one another, but features are missing. For example my 2 Z5 have both a microphone as well as the FM radio, while the Z5 that someone took apart below has neither FM radio nor microphone. Other variants are NAND type and LCD type.
SLC version --> 1 GB
MLC version --> 2/4 GB
2 firmware updates are available here: http://www.anythingbutipod.com/forum/showthread.php?t=32690. The update is performed by placing the =Z5Update.dat file in the root of the player or the System/Data folder, depending on the current version you're player is running. This player runs Linux as well as a particular Java virtual machine! Indeed, the firmware UI is made up in Java and all the class are visible (and hacker-able ). Lots of interesting scripts and executable are present in the firmware.
With the help of the Z5 updater (recovery) application we can restore the firmware through the STMP3600 recovery mode. A updater.sb as sent to the device. This ~1,8MB file is really complex since it includes some code to load a Linux kernel with a rootfs-based recovery. Then a z5-fw.dat is sent to the user memory (through UMS) and the process of decryption + flashing begins!
Z5Update?.dat is a mixture of plain and encrypted bytes.
| Header || 0 || 0x38 |
| Data || 0x38 || Size of the data |
| MD5 Encrypted data || 0x38 + Size of the data || 0x10 |
| Signature (SAMSUNG YEPP) || 0 || 0xC |
| Unknown || 0xC || 0x4 |
| Version || 0x10 || 0x8 |
| Region Code || 0x18 || 0x4 |
| Unknown (revision ?) || 0x1C || 0x4 |
| Model || 0x20 || 0x14 |
| Size of the data || 0x34 || 0x4 |
| ufd0p0 || 16 || 4MB ( 16 blks, 1 blk = 256KB) chip-0, part-0 (blk 16 ~ 31) ? |
| ufd0p1 || 32 || 4MB ( 16 blks, 1 blk = 256KB) chip-0, part-1 (blk 32 ~ 47) || ? |
| ufd0p2 || 48 || 16MB ( 64 blks, 1 blk = 256KB) chip-0, part-2 (blk 48 ~ 111) || ? |
| ufd0p3 || 112 || 32MB ( 128 blks, 1 blk = 256KB) chip-0, part-3 (blk 112 ~ 239) || ? |
| ufd0p4 || 240 || 923MB (3692 blks, 1 blk = 256KB) chip-0, part-4 (blk 240 ~ 3931) || User data |
| **ufdrawa || 16 || 4MB ( 16 blks, 1 blk = 256KB) chip-0, part-0 (blk 16 ~ 31) || ?kernel? |
| **ufdrawb || ? || ? || rootfs |
| **ufdrawc || ? || ? || Oasis UI app data |
To get the player to present itself as a STMP3600/Player Recovery Class device, hold the middle select button while connecting to USB from the off state.
Keep in mind that this device has a sleep mode and the only way to truly turn it off is by pressing in the reset button on the bottom. (applies to OF, not other modes!!!)
Schematics & Stuff
YP-Z5 Schematics, Service Manual & more!
| ADC0 || Tactile Buttons |
| ADC1 || Microphone Power? |
| ADC2 || Touchpad AX- |
| ADC3 || Touchpad AY- |
| ADC4 || Touchpad AX+ |
| ADC5 || Touchpad AY+ |
|GPIO/other pins||Name||Default State (OF)||Direction||Description / use|
| PSWITCH || PSWITCH || L || I || Special pin to get power button and Center button states |
| SSP_DATA1 B0P29? (SSP_DATA1) || SDRAM_PWR || N/A || O || Powers up the SDRAM before its actual usage |
| GPMI_D00 B0P10? (GPMI_D10) ||Boot FM_BUS mode || N/A || O || Enables FM radio chip (power) |
| GPMI_D01 B0P12? (GPMI_D12) ||Boot USB_Detect mode || N/A || I || |
| GPMI_D02 B0P13? (GPMI_D13) ; B0P14? (some HW revisions) ||Boot Hold_SW mode || N/A || I || Low: unlocked; High: unlocked |
| GPMI_D03 B3P12? (PWM2) ||Boot LCD_TP mode || N/A || I || Identify LCD Type (2 possibilities) |
| GPMI_D09 B3P13? (PWM3) ||LCD_RD BLU_ON_LCD || N/A || O || Enable/set backlight, see code for description of usage |
| GPMI_D10 B1P21? (LCD_BUSY) ||FM_BUS Touchpad TY- ||N/A 0 || O || Enable touchpad |
| GPMI_D12 B3P15? (ROTARYA) ||USB_Detect Touchpad TX- ||N/A 1 || O || Enable touchpad |
| GPMI_D13 B0P26? (SSP_CMD) ||Hold_SW Touchpad TY+ ||N/A 1 ||Low: O unlocked; High: unlocked || Enable touchpad |
| PWM2 B0P25? (SSP_DETECT) ||LCD_TP Touchpad TX+ ||N/A 0 ||Identify O LCD Type (2 possibilities) || Enable touchpad |
| PWM3 B0P30? (SSP_DATA2) ||BLU_ON_LCD FM_INT (interrupt) || N/A ||Manage I backlight || Related to radio chip; RDS package arrived or stereo indication |
| LCD_BUSY B1P22? (UART2_CTS) ||Touchpad MUTE_ON TY- || 0 || O ||Enable touchpad Disable audio output |
| ROTARYA B3P16? (ROTARYB) ||Touchpad DTV_DETECT TX- ||1 N/A ||O I/O ||Enable touchpad USB_ID as pinout; might be related to some OTG feature ? |
| SSP_CMD B0P28?||Touchpad FM_DETECT TY+ ||1 N/A ||O I ||Enable touchpad High: FM present; Low: FM absent |
| SSP_DETECT B0P24?||Touchpad NAND_TYPE TX+ ||0 N/A ||O I ||Enable touchpad High: MLC; Low: SLC |
| SSP_DATA2 B0P27?||FM_INT NAND_TYPE (interrupt) || N/A || I || High: CS4; Low: CS2 (CHECK! Inconsistency with loader's output!) |
| UART2_CTS B0P31?||MUTE_ON TOUCH_TYPE || N/A ||O I || High: CAP; Low: REG (?!!?) |
| ROTARYB || DTV_DETECT || N/A || I/O || |
Touchpad device shall be enabled via the TX/TY +/- pins. See the "Default value" in the table above.
Bootloader + Some system messages log during bootup
I'm working on this port and things are going fine, what is implemented so far in a "playground" code to be sent to device is:
- Keypad (7 buttons) - needs a review since it works fine on my test device while in the good one some buttons aren't correctly read
- Backlight - needs some care to set the maximum current to 15mA instead of 20mA to be more safe
- Display - initializes and I can draw something
- Hold button
- ADC readings (also for keypad)
- Touchpad enable
Copyright © by the contributing authors.