Samsung Z5

---

Introduction

7 tactile buttons and a touchpad (directions).

Dedicated hold switch

SoC: Sigmatel STMP360(B)

Screen resolution: 128 x 160 (RGB) [there are 2 LCD variants, see below in the hardware section]

Radio (where present): Philips TEA5767

Nand: 1 - 2 - 4 GB splitted in various logical partitions (see under)

Hardware variants: from the bootloader I understood that there are at least something like 8 HW revisions. Of course these revisions are not very different one another, but features are missing. For example my 2 Z5 have both a microphone as well as the FM radio, while the Z5 that someone took apart below has neither FM radio nor microphone. Other variants are NAND type and LCD type.

SLC version --> 1 GB

MLC version --> 2/4 GB

---

Firmware

2 firmware updates are available here: http://www.anythingbutipod.com/forum/showthread.php?t=32690. The update is performed by placing the =Z5Update.dat file in the root of the player or the System/Data folder, depending on the current version you're player is running. This player runs Linux as well as a particular Java virtual machine! Indeed, the firmware UI is made up in Java and all the class are visible (and hacker-able ). Lots of interesting scripts and executable are present in the firmware.

Update process

With the help of the Z5 updater (recovery) application we can restore the firmware through the STMP3600 recovery mode. A updater.sb as sent to the device. This ~1,8MB file is really complex since it includes some code to load a Linux kernel with a rootfs-based recovery. Then a z5-fw.dat is sent to the user memory (through UMS) and the process of decryption + flashing begins!

Z5Update?.dat is a mixture of plain and encrypted bytes.

Meaning	Offset	Length
Header	0	0x38
Data	0x38	Size of the data
MD5 Encrypted data	0x38 + Size of the data	0x10

Header info	Offset	Length
Signature (SAMSUNG YEPP)	0	0xC
Unknown	0xC	0x4
Version	0x10	0x8
Region Code	0x18	0x4
Unknown (revision ?)	0x1C	0x4
Model	0x20	0x14
Size of the data	0x34	0x4

Partitions

Name	Offset	Length	Usage
ufd0p0	16	4MB ( 16 blks, 1 blk = 256KB) chip-0, part-0 (blk 16 ~ 31) ?
ufd0p1	32	4MB ( 16 blks, 1 blk = 256KB) chip-0, part-1 (blk 32 ~ 47)	?
ufd0p2	48	16MB ( 64 blks, 1 blk = 256KB) chip-0, part-2 (blk 48 ~ 111)	?
ufd0p3	112	32MB ( 128 blks, 1 blk = 256KB) chip-0, part-3 (blk 112 ~ 239)	?
ufd0p4	240	923MB (3692 blks, 1 blk = 256KB) chip-0, part-4 (blk 240 ~ 3931)	User data
**ufdrawa	16	4MB ( 16 blks, 1 blk = 256KB) chip-0, part-0 (blk 16 ~ 31)	?kernel?
**ufdrawb	?	?	rootfs
**ufdrawc	?	?	Oasis UI app data

---

Modes

To get the player to present itself as a STMP3600/Player Recovery Class device, hold the middle select button while connecting to USB from the off state.

Keep in mind that this device has a sleep mode and the only way to truly turn it off is by pressing in the reset button on the bottom. (applies to OF, not other modes!!!)

---

Insides

---

Schematics & Stuff

YP-Z5 Schematics, Service Manual & more!

ADCChannel	Usage
ADC0	Tactile Buttons
ADC1	Microphone Power?
ADC2	Touchpad AX-
ADC3	Touchpad AY-
ADC4	Touchpad AX+
ADC5	Touchpad AY+

Touchpad device shall be enabled via the TX/TY +/- pins. See the "Default value" in the table above.

---

Useful Links

• SigmaTelSTMP3xxx

---

---

UART Log

Bootloader + Some system messages log during bootup

---

---

Actual implementations

I'm working on this port and things are going fine, what is implemented so far in a "playground" code to be sent to device is:

• Keypad (7 buttons) - needs a review since it works fine on my test device while in the good one some buttons aren't correctly read
• Backlight - needs some care to set the maximum current to 15mA instead of 20mA to be more safe
• Display - initializes and I can draw something
• Hold button
• ADC readings (also for keypad)
• Touchpad enable

---

• YPZ5_SM.pdf: Service Manual, Schematics and more