Sony NW-A1000/1200/3000 Port Index
Introduction
This series of DAPs shares the same microprocessor as the iAudio X5/M5 series players. The firmware appears to be encrypted as there are no visible strings after the initial "NWA3000" and IDA-Pro doesn't seem to know what to do with it.
There is no code written for this device. Things that need to be done are: find a way to recover from a bad flash and understanding the firmware files. Perhaps someone with a A1000/1200 could try booting with the drive removed to see what happens (the A3000 requires de-soldering 4 pins just to get at the HDD). I found a report that said holding the volume-up button while connecting to a PC would execute a recovery mode but haven't been able to confirm this.
Firmware Update
Sony NW-A1000 Firmware v2.01
Sony NW-A1000 Firmware v3.00
Sony NW-A1200 Firmware v2.01
Sony NW-A1200 Firmware v3.00
Sony NW-A3000 Firmware v2.01
Sony NW-A3000 Firmware v3.00
Firmware updates are performed by placing a NW_AX000.bin file in the root directory and restarting the player. For the v3 update, an extra file called NW_A3000.UPG is placed in the root as well. You can extract the files from the installer executables with common archive programs (7zip, WinRAR, etc).
Firmware Format
| Address | Size in bytes | A1000v2 | A1000v3 | A1000v3UPG | A1200v2 | A1200v3 | A1200v3UPG | A3000v2 | A3000v3 | A3000v3UPG | Description |
|---|
| 0x0 | 7 | NWA1000 | NWA1200 | NWA3000 | Model Name |
| 0x7 | 2 | 5F00 | Padding? |
| 0x9 | 3 | 2B87A0 | 295810 | 2E02E0 | 2B87A0 | 2957C0 | 2E0290 | 2B87A0 | 295930 | 2E03F0 | Total file size minus 4 Bytes |
| 0xC | 29 | 09080B0A1D152A77585981295B5ECA305E6393372F29C86B646DE54567 | ? |
| 0x29 | 3 | 6AAE4C | 677E3C | 67E70C | 6AAE4C | 677E6C | 6AE6BC | 6AAE4C | 677FDC | 6AE41C | File size related? |
| 0x2C | 1 | 6A | ? |
| 0x2D | 1 | 77 | 7F | 7F | 77 | 7F | 7F | 77 | 7F | 7F | Version related? |
| 0x2E | 7 | B7532B29990F70? | ? |
| 0x35 | 3 | 998961 | 97D911 | 994021 | 998961 | 97D941 | 994191 | 998961 | 97D8F1 | 994331 | File size related? |
| 0x38 | 5 | 7389954876 | ? |
| 0x3D | 1 | 8B | BB | BB | 8B | BB | BB | 8B | BB | BB | Version related? |
| 0x3E | 7 | DB6FEA8265147C? | ? |
| 0x45 | 3 | B26A5D? | B0BAED? | B23D1D? | B26A5D? | B0BA3D? | B23D6D? | B26A5D? | B0B5CD? | B23C0D? | File size related? |
| 0x48 | 1 | 7F | ? |
| 0x49 | 2 | 9EF6 | 9EF6 | 9CC4 | 9EF6 | 9EF6 | 9CC4 | 9EF6 | 9EF6 | 9CC4 | Upgrade file related? |
| 0x4B | 2 | 8482 | ? |
| 0x4D | 1 | 9F | B7 | B7 | 9F | B7 | B7 | 9F | B7 | B7 | Version related? |
| 0x4E | 53 | FF8B85A5089288AA11998BAF1AA08EB423A791B92CAE94BE35B597C33EBC9AC847C39DCD50CAA0D259D1A3D762D8A6DC6BDFB9E08B? | ? |
| 0x83 | 1 | 16 | 06 | 06 | 16 | 06 | 06 | 16 | 06 | 06 | Version related? |
| 0x84 | 13 | ACE67DE5E917A1F49C8C9FFA4A? | ? |
| 0x91 | 1 | 05 | 15 | 15 | 05 | 15 | 15 | 05 | 15 | 15 | Version related? |
Test Mode
There is a production test mode built into the firmware (bootloader?) whose usefulness at this point is unclear. It can be accessed through the following method:
- Turn the power on.
- Long-press the Hold button to set the hold on.
- While holding the Link button, press the buttons in the following order: Up → Down → Option → Up → Down → Right → Left → Right → Left → Left → Play/Pause → Option
- Long-press the Hold button to set the hold off to enter test mode.
To exit, hold the Back button for until the unit shuts off.
Docs
NW-A1000 service manual
NW-A3000 service manual
Both of these require registration. They contain tons of details regarding the components.
Insides
Useful Links
Forum thread
Copyright © by the contributing authors.
