release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Wiki > Main > SonyNWAPort (compare)

Difference: SonyNWAPort (r6 vs. r5)

Sony NW-A1000/1200/3000 Port Index



Introduction

This series of DAPs shares the same microprocessor as the iAudio X5/M5 series players. The firmware appears to be encrypted as there are no visible strings after the initial "NWA3000" and IDA-Pro doesn't seem to know what to do with it.



Port Status

There is no code written for this device. Things that need to be done are: find a way to recover from a bad flash and understanding the firmware files. Perhaps someone with a A1000/1200 could try booting with the drive removed to see what happens (the A3000 requires de-soldering 4 pins just to get at the HDD). I found a report that said holding the volume-up button while connecting to a PC would execute a recovery mode but haven't been able to confirm this.



Firmware Update

Sony NW-A1000 Firmware v2.01
Sony NW-A1000 Firmware v3.00
Sony NW-A1200 Firmware v2.01
Sony NW-A1200 Firmware v3.00
Sony NW-A3000 Firmware v2.01
Sony NW-A3000 Firmware v3.00

Firmware updates are performed by placing a NW_AX000.bin file in the root directory and restarting the player. For the v3 update, an extra file called NW_A3000.UPG is placed in the root as well. You can extract the files from the installer executables with common archive programs (7zip, WinRAR, etc).



Firmware Format

AddressSize in bytesA1000v2A1000v3A1000v3UPGA1200v2A1200v3A1200v3UPGA3000v2A3000v3A3000v3UPGDescription
0x0 7 NWA1000 NWA1200 NWA3000 Model Name
0x7 2 5F00 Padding?
0x9 3 2B87A0 295810 2E02E0 2B87A0 2957C0 2E0290 2B87A0 295930 2E03F0 Total file size minus 4 Bytes
0xC 29 09080B0A1D152A77585981295B5ECA305E6393372F29C86B646DE54567 ?
0x29 3 6AAE4C 677E3C 67E70C 6AAE4C 677E6C 6AE6BC 6AAE4C 677FDC 6AE41C File size related?
0x2C 1 6A ?
0x2D 1 77 7F 7F 77 7F 7F 77 7F 7F Version related?
0x2E 7 B7532B29990F70? ?
0x35 3 998961 97D911 994021 998961 97D941 994191 998961 97D8F1 994331 File size related?
0x38 5 7389954876 ?
0x3D 1 8B BB BB 8B BB BB 8B BB BB Version related?
0x3E 7 DB6FEA8265147C? ?
0x45 3 B26A5D?B0BAED?B23D1D?B26A5D?B0BA3D?B23D6D?B26A5D?B0B5CD?B23C0D? File size related?
0x48 1 7F ?
0x49 2 9EF6 9EF6 9CC4 9EF6 9EF6 9CC4 9EF6 9EF6 9CC4 Upgrade file related?
0x4B 2 8482 ?
0x4D 1 9F B7 B7 9F B7 B7 9F B7 B7 Version related?
0x4E 53 FF8B85A5089288AA11998BAF1AA08EB423A791B92CAE94BE35B597C33EBC9AC847C39DCD50CAA0D259D1A3D762D8A6DC6BDFB9E08B? ?
0x83 1 16 06 06 16 06 06 16 06 06 Version related?
0x84 13 ACE67DE5E917A1F49C8C9FFA4A? ?
0x91 1 05 15 15 05 15 15 05 15 15 Version related?



Test Mode

There is a production test mode built into the firmware (bootloader?) whose usefulness at this point is unclear. It can be accessed through the following method:

  1. Turn the power on.
  2. Long-press the Hold button to set the hold on.
  3. While holding the Link button, press the buttons in the following order: Up → Down → Option → Up → Down → Right → Left → Right → Left → Left → Play/Pause → Option
  4. Long-press the Hold button to set the hold off to enter test mode.

To exit, hold the Back button for until the unit shuts off.



Docs

NW-A1000 service manual
NW-A3000 service manual

Both of these require registration. They contain tons of details regarding the components.



Insides

ItemA3000A1000/1200Docs
Microprocessor SCF5250ColdFire
DAC BB TI 1772 5BM 188http://www.digchip.com/datasheets/parts/datasheet/477/PCM1772RGAR.php?
Amp AN17020A?-VB http://www.datasheetcatalog.com/datasheets_pdf/A/N/1/7/AN17020A.shtml
32Mbit Flash PL032J60BFI12http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/S29PL127_129_064_032J_00_A6.pdf
SDRAM K4M281633H-BG75EDS1216AABH?-75-E/KM http://www.alldatasheet.com/datasheet-pdf/pdf/118959/ELPIDA/EDS1216AABH.html
RTC R2061K01?-E2 Datasheet
Power Control Sony 55Y03 4802  
Regulator XC6219B302DR?XC6219B282DR?  
Acceleration sensor HAAM-313Bhttp://www.hdk.co.jp/english/topics_e/tpc042_e.htm
TI Dual Analog Switch SN74LVC2G66DCUR? x 2  
TI (De)Multiplexer TS5A3357DCUR?http://www.alldatasheet.com/datasheet-pdf/pdf/111839/TI/TS5A3357DCUR.html
CMOS Schmitt Inverter TC7SH14FU? (T5RSOYJF?) x 2 http://www.datasheetcatalog.com/datasheets_pdf/T/C/7/S/TC7SH14FU.shtml
Complex Programmable Logic Device LC4128ZC-75MN132C-U5LC4128ZC?-75MN132C  
Boost Converter TPS61045DRBR?  
Boost Conveter TPS61041DBVR?  
? S1R72003BOOA100  
? CXR710160-215GH  
Drive MK2008GAL? HDD Unknown Microdrive  



Useful Links

Forum thread


r8 - 23 Sep 2008 - 01:51:08 - MarcGuay

Revision r6 - 13 Sep 2008 - 17:50 - MarcGuay
Revision r5 - 13 Sep 2008 - 16:02 - MarcGuay
Copyright by the contributing authors.