Sony NW-A1000/1200/3000 Port Index

---

Introduction

This series of DAPs shares the same microprocessor as the iAudio X5/M5 series players. The firmware appears to be encrypted as there are no visible strings after the initial "NWA3000" and IDA-Pro doesn't seem to know what to do with it.

---

Port Status

There is no code written for this device. Things that need to be done are: find a way to recover from a bad flash and understanding the firmware files. Perhaps someone with a A1000/1200 could try booting with the drive removed to see what happens (the A3000 requires de-soldering 4 pins just to get at the HDD). I found a report that said holding the volume-up button while connecting to a PC would execute a recovery mode but haven't been able to confirm this.

---

Firmware Update

Sony NW-A1000 Firmware v2.01
Sony NW-A1000 Firmware v3.00
Sony NW-A1200 Firmware v2.01
Sony NW-A1200 Firmware v3.00
Sony NW-A3000 Firmware v2.01
Sony NW-A3000 Firmware v3.00

Firmware updates are performed by placing a NW_AX000.bin file in the root directory and restarting the player. For the v3 update, an extra file called NW_A3000.UPG is placed in the root as well. You can extract the files from the installer executables with common archive programs (7zip, WinRAR, etc).

---

Firmware Format

Address	Size in bytes	A1000v2	A1000v3	A1000v3UPG	A1200v2	A1200v3	A1200v3UPG	A3000v2	A3000v3	A3000v3UPG	Description
0x0	7	NWA1000			NWA1200			NWA3000			Model Name
0x7	2	5F00									Padding?
0x9	3	2B87A0	295810	2E02E0	2B87A0	2957C0	2E0290	2B87A0	295930	2E03F0	Total file size minus 4 Bytes
0xC	29	09080B0A1D152A77585981295B5ECA305E6393372F29C86B646DE54567									?
0x29	3	6AAE4C	677E3C	67E70C	6AAE4C	677E6C	6AE6BC	6AAE4C	677FDC	6AE41C	File size related?
0x2C	1	6A									?
0x2D	1	77	7F	7F	77	7F	7F	77	7F	7F	Version related?
0x2E	7	B7532B29990F70?									?
0x35	3	998961	97D911	994021	998961	97D941	994191	998961	97D8F1	994331	File size related?
0x38	5	7389954876									?
0x3D	1	8B	BB	BB	8B	BB	BB	8B	BB	BB	Version related?
0x3E	7	DB6FEA8265147C?									?
0x45	3	B26A5D?	B0BAED?	B23D1D?	B26A5D?	B0BA3D?	B23D6D?	B26A5D?	B0B5CD?	B23C0D?	File size related?
0x48	1	7F									?
0x49	2	9EF6	9EF6	9CC4	9EF6	9EF6	9CC4	9EF6	9EF6	9CC4	Upgrade file related?
0x4B	2	8482									?
0x4D	1	9F	B7	B7	9F	B7	B7	9F	B7	B7	Version related?
0x4E	53	FF8B85A5089288AA11998BAF1AA08EB423A791B92CAE94BE35B597C33EBC9AC847C39DCD50CAA0D259D1A3D762D8A6DC6BDFB9E08B?									?
0x83	1	16	06	06	16	06	06	16	06	06	Version related?
0x84	13	ACE67DE5E917A1F49C8C9FFA4A?									?
0x91	1	05	15	15	05	15	15	05	15	15	Version related?

---

Test Mode

There is a production test mode built into the firmware (bootloader?) whose usefulness at this point is unclear. It can be accessed through the following method:

1. Turn the power on.
2. Long-press the Hold button to set the hold on.
3. While holding the Link button, press the buttons in the following order: Up → Down → Option → Up → Down → Right → Left → Right → Left → Left → Play/Pause → Option
4. Long-press the Hold button to set the hold off to enter test mode.

To exit, hold the Back button for until the unit shuts off.

---

Docs

NW-A1000 service manual
NW-A3000 service manual

Both of these require registration. They contain tons of details regarding the components.

---

Insides

Item	A3000	A1000/1200	Docs
Microprocessor	SCF5250		ColdFire
DAC	BB TI 1772 5BM 188		http://www.digchip.com/datasheets/parts/datasheet/477/PCM1772RGAR.php?
Amp	AN17020A?-VB		http://www.datasheetcatalog.com/datasheets_pdf/A/N/1/7/AN17020A.shtml
32Mbit Flash	PL032J60BFI12		http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/S29PL127_129_064_032J_00_A6.pdf
SDRAM	K4M281633H-BG75	EDS1216AABH?-75-E/KM	http://www.alldatasheet.com/datasheet-pdf/pdf/118959/ELPIDA/EDS1216AABH.html
RTC	R2061K01?-E2		Datasheet
Power Control	Sony 55Y03 4802
Regulator	XC6219B302DR?	XC6219B282DR?
Acceleration sensor	HAAM-313B		http://www.hdk.co.jp/english/topics_e/tpc042_e.htm
TI Dual Analog Switch	SN74LVC2G66DCUR? x 2
TI (De)Multiplexer	TS5A3357DCUR?		http://www.alldatasheet.com/datasheet-pdf/pdf/111839/TI/TS5A3357DCUR.html
CMOS Schmitt Inverter	TC7SH14FU? (T5RSOYJF?) x 2		http://www.datasheetcatalog.com/datasheets_pdf/T/C/7/S/TC7SH14FU.shtml
Complex Programmable Logic Device	LC4128ZC-75MN132C-U5	LC4128ZC?-75MN132C
Boost Converter	TPS61045DRBR?
Boost Conveter	TPS61041DBVR?
?	S1R72003BOOA100
?	CXR710160-215GH
Drive	MK2008GAL? HDD	Unknown Microdrive

---

Useful Links

Forum thread

---