release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Wiki > Main > SonyNWAPort (compare)

Difference: SonyNWAPort (r8 vs. r7)

Sony NW-A1000/1200/3000 Port Index



Introduction

This series of DAPs shares the same microprocessor as the iAudio X5/M5 series players. The firmware appears to be encrypted as there are no visible strings after the initial "NWA3000" and IDA-Pro doesn't seem to know what to do with it.



Port Status

There is no code written for this device. Things that need to be done are: find a way to recover from a bad flash and understanding the firmware files. Perhaps someone with a A1000/1200 could try booting with the drive removed to see what happens (the A3000 requires de-soldering 4 pins just to get at the HDD). I found a report that said holding the volume-up button while connecting to a PC would execute a recovery mode but haven't been able to confirm this.



USB Modes

When the unit is plugged in from the Off state, the bootloader skips the "Walkman" logo and tries to make a USB connection. It could be that this is a USB boot mode that could be used to recover from a bad firmware flash.



Firmware Update

Sony NW-A1000 Firmware v2.01
Sony NW-A1000 Firmware v3.00
Sony NW-A1200 Firmware v2.01
Sony NW-A1200 Firmware v3.00
Sony NW-A3000 Firmware v2.01
Sony NW-A3000 Firmware v3.00

Firmware updates are performed by placing a NW_AX000.bin file in the root directory and restarting the player. For the v3 update, an extra file called NW_A3000.UPG is placed in the root as well. You can extract the files from the installer executables with common archive programs (7zip, WinRAR, etc).



Firmware Format

AddressSize in bytesA1000v2A1000v3A1000v3UPGA1200v2A1200v3A1200v3UPGA3000v2A3000v3A3000v3UPGDescription
0x0 7 8 NWA1000 NWA1000_ NWA1200 NWA1200_ NWA3000 NWA3000_ Model Name
0x7 0x8 2 4 5F00 002B87A0 Padding? 00295810 002E02E0 002B87A0 002957C0 002E0290 002B87A0 00295930 002E03F0 Total file size minus 4 Bytes
0x9 0xC 3 29 2B87A0 09080B0A1D152A77585981295B5ECA305E6393372F29C86B646DE54567 295810 ? 2E02E0 2B87A0 2957C0 2E0290 2B87A0 295930 2E03F0 Total file size minus 4 Bytes
0xC 0x29 29 3 09080B0A1D152A77585981295B5ECA305E6393372F29C86B646DE54567 6AAE4C ? 677E3C 67E70C 6AAE4C 677E6C 6AE6BC 6AAE4C 677FDC 6AE41C File size related?
0x29 0x2C 3 1 6AAE4C 6A 677E3C ? 67E70C 6AAE4C 677E6C 6AE6BC 6AAE4C 677FDC 6AE41C File size related?
0x2C 0x2D 1 6A 77 ? 7F 7F 77 7F 7F 77 7F 7F Version related?
0x2D 0x2E 1 7 77 B7532B29990F70?7F ? 7F 77 7F 7F 77 7F 7F Version related?
0x2E 0x35 7 3 B7532B29990F70? 998961 ? 97D911 994021 998961 97D941 994191 998961 97D8F1 994331 File size related?
0x35 0x38 3 5 998961 7389954876 97D911 ? 994021 998961 97D941 994191 998961 97D8F1 994331 File size related?
0x38 0x3D 5 1 7389954876 8B ? BB BB 8B BB BB 8B BB BB Version related?
0x3D 0x3E 1 7 8B DB6FEA8265147C?BB ? BB 8B BB BB 8B BB BB Version related?
0x3E 0x45 7 3 DB6FEA8265147C B26A5D ? ? B0BAED?B23D1D?B26A5D?B0BA3D?B23D6D?B26A5D?B0B5CD?B23C0D? File size related?
0x45 0x48 3 1 B26A5D? 7F B0BAED? ? B23D1D?B26A5D?B0BA3D?B23D6D?B26A5D?B0B5CD?B23C0D? File size related?
0x48 0x49 1 2 7F 9EF6 ? 9EF6 9CC4 9EF6 9EF6 9CC4 9EF6 9EF6 9CC4 Upgrade file related?
0x49 0x4B 2 9EF6 8482 9EF6 ? 9CC4 9EF6 9EF6 9CC4 9EF6 9EF6 9CC4 Upgrade file related?
0x4B 0x4D 2 1 8482 9F ? B7 B7 9F B7 B7 9F B7 B7 Version related?
0x4D 0x4E 1 53 9F FF8B85A5089288AA11998BAF1AA08EB423A791B92CAE94BE35B597C33EBC9AC847C39DCD50CAA0D259D1A3D762D8A6DC6BDFB9E08B?B7 ? B7 9F B7 B7 9F B7 B7 Version related?
0x4E 0x83 53 1 FF8B85A5089288AA11998BAF1AA08EB423A791B92CAE94BE35B597C33EBC9AC847C39DCD50CAA0D259D1A3D762D8A6DC6BDFB9E08B? 16 ? 06 06 16 06 06 16 06 06 Version related?
0x83 0x84 1 13 16 ACE67DE5E917A1F49C8C9FFA4A?06 ? 06 16 06 06 16 06 06 Version related?
0x84 0x91 13 1 ACE67DE5E917A1F49C8C9FFA4A? 05 ? 15 15 05 15 15 05 15 15 Version related?
0x91 Last 4 bytes 1 4 05 2894D2CA 15 EEABE86D?15 39442C0A 05 4D85A12D 15 FE4A0643? 15 C50F2AC3? 05 BB0C205F?15 4A65D396 15 883397E4 Version ? related?



Test Mode

There is a production test mode built into the firmware (bootloader?) whose usefulness at this point is unclear. It can be accessed through the following method:

  1. Turn the power on.
  2. Long-press the Hold button to set the hold on.
  3. While holding the Link button, press the buttons in the following order: Up → Down → Option → Up → Down → Right → Left → Right → Left → Left → Play/Pause → Option
  4. Long-press the Hold button to set the hold off to enter test mode.

To exit, hold the Back button for until the unit shuts off.



Docs

NW-A1000 service manual
NW-A3000 service manual

Both of these require registration. They contain tons of details regarding the components.



Insides

ItemA3000A1000/1200Docs
Microprocessor SCF5250ColdFire
DAC BB TI 1772 5BM 188http://www.digchip.com/datasheets/parts/datasheet/477/PCM1772RGAR.php?
Amp AN17020A?-VB http://www.datasheetcatalog.com/datasheets_pdf/A/N/1/7/AN17020A.shtml
32Mbit Flash PL032J60BFI12http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/S29PL127_129_064_032J_00_A6.pdf
SDRAM K4M281633H-BG75EDS1216AABH?-75-E/KM http://www.alldatasheet.com/datasheet-pdf/pdf/118959/ELPIDA/EDS1216AABH.html
RTC R2061K01?-E2 Datasheet
Power Control Sony 55Y03 4802  
Regulator XC6219B302DR?XC6219B282DR?  
Acceleration sensor HAAM-313Bhttp://www.hdk.co.jp/english/topics_e/tpc042_e.htm
TI Dual Analog Switch SN74LVC2G66DCUR? x 2  
TI (De)Multiplexer TS5A3357DCUR?http://www.alldatasheet.com/datasheet-pdf/pdf/111839/TI/TS5A3357DCUR.html
CMOS Schmitt Inverter TC7SH14FU? (T5RSOYJF?) x 2 http://www.datasheetcatalog.com/datasheets_pdf/T/C/7/S/TC7SH14FU.shtml
Complex Programmable Logic Device LC4128ZC-75MN132C-U5LC4128ZC?-75MN132C  
Boost Converter TPS61045DRBR?  
Boost Conveter TPS61041DBVR?  
? S1R72003BOOA100  
? CXR710160-215GH  
Drive MK2008GAL? HDD Unknown Microdrive  



Useful Links

Forum thread


r8 - 23 Sep 2008 - 01:51:08 - MarcGuay

Revision r8 - 23 Sep 2008 - 01:51 - MarcGuay
Revision r7 - 16 Sep 2008 - 11:41 - MarcGuay
Copyright by the contributing authors.