release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Search | Go
Wiki > Main > FiioX1 > FiioFirmware
The FiioX1 (and X3, X5) all come in the same firmware format, which seems like a modified version of the IHFS in ChinaChip. It contains sys.bin file which is the operating system and is scrambled. Tools to deal with this format can be found in the repository in utils/jz4760_tools.

Firmware Structure

The firmware structure in the following:

Header File Table Data CRC

The sector size is 512 bytes.

Offset Length Comment
0x0 4 Magic value, always 0x49484653 or 'IHFS'
0x4 4 File system size in bytes ?
0x8 4 Header size in sectors, always 4
0xc 4 Unknown, padding ?
0x10 12 Date and time, in yyyymmddhhmm format
0x1c 4 Number of files
0x20 4 Unsure, CRC mode ? 0 would mean no CRC, 2 would mean 4-byte CRC at the end
0x24 12 Unknown, padding ?
0x30 8 Machine string
0x38 452 Padding
0x1fc 4 End of header, always 0x55aa55aa

Each file entry in the file table uses the following format.

Offset Length Comment
0x0 56 Filename
0x38 4 Data offset in sectors (relative to the beginning of the file)
0x3c 4 File size in bytes

Operating System

The firmware contains a sys.bin file which is the operating system. It is scrambled using 344-byte XOR key and is a MIPS binary with no header, apparently loaded at 0x80000000 (or 0x80001000 for the factory boot). The scrambling algorithm is implemented in utils/jz4760/packtools. The XOR table is in fact obtained as follows: it contains two copies of a 172-byte table, containing the lower 8-bit of the first 172 prime numbers.

-- AmauryPouly - 27 Aug 2015

r4 - 02 Apr 2021 - 20:46:06 - UnknownUser


Parents: FiioX1
Copyright © by the contributing authors.