The FiioX1 (and X3, X5) all come in the same firmware format, which seems like a modified version of the IHFS in ChinaChip. It contains sys.bin file which is the operating system and is scrambled. Tools to deal with this format can be found in the repository in utils/jz4760_tools.

Firmware Structure

The firmware structure in the following:

Header

File Table

Data

CRC

The sector size is 512 bytes.

Offset	Length	Comment
0x0	4	Magic value, always 0x49484653 or 'IHFS'
0x4	4	File system size in bytes ?
0x8	4	Header size in sectors, always 4
0xc	4	Unknown, padding ?
0x10	12	Date and time, in yyyymmddhhmm format
0x1c	4	Number of files
0x20	4	Unsure, CRC mode ? 0 would mean no CRC, 2 would mean 4-byte CRC at the end
0x24	12	Unknown, padding ?
0x30	8	Machine string
0x38	452	Padding
0x1fc	4	End of header, always 0x55aa55aa

Each file entry in the file table uses the following format.

Offset	Length	Comment
0x0	56	Filename
0x38	4	Data offset in sectors (relative to the beginning of the file)
0x3c	4	File size in bytes

Operating System

The firmware contains a sys.bin file which is the operating system. It is scrambled using 344-byte XOR key and is a MIPS binary with no header, apparently loaded at 0x80000000 (or 0x80001000 for the factory boot). The scrambling algorithm is implemented in utils/jz4760/packtools. The XOR table is in fact obtained as follows: it contains two copies of a 172-byte table, containing the lower 8-bit of the first 172 prime numbers.

-- AmauryPouly - 27 Aug 2015