|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
DocumentationHere is the documentation for the IC's used:
TEA5767 radio FM moduleThe pinout is as fallows: Module is configured to comunicate over I2C and has address 0xC0.I2C comunicationI have attached logic analyzer to the I2C bus (pins described abowe). Without HDD connected (so firmware hangs on IDE access) the only communication on the bus is 0x34 0x0A 0x00 which looks like some command for DAC. I have partialy confirmed this by entering "Diagnostic mode" - no I2C communication, than selecting DAC test we see very the same sequence of bytes. According to WM8750 datasheet it means to unmute DAC which makes sense.Diagnostic modeYou can put player in sort of diagnostic mode by pressing both rec and play buttons at startup. There You can choose to test DAC, USB connection, DRAM, LCD and keys (ADC). Particulary interesting is the keys (ADC) test which gives some informations how buttons are hooked. Buttons change reading from ADC2 (it is second channel of scf5249 adc). Play button seems to have the highest priority but it also ends the test so the value it produces is unknown. Other keys priority are in order: rec>vol down>vol up>next>prev>select the readings are: 340>680>1060>1410>1750>2100. Untouched buttons gives reading about 2800. This is very similar to the Iriver H1xx. Moreover ADC1 and ADC4 seems to be related to headphone plug detection. When headphones are plugged reading from ADC1 and ADC4 is 000/2880 when jack is unplugged readings are 2900/0252. Looking through the firmware disasm ADC1 is related to the remote. ADC3 is related to battery voltage reading. In original firmware value from ADC3 is readed 20 times and mean value of the 10 highest readings is indicator of the battery condition.Firmware dissasemblyDisassembly of the firmwareScans of the PCB
r22 - 02 Apr 2021 - 20:46:06 - UnknownUser
Copyright © by the contributing authors.
|