dev builds
themes manual
device status forums
mailing lists
IRC bugs
dev guide

Search | Go
Wiki > Main > SamsungYPR0

Samsung YP-R0 Port Page

This port is intended to make rockbox work as an "hybrid" application, that runs on linux, but must control lot's of HW parameters by itself > Do NOT think as this port being something like an application for Android. It's the only application running on the device at a time...

Player Info

  1. CPU - ARM IMX37_Apollo (532MHz ARM1176JZF?-S core)
  2. Linux Kernel 2.6.24-2.4.2 - base (Opensource tools available : punch in "YP-R0" in search bar!)
  3. Firmware Encrypted 4 Parts: MBoot,Linux,RootFS,Sysdata each encrypted and output from MounEncrypt? >> into R0.ROM, MD5 Checksum created before Encryption -> now makes sense when installing new Firmware -> Checking needs time to decrypt, decompress, split and then check md5
  4. Player uses Whimory FTL (according to WhimoryFTL it may be version 2.2.1)
  5. Uses ALSA for PCM streaming. Both playback and record are working.
  6. 64 MB of RAM -> about 32 free after kernel is loaded -> plenty of space for RB
  7. CPU frequencies (200 MHz - 400 MHz - 532 MHz easily selectable using kernel's cpufreq)
  8. AS3543 audio codec
  9. SI4709 radio device
  10. SC900776 "minivet device" -> controls accessories/usb/recovery mode
  11. Partitions mounted: /mnt/media0 -> 4/8/16 GB user storage; /mnt/media1 -> about 64 mb, to store settings and modded sysdata; /mnt/mmc -> mount point for SD card
  12. Other interesting block devices -> /dev/stl1, contains region code, RTC time diff, and other things. Should be even usable for most of the space (lot isn't used by R0 application)
  13. IMX37 has both VPU and IPU, for decoding and manipulating videos and images respectively.

For other informations, just wait I'll copy from my piratenpad page (lots of info)

Port Status

The port is now nearly stable. It is usable for the everyday usage (tested since months now...). No particular HW/SW issues, just some aspects to be improved and implemented.

To compile, you need a complete arm-linux gcc toolchain. You can build it using (takes a looong time, since glibc needs to be build as well).

driver status comments
LCD 100% Standard Linux framebuffer device. ~1200 FPS fullscreen
Backlight 100% Works fine so far. Explore the possibility of LCD sleep during backlight off to save power
Buttons 95% Keymap needs some love, but is largely OK. Multiple keypresses through GPIO module are working fine.
Audio 100% Playback seems to work rather flawlessy audio-driver wise (using standard alsalib). Volume handling is seperately implemented since alsalib doesnt offer this. For this we directly communicate with the as3543 audio codec. The same driver that SansaAMS uses is used, through ascodec API.
FM Radio 100% FM Radio is supported using a custom kernel module. RDS works too.
Recording 0% It is possible to record radio. AS3543 initialization works perfectly. Need to write down the ALSA recording wrapper.
Power Management 90% Charging, voltage readout and charger status are working. We save power by using the ondemand cpu governor the Linux kernel provides. Runtime is about 25 hrs. Space for improvements?
USB 50% We provide a early/safe USB mode in the patched firmware so the OF isn't needed. However there's no USB cable detection in Rockbox yet. Also, doing USB from within Rockbox is desirable to avoid reboots. Special care is needed to close open files before we make a connection, since the USB device cannot be exposed with open handles.
Storage 50% Storage handled by Linux. However, we need to mount the sdcard ourself (TODO)
Plugins 90% All plugins should work and have a keymap. But some actually don't.


These instructions are to setup rockbox entirely using our official tools and the Samsung rom. Unfortunately, they are complex. An alternative is to use a modified Samsung ROM:

Installation Guide Using Rockbox Tools

Download the latest rockbox build:

And extract it to the players root folder.

After that we need to prepare the firmware to be able to launch and run RockBox application.

What's needed:

  1. Original R0.ROM (v1.25):
  2. Rockbox git cloned into a folder of your choice
  3. Linux environment without particular dependencies, for sure you need basic dev-tools.


  1. Open a terminal and browse to utils/ypr0tools
  2. Copy the original R0.ROM file into this folder (for convenience)
  3. Execute the following commands from here (notice: paths may be different!)
  4. $ make
  5. $ ./ R0.ROM /tmp/romfiles
  6. $ sudo ./ files /tmp/romfiles # needs sudo
  7. $ ./ R0.ROM /tmp/romfiles
  8. After that, R0.ROM is patched and can load Rockbox. is a script to put into It's a small loader script that sets stuff up.

files/lib/modules/si4709.ko is a replacement kernel module for fm radio support, its source code is packaged in ./si4709.7z.

If these instructions are too complex, you can find other modified firmwares with more advanced functionalities that can load rockbox too, on ABI forum page dedicated to YP-R0:

(Note that does not support 3rd party firmware files, although many can be used to load the official rockbox build)

Internals (and disassembly)

(Right-click, View Image for a more detailed resolution)

You can find here a nice tutorial: [thanks to lebellium]

comparison.jpg comparison.jpg comparison.jpg


Here ( you can find the RockBox porting thread and the modded firmware. These ROMs are way more advanced that the official patched one: you can use the ROM which best fits your needs wink

Firmware structure

This player is based on linux. So, let's have a quick look at what is done at startup. When you turn the device on, MBoot (the bootloader) pushes some raw data to the screen: the Samsung logo. This can be easily found in the mboot binary. Then, linux kernel is loaded with the following parameters

noinitrd console=ttymxc0 root=/dev/bml2 rw rootfstype=cramfs

As you can see, ttymxc0 is the UART console (on IMX37) and /dev/bml2 is the block device that contains the cramfs (with all linux stuff + OF application executable and libs)

Once kernel is loaded, some Samsung modules are loaded, such as keypad handler and so on, and then OF application is launched.

MBoot has another important task: if R0.ROM is copied in the nand (precisely /dev/stl3 mounted - when system is fully loaded - as /mnt/media0), then the update process is started. It consists in a firmware checking stage (where CRC's are checked; lebellium told me if that fails device is anyway bricked because R0.ROM is not deleted :S) and then the real flashing procedure. I still don't know how this flashing works but basically is a raw copy from the decrypted rom data to the storages of /dev/bml1-2-3-4.

Firmware is composed by:

  1. MBoot: bootloader, manages startup + device update and launches kernel
  2. zImage: compressed (or as I tested, also uncompressed) kernel image
  3. cramfs-fsl: image of a normal cramfs filesystem. Easy to unpack and repack through linux.
  4. SysData: contains resources stuff for OF application. It is mounted at /mnt/media1/Sysdata. If you extract it using a tool developed by user, you are able to see the content, modify it and repack it once again. Through safe mode of my modded firmware you can copy this content directly to media1/sysdata editing it in this folder. New resources will load instead of the "flashed" one wink

Software related interesting facts

Samsung uses a filesystem layer: RFS. Documentation is public available, source not but I found them on a chinese site hehe link:

Link about RFS used by the player:

Setting cpu to 200 MHz, using default application you will hear scratches while playing WITH backlight off. Interesting is that, if you set the backlight to stay on and you create a script that manages it instead of the OF app, you will not hear these scratches, thus:

  1. There is a low power mode somewhere (FOUND!!)
  2. Screen sleep produces that

Moreover original software is full of bugs everywhere stick out tongue

Bricked device

The Samsung tool has been leaked, more information below. I have used this tool lots of times and its 100% safe (even disconnecting cable during the process hasn't been a problem ever!!!)

TODOs and ideas

  1. USB: easy to make a connection using kernel tools. Easy to detect if cable is inserted or not (DONE).
  2. SD CARD: implement a way of controlling SD card mount/unmount, considering caching (hot swap).
  3. RECORDING: radio can be recorded implementing either an ALSA wrapper for that or working directly on i2c.


  1. using Samsung Opensource Tools, able to create new R0.ROM BOTH encryption and decryption are working
  2. I (Slade, Ed.) was able to decrypt firmware again its basically XOR, thanks to JeanLouis? which was restated at -> Next Step is to poke around until I am able to share rootfs and all other partions with USB (is done in the modded firmware - "Safe Mode")
  3. SysData.bin: there is a packer/unpacker. Cmd line version is both linux/windows. GUI version is unfortunately only for windowds, but that's not an issue, as we can mod it on the fly using "Safe Mode"
  4. MBoot.bin looks promising and interesting in Hexeditor
  5. it should be possible to abuse Mboot.bin to boot rockbox, I (Slade, Ed.) will compile with the hardware i already know, create a zImage as well es cramfs which is mandetory if we use regular firmware check and build a new firmware cloaked as Samsungs Firmware this means loss of original firmware


  1. Doom game doesn't work.
  2. Cube demo plugin makes the application to quit --> see the quit function, may interfere with another quit function!
  3. Rare crashes when pressing a button while backlight is off

Detect the player when connected to the USB port of a PC

USB-ID: 04e8:5124 Peculiar files / folders: 1 file: /RFS_LOG.LOG 1 folder: /My Pack 1 file: /Datacasts
I Attachment Action Size Date Who Comment
R0_disassembly_pictures_backup.zipzip manage 3189.0 K 02 Jan 2015 - 13:50 LudovicJacques R0 disassembly pictures backup from the ABI tutorial
r32 - 01 May 2017 - 11:45:30 - LorenzoMiori?

Parents: WebHome
Copyright by the contributing authors.