Recovering from loading your own buggy firmware

These instructions are for when you have flashed bad firmware you wrote yourself onto your device, and are unable to reflash a fixed version. If your player has become unresponsive and you didn't flash your own-built firmware, your player is likely broken and this guide will not help.

WARNING! These instructions are only to be used if you are sure your player is unrecoverable in any other way! Failing to follow these steps (or using them when not necessary) can result in a 100% dead piece of plastic!

--> Talk to us in IRC BEFORE attempting this procedure! <--

This only works on e200v2, Fuzev1, Fuzev2, Clipv1, Clipv2, Clip+ and Clip Zip (for now) !

Entering the recovery mode

The flash of the player can be directly accessed via USB with the following method:

• Take the player completely apart
• Search for the two open solder pads near the bottom left corner of NAND flash (exact location varies depending the model, see pictures at the bottom)
• Make sure you got the right pads, if you accidentally bridge an unpopulated capacitor, the resulting short might destroy your player!
• Bridge them with a piece of wire or something
• Connect the player to your PC (preferably running Linux)
• Execute "sudo fdisk -l". It should report a drive without partitions, with a size of 979.75MB (approximately, there is some 1000/1024 Bytes rounding). If it reports 4MB, your flash is broken.
• Take away the wire bridging the two pads

If it doesn't works, try to repeat it several times.

You must make sure that the player was off before plugging the USB cable to the PC.

To do this you can unsolder the battery (if you are wanting to resolder it after the recovery).

Another method is: press quickly the power button to be sure the player is running if it wasn't already. Then keep pressing the power button a long time to trigger a hardware power-off.

Use the recovery mode

Now you can access the hidden part of the NAND flash over that drive (reported by fdisk).

You can write the whole OF-Image onto that by using e.g.:

dd if=orig_image.bin of=/dev/sde (replace orig_image.bin and sde with the actual filename and drive)

You can also dump the image from the player to your hard disk by using e.g.:

dd if=/dev/sde of=orig_image.bin bs=512 count=$((0xF000)) (count is 0x5000 for Clipv1/C200v2/M200v4, 0xf000 for others)

If you are somehow unsure with some step, just get in contact with us on IRC

Hacking

This might work on other models too (m200v4, c200v2)

The size of the drive is exactly the size reported in the CSD register before we enable bank switching and request the CSD register a second time (e.g. 0x1E9E00 sectors)

The size reserved by the OF is exactly twice the size of the firmware file when the reserved space is 0xF000 sectors (models with 8MB of ram)

It is exactly twice the size of the firmware file minus the header (2 sectors) when the reserved space is 0x5000 sectors (models with 2MB of ram)

Copying an OF image over this drive might not be enough to recover operation, you might need the full part reserved by OF.

I copied an OF (tried both patched and unpatched) on the recovery drive of a Fuzev1, rockbox would work correctly but OF would only power the backlight and do nothing.

After copying the full reserved data from another Fuzev1, it worked correctly -- RafaelCarre - 2010-06-01

Some people have recovered without an OF image. It might be enough to just zero the entire reserve space and then copy the OF firmware file back over the first part of the reserved space.

• Recovery pins for Clipv1:
  

• Recovery pins for Clipv2:
  

• Recovery pins for Clip+, use the two RED pins:
  

• Recovery pins for Clip Zip:
  

• Recovery pins for Fuzev1:
  

• Recovery pins for Fuzev2:
  

• Recovery pins for e200v2:
  

Original e200v2 picture by Daniel ( source)

Original Fuzev1, Clipv1 and Clip+ pictures copyright © 2005-2009 EnzoTen Media. All rights reserved. ( source)