dev builds
themes manual
device status forums
mailing lists
IRC bugs
dev guide

Search | Go
Wiki > Main > TargetStatus > ShanlingQ1Port

Shanling Q1

Hardware summary

Component Model Notes
SoC X1000E 1.0GHz MIPS XBurst with 64MB of SIP LPDDR RAM
NAND ATO25D1GA 1 Gbit SPI NAND flash
DAC ES9218P  
PMU AXP192  
Fuel gauge CW2015  
LCD controller RM68090(?) some commands seem to match up
Touch controller FT6x06  
Bluetooth/WiFi BCM4343W(?) completely unverified
Battery ??? 1100 mAh

See also: IngenicX1000

Accessing the CPU boot ROM

Holding the middle button on the left side of the unit while plugging it into a USB port will enter USB boot mode, under the standard X1000 USB ID of a108:1000. It's possible to load Rockbox directly with ingenic_tools/usbboot.

Executing scripts on the OF

Creating the following two files on the SD card allows running a custom script instead of the player app:

The OF will execute factorytestapp as root if both files exist. (Note they must both be normal files.) This can be used to extract information from the running kernel by writing a script. After the script finishes the Q1 will hang in the splash screen so you have to wait sufficient time for your script to run, and then force power off by holding the power button. On the Q1's filesystem the SD card is mounted at /mnt/mmc, that can be used to save script outputs.

Example scripts

Get the contents of the root filesystem and kernel messages:

ls -lR / > /mnt/mmc/rootfs.txt
dmesg > /mnt/mmc/dmesg.txt

Dump the contents of the NAND flash partitions to the SD card (warning: this will take a while -- allow several minutes before powering off to ensure you get a complete dump).

nanddump -f /mnt/mmc/nand0.bin /dev/mtd0
nanddump -f /mnt/mmc/nand1.bin /dev/mtd1
nanddump -f /mnt/mmc/nand2.bin /dev/mtd2
nanddump -f /mnt/mmc/nand3.bin /dev/mtd3
nanddump -f /mnt/mmc/nand4.bin /dev/mtd4
nanddump -f /mnt/mmc/nand5.bin /dev/mtd5
nanddump -f /mnt/mmc/nand6.bin /dev/mtd6

# NOTE: these seem different from the ones above, and might not dump successfully
#nanddump -f /mnt/mmc/nand7.bin /dev/mtd7
#nanddump -f /mnt/mmc/nand8.bin /dev/mtd8

Kernel source

Shanling provided these links to their Linux kernel source. Both tarballs are identical and the code appears to be for the M0, with no reference to the Q1. According to Shanling this is correct, and they've stated the source for the players are "more or less identical". Based on some structs which have been changed from Ingenic's sources, this is indeed the case, but disassembling the Q1's kernel is still necessary to get some critical info like GPIOs.

I Attachment Action Size Date Who Comment
ubi_extract.shsh manage 1.8 K 12 May 2021 - 22:29 AidanMacDonald utility script to convert UBI root filesystem image to a tarball
r6 - 16 Jul 2021 - 00:01:21 - AidanMacDonald

Parents: TargetStatus
Copyright © by the contributing authors.