release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Search | Go
Wiki > Main > TargetStatus > ShanlingQ1Port

Shanling Q1

Hardware summary

Component Model Notes
SoC X1000E 1.0GHz MIPS XBurst with 64MB of SIP LPDDR RAM
NAND ??? 1Gb based on the update package metadata
DAC ES9218P  
PMU AXP192 guessed from disassembly and testing with Rockbox
Fuel gauge CW2015  
LCD controller RM67162 / SSD2805c ? completely unconfirmed, but working in Rockbox anyway
Touch controller FT6x06  
Bluetooth/WiFi BCM4343W(?) based on the names of firmware blobs in the root filesystem
Battery ??? 1100 mAh

NOTE: the Shanling M0 is a very similar model which should share most of the same hardware, but with a different screen/button configuration.

Accessing the CPU boot ROM

Holding the middle button on the left side of the unit while plugging it into a USB port will enter USB boot mode, under the standard X1000 USB ID of a108:1000. It's possible to load Rockbox directly with ingenic_tools/usbboot.

Executing scripts on the OF

Creating the following two files on the SD card allows running a custom script instead of the player app:
/factory_test/a35c2bg0suw=rvbsug97z8#2fp
/factory_test/factorytestapp

The OF will execute factorytestapp as root if both files exist. (Note they must both be normal files.) This can be used to extract information from the running kernel by writing a script. After the script finishes the Q1 will hang in the splash screen so you have to wait sufficient time for your script to run, and then force power off by holding the power button. On the Q1's filesystem the SD card is mounted at /mnt/mmc, that can be used to save script outputs.

Example scripts

Get the contents of the root filesystem and kernel messages:
#!/bin/ash

ls -lR / > /mnt/mmc/rootfs.txt
dmesg > /mnt/mmc/dmesg.txt
sync

Dump the contents of the NAND flash partitions to the SD card (warning: this will take a while -- allow several minutes before powering off to ensure you get a complete dump). TODO: nand7 won't dump and the sizes don't add up properly, need to figure out why...
#!/bin/ash

nanddump -f /mnt/mmc/nand0.bin /dev/mtd0
nanddump -f /mnt/mmc/nand1.bin /dev/mtd1
nanddump -f /mnt/mmc/nand2.bin /dev/mtd2
nanddump -f /mnt/mmc/nand3.bin /dev/mtd3
nanddump -f /mnt/mmc/nand4.bin /dev/mtd4
nanddump -f /mnt/mmc/nand5.bin /dev/mtd5
nanddump -f /mnt/mmc/nand6.bin /dev/mtd6
nanddump -f /mnt/mmc/nand7.bin /dev/mtd7
nanddump -f /mnt/mmc/nand8.bin /dev/mtd8
sync

Kernel source

Shanling provided these links to their Linux kernel source. Both tarballs are identical and the code appears to be for the M0, with no reference to the Q1. According to Shanling this is correct, and they've stated the source for the players are "more or less identical". Based on some structs which have been changed from Ingenic's sources, this is indeed the case, but disassembling the Q1's kernel is still necessary to get some critical info like GPIOs.

I Attachment Action Size Date Who Comment
ubi_extract.shsh ubi_extract.sh manage 1.8 K 12 May 2021 - 22:29 AidanMacDonald utility script to convert UBI root filesystem image to a tarball
r4 - 06 Jun 2021 - 11:59:37 - AidanMacDonald


Parents: TargetStatus
Copyright © by the contributing authors.