Sony NW-A1000/1200/3000 Port Index

---

Introduction

This series of DAPs shares the same microprocessor as the iAudio X5/M5 series players. The firmware appears to be encrypted as there are no visible strings after the initial "NWA3000" and IDA-Pro doesn't seem to know what to do with it.

---

Port Status

There is no code written for this device. Things that need to be done are: find a way to recover from a bad flash and understanding the firmware files. Perhaps someone with a A1000/1200 could try booting with the drive removed to see what happens (the A3000 requires de-soldering 4 pins just to get at the HDD). I found a report that said holding the volume-up button while connecting to a PC would execute a recovery mode but haven't been able to confirm this.

---

USB Modes

When the unit is plugged in from the Off state, the bootloader skips the "Walkman" logo and tries to make a USB connection. It could be that this is a USB boot mode that could be used to recover from a bad firmware flash.

---

Firmware Update

Sony NW-A1000 Firmware v2.01
Sony NW-A1000 Firmware v3.00
Sony NW-A1200 Firmware v2.01
Sony NW-A1200 Firmware v3.00
Sony NW-A3000 Firmware v2.01
Sony NW-A3000 Firmware v3.00

Firmware updates are performed by placing a NW_AX000.bin file in the root directory and restarting the player. For the v3 update, an extra file called NW_A3000.UPG is placed in the root as well. You can extract the files from the installer executables with common archive programs (7zip, WinRAR, etc).

---

Firmware Format

Address	Size in bytes	A1000v2	A1000v3	A1000v3UPG	A1200v2	A1200v3	A1200v3UPG	A3000v2	A3000v3	A3000v3UPG	Description
0x0	8	NWA1000_			NWA1200_			NWA3000_			Model Name
0x8	4	002B87A0	00295810	002E02E0	002B87A0	002957C0	002E0290	002B87A0	00295930	002E03F0	Total file size minus 4 Bytes
0xC	29	09080B0A1D152A77585981295B5ECA305E6393372F29C86B646DE54567									?
0x29	3	6AAE4C	677E3C	67E70C	6AAE4C	677E6C	6AE6BC	6AAE4C	677FDC	6AE41C	File size related?
0x2C	1	6A									?
0x2D	1	77	7F	7F	77	7F	7F	77	7F	7F	Version related?
0x2E	7	B7532B29990F70									?
0x35	3	998961	97D911	994021	998961	97D941	994191	998961	97D8F1	994331	File size related?
0x38	5	7389954876									?
0x3D	1	8B	BB	BB	8B	BB	BB	8B	BB	BB	Version related?
0x3E	7	DB6FEA8265147C									?
0x45	3	B26A5D	B0BAED	B23D1D	B26A5D	B0BA3D	B23D6D	B26A5D	B0B5CD	B23C0D	File size related?
0x48	1	7F									?
0x49	2	9EF6	9EF6	9CC4	9EF6	9EF6	9CC4	9EF6	9EF6	9CC4	Upgrade file related?
0x4B	2	8482									?
0x4D	1	9F	B7	B7	9F	B7	B7	9F	B7	B7	Version related?
0x4E	53	FF8B85A5089288AA11998BAF1AA08EB423A791B92CAE94BE35B597C33EBC9AC847C39DCD50CAA0D259D1A3D762D8A6DC6BDFB9E08B									?
0x83	1	16	06	06	16	06	06	16	06	06	Version related?
0x84	13	ACE67DE5E917A1F49C8C9FFA4A									?
0x91	1	05	15	15	05	15	15	05	15	15	Version related?
Last 4 bytes	4	2894D2CA	EEABE86D	39442C0A	4D85A12D	FE4A0643	C50F2AC3	BB0C205F	4A65D396	883397E4	?

---

Test Mode

There is a production test mode built into the firmware (bootloader?) whose usefulness at this point is unclear. It can be accessed through the following method:

1. Turn the power on.
2. Long-press the Hold button to set the hold on.
3. While holding the Link button, press the buttons in the following order: Up → Down → Option → Up → Down → Right → Left → Right → Left → Left → Play/Pause → Option
4. Long-press the Hold button to set the hold off to enter test mode.

To exit, hold the Back button for until the unit shuts off.

---

Docs

NW-A1000 service manual
NW-A3000 service manual

Both of these require registration. They contain tons of details regarding the components.

---

Insides

Item	A3000	A1000/1200	Docs
Microprocessor	SCF5250		ColdFire
DAC	BB TI 1772 5BM 188		http://www.digchip.com/datasheets/parts/datasheet/477/PCM1772RGAR.php?
Amp	AN17020A-VB		http://www.datasheetcatalog.com/datasheets_pdf/A/N/1/7/AN17020A.shtml
32Mbit Flash	PL032J60BFI12		http://www.amd.com/us-en/assets/content_type/white_papers_and_tech_docs/S29PL127_129_064_032J_00_A6.pdf
SDRAM	K4M281633H-BG75	EDS1216AABH-75-E/KM	http://www.alldatasheet.com/datasheet-pdf/pdf/118959/ELPIDA/EDS1216AABH.html
RTC	R2061K01-E2		Datasheet
Power Control	Sony 55Y03 4802
Regulator	XC6219B302DR	XC6219B282DR
Acceleration sensor	HAAM-313B		http://www.hdk.co.jp/english/topics_e/tpc042_e.htm
TI Dual Analog Switch	SN74LVC2G66DCUR x 2
TI (De)Multiplexer	TS5A3357DCUR		http://www.alldatasheet.com/datasheet-pdf/pdf/111839/TI/TS5A3357DCUR.html
CMOS Schmitt Inverter	TC7SH14FU (T5RSOYJF) x 2		http://www.datasheetcatalog.com/datasheets_pdf/T/C/7/S/TC7SH14FU.shtml
Complex Programmable Logic Device	LC4128ZC-75MN132C-U5	LC4128ZC-75MN132C
Boost Converter	TPS61045DRBR
Boost Conveter	TPS61041DBVR
?	S1R72003BOOA100
?	CXR710160-215GH
Drive	MK2008GAL HDD	Unknown Microdrive

---

Useful Links

Forum thread

---