dev builds
themes manual
device status forums
mailing lists
IRC bugs
dev guide

Search | Go
Wiki > Main > SonyNWAPort (r6)

Sony NW-A1000/1200/3000 Port Index


This series of DAPs shares the same microprocessor as the iAudio X5/M5 series players. The firmware appears to be encrypted as there are no visible strings after the initial "NWA3000" and IDA-Pro doesn't seem to know what to do with it.

Port Status

There is no code written for this device. Things that need to be done are: find a way to recover from a bad flash and understanding the firmware files. Perhaps someone with a A1000/1200 could try booting with the drive removed to see what happens (the A3000 requires de-soldering 4 pins just to get at the HDD). I found a report that said holding the volume-up button while connecting to a PC would execute a recovery mode but haven't been able to confirm this.

Firmware Update

Sony NW-A1000 Firmware v2.01
Sony NW-A1000 Firmware v3.00
Sony NW-A1200 Firmware v2.01
Sony NW-A1200 Firmware v3.00
Sony NW-A3000 Firmware v2.01
Sony NW-A3000 Firmware v3.00

Firmware updates are performed by placing a NW_AX000.bin file in the root directory and restarting the player. For the v3 update, an extra file called NW_A3000.UPG is placed in the root as well. You can extract the files from the installer executables with common archive programs (7zip, WinRAR, etc).

Firmware Format

Address Size in bytes A1000v2 A1000v3 A1000v3UPG? A1200v2 A1200v3 A1200v3UPG? A3000v2 A3000v3 A3000v3UPG? Description
0x0 7 NWA1000 NWA1200 NWA3000 Model Name
0x7 2 5F00 Padding?
0x9 3 2B87A0 295810 2E02E0 2B87A0 2957C0 2E0290 2B87A0 295930 2E03F0 Total file size minus 4 Bytes
0xC 29 09080B0A1D152A77585981295B5ECA305E6393372F29C86B646DE54567 ?
0x29 3 6AAE4C 677E3C 67E70C 6AAE4C 677E6C 6AE6BC 6AAE4C 677FDC 6AE41C File size related?
0x2C 1 6A ?
0x2D 1 77 7F 7F 77 7F 7F 77 7F 7F Version related?
0x2E 7 B7532B29990F70? ?
0x35 3 998961 97D911 994021 998961 97D941 994191 998961 97D8F1 994331 File size related?
0x38 5 7389954876 ?
0x3D 1 8B BB BB 8B BB BB 8B BB BB Version related?
0x3E 7 DB6FEA8265147C? ?
0x45 3 B26A5D? B0BAED? B23D1D? B26A5D? B0BA3D? B23D6D? B26A5D? B0B5CD? B23C0D? File size related?
0x48 1 7F ?
0x49 2 9EF6 9EF6 9CC4 9EF6 9EF6 9CC4 9EF6 9EF6 9CC4 Upgrade file related?
0x4B 2 8482 ?
0x4D 1 9F B7 B7 9F B7 B7 9F B7 B7 Version related?
0x4E 53 FF8B85A5089288AA11998BAF1AA08EB423A791B92CAE94BE35B597C33EBC9AC847C39DCD50CAA0D259D1A3D762D8A6DC6BDFB9E08B? ?
0x83 1 16 06 06 16 06 06 16 06 06 Version related?
0x84 13 ACE67DE5E917A1F49C8C9FFA4A? ?
0x91 1 05 15 15 05 15 15 05 15 15 Version related?

Test Mode

There is a production test mode built into the firmware (bootloader?) whose usefulness at this point is unclear. It can be accessed through the following method:

  1. Turn the power on.
  2. Long-press the Hold button to set the hold on.
  3. While holding the Link button, press the buttons in the following order: Up → Down → Option → Up → Down → Right → Left → Right → Left → Left → Play/Pause → Option
  4. Long-press the Hold button to set the hold off to enter test mode.

To exit, hold the Back button for until the unit shuts off.


NW-A1000 service manual
NW-A3000 service manual

Both of these require registration. They contain tons of details regarding the components.


Item A3000 A1000/1200 Docs
Microprocessor SCF5250 ColdFire
DAC BB TI 1772 5BM 188
Amp AN17020A?-VB
32Mbit Flash PL032J60BFI12
SDRAM K4M281633H-BG75 EDS1216AABH?-75-E/KM
RTC R2061K01?-E2 Datasheet
Power Control Sony 55Y03 4802  
Regulator XC6219B302DR? XC6219B282DR?  
Acceleration sensor HAAM-313B
TI Dual Analog Switch SN74LVC2G66DCUR? x 2  
TI (De)Multiplexer TS5A3357DCUR?
CMOS Schmitt Inverter TC7SH14FU? (T5RSOYJF?) x 2
Complex Programmable Logic Device LC4128ZC-75MN132C-U5 LC4128ZC?-75MN132C  
Boost Converter TPS61045DRBR?  
Boost Conveter TPS61041DBVR?  
? S1R72003BOOA100  
? CXR710160-215GH  
Drive MK2008GAL? HDD Unknown Microdrive  

Useful Links

Forum thread

r6 - 13 Sep 2008 - 17:50:20 - MarcGuay

Copyright by the contributing authors.