Sony NWZ-E460 Analysis

---

Overview

This page describes what we know about the Sony NWZ-E460 Series.

Dumps

Here are a few useful pieces of information:

In firmware upgrade mode:

• output of mount NOTE: the /contents file-system is mounted read-only, but the dumping script remounts in read-write mode.
• output of dmesg
• output of sysinfo
• output of mmcinfo map
• live content of FU initrd

Dumps were obtained using scripts in utils/nwztools/scripts in the repository.

History (aka Ode to AmauryPouly)

The NWZ-E460 was the very first Linux-based Sony player of which I successfully dumped the root filesystem. By removing the SonyNWZE460MMCBoard and hooking it up to a microcontroller, I was able to dump the entire flash. This allowed me to reverse engineer the upgrade and encryption code from the device. I was also able to reverse engineer the SCSI command, the NVP map. After bricking my device 2 times and recovering by rewriting parts of the eMMC using a microcontroller, I was able to create the vert first non-Sony firmware upgrade.

-- AmauryPouly - 17 Aug 2016