front | blog | photos | contact | projects
The SanDisk Rockbox Connection
Rockbox SanDisk Connection Sansa e200 Pics Hacking Devboard e200tool mi4 File Format mi4code AMS Sansas Sansa View
SanDisk Initial Contact

On May 26th 2006, a person from SanDisk USA contacted the Rockbox team, asking about our interest to port Rockbox to their Sansa e200 series.

I responded and we exchanged a few mails about what we want and a little about what Rockbox is and how Rockbox is developed (open source, spare time hacking, reverse engineering, and all that), and what we really could use (== docs, schematics, source code etc) and would need to make a proper port to their players.

Eager fans obviously take every chance to submit very premature stories to news sites, proven by this Slashdot on June 2nd 2006 entry that pointed out a cnet.co.uk article which is based on a forum post I did in which I confirmed we talked to SanDisk. And that's all I confirmed. They made quite some hen out of that feather...

October 2006: SanDisk does not provide any help, docs or anything else that help us with this effort. They donated some hardware but then their part ended.

December 2006: Rockbox now has a working dual-boot bootloader that can start Rockbox or the original firmware. Rockbox starts and runs. LCD works, buttons work, scroll wheel works, accessing NAND flash works, playing games/running plugins work. There's still no sound, no USB and no battery charge level support etc.

March 10 2007: Rockbox now has sound on the SanDisk Sansa e200 series.

September 3 2007: Rockbox now works on the e200R Rhapsody models as well.

A Package Received from SanDisk

Our SanDisk friend put together a package and sent us. Archos Recorder, iriver h140, iAudio X5 and Sansa e200

In spite of UPS doing their best at throwing their lousy service at me, I managed to get the package in my hands.

I received the box with great hopes but with a suspicion things won't be as great as we'd like them to be.

At about 10 am on June 14th 2006 I opened the box and it contained:

Yes, there's a certain lack of... docs or any other developer's material.

In August I received a Sansa Devboard.

What We Did Not Get
I just want to stress this since people continue to ask:

We didn't get anything to help us actually make Rockbox to these players. We got two players, yes, but we got no info, no docs. No help at all.

First Impressions Sansa e200 Hardware
Archos Recorder, iriver h140, iAudio X5 and Sansa e200

e200 internals, and Rockbox's SandiskE200HardwareComponents

The box comes wrapped in amazingly endurable plastic that took quite some effort to break through.

I tested this on three techy persons: I put the player in their hand and said something about this is my new toy. All three had the same reaction: "wow, its heavy!". The unit certainly is strikingly heavy, but that also gives it a solid and reliable feeling. Review sites on the net claims it weights 2.6 oz (~75 grams). (Compare with iPod Nano's 42 grams, or Archos Ondio's 60 grams).

It can only be charged over USB since there's no other cable provided.

A nice detail is the user replacable battery, which also means the player seems easy enough to open up. I'll do that within shortly to get a better look of this toy. SanDisk claims the unit does 20 hours run-time.

The scroll wheel, while cool looking since it can glow, feels a bit plastic (in the negative sense).

First Impressions Sansa e200 Firmware
Archos Recorder, iriver h140, iAudio X5 and Sansa e200

Anyway, after inserting the cable I had troubles getting my computer to see the player in UMS mode all the way until I figured out I had to change the USB settings on the player which otherwise defaults to MTP mode...

It is a neat little thing. The screen is rotated (220x176 portrait mode 1.8") and there's a wheel thing that can light up. Both me and Linus liked the "WPS scroller" thing the firmware shows in all non-WPS screens when a song or radio is on, displaying what's currently playing.

Upgrading the firmware is done with an .exe file and I didn't check just yet exactly what it did, but it could figure out the version number of the player's firmware and it said "upgrading..." and while it said that the player's "connected" screen (which it says while in USB mode) changed to "writing".

... when it completed and I yanked the cable, the player rebooted itself and it said "upgrading firmware..." blabla and then rebooted again and came up fine.

The player indexed all my (new) music files on boot, and it only allows browsing the music using that mode.

It plays MP3, WMA and "secure WMA" according to the manual.

I could also mention that the CD that comes with the player contains the user's manual, a windows program for converting images/movies to the player (Sansa Media Converter) and Rhapsody which is said to be a "music management application".

First Objdumping the Firmware

To upgrade the player's firmware, you need to run a Windows exe and it stores four files in the root of the player's file system:

  Size   Name
  392248 BL_SD_boardSupportSD.rom
 5420032 PP5022.mi4
     512 VERSION.TXT
     512 version.sdk

$ cat VERSION.TXT
Version Info: Product Rev.: PP5022AF-05.51-S301-00.12-S301.00.12A-D
Base Code: 05.51-S301-00.12-S301.00.12A-D
ODM Ver.: S301-00.12-S301.00.12A-D
OEM Ver.: S301.00.12A-D
Build Type: -D
Build Date: 2006.03.29
Build Number: (Build 169.20)

$ cat version.sdk
#DO  NOT EDIT OR REMOVE THIS FILE
Product: e260
FW: 01.00.12A
Region: America
Build Date: 2006.03.29
Serial:

Both the version.* files were padded with zero-bytes to 512 bytes.

During the installation, the installer writes two slightly different .mi4 files to a temp directory. One called SKU_E and one called SKU_A. The SKU_A one is what gets installed on my player. Possibly America/Europe? Note above how my player is 'Region: America'.

The mi4 file seems to be a format commonly used by other (PortalPlayer based) players. For the fun of it, I compared the Sansa mi4 file with one for Philips HDD6320, for iriver H10 and for Samsung-925GS and they all indeed have many similarities.

The BL* files seems to have the ARM exception vectors already at offset 0, while in the .mi4 ones they start at offset 0x200. (iriver h10 uses BL_H10.rom and the Samsung uses BL_YH925.rom.)

Here's our mi4 research page. We've nailed it!

BL just have to stand for Boot Loader.

Funny detail: the file name above says PP5022, and the same string appears in all the four files. Nowhere does it say 5024, although this anythingbutipod review and this PP conference transcript claim the e200s feature a 5024. To verify, I pulled it apart and had a look for myself. "PP5024B-TCF" says the chip markings.

Database details

Another interesting note on this firmware in comparison with other PP-based ones: checking the sansa's file system there's a folder called SYSTEM/DATA that at the time I checked it looked like this:

$ ls -l
total 170
-rw-r--r-- 1 user group   8414 Feb 17  1980 PP5000.DAT
-rw-r--r-- 1 user group 144024 Jun 15 09:26 PP5000.HDR
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_@DEV.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_BUYF.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_FNAM.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_FPTH.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_FRMT.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_MGEN.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_MODF.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_MTPF.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_PCNT.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_RATG.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_TALB.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_TCON.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_TIT2.IDX
-rw-r--r-- 1 user group    396 Feb 17  1980 PP5000_TPE1.IDX

This is clearly the firmware's music/file database. It is strikingly similar to how the Samsung YH-925GS stores it and indeed also as the Philips. HDD 100/120 does... And iriver H10, for which there's gathered db format documented.

Linked to by this LWN article

I intend to update this page as I go.
Updated: January 28, 2014 08:58 (Central European, Stockholm Sweden)