The mi4 File Format

The mi4 file format is something PortalPlayer provides or supports, as numerous PortalPlayer based music players use that for firmware upgrades.

All glory to MrH for his hard digging on this.

mi4code is a tool for dealing with mi4 and BL files.

An extensive collection of most (if not all) existing firmwares for Sansa E200 an Sansa C200

mi4 file	decode	thanks to	BL file	Notes	mi4 md5sum
SanDisk Sansa View	OK	zivan56	BL rom	1.00.03	27124dcbe7425cf36314ae9d7454826a
SanDisk Sansa c200	OK	zefie	BL rom	1.00.06	7d4de4ac02f6c3d8aeff88c8872b08a5
SanDisk Sansa e200 (American)	OK		BL rom	1.00.12	2c11dc0b10f1393115c54b17b6278cd2
SanDisk Sansa e200 (American)	OK	lgianasi	BL rom	1.01.11A	8fbdfa44671e936bb2fffc9e11e8bedb
SanDisk Sansa e200 (American)	OK	matze	regular BL	1.02.15a	e83a74b44accc88f64f1e81039200442
SanDisk Sansa e200 (European)	OK	Dave Chapman	BL rom	1.00.12	86db01ed5175f2e18ff833baa9f2660c
SanDisk Sansa e250R	OK	Kpt Kill & MrH	BL btl	1.0.2.31	c9d7b92492ceddf8c32008e925aee5f4
iriver H10	OK		BL rom		d4f5cc4e52124249cd6880ae0c1cbae5
iriver H10 20GC/MTP	OK	Barry Wardell	BL hex		c57b2cf2a6b49dbbc43645fecee6a576
Medion MD 95x00	OK				8562a83695383a5f09290225d89ca68d
Philips HDD6330	FAIL			needs BL to decode	a58edfeb2745ac132119b3c9b5742a12
Philips HDD120/00	OK	Marcoen Hirschberg			a0393696971474cc73328426e482bf9e
Philips SA9200	OK	philips.com	BL	BL ripped from target	d384fe46e2e40ed80fef6a45ed1e2944
Virgin Electronics	OK		BL rom		318df5fecc7327fdc14620dc9885baf1
Tatung Elio M310	OK	Jason Simpson			e5e0c4f1d8f5a5e0db0494a9246966d0
Tatung Elio P722 #2	OK				f96200548d9923042345814d0fad0af9
Tatung Elio P810	FAIL			needs BL to decode	589641eff7c0ed70c3aaa96922bd3834
Tatung Elio TPJ-1022	OK	Dave Chapman		010201 using default key	2be6b2878ef8fd385aa8a52cbccefcb6
M-Audio MicroTrack 24/96	OK	Lee Koloszyc	BL rom		03795b6d92c385ea0559a1ef3a03973e
Aldi Pod	OK	Dave Hooper			79c23133c51b4f41f942a9b64692e3c7
Sirrius S50	FAIL	Lee Koloszyc		needs BL to decode	93a2d15aeeec7fba813bf3986d81e31c
Samsung YH-925GS	OK		BL rom		18d7d69e823eacda37d5b154d2b59fb2
Samsung YH-820	OK				f40347a60d322193cb03154a7e61addb
Samsung YH-920	OK				3ed1bb882128ee26dbf6420da3245a9c
Samsung YH-925	OK	Benjamin Larsson			18d7d69e823eacda37d5b154d2b59fb2
MSI P610	OK		BL rom PRI + BL rom SEC		fcb868a7773384d1ee6282b9c40de60f
MSI P640	OK		BL rom		014848b3ed9e4e353d7b691d93311c05
Olympus MR-100	OK		BL rom		7417ee459d86e22d795240899441ef07

Reminder: arm-elf-objdump -D --target binary -marm PP5022.mi4.bin

Offset	What
0x00	32bit magic (50504f53 == "PPOS")
0x04	32bit indicating version as the 01030100 ones have bigger headers (0x44 bytes == includes DSA keys) than the 01020100 ones (0x1C bytes).
0x08	32bit number, The length of actual data used within the file (beyond this point the files seems to be zero-padded). However, the last 32bit word of the data always is 0xaa55aa55 and the bootloader checks it.
0x0C	32bit crc32 (starting polynomial 0xEDB88320) over the firwmare image starting at index 0x200 (with initial value of 0 and without pre- and post-conditioning). This value seems to not get checked for 010301 versions.
0x10	32bit encryption algorithm ID (or similar). The bootloader will skip the decryption if the value here is zero, use TEA if the value is two and fail if the value is any other.
0x14	32bit file size of the mi4 (even 0x400 bytes)
0x18	32bit length of the plaintext part. The YH-920 mi4 file has zero there. Every other file has it 0x200. Most bootloaders seems to be OK with this value being the entire file's size and thus effectively removing encryption.
0x1C-0x2F 0x30-0x43	Two 160bit DSA-related numbers. They are the signature (referred to as r and s in the literature). The public key (p, q, g and y) is in the BL. The private key (x) is not disclosed anywhere.

Other details:

there is a few "magic words" within the mi4 file that have to be correct for the BL to accept it. TODO: list them
the number at index 0x18 can be set to be the size of the entire mi4 file and thus totally avoid having the mi4 file encrypted - this is what we do in Rockbox when we generate mi4 files.
the DSA signature can be replaced with a "dummy" (by using mi4code) which is a fixed combination that is a known flaw in the DSA algorithm that is accepted by the Sansa e200 BL. This allows us to run any mi4 file without having to sign it with a "real" signature or patch the BL file to accept our own signature. In the Rhapsody BL, they removed this flaw.