Re: MPeye HTS-150
Hi, any progress on this one, or responses from the manufacturer? I couldn't find any recent information on the wikis. Ronald On Tue, 13 Dec 2005 12:50:21 +0100, Tim Schmidt [EMAIL PROTECTED] wrote: Hey guys, I've put up a page documenting the insides of the MPeye / Touchstone Technology HTS-150 (HTS-100 v2.2) MP3 / WMA / OGG player at http://narrow-band.net/wiki/index.php/Rockbox_on_the_MPeye_/_Touchstone_Technology_HTS-150_MP3_Player It appears to be similar to the iRiver H3xx units while only a fraction of the price (I got mine used for $45 on ebay). It has some excellent features like a built-in FM tuner, a line in and a mic to record from, USB2, a rechargable li-ion battery, it charges from the USB port, and easy firmware upgrades (basically you copy the firmware file to a specific directory on the hard disk and re-boot the player). It's cheap and featurefull, and begging to run rockbox. If anyone's interested in porting it to this player I'll assist in any way possible -- again, I've already put up quite a few photos on the wiki page (I have more and at higher resolution), I'm willing to test any sort of software, and I've compiled my fair share of kernels, userspace software, etc. --tim
Re: MPeye HTS-150
On 12/22/05, Ronald Teune [EMAIL PROTECTED] wrote: Hi, any progress on this one, or responses from the manufacturer? I couldn't find any recent information on the wikis. Ronald I'm in the middle of another embedded project (fortunately a somewhat simpler one) working with some Netgear WGT634U's. Then there's the hollidays, and school starts on Jan 12th after that. Sometime soon I'll get around to looking a bit more in depth at the firmware upgrade(s) and the player itself (still need to see what's under the LCD). Until then, there are a few more chips that could due with being identified on the wiki, I'm still unaware of anyone successfully contacting the manufacturer, so that's an option for further work, and anyone who can find one of these beasts cheap and send one to someone a bit more capable with low level work than I (read: knows assembler from line noise) would be a hero in my book. I still think this is an important player to get rockbox on if for no other reason than it's price. No other player has similar horsepower at this pricepoint, let alone with a 128x128 greyscale screen and an FM radio. I'll continue to work on it, but it will take time. That's what the wiki is for more than anything else, it's my extended memory. --tim
Re: MPeye HTS-150
Tim Schmidt wrote: Updated the Wiki page again (http://narrow-band.net/wiki/index.php/Rockbox_on_the_MPeye_/_Touchstone_Technology_HTS-150_MP3_Player) with some findings... It looks like the firmware upgrade file isn't encrypted (as far as I can tell -- not that far really). Anyone care to take a look at it? The strings dump you show indeed looks like it isn't encrypted... Do you have a link to the firmware file? Or can you upload it somewhere? Tomas
Re: MPeye HTS-150
The strings dump you show indeed looks like it isn't encrypted... Do you have a link to the firmware file? Or can you upload it somewhere? The latest firmware is available from MPeye at: http://mpeye.co.kr/file3/05_HTS_100.zip --tim
Re: MPeye HTS-150
On Wed, 14 Dec 2005, Tim Schmidt wrote: The latest firmware is available from MPeye at: http://mpeye.co.kr/file3/05_HTS_100.zip That is truely revealing. I played a little with it and I would say that it is likely that the addresses spaces in use are at 0x1000 and 0x30c. Possibly one of them are the flash and the other the ram. (using 'm68k-elf-objdump -mm68k -D -b binary HTS_100.frg' of course to dissassemble it) The most used subroutines (by grepping for 'jsr'): 199 0x30c45424 172 0x12cc 82 0x30c71370 81 0x30c557ac 63 0x1340 61 0x30c4fa10 61 0x30c4f7bc 60 0x30c70efc Perhaps the start of the .frg file can be what should be at address 0x1000 since at index 340 (the fifth most commonly called jsr) there seems to be a tiny function that moves data from d0 to the stack and then it calls 0x30c4f7bc. It looks like some kind of function dispatcher that could be actual code. I'm not sure this is actually usable for anything, but here it is! ;-) -- Daniel Stenberg -- http://www.rockbox.org/ -- http://daniel.haxx.se/
Re: MPeye HTS-150
That is truely revealing. I played a little with it and I would say that it is likely that the addresses spaces in use are at 0x1000 and 0x30c. Possibly one of them are the flash and the other the ram. (using 'm68k-elf-objdump -mm68k -D -b binary HTS_100.frg' of course to dissassemble it) The most used subroutines (by grepping for 'jsr'): 199 0x30c45424 172 0x12cc 82 0x30c71370 81 0x30c557ac 63 0x1340 61 0x30c4fa10 61 0x30c4f7bc 60 0x30c70efc Perhaps the start of the .frg file can be what should be at address 0x1000 since at index 340 (the fifth most commonly called jsr) there seems to be a tiny function that moves data from d0 to the stack and then it calls 0x30c4f7bc. It looks like some kind of function dispatcher that could be actual code. I'm not sure this is actually usable for anything, but here it is! ;-) Based on the descriptions of the player's function that I've found on-line, while playing, it supposedly spins up the disk, copies several megabytes of data to it's ram as a buffer, and then spins down the disk. In other words, the ram is there as a buffer and not much else. Assuming the software executes in place on the flash (without needing to be copied to ram) that would make 0x1000 likely the beginning of ram and 0x30c the beginning of flash. Of course, I could be all wrong. --tim
Re: MPeye HTS-150
On Wed, 14 Dec 2005, Tim Schmidt wrote: Based on the descriptions of the player's function that I've found on-line, while playing, it supposedly spins up the disk, copies several megabytes of data to it's ram as a buffer, and then spins down the disk. In other words, the ram is there as a buffer and not much else. Well, that's a description that fits most (all?) disk-based music players. The question is only how much of the ram that is used for buffer and what else there is in there. I would say that the addresses used in the firmware indicates that there's code in at least parts of the ram. I would assume that executing in ram is faster than from flash. Of course the CF5249 also has 96KB internal ram. -- Daniel Stenberg -- http://www.rockbox.org/ -- http://daniel.haxx.se/
Re: MPeye HTS-150
Intersting data strings? I was looking at the HTS-150 Wiki and there are some interesting things there There's that whole message about using FP not enabled in this library. Use libcfp.a message, which seems interesting, and then there is this: A sibal jola jjajungna jakku ssang soriman nane!!! Does anyone have any idea what this could mean? Google search reveals little, but one page in a foreign language lists the string along with something related to the HTS player. Any ideas on what this is? -- Steve signature.asc Description: This is a digitally signed message part
Re: MPeye HTS-150
On Wed, 14 Dec 2005, Steve Moskovchenko wrote: A sibal jola jjajungna jakku ssang soriman nane!!! Does anyone have any idea what this could mean? According to Jungti1234 (Korean user on IRC), the phrase is roughly translated into motherfucker shit pair voice sounds constantly!!! What also might be interesting is that he also said that The company became dishonor. and MPeye was ruined. Whatever that means... (logged in today's dec-14-2004 IRC logs) -- Daniel Stenberg -- http://www.rockbox.org/ -- http://daniel.haxx.se/
Re: MPeye HTS-150
That's the BDM I mentioned. You need to connect a BDM wiggler to the CF5249. I'm sure Linus can offer some further advice on that (as he's the only one I know who's done that on a coldfire-based player), should you decide to go that route. The wiggler costs about 150USD the last time I checked. I take it that means something like this: http://warmcat.com/milksop/cheaptag.html won't work... Hmmm... I'm willing to spend a week researching how to build a cheap(er) cable but not really willing to spend $150 to get rockbox running on my $45 player... I'd just buy a $150 player that already supported rockbox. I'll start digging for information on BDM with that particular coldfire processor. As far as other users of this player go, I doubt there are that many. It seems to only have been sold widely in Korea and the UK. MPeye (the OEM) doesn't even have an english language website (www.mpeye.co.kr). At any rate, I've got enough to start working on it. I'll at least take a good long look at the firmware upgrade and see what I can find about BDM. --tim
Re: MPeye HTS-150
The wiggler costs about 150USD the last time I checked. I take it that means something like this: http://warmcat.com/milksop/cheaptag.html won't work... Hmmm... I'm willing to spend a week researching how to build a cheap(er) cable but not really willing to spend $150 to get rockbox running on my $45 player... I'd just buy a $150 player that already supported rockbox. Afair, you can build a BDM probe if you have more time and EE skills than money. It's a simple circuit, one PAL chip or so, with documented content. Perhaps somebody here can produce a few for the other coldfire hackers. Jörg -- 10 GB Mailbox, 100 FreeSMS/Monat http://www.gmx.net/de/go/topmail +++ GMX - die erste Adresse für Mail, Message, More +++
Re: MPeye HTS-150
Jerry Van Baren wrote: Not a coldfire, but in the same family: http://cmp.felk.cvut.cz/~pisa/m683xx/bdm_driver.html These are MPC8xx interfaces, but the coldfire is probably similar: http://bdm4gdb.sourceforge.net/ http://www.vas-gmbh.de/software/mpcbdm/ The Coldfire BDM interface is a little different, and requires that the signals are synchronous to the PSTCLK clock. A wiggler designed for MPC8xx or CPU32 won't work. Check here for a BDM driver that is compatible with the PE wiggler: http://sourceforge.net/projects/bdm Linus
Re: MPeye HTS-150
It just appeared to me that this thing might be similar to to the Xclef or its clones: http://www.rockbox.org/twiki/bin/view/Main/XclefInfo BTW, what form factor of disk is inside? The wide-spread PCB suggests it's not so small. My pictures didn't do it justice... The drive is approximately 1.5 square, with rubber bumbers on each corner. The entire player is 2 x 3 7/16 x 11/16 (sorry, didn't have a CM ruler handy). The MPeye website claims it weighs 70g and I believe them. It's incredibly light. --tim
Re: MPeye HTS-150
The Coldfire BDM interface is a little different, and requires that the signals are synchronous to the PSTCLK clock. A wiggler designed for MPC8xx or CPU32 won't work. Check here for a BDM driver that is compatible with the PE wiggler: http://sourceforge.net/projects/bdm Thanks for the info. I'll keep looking. Worst case scenario I'm taking a few EE classes next semester and I'll see what I can do then about building my own. I'll also contact MPeye (and hope that someone there speaks english or can decipher computer-translated korean) and see if they're willing to cooperate. If they are, what should I ask them for? The procedure for making a new firmware image and bootloader information are two big items, anything else? --tim
Re: MPeye HTS-150
Hi, I'll also contact MPeye (and hope that someone there speaks english or can decipher computer-translated korean) and see if they're willing to cooperate. I can do that for you... I don't have the device myself... but I would love to help with this port. We can suggest them to start selling it in Europe with rockbox as an option, that might make it sell way better. If they are, what should I ask them for? The procedure for making a new firmware image and bootloader information are two big items, anything else? Hardware info (they might know more than we can see). The firmware code would be nice, but we don't need it... It's just handy to take a look at it some times. And if they do want to sell it claiming a rockbox player then I guess they'll have to do support for it too.. but that's far far away from now. Tomas
Re: MPeye HTS-150
I can do that for you... I don't have the device myself... but I would love to help with this port. Alright. Feel free ;) Their website is at www.mpeye.co.kr here's the sitemap: http://www.mpeye.co.kr/common/sitemap_01.php --tim
