Re: [Fwd: TOC hack and also a firmware hack idea]

Thanks to Matt Preston for forwarding this to me!


> -------- Original Message --------
> Subject: TOC hack and also a firmware hack idea
> Date: Sat, 17 May 2003 22:37:15 +0100
> From: Adam <[email protected]>
>
> Firmware
> ~~~~~~~~
> 
> Whilst doing some research I found that there is a flash ram chip,
> refered to by Sony (service manual) as IC804 (AK6417AM-E2) that can be
> programmed via the USB port when either this chip or the mainboard has
> been replaced.
> This requires a program called PatchWriter that some nice service
> engineer may leak some day. Or not.

I did spend a while playing phone tag with Sony, who eventually
said that only authorised repair centres could get hold of
PatchWriter.  I made a few enquiries with some service centres
picked at random, but they were generally totally unaware of
the software, and certainly unwilling to supply it to a mere
end user.

> The thing is, the mainboard is also for the N505 and i wonder if the
> reason this is refered to as patch data is because it merely tells
> software burnt into IC801 the configuration of the buttons, etc, rather
> than being the actual firmware.

The NVRAM just contains config data, user settings etc.  There's
an interesting article on minidisc.org on hacking the NVRAM
contents via service mode to "upgrade" an MZ505 to have some of
the functions of a MZ707, for example.  There's probably other
stuff that could be done too.

Also, if you read the description of how to use PatchWriter in
one of the service manuals, it's pretty evident that it's just 
storing config info.

The actual firmware is probably stored in the main system
controller... If I recall right, it's built around an ARM core
and those tend to have integrated ROM and RAM.

There is, however, a tantalising hint here:-
http://md-l.amulation.com/archive/200303/frm00011.html

which suggests that the firmware can be replaced, and that
with the correct firmware both ATRAC and PCM data can be
transferred both ways over USB.

It may be that the firmware is upgradable via USB (using a 
program like PatchWriter) or it may be a factory procedure
when the units are being built, using contacts on the main
board or something.

Pete.