The Boot ROM Knows Everything

Reverse engineering the FiiO X1.

The FiiO X1 runs firmware written by HiBy on the µC/OS-II real-time kernel, on an Ingenic JZ4760B MIPS32 chip. The Rockbox port stalled; its developer wrote that he could not find the RAM setup. This series gets that setup out of the boot loader, dumps the NAND, decompiles the firmware, finds a hidden USB DAC mode, builds a patcher, and then spends a long time on why its EQ tables did not work.

  1. FiiO X1 boot ROM: running code on a JZ4760B with no RAM
  2. FiiO X1 DDR deadlock: reading RAM config from live registers
  3. FiiO X1 NAND dump: hwstub, fee1:dead and a 64-bit compiler
  4. FiiO X1 IPL decompiled: 8 KB of JZ4760B DDR init code
  5. FiiO X1 factory.x1: unsigned code execution from the SD card
  6. FiiO X1 NAND dump: 128 MB over USB, one block at a time
  7. FiiO X1 NAND map: fonts, plaintext and a stranger's music
  8. FiiO X1 NAND: 44 KB of high-entropy data, identified
  9. FiiO X1 firmware: a hidden USB DAC mode and a debug shell
  10. FiiO X1 firmware patcher: everything but the EQ
  11. FiiO X1 bootloader in Ghidra: 94 functions at the wrong base
  12. FiiO X1 EQ presets: floats in .data, not a NAND cache
  13. FiiO X1 Rockbox bootloader: 12 KB of SD, FAT32 and a menu
  14. FiiO X1 bare-metal audio: four GPIO offsets, all wrong
  15. FiiO X1 EQ table: seven register bytes my generator never read
  16. Carving a SQLite database from a FiiO X1's raw NAND
  17. FiiO X1 PCM5142 DSP blocks: the flat head I believed
  18. FiiO X1 FTL reversed: the map was in the OOB bytes I never dumped