fiio
- FiiO X1 FTL reversed: the map was in the OOB bytes I never dumped
The FiiO X1's flash translation layer rebuilds its block map from the spare bytes of each block's first page. My NAND dump kept 2,048 bytes a page.
- FiiO X1 PCM5142 DSP blocks: the flat head I believed
Three FiiO X1 firmware blocks the DAC loads per stream looked like passthrough filters, until the decoder read all 2,708 bytes of each one.
- Carving a SQLite database from a FiiO X1's raw NAND
One SQLite header in a FiiO X1's 128 MB NAND dump: a malformed carve, sqlite3 .recover, six of my own tracks and a previous owner's ten favourites.
- FiiO X1 EQ table: seven register bytes my generator never read
Decoding the FiiO X1's PCM5142 EQ coefficient table: the format was fine, the register bytes were not, and my first proof of the layout was wrong too.
- FiiO X1 bare-metal audio: four GPIO offsets, all wrong
A bare-metal sine-wave test for the FiiO X1's PCM5142 DAC built clean; two code reviews forced 16 fixes, including four GPIO offsets. None of it ran.
- FiiO X1 Rockbox bootloader: 12 KB of SD, FAT32 and a menu
A bare-metal dual-boot loader for the FiiO X1: SD reads, a FAT32 driver, a cache flush that review caught, 12,512 bytes. Built and reviewed, not yet run.
- FiiO X1 EQ presets: floats in .data, not a NAND cache
Ghidra shows the FiiO X1 never reads its eq.ini back: preset gains are floats in .data, reloaded each boot. Nine new presets showed after a factory reset.
- FiiO X1 bootloader in Ghidra: 94 functions at the wrong base
The FiiO X1's bootloader looked like 94 opaque functions until a re-import at 0x80600000: 237 functions, no integrity check, and its SDK source on GitHub.
- FiiO X1 firmware patcher: everything but the EQ
A Python patcher for the FiiO X1's x1.fw: config switches and a font swap flash fine; the EQ breaks the boot, breaks playback or lands one slot off.
- FiiO X1 firmware: a hidden USB DAC mode and a debug shell
The FiiO X1 shipped as a USB disk only, yet its firmware holds a USB Audio Class 2.0 DAC mode, switched off in its settings, and a hidden debug shell.