reverse-engineering
- FiiO X1 firmware patcher: everything but the EQ
A Python patcher for the FiiO X1's x1.fw: config switches and a font swap flash fine; the EQ breaks the boot, breaks playback or lands one slot off.
- FiiO X1 firmware: a hidden USB DAC mode and a debug shell
The FiiO X1 shipped as a USB disk only, yet its firmware holds a USB Audio Class 2.0 DAC mode, switched off in its settings, and a hidden debug shell.
- Terraria on the HTC Desire Z: a DRM loop and a dead edge
Terraria on an HTC Desire Z with Android 2.3: a license check that called itself, a signing key that broke installs, and an edge that never answers.
- FiiO X1 NAND: 44 KB of high-entropy data, identified
43,535 bytes at the start of the FiiO X1's boot resource partition looked encrypted. XOR, zlib and LZMA all failed; the firmware image named the file.
- FiiO X1 NAND map: fonts, plaintext and a stranger's music
Mapping a raw FiiO X1 NAND dump: the firmware found in one search, no PN scrambling, 25 MB of fonts that pass for code, and an old owner's music.
- FiiO X1 NAND dump: 128 MB over USB, one block at a time
A bare-metal SD dumper for the FiiO X1 that never ran, and the hwstub shell loop that copied all 128 MB of its NAND flash overnight with zero read errors.
- FiiO X1 factory.x1: unsigned code execution from the SD card
The FiiO X1's X-Boot loader jumps into any factory.x1 on the SD card on its recovery path: XOR-scrambled with a public prime key, never signed.
- FiiO X1 IPL decompiled: 8 KB of JZ4760B DDR init code
Decompiling the FiiO X1's 8 KB IPL in Ghidra: warm resume, a UART log nobody reads, 64-step DQS calibration and the real DDR timings.
- FiiO X1 NAND dump: hwstub, fee1:dead and a 64-bit compiler
Dumping the FiiO X1's IPL from NAND after every ingenic-boot route failed: Rockbox hwstub cross-built for the JZ4760B, shimmed for Lua 5.4.
- FiiO X1 DDR deadlock: reading RAM config from live registers
A warm reboot into the FiiO X1's USB boot mode left its JZ4760B DDR controller configured: its live registers gave up the config, clocks and DQS value.