Do to the large amount of spam being introduced on the pmpLinux wiki, it will be shutdown and the good content translated into HTML. If you wish to submit content, email me. webmaster@shamrockman.net.
copy -c k -s s -d r -f rrbin
copy -c f -s s -d r -f rrbin
=iRiver Firmware details=
==Graphics file format==
===Header===
* Major Version (byte)
* Minor Version (byte)
* file size (8 bytes)
* padding (122 bytes) + 62byte ELF header
===Palette (YCbCr colorspace)===
First entry is for color 0, second is for color 1, etc.
* Y' (byte)
* Cb (byte)
* Cr (byte)
RGB conversion formula:
Y' = + 0.299 * R' + 0.587 * G' + 0.114 * B'
Cb = - 0.168736 * R' - 0.331264 * G' + 0.5 * B'
Cr = + 0.5 * R' - 0.418688 * G' - 0.081312 * B'
===Bitmap Image===
*Height (2 bytes)
*Width (2bytes)
*Image data
==Font file format==
*Major Version (byte)
*Minor Version (byte)
*[4h-6h]????
*Padding(126 bytes) + ELF header (62bytes)
*[184h-]font data
===Font storage===
*1 bit image
*8x8 image size
==Firmare Update==
===Header===
* Major Version (byte)
* Minor Version (byte)
* Bitmap Major Version (byte)
* Bitmap Minor Version (byte)
* CRC checksum (2 bytes) Program to calculate the CRC: [http://vic.magusz.net/pmp/checksum.c]
* Language (byte) #010974
----
In the middle of the firmware (#1C0020) begins partition snapshot - romfs.
Under Linux it is possible to mount this file system.
for mount:
machine:~$ strings -t d allimg.hex | grep rom1fs
1835040 -rom1fs-
machine:~$ losetup -o 1835040 /dev/loop0 allimg.hex
machine:~$ mount -t romfs /dev/loop0 /mnt/pmp
----
==sys.img Header== (offset 0x1c0010)
[0]Checksum?
[0xD](DWORD) ROM-FS image size
[0x11-EOF]ROM FS image.
Note: allimg.hex must be 4MB. Fill unused space with FF.
=Serial Port=
Look closely on the backside of the pmp's circut board. Notice the dots labeled txd, rxd, and gnd. wire those to your serial port. enjoy
It would be wise to put a "voltage translator" in between your computer and the PMP, so you dont fry anything. The computer uses 5v for comm, the PMP uses 1.6 and 3.3v.
Make sure your comm program is set to 115200 baud. Then to access rrload, hold down "enter" before turning the PMP on. Now enjoy.
Here are some pictures as proof:
http://shamrockman.net/pmp/image.php?filename=firmware/firmware2.JPG
http://shamrockman.net/pmp/image.php?filename=firmware/firmware3.JPG
http://shamrockman.net/pmp/image.php?filename=firmware/firmware4.JPG
The places to attach the wires from your computer to the PMP. You can use DGND instead of DGND2.
http://images.shamrockman.net/?filename=other/wires.jpg
=IRV Editing (Advanced folder browsing)=
The .irv file in the /iRiverSys/etc folder on the PMP contains info on the last directory opened for a browser (such as video, pictures, etc). And by opening this file up in notepad or a hex editor, you can change the path to /mnt/Root/../../ which will be parsed as / (the real root folder) of the PMP, allowing you to view the OS files.
[http://www.shamrockman.net/pmp/tmpFileRightNaviBack.irv A sample .irv file] (Place this in /iRiverSys/etc)
=Directory Read bug=
If a directory path is around 255 characters in windows, it causes the pmp to crash. The PMP uses /mnt/Root/%PATH_HERE% internally, so via windows, its possible to overflow the PMP with ~8 bytes, since windows refers to the PMP as $:\. More testing needs to be done to see if a JMP instruction can be embeded into a directory name.