EEVblog Electronics Community Forum

Electronics => Repair => Topic started by: baltersice on July 25, 2017, 01:38:29 pm

Title: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: baltersice on July 25, 2017, 01:38:29 pm
I bought this portable audio recorder as non-functional, hoping for an easy repair. But I got something else :palm:

https://www.youtube.com/watch?v=tdyWXhP1kHI (https://www.youtube.com/watch?v=tdyWXhP1kHI)

It freezes at the startup screen, or at the "connect as USB microphone" menu. If I had to guess, I'd say a firmware update was interrupted.
But I cannot re-flash the firmware because that screen doesn't come up either.

On zoomforum.us (http://www.zoomforum.us/viewtopic.php?p=175509&sid=0e96fe037aeeaffacaff719ac3d5844f#p175509) a similar problem is described and an answer from their support is quoted:
Quote
Interesting problem. Not one I've come across before. Certainly not with links to iTunes. The only occasion that was somewhat similar is when a customer performing an upgrade used failing batteries that caused corruption of the Boot Program. That unit had to be fitted with a new digital main board (DMB). The only customer repair procedure, renewing its system file, he's done. The unit will need to be returned here for service , labour will be £ 33.00 and parts as necessary. Worst case, a new DMB, £67.50. Best case, re-programming the flash RAM boot file on that board, £0.

I asked again (because the post above is 6 years old) but didn't get anything.
Quote
Thank you for contacting us with your question. Unfortunately we do not have any service manuals or schematics available for our products, nor do we have any component level technicians who would be able to assist with this service.

So I guess I'm on my own ... or am I? ;)

(http://i.imgur.com/RbbBsms.jpg)

Well I have taken it apart (beautiful construction, made in japan) and underneath the SD card slot I found a TI TMS320 DSP and a rather large flash chip (cFeon 16 Megabit (2048K x 8-bit / 1024K x 16-bit) Flash Memory
Boot Sector Flash Memory, CMOS 3.0 Volt-only) Well the latest firmware update file is about 14.6 Mbit, so it might just be what I was looking for ...

I also have a few high pin count devices like an Arduino Mega and an FPGA board, so I think I should be able to talk to that thing.
But here is my problem: I bet the firmware image (https://zoom-na.com/sites/default/files/products/downloads/software/H4n_v1.90E.zip) is encoded somehow or needs to be written to certain locations in the memory.

And before starting to solder in 48 tiny wires I thought I'd ask if I am on the right track at all ...

Thank you :-+




On another board there is also a NEC 78k0 series microcontroller (http://www.datasheetspdf.com/PDF/D78F0536/837892/1). It might be there only to operate the LCD and the buttons while the TMS320 runs the show, or it might the other way around and the TMS320 does only DSP things ...?
(http://i.imgur.com/LkoGLzo.jpg)
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: Zucca on July 25, 2017, 03:15:29 pm
I know that feeling, how many time I bought something on ebay and  it was a disaster? Buy a used one, dump it out the FW and then resell it on Ebay..
If the FW is bricked, you need first a good FW image.
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: baltersice on July 25, 2017, 03:22:08 pm
Good idea, thank you!
But I spent 20 bucks on this one, so it is fun.
If I pay 150 for a used working one, it's an investment  :-/O
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: baltersice on August 19, 2017, 08:11:06 pm
Sorry for bumping this old thing, but I might have made a bit of progress:

I have desoldered the flash chip (https://www.maritex.com.pl/product/attachment/37448/EN29LV160B.pdf) and attached it to an Arduino Mega.

(http://i.imgur.com/hc8oxzH.jpg)

I know that the flash chip wants VCC around 3.3V and the Arduino is a 5V device, but I am running it on 4.3V I am running it at 4.3V]https://www.youtube.com/watch?v=HCxsXx1QqWs]I am running it at 4.3V (https://www.youtube.com/watch?v=HCxsXx1QqWs) and I have added resistors to all digital pins, hoping that the flash chip might have internal ovp diodes. If I end up destroying it, that would be ok ... I have tried ... moving on.

(http://i.imgur.com/c2y6AA3.png)

But so far it doesn't seem destroyed, just a slightly confused maybe? Trying to read the contents with this program (https://pastebin.com/sqt97AmG) I am getting different byte values by adding small delay(1); calls at different places. Like between setting the address and reading the byte. Same happens when I change the serial baud rate. I have tried to toggle the output_enable pin every time I am changing the adress, but that hasn't helped.

In the long I am hoping to find that somewhere on that chip the data just stops, like when the user disconnected power during firmware update. Then I could try to find the bytes in the firmware .bin file and manually copy it over. Doesn't even have to be perfect, just enough to get through the built-in firmware updater.
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: baltersice on August 21, 2017, 07:33:42 am
I am now getting consistent data out of the chip. My mistake was using Arduino Pin 1, which has an internal function assigned.
That is more than I had hoped to accomplish, but it is still far from done.
Using a hex editor I am occasionally finding readable content in the firmware file (https://zoom-na.com/sites/default/files/products/downloads/software/H4n_v1.90E.zip):
Code: [Select]
(.G.E.N.E.R.A.L.). . ...C.O.M.P.2.(.V.O.C.A.L.). . . . ...C.O.M.P.3.(.D.R.U.M.). . . . . ...L.I.M.I.T.1.(.G.E.N.E.R.A.L.). ...L.I.M.I.T.2.(.C.O.N.C.E.R.T.). ...L.I.M.I.T.3.(.S.T.U.D.I.O.)
But not in the data I read from the chip. And that is no surprise because I don't even know if I got all the lsb ... msb orders right, or I might have to invert the bits I am reading ... or ... or

I am getting the most reasonable output (as in few unknown, newline, tab symbols) using this Arduino program:

Code: [Select]
void loop() {
  char reading = 0;
 
  if (address == 2097152)
    while(1)
      delay(1);

   if (address%16==0){
    Serial.println();
    Serial.print(address);
    Serial.print(" ");
   }

  for (uint8_t i = 0; i < 21; i++)
    digitalWrite(adress[i], bitRead(address, i));

  for (uint8_t i = 0; i < 8; i++)
    bitWrite(reading,i,!digitalRead(inputs[7-i]));

  Serial.print(reading);
  Serial.print(" ");
 
  address++;
}

Any ideas?
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: baltersice on August 23, 2017, 08:36:19 am
Even though nobody seems to read this, I'll see it through to the end ::)

I have now managed to get readable data from the flash chip: https://drive.google.com/file/d/0B6S_PcWWM1YlQm9HVFc0Y2Z0NWM/view?usp=sharing (https://drive.google.com/file/d/0B6S_PcWWM1YlQm9HVFc0Y2Z0NWM/view?usp=sharing)
Starting at byte 50688 approximately there seem to be a few error messages, like
Code: [Select]
R.e.g.r.e.s.s.i.o.n. .T.e.s.t. .E.r.r.o.r or
Code: [Select]
S.Y.S.T.E.M. .E.R.R.O.R.!Probably just templates for stuff, that may be displayed, and not the cause of my problems, right?
I didn't find a sudden end in the data tough, which would have confirmed my power-loss during update theory. However it is still possible, if they erased only a sector somewhere and then interrupted rewriting it.

The firmware .bin file (only a newer version was available) has a lot of similarities in both structure and data: https://drive.google.com/file/d/0B6S_PcWWM1YlX002enBmajRROUk/view?usp=sharing

Now my next problem is: Does it make sense to try and write the firmware.bin file to the chip? If yes, which is the first byte and where do I put it?
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: Zucca on August 23, 2017, 10:50:11 am
Even though nobody seems to read this, I'll see it through to the end ::)

At least 100 people are reading this, no worries.

Probably just templates for stuff, that may be displayed, and not the cause of my problems, right?

Right, seems reasonable to me.

Does it make sense to try and write the firmware.bin file to the chip?

Yes, why not? You can not damage any further an already bad FW image.

If yes, which is the first byte and where do I put it?

I don't know, try are learn from what happen next. May be the flash chip itself is brocken....
Ah, Don't you have a scope?

I never lose. I either win or learn. "Nelson Mandela"
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: DaJMasta on August 23, 2017, 09:32:37 pm
+1 to I think rewriting the chip would be the way to go - worst case, nothing changes... but even if that's true, you can probably continue to rewrite until something else happens.

Could also give you some insight into whether the chip is bad or not, and odds are good you can find a suitable replacement chip, even if it's not the exact one used.
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: Zucca on August 24, 2017, 06:36:51 am
with a scope you can check if the rising/falling edge of the flash chip are sharp... if not that chip is toasted which could also explain why you were getting not consistens readings from it.
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: tahitibob57 on September 21, 2018, 07:14:50 pm
Hello. I have the same problem. Did you find the problem?
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: baltersice on September 21, 2018, 07:46:45 pm
Nope, sorry, have tossed it into scrap box  :(
Title: Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Post by: Chris56000 on September 27, 2018, 12:47:00 pm
Hi!

May be a pot–shot in the dark, but have you tried formatting a small SD card (512 MB or smaller) to FAT16, loading the  latest known good firmware file available onto it, inserting it in your player with the power off/battery disconnected, then leaving it 30 min before powering up again?

(You'll have to resolder the flash–chip back or fit a new one first, tho!)

If the bootloader is still intact, this might help!

Chris Williams