-
Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
Posted by baltersice on 25 Jul, 2017 13:38 -
I bought this portable audio recorder as non-functional, hoping for an easy repair. But I got something else
It freezes at the startup screen, or at the "connect as USB microphone" menu. If I had to guess, I'd say a firmware update was interrupted.
But I cannot re-flash the firmware because that screen doesn't come up either.
On zoomforum.us a similar problem is described and an answer from their support is quoted:QuoteInteresting problem. Not one I've come across before. Certainly not with links to iTunes. The only occasion that was somewhat similar is when a customer performing an upgrade used failing batteries that caused corruption of the Boot Program. That unit had to be fitted with a new digital main board (DMB). The only customer repair procedure, renewing its system file, he's done. The unit will need to be returned here for service , labour will be £ 33.00 and parts as necessary. Worst case, a new DMB, £67.50. Best case, re-programming the flash RAM boot file on that board, £0.
I asked again (because the post above is 6 years old) but didn't get anything.QuoteThank you for contacting us with your question. Unfortunately we do not have any service manuals or schematics available for our products, nor do we have any component level technicians who would be able to assist with this service.
So I guess I'm on my own ... or am I?
Well I have taken it apart (beautiful construction, made in japan) and underneath the SD card slot I found a TI TMS320 DSP and a rather large flash chip (cFeon 16 Megabit (2048K x 8-bit / 1024K x 16-bit) Flash Memory
Boot Sector Flash Memory, CMOS 3.0 Volt-only) Well the latest firmware update file is about 14.6 Mbit, so it might just be what I was looking for ...
I also have a few high pin count devices like an Arduino Mega and an FPGA board, so I think I should be able to talk to that thing.
But here is my problem: I bet the firmware image is encoded somehow or needs to be written to certain locations in the memory.
And before starting to solder in 48 tiny wires I thought I'd ask if I am on the right track at all ...
Thank you
On another board there is also a NEC 78k0 series microcontroller. It might be there only to operate the LCD and the buttons while the TMS320 runs the show, or it might the other way around and the TMS320 does only DSP things ...?
-
I know that feeling, how many time I bought something on ebay and it was a disaster? Buy a used one, dump it out the FW and then resell it on Ebay..
If the FW is bricked, you need first a good FW image. -
Good idea, thank you!
But I spent 20 bucks on this one, so it is fun.
If I pay 150 for a used working one, it's an investment
-
Sorry for bumping this old thing, but I might have made a bit of progress:
I have desoldered the flash chip and attached it to an Arduino Mega.
I know that the flash chip wants VCC around 3.3V and the Arduino is a 5V device, but I am running it on 4.3V and I have added resistors to all digital pins, hoping that the flash chip might have internal ovp diodes. If I end up destroying it, that would be ok ... I have tried ... moving on.
But so far it doesn't seem destroyed, just a slightly confused maybe? Trying to read the contents with this program I am getting different byte values by adding small delay(1); calls at different places. Like between setting the address and reading the byte. Same happens when I change the serial baud rate. I have tried to toggle the output_enable pin every time I am changing the adress, but that hasn't helped.
In the long I am hoping to find that somewhere on that chip the data just stops, like when the user disconnected power during firmware update. Then I could try to find the bytes in the firmware .bin file and manually copy it over. Doesn't even have to be perfect, just enough to get through the built-in firmware updater. -
I am now getting consistent data out of the chip. My mistake was using Arduino Pin 1, which has an internal function assigned.
That is more than I had hoped to accomplish, but it is still far from done.
Using a hex editor I am occasionally finding readable content in the firmware file:Code: [Select](.G.E.N.E.R.A.L.). . ...C.O.M.P.2.(.V.O.C.A.L.). . . . ...C.O.M.P.3.(.D.R.U.M.). . . . . ...L.I.M.I.T.1.(.G.E.N.E.R.A.L.). ...L.I.M.I.T.2.(.C.O.N.C.E.R.T.). ...L.I.M.I.T.3.(.S.T.U.D.I.O.)
But not in the data I read from the chip. And that is no surprise because I don't even know if I got all the lsb ... msb orders right, or I might have to invert the bits I am reading ... or ... or
I am getting the most reasonable output (as in few unknown, newline, tab symbols) using this Arduino program:Code: [Select]void loop() {
char reading = 0;
if (address == 2097152)
while(1)
delay(1);
if (address%16==0){
Serial.println();
Serial.print(address);
Serial.print(" ");
}
for (uint8_t i = 0; i < 21; i++)
digitalWrite(adress[i], bitRead(address, i));
for (uint8_t i = 0; i < 8; i++)
bitWrite(reading,i,!digitalRead(inputs[7-i]));
Serial.print(reading);
Serial.print(" ");
address++;
}
Any ideas? -
Even though nobody seems to read this, I'll see it through to the end
I have now managed to get readable data from the flash chip: https://drive.google.com/file/d/0B6S_PcWWM1YlQm9HVFc0Y2Z0NWM/view?usp=sharing
Starting at byte 50688 approximately there seem to be a few error messages, likeCode: [Select]R.e.g.r.e.s.s.i.o.n. .T.e.s.t. .E.r.r.o.rorCode: [Select]S.Y.S.T.E.M. .E.R.R.O.R.!Probably just templates for stuff, that may be displayed, and not the cause of my problems, right?
I didn't find a sudden end in the data tough, which would have confirmed my power-loss during update theory. However it is still possible, if they erased only a sector somewhere and then interrupted rewriting it.
The firmware .bin file (only a newer version was available) has a lot of similarities in both structure and data: https://drive.google.com/file/d/0B6S_PcWWM1YlX002enBmajRROUk/view?usp=sharing
Now my next problem is: Does it make sense to try and write the firmware.bin file to the chip? If yes, which is the first byte and where do I put it? -
Even though nobody seems to read this, I'll see it through to the end
At least 100 people are reading this, no worries.Probably just templates for stuff, that may be displayed, and not the cause of my problems, right?
Right, seems reasonable to me.Does it make sense to try and write the firmware.bin file to the chip?
Yes, why not? You can not damage any further an already bad FW image.If yes, which is the first byte and where do I put it?
I don't know, try are learn from what happen next. May be the flash chip itself is brocken....
Ah, Don't you have a scope?
I never lose. I either win or learn. "Nelson Mandela"
-
+1 to I think rewriting the chip would be the way to go - worst case, nothing changes... but even if that's true, you can probably continue to rewrite until something else happens.
Could also give you some insight into whether the chip is bad or not, and odds are good you can find a suitable replacement chip, even if it's not the exact one used. -
with a scope you can check if the rising/falling edge of the flash chip are sharp... if not that chip is toasted which could also explain why you were getting not consistens readings from it.
-
Hello. I have the same problem. Did you find the problem?
-
Nope, sorry, have tossed it into scrap box
-
Hi!
May be a pot–shot in the dark, but have you tried formatting a small SD card (512 MB or smaller) to FAT16, loading the latest known good firmware file available onto it, inserting it in your player with the power off/battery disconnected, then leaving it 30 min before powering up again?
(You'll have to resolder the flash–chip back or fit a new one first, tho!)
If the bootloader is still intact, this might help!
Chris Williams