Author Topic: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist  (Read 4748 times)

0 Members and 1 Guest are viewing this topic.

Offline baltersice

  • Regular Contributor
  • *
  • Posts: 63
  • Country: de
I bought this portable audio recorder as non-functional, hoping for an easy repair. But I got something else :palm:



It freezes at the startup screen, or at the "connect as USB microphone" menu. If I had to guess, I'd say a firmware update was interrupted.
But I cannot re-flash the firmware because that screen doesn't come up either.

On zoomforum.us a similar problem is described and an answer from their support is quoted:
Quote
Interesting problem. Not one I've come across before. Certainly not with links to iTunes. The only occasion that was somewhat similar is when a customer performing an upgrade used failing batteries that caused corruption of the Boot Program. That unit had to be fitted with a new digital main board (DMB). The only customer repair procedure, renewing its system file, he's done. The unit will need to be returned here for service , labour will be £ 33.00 and parts as necessary. Worst case, a new DMB, £67.50. Best case, re-programming the flash RAM boot file on that board, £0.

I asked again (because the post above is 6 years old) but didn't get anything.
Quote
Thank you for contacting us with your question. Unfortunately we do not have any service manuals or schematics available for our products, nor do we have any component level technicians who would be able to assist with this service.

So I guess I'm on my own ... or am I? ;)



Well I have taken it apart (beautiful construction, made in japan) and underneath the SD card slot I found a TI TMS320 DSP and a rather large flash chip (cFeon 16 Megabit (2048K x 8-bit / 1024K x 16-bit) Flash Memory
Boot Sector Flash Memory, CMOS 3.0 Volt-only) Well the latest firmware update file is about 14.6 Mbit, so it might just be what I was looking for ...

I also have a few high pin count devices like an Arduino Mega and an FPGA board, so I think I should be able to talk to that thing.
But here is my problem: I bet the firmware image is encoded somehow or needs to be written to certain locations in the memory.

And before starting to solder in 48 tiny wires I thought I'd ask if I am on the right track at all ...

Thank you :-+




On another board there is also a NEC 78k0 series microcontroller. It might be there only to operate the LCD and the buttons while the TMS320 runs the show, or it might the other way around and the TMS320 does only DSP things ...?
« Last Edit: July 25, 2017, 01:56:19 pm by baltersice »
 

Offline Zucca

  • Supporter
  • ****
  • Posts: 3278
  • Country: it
  • EE meid in Itali
I know that feeling, how many time I bought something on ebay and  it was a disaster? Buy a used one, dump it out the FW and then resell it on Ebay..
If the FW is bricked, you need first a good FW image.
« Last Edit: July 26, 2017, 07:10:58 am by zucca »
Can't know what you don't love. St. Augustine
Can't love what you don't know. Zucca
 
The following users thanked this post: baltersice

Offline baltersice

  • Regular Contributor
  • *
  • Posts: 63
  • Country: de
Good idea, thank you!
But I spent 20 bucks on this one, so it is fun.
If I pay 150 for a used working one, it's an investment  :-/O
 

Offline baltersice

  • Regular Contributor
  • *
  • Posts: 63
  • Country: de
Sorry for bumping this old thing, but I might have made a bit of progress:

I have desoldered the flash chip and attached it to an Arduino Mega.



I know that the flash chip wants VCC around 3.3V and the Arduino is a 5V device, but I am running it on 4.3V and I have added resistors to all digital pins, hoping that the flash chip might have internal ovp diodes. If I end up destroying it, that would be ok ... I have tried ... moving on.



But so far it doesn't seem destroyed, just a slightly confused maybe? Trying to read the contents with this program I am getting different byte values by adding small delay(1); calls at different places. Like between setting the address and reading the byte. Same happens when I change the serial baud rate. I have tried to toggle the output_enable pin every time I am changing the adress, but that hasn't helped.

In the long I am hoping to find that somewhere on that chip the data just stops, like when the user disconnected power during firmware update. Then I could try to find the bytes in the firmware .bin file and manually copy it over. Doesn't even have to be perfect, just enough to get through the built-in firmware updater.
« Last Edit: August 19, 2017, 08:13:26 pm by baltersice »
 

Offline baltersice

  • Regular Contributor
  • *
  • Posts: 63
  • Country: de
I am now getting consistent data out of the chip. My mistake was using Arduino Pin 1, which has an internal function assigned.
That is more than I had hoped to accomplish, but it is still far from done.
Using a hex editor I am occasionally finding readable content in the firmware file:
Code: [Select]
(.G.E.N.E.R.A.L.). . ...C.O.M.P.2.(.V.O.C.A.L.). . . . ...C.O.M.P.3.(.D.R.U.M.). . . . . ...L.I.M.I.T.1.(.G.E.N.E.R.A.L.). ...L.I.M.I.T.2.(.C.O.N.C.E.R.T.). ...L.I.M.I.T.3.(.S.T.U.D.I.O.)
But not in the data I read from the chip. And that is no surprise because I don't even know if I got all the lsb ... msb orders right, or I might have to invert the bits I am reading ... or ... or

I am getting the most reasonable output (as in few unknown, newline, tab symbols) using this Arduino program:

Code: [Select]
void loop() {
  char reading = 0;
 
  if (address == 2097152)
    while(1)
      delay(1);

   if (address%16==0){
    Serial.println();
    Serial.print(address);
    Serial.print(" ");
   }

  for (uint8_t i = 0; i < 21; i++)
    digitalWrite(adress[i], bitRead(address, i));

  for (uint8_t i = 0; i < 8; i++)
    bitWrite(reading,i,!digitalRead(inputs[7-i]));

  Serial.print(reading);
  Serial.print(" ");
 
  address++;
}

Any ideas?
 

Offline baltersice

  • Regular Contributor
  • *
  • Posts: 63
  • Country: de
Even though nobody seems to read this, I'll see it through to the end ::)

I have now managed to get readable data from the flash chip: https://drive.google.com/file/d/0B6S_PcWWM1YlQm9HVFc0Y2Z0NWM/view?usp=sharing
Starting at byte 50688 approximately there seem to be a few error messages, like
Code: [Select]
R.e.g.r.e.s.s.i.o.n. .T.e.s.t. .E.r.r.o.r or
Code: [Select]
S.Y.S.T.E.M. .E.R.R.O.R.!Probably just templates for stuff, that may be displayed, and not the cause of my problems, right?
I didn't find a sudden end in the data tough, which would have confirmed my power-loss during update theory. However it is still possible, if they erased only a sector somewhere and then interrupted rewriting it.

The firmware .bin file (only a newer version was available) has a lot of similarities in both structure and data: https://drive.google.com/file/d/0B6S_PcWWM1YlX002enBmajRROUk/view?usp=sharing

Now my next problem is: Does it make sense to try and write the firmware.bin file to the chip? If yes, which is the first byte and where do I put it?
 

Offline Zucca

  • Supporter
  • ****
  • Posts: 3278
  • Country: it
  • EE meid in Itali
Even though nobody seems to read this, I'll see it through to the end ::)

At least 100 people are reading this, no worries.

Probably just templates for stuff, that may be displayed, and not the cause of my problems, right?

Right, seems reasonable to me.

Does it make sense to try and write the firmware.bin file to the chip?

Yes, why not? You can not damage any further an already bad FW image.

If yes, which is the first byte and where do I put it?

I don't know, try are learn from what happen next. May be the flash chip itself is brocken....
Ah, Don't you have a scope?

I never lose. I either win or learn. "Nelson Mandela"
« Last Edit: August 23, 2017, 10:51:54 am by zucca »
Can't know what you don't love. St. Augustine
Can't love what you don't know. Zucca
 
The following users thanked this post: baltersice

Offline DaJMasta

  • Super Contributor
  • ***
  • Posts: 2104
  • Country: us
    • medpants.com
+1 to I think rewriting the chip would be the way to go - worst case, nothing changes... but even if that's true, you can probably continue to rewrite until something else happens.

Could also give you some insight into whether the chip is bad or not, and odds are good you can find a suitable replacement chip, even if it's not the exact one used.
 

Offline Zucca

  • Supporter
  • ****
  • Posts: 3278
  • Country: it
  • EE meid in Itali
with a scope you can check if the rising/falling edge of the flash chip are sharp... if not that chip is toasted which could also explain why you were getting not consistens readings from it.
Can't know what you don't love. St. Augustine
Can't love what you don't know. Zucca
 

Offline tahitibob57

  • Newbie
  • Posts: 1
  • Country: fr
Hello. I have the same problem. Did you find the problem?
 

Offline baltersice

  • Regular Contributor
  • *
  • Posts: 63
  • Country: de
Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
« Reply #10 on: September 21, 2018, 07:46:45 pm »
Nope, sorry, have tossed it into scrap box  :(
 

Offline Chris56000

  • Frequent Contributor
  • **
  • Posts: 614
  • Country: gb
Re: Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist
« Reply #11 on: September 27, 2018, 12:47:00 pm »
Hi!

May be a pot–shot in the dark, but have you tried formatting a small SD card (512 MB or smaller) to FAT16, loading the  latest known good firmware file available onto it, inserting it in your player with the power off/battery disconnected, then leaving it 30 min before powering up again?

(You'll have to resolder the flash–chip back or fit a new one first, tho!)

If the bootloader is still intact, this might help!

Chris Williams
« Last Edit: September 27, 2018, 12:50:09 pm by Chris56000 »
It's an enigma that's what it is!! This thing's not fixed because it doesn't want to be fixed!!
 


Share me

Digg  Facebook  SlashDot  Delicious  Technorati  Twitter  Google  Yahoo
Smf