| 
  • If you are citizen of an European Union member nation, you may not use this service unless you are at least 16 years old.

  • Finally, you can manage your Google Docs, uploads, and email attachments (plus Dropbox and Slack files) in one convenient place. Claim a free account, and in less than 2 minutes, Dokkio (from the makers of PBworks) can automatically organize your content for you.

View
 

Debricking

Page history last edited by Vasile 12 years, 3 months ago


Introduction

As with many embedded devices, it's possible to get your MG-35's internal firmware into a state whereby the unit won't work and can't be reflashed in the normal way. This process is usually called "bricking" and your media player is now "bricked" or a "brick". The reverse process is called "debricking" or "unbricking" and after performing it your MG-35 is "unbricked". As the manufacturers of embedded devices make the debricking process rather difficult and dependent on secret knowledge and undocumented connectors, stronger terms are used at times.

 

This serial approach to recovering your MG-35 will only work if the bootloader at the start of the flash is intact. If your unit died due to reflashing with firmware with a wrong kernel or disk image, then the loader should be OK. If it died due to loss of power during an erase/flash cycle, then you're probably out of luck. If your blue light flashes on power on, and never stops flashing, then you're probably OK with the approach here.

 

You will need:

 

Firing it up

If you connect the cable to a PC and fire up Hyperterminal (or similar) with the settings on 38400 for bit rate, no parity, one stop bit and xon/off handshaking (38400-8-N-1) you should see the serial loader messages as you power on the MG-35. If you don't, try swaping RX and TX and check your settings.

 

Here is roughly what you should see. Your output may look different if you have a different flash chip, and you may well see an error if your Linux kernel didn't decompress correctly due to it being corrupt.

  Jasper Bootloader v1.0.0 (Feb 10 2006 15:34:08)                                               
  Supports BootMenu Flash Network                                 
 This version of fips use micom with power control, version[3]                                                             
 Swapping erase regions for broken CFI table.                                            
 0031.0032 mfr 00ec id 2275 Top bootsector                                         
 Flash 0 at address 0x00000000                             
  ID : AMD/Fujitsu Standard                           
  Size : 4096 KB                
  Regions : 2             
    0 : 0x003e0000 - 0x00004000 *  8                                    
    1 : 0x00000000 - 0x00020000 * 31                                    
 0BF0IDENTIFY FAILED                   
 Inptr=
 00000014
 Inflating....
 Final Inptr=000A27FD
 Original LEN =0014BB48OutCnt = 0014BB48
 Original CRC =B1201065
 Computed CRC =B1201065
 01008000

 

Spansion Chips:

 Jasper Bootloader v1.0.0 (Oct 25 2007 14:54:35)
  Supports BootMenu Flash Network
This version of fips use micom with power control, version[3]
0031.0033 mfr 0001 id 22c4 Bottom bootsector
Flash 0 at address 0x00000000
  ID : AMD/Fujitsu Standard
  Size : 4096 KB
  Regions : 4
    0 : 0x00000000 - 0x00008000 *  1
    1 : 0x00008000 - 0x00004000 *  2
    2 : 0x00010000 - 0x00010000 *  1
    3 : 0x00020000 - 0x00020000 * 31
0BF0IDENTIFY FAILED

Inptr=
00000014
Inflating....

Final Inptr=00090743
Original LEN =001287ECOutCnt = 001287EC
Original CRC =AEF8FCA7
Computed CRC =AEF8FCA7
01008000

 

Login

 

To get access to the serial loader's menus, you have to send character on the serial interface to the MG35.Since the time window is very short, the easiest way is to press and hold the space key on the PC (in Hyperterminal) as you power up the MG-35. You will get a sign-on message which ends with "This version of fips..." and the MG35 is waiting for a pasword to be entered. Note there is no prompt to enter this string - the MG-35 will just echo your typing until you type the magic string.

 

 

The correct password is:

MediaGate.

Note the capitalization and the period at the end.

 


 

Steps

1. Prepare a romfs file as instructed at .... or get a good one from here.

 

2. Download the romfs file from the PC into the MG-35. The following command will load the file in RAM, starting at 0x0140-0000:

 

download serial romfs

 

After issuing the command, start the file transfer from your PC to MG35 using your favourite communication program on the PC-side (e.g. Hyperterminal). The protocol is ymodem.

 

Optional: At the default speed (38400 baud) the transfer takes a few minutes. If you're the impatient kind, you can speed up the download by increasing the serial speed prior to the download. Before using the download command, type this command to increas the serial speed:


config serial 115200

You will then need to increase the speed at the PC end. In hyperterminal, this involves disconnecting, changing the properties of the serial port to 115200, and then reconnecting. After that, issue the download command as presented above. The transfer will take 3x less time - about 5 minutes.

 

 

3. Write the loaded file into the flash memory. The following command erases the 0x0004-0000 to 0x003F-FFFF flash area and then writes the contents of the romfs from 0x01400000 into the erased flash region: (Note the numbers are given for completeness - you don't need to worry about them)

 

flash romfs

 

WARNING!!! Do not power-off the MG-35 during this operation!

 

After the reflash is complete, you can boot the MG-35 without power cycling using this command:

boot flash

 

 

 

Comments (0)

You don't have permission to comment on this page.