As with many embedded devices, it's possible to get your MG-35's internal firmware into a state whereby the unit won't work and can't be reflashed in the normal way. This process is usually called "bricking" and your media player is now "bricked" or a "brick". The reverse process is called "debricking" or "unbricking" and after performing it your MG-35 is "unbricked". As the manufacturers of embedded devices make the debricking process rather difficult and dependent on secret knowledge and undocumented connectors, stronger terms are used at times.
This serial approach to recovering your MG-35 will only work if the bootloader at the start of the flash is intact. If your unit died due to reflashing with firmware with a wrong kernel or disk image, then the loader should be OK. If it died due to loss of power during an erase/flash cycle, then you're probably out of luck. If your blue light flashes on power on, and never stops flashing, then you're probably OK with the approach here.
You will need:
If you connect the cable to a PC and fire up Hyperterminal (or similar) with the settings on 38400 for bit rate, no parity, one stop bit and xon/off handshaking (38400-8-N-1) you should see the serial loader messages as you power on the MG-35. If you don't, try swaping RX and TX and check your settings.
Here is roughly what you should see. Your output may look different if you have a different flash chip, and you may well see an error if your Linux kernel didn't decompress correctly due to it being corrupt.
Jasper Bootloader v1.0.0 (Feb 10 2006 15:34:08) Supports BootMenu Flash Network This version of fips use micom with power control, version[3] Swapping erase regions for broken CFI table. 0031.0032 mfr 00ec id 2275 Top bootsector Flash 0 at address 0x00000000 ID : AMD/Fujitsu Standard Size : 4096 KB Regions : 2 0 : 0x003e0000 - 0x00004000 * 8 1 : 0x00000000 - 0x00020000 * 31 0BF0IDENTIFY FAILED Inptr= 00000014 Inflating.... Final Inptr=000A27FD Original LEN =0014BB48OutCnt = 0014BB48 Original CRC =B1201065 Computed CRC =B1201065 01008000 |
Spansion Chips:
Jasper Bootloader v1.0.0 (Oct 25 2007 14:54:35) Supports BootMenu Flash Network This version of fips use micom with power control, version[3] 0031.0033 mfr 0001 id 22c4 Bottom bootsector Flash 0 at address 0x00000000 ID : AMD/Fujitsu Standard Size : 4096 KB Regions : 4 0 : 0x00000000 - 0x00008000 * 1 1 : 0x00008000 - 0x00004000 * 2 2 : 0x00010000 - 0x00010000 * 1 3 : 0x00020000 - 0x00020000 * 31 0BF0IDENTIFY FAILED Inptr= 00000014 Inflating.... Final Inptr=00090743 Original LEN =001287ECOutCnt = 001287EC Original CRC =AEF8FCA7 Computed CRC =AEF8FCA7 01008000 |
To get access to the serial loader's menus, you have to send character on the serial interface to the MG35.Since the time window is very short, the easiest way is to press and hold the space key on the PC (in Hyperterminal) as you power up the MG-35. You will get a sign-on message which ends with "This version of fips..." and the MG35 is waiting for a pasword to be entered. Note there is no prompt to enter this string - the MG-35 will just echo your typing until you type the magic string.
The correct password is:
MediaGate. |
Note the capitalization and the period at the end.
1. Prepare a romfs file as instructed at .... or get a good one from here.
2. Download the romfs file from the PC into the MG-35. The following command will load the file in RAM, starting at 0x0140-0000:
download serial romfs
After issuing the command, start the file transfer from your PC to MG35 using your favourite communication program on the PC-side (e.g. Hyperterminal). The protocol is ymodem.
Optional: At the default speed (38400 baud) the transfer takes a few minutes. If you're the impatient kind, you can speed up the download by increasing the serial speed prior to the download. Before using the download command, type this command to increas the serial speed:
config serial 115200
You will then need to increase the speed at the PC end. In hyperterminal, this involves disconnecting, changing the properties of the serial port to 115200, and then reconnecting. After that, issue the download command as presented above. The transfer will take 3x less time - about 5 minutes.
3. Write the loaded file into the flash memory. The following command erases the 0x0004-0000 to 0x003F-FFFF flash area and then writes the contents of the romfs from 0x01400000 into the erased flash region: (Note the numbers are given for completeness - you don't need to worry about them)
flash romfs |
WARNING!!! Do not power-off the MG-35 during this operation!
After the reflash is complete, you can boot the MG-35 without power cycling using this command:
boot flash |