Bricked Zoom H4n Handy recorder: Need a firmware RE / flash memory specialist - Page 1
Forum section: electronics / repair

author: baltersice
author_rank: Regular Contributor
timestamp: July 25, 2017, 01:38:29 pm
content: I bought this portable audio recorder as non-functional, hoping for an easy repair. But I got something elseIt freezes at the startup screen, or at the "connect as USB microphone" menu. If I had to guess, I'd say a firmware update was interrupted.But I cannot re-flash the firmware because that screen doesn't come up either.Onzoomforum.usa similar problem is described and an answer from their support is quoted:QuoteI asked again (because the post above is 6 years old) but didn't get anything.QuoteSo I guess I'm on my own ... or am I?Well I have taken it apart (beautiful construction, made in japan) and underneath the SD card slot I found a TI TMS320 DSP and a rather large flash chip (cFeon 16 Megabit (2048K x 8-bit / 1024K x 16-bit) Flash MemoryBoot Sector Flash Memory, CMOS 3.0 Volt-only) Well the latest firmware update file is about 14.6 Mbit, so it might just be what I was looking for ...I also have a few high pin count devices like an Arduino Mega and an FPGA board, so I think I should be able to talk to that thing.But here is my problem: I bet thefirmware imageis encoded somehow or needs to be written to certain locations in the memory.And before starting to solder in 48 tiny wires I thought I'd ask if I am on the right track at all ...Thank youOn another board there is also aNEC 78k0 series microcontroller. It might be there only to operate the LCD and the buttons while the TMS320 runs the show, or it might the other way around and the TMS320 does only DSP things ...?

author: Zucca
author_rank: Unknown
timestamp: July 25, 2017, 03:15:29 pm
content: I know that feeling, how many time I bought something on ebay and it was a disaster? Buy a used one, dump it out the FW and then resell it on Ebay..If the FW is bricked, you need first a good FW image.

author: baltersice
author_rank: Regular Contributor
timestamp: July 25, 2017, 03:22:08 pm
content: Good idea, thank you!But I spent 20 bucks on this one, so it is fun.If I pay 150 for a used working one, it's an investment

author: baltersice
author_rank: Regular Contributor
timestamp: August 19, 2017, 08:11:06 pm
content: Sorry for bumping this old thing, but I might have made a bit of progress:I have desoldered theflash chipand attached it to an Arduino Mega.I know that the flash chip wants VCC around 3.3V and the Arduino is a 5V device, but I am running it on 4.3Vand I have added resistors to all digital pins, hoping that the flash chip might have internal ovp diodes. If I end up destroying it, that would be ok ... I have tried ... moving on.But so far it doesn't seem destroyed, just a slightly confused maybe? Trying to read the contents withthis programI am getting different byte values by adding small delay(1); calls at different places. Like between setting the address and reading the byte. Same happens when I change the serial baud rate. I have tried to toggle the output_enable pin every time I am changing the adress, but that hasn't helped.In the long I am hoping to find that somewhere on that chip the data just stops, like when the user disconnected power during firmware update. Then I could try to find the bytes in the firmware .bin file and manually copy it over. Doesn't even have to be perfect, just enough to get through the built-in firmware updater.

author: baltersice
author_rank: Regular Contributor
timestamp: August 21, 2017, 07:33:42 am
content: I am now getting consistent data out of the chip. My mistake was using Arduino Pin 1, which has an internal function assigned.That is more than I had hoped to accomplish, but it is still far from done.Using a hex editor I am occasionally finding readable content in thefirmware file:Code:(.G.E.N.E.R.A.L.). . ...C.O.M.P.2.(.V.O.C.A.L.). . . . ...C.O.M.P.3.(.D.R.U.M.). . . . . ...L.I.M.I.T.1.(.G.E.N.E.R.A.L.). ...L.I.M.I.T.2.(.C.O.N.C.E.R.T.). ...L.I.M.I.T.3.(.S.T.U.D.I.O.)But not in the data I read from the chip. And that is no surprise because I don't even know if I got all the lsb ... msb orders right, or I might have to invert the bits I am reading ... or ... orI am getting the most reasonable output (as in few unknown, newline, tab symbols) using this Arduino program:Code:void loop() {char reading = 0;if (address == 2097152)while(1)delay(1);if (address%16==0){Serial.println();Serial.print(address);Serial.print(" ");}for (uint8_t i = 0; i < 21; i++)digitalWrite(adress, bitRead(address, i));for (uint8_t i = 0; i < 8; i++)bitWrite(reading,i,!digitalRead(inputs[7-i]));Serial.print(reading);Serial.print(" ");address++;}Any ideas?

author: baltersice
author_rank: Regular Contributor
timestamp: August 23, 2017, 08:36:19 am
content: Even though nobody seems to read this, I'll see it through to the endI have now managed to get readable data from the flash chip:https://drive.google.com/file/d/0B6S_PcWWM1YlQm9HVFc0Y2Z0NWM/view?usp=sharingStarting at byte 50688 approximately there seem to be a few error messages, likeCode:R.e.g.r.e.s.s.i.o.n. .T.e.s.t. .E.r.r.o.rorCode:S.Y.S.T.E.M. .E.R.R.O.R.!Probably just templates for stuff, that may be displayed, and not the cause of my problems, right?I didn't find a sudden end in the data tough, which would have confirmed my power-loss during update theory. However it is still possible, if they erased only a sector somewhere and then interrupted rewriting it.The firmware .bin file (only a newer version was available) hasa lotof similarities in both structure and data:https://drive.google.com/file/d/0B6S_PcWWM1YlX002enBmajRROUk/view?usp=sharingNow my next problem is: Does it make sense to try and write the firmware.bin file to the chip? If yes, which is the first byte and where do I put it?

author: Zucca
author_rank: Unknown
timestamp: August 23, 2017, 10:50:11 am
content: Quote from: baltersice on August 23, 2017, 08:36:19 amAt least 100 people are reading this, no worries.Quote from: baltersice on August 23, 2017, 08:36:19 amRight, seems reasonable to me.Quote from: baltersice on August 23, 2017, 08:36:19 amYes, why not? You can not damage any further an already bad FW image.Quote from: baltersice on August 23, 2017, 08:36:19 amI don't know, try are learn from what happen next. May be the flash chip itself is brocken....Ah, Don't you have a scope?I never lose. I either win or learn. "Nelson Mandela"

author: DaJMasta
author_rank: Super Contributor
timestamp: August 23, 2017, 09:32:37 pm
content: +1 to I think rewriting the chip would be the way to go - worst case, nothing changes... but even if that's true, you can probably continue to rewrite until something else happens.Could also give you some insight into whether the chip is bad or not, and odds are good you can find a suitable replacement chip, even if it's not the exact one used.

author: Zucca
author_rank: Unknown
timestamp: August 24, 2017, 06:36:51 am
content: with a scope you can check if the rising/falling edge of the flash chip are sharp... if not that chip is toasted which could also explain why you were getting not consistens readings from it.

author: tahitibob57
author_rank: Newbie
timestamp: September 21, 2018, 07:14:50 pm
content: Hello. I have the same problem. Did you find the problem?

author: baltersice
author_rank: Regular Contributor
timestamp: September 21, 2018, 07:46:45 pm
content: Nope, sorry, have tossed it into scrap box

author: Chris56000
author_rank: Frequent Contributor
timestamp: September 27, 2018, 12:47:00 pm
content: Hi!May be a pot–shot in the dark, but have you tried formatting a small SD card (512 MB or smaller) to FAT16, loading the latest known good firmware file available onto it, inserting it in your player with the power off/battery disconnected, then leaving it 30 min before powering up again?(You'll have to resolder the flash–chip back or fit a new one first, tho!)If the bootloader is still intact, this might help!Chris Williams