How the first gen iPod was reverse engineered to run Rockbox(mastodon.social)
mastodon.social
How the first gen iPod was reverse engineered to run Rockbox
https://mastodon.social/@bagder/111538350617290554
59 コメント
Rockbox was definitely life-changing software for me. I was so proud when I first managed to get it installed, at the age of 10 if that. I got a Sansa Clip Plus for about $25, an affordable price, even at that age, and Rockbox made it talk. Similar devices directly aimed at the blind marked are more expensive at least by an order of magnitude. It has served me well for years, up until 2016 or so, when I finally bit the bullet and switched over to listening on a smartphone full time. I definitely have very fond memories of generating audiobooks on my computer with text-to-speech software to play them later on the Sansa, though.
I loved the sansa so much. I miss them
rockbox + sansa clip at the gym + live jamband shows were the best. rockbox made it easy to just throw stuff on and play from a folder, no worrying about a "database" or how the mp3 tags would be interpreted or sorted, just put them in alpha order and you're good. and it did gapless mp3 with ease, it was so awesome!
Similar experience here. I grabbed a few Clip Zip/Plus players in 2015 because I figured they'd get harder and harder to find (prices were ridiculous) and might still use one for music/audiobooks if it weren't for the fact that I pretty much exclusively use bluetooth now. They were fast, had amazing battery life, and just did what they did really well. Maybe I'm just "doing something wrong" (I've never made real use of a streaming service, strip my audiobooks of DRM and play them in a media player rather than a dedicated app etc) but the modern phone experience just seems like a step backward when it comes to this.
20-some odd years ago I added the initial bookmarking feature to Rockbox. None the MP3 players at the time targeted audiobook users so it wasn't a feature you could find on the market. With Rockbox, I just added it. Good times.
I definitely remember using that one a lot. I also remember being frustrated at how small the "recent bookmarks" list was, especially considering that it didn't have a "only show one bookmark per folder" option. I've lost more bookmarks due to this issue than I can count.
My kids still take a beat up, Rockbox loaded, Sansa Fuze upstairs with them when they go to bed.
We (them or I) aren't ready for them (6 and 9) to have anything smarter, and it still does the job.
We (them or I) aren't ready for them (6 and 9) to have anything smarter, and it still does the job.
> Now the exploit was rewritten to read memory, and blink out the contents using the LCD backlight. A LEGO construction was built and a webcam would register the binary stream of a few megabytes of memory contents. Slooooow.
It both amazes me and cracks me up how exploits are accomplished. Given enough time and determination...
It both amazes me and cracks me up how exploits are accomplished. Given enough time and determination...
It's really cool how they did this and not to diminish it in any way, but this is really a form of bit banging that a lot of devs already understand how to do.
You would probably appreciate this clip [0] from the AMC show Halt and Catch Fire where the character reads out the entire firmware from an IBM PC using lights.
[0] https://youtube.com/watch?v=jSZwtrnKxf4
[0] https://youtube.com/watch?v=jSZwtrnKxf4
Couldn't even make it through the whole thing it's so cringe.
Checking voltages and they have a sine wave on the oscilloscope lol.
You could just read out the whole rom contents quite easily with whatever computer you had handy.
There was no read back protection or scrambling - You give it an address and read out the bytes
Checking voltages and they have a sine wave on the oscilloscope lol.
You could just read out the whole rom contents quite easily with whatever computer you had handy.
There was no read back protection or scrambling - You give it an address and read out the bytes
Also IBM put a listing of the BIOS ROM in the PC technical reference manual so none of this was necessary to begin with.
A character in Cryptonomicon did something similar, using the lights to blink out morse code so he could gain information without his captors realizing it.
There’s virtually nothing in that clip that is factual and it’s not internally consistent. There would be no mystery about which chip is the BIOS, it’s not even self consistent with the claim of it being “off the shelf” junk. You could just dump the thing. And even if you couldn’t, 7 segment displays and other niceties were available. The oscilloscope stuff has no basis in reality.
HCF is a fine series with good storytelling, but the technical stuff is all window dressing and should not be examined too closely or confused with the real deal.
HCF is a fine series with good storytelling, but the technical stuff is all window dressing and should not be examined too closely or confused with the real deal.
IIRC they used a variation of this a second time on a newer model of iPod. They found a way to trigger the click speaker, wrote a program to dump the ROM via the clicker Morse code style, and left it sitting next to a microphone in a foam lined box for a few days.
I went for some "security training" with a grayhat once for a company I was developing for. He showed me his SQL injection script that exfiltrated the remote DB by using pauses in the SQL query depending on each letter of the table names/col names/etc. He had a script that would just keep firing blind queries through a textarea and recording the delay before the page returned.
Blind SQL injection is what I’ve heard this called, if anyone wants to read more. I used this concept to exfiltrate sensitive material from our database using PgHero’s analyze feature for an in-house incident response workshop once.
Thank you, I never knew if it had a name.
https://owasp.org/www-community/attacks/Blind_SQL_Injection
https://owasp.org/www-community/attacks/Blind_SQL_Injection
I'm struggling to understand.
I can understand how a timing attack would reveal enough details to differentiate between data being touched (but not expected to be returned).
But I can't understand how this would cause SQL injection... do you mean it's a way to perform unauthorized queries, or do you mean data-altering statements could also be executed?
I can understand how a timing attack would reveal enough details to differentiate between data being touched (but not expected to be returned).
But I can't understand how this would cause SQL injection... do you mean it's a way to perform unauthorized queries, or do you mean data-altering statements could also be executed?
Sibling poster knew the name for it:
https://owasp.org/www-community/attacks/Blind_SQL_Injection
https://owasp.org/www-community/attacks/Blind_SQL_Injection
I _still_ use Rockbox. The UI and performance is just really good. Probably doesn't hurt that it was one of the first pieces of software I ever contributed to (I only wrote a plugin/game, but it was still extremely satisfying), so I have a lot of fond feelings for it.
It's gotten hard to find decent players that support it though. I hope one still exists to buy when my current one dies someday.
It's gotten hard to find decent players that support it though. I hope one still exists to buy when my current one dies someday.
Likewise, RockBox is the only thing I’ve run my my current iPod Classic.
The first time I ever used Linux/gcc as a kid was changing the rockbox bootloader to boot rockbox by default on an iPod nano
The first time I ever used Linux/gcc as a kid was changing the rockbox bootloader to boot rockbox by default on an iPod nano
> The UI and performance is just really good.
The performance is fantastic, but if you're installing it on an iPod let's not kid ourselves: It's clunky and awkward in comparison to the stock OS.
I've tried to use the in-built tools to fix it as much as possible, such as hiding the "file browser" from the main page. Unfortunately there doesn't seem to be any way to rename "Database" to "Music" without recompiling the whole thing, which is what the cranky old guard seem to suggest for any minor UX suggestion on the forums.
The performance is fantastic, but if you're installing it on an iPod let's not kid ourselves: It's clunky and awkward in comparison to the stock OS.
I've tried to use the in-built tools to fix it as much as possible, such as hiding the "file browser" from the main page. Unfortunately there doesn't seem to be any way to rename "Database" to "Music" without recompiling the whole thing, which is what the cranky old guard seem to suggest for any minor UX suggestion on the forums.
Maybe I just have different needs. All I ever want is to go in, pick an album or two, and hit play. I also use different hardware but typically it's consistent across hardware with similar number of buttons so I doubt that's much different.
Sure, I'm not saying it's bad necessarily. And it's probably an entirely different story on other hardware. I'm just frustrated that there's such a UX tradeoff on the iPod when some TLC could make it flat-out superior to stock.
It's a shame that there is no steady hardware supply because unfortunately they tend to die sooner or later (from humidity or just the 3.5mm wearing out).
I do lots of listening on the phone nowadays of course but nothing beats a simple throwaway mp3 player for sports, can navigate them blind and get away with charging at most once a week.
I do lots of listening on the phone nowadays of course but nothing beats a simple throwaway mp3 player for sports, can navigate them blind and get away with charging at most once a week.
Yeah, even on my desk I like having a dedicated little device. It's easier to hit a phyical button than to hunt down the right app on my phone.
One neat little quirk I've discovered about Rockbox on the iPod (I'm assuming it works on other hardware) is that while plugged into a computer it acts as an external HID: You can play/pause, skip, previous, and change the volume using it as a remote for your computer.
I've got plans to incorporate this to my office setup at some point rather than using media keys and an encoder.
I've got plans to incorporate this to my office setup at some point rather than using media keys and an encoder.
A later model had the firmware dumped via the piezo speaker http://www.ipodlinux.org/stories/piezo/
The archived version has the images that are referred to in the writing: https://web.archive.org/web/20050828114013/http://www.ipodli...
I wonder why they could only use the piezo buzzer and not send cleaner audio out of the headphone port.
I wonder why they could only use the piezo buzzer and not send cleaner audio out of the headphone port.
The piezo was probably pretty close to a gpio line. There's normally a lot more setup involved getting true audio hardware going.
Fond memories of running Rockbox on my iPod Video. Today, like many, I want to get away from my smartphone that only distracts me, and I wish I had kept my old iPod and upgraded its storage to flash. I wonder what battery availability is like now.
One of the many disappointing aspects of the PinePhone is that it would often stutter playing FLACs, something that Rockbox on weaker hardware never did.
One of the many disappointing aspects of the PinePhone is that it would often stutter playing FLACs, something that Rockbox on weaker hardware never did.
I actually just bought a 6th gen ipod classic. Converted it to flash and put a new battery in. It's definitely an experience, but it's been a fun ride so far
I actually have a solution for this if you have an old apple device handy. You can load a profile on it using Apple Configurator 2 that disables web browsing and restricts which apps can be run. (I seem to remember this working without needing a business account.)
I’ve got some old devices locked into single app mode this way.
I’ve got some old devices locked into single app mode this way.
You can find batteries online for under $20. They aren't too difficult to replace if you are patient and take your time. (Easier on 5th gen and earlier iPods). You can even order larger sized batteries if you free up some space with a flash upgrade.
Only big issue with replacement batteries is their quality. None of them will be as high quality as original Apple batteries.
Only big issue with replacement batteries is their quality. None of them will be as high quality as original Apple batteries.
One thing I'd advise from my experience a few months ago upgrading my 6th gen classic, take your time and be careful getting the right parts. Dimensions matter when it's getting crammed into a case, and for however much I'm not thrilled about apple using their own connectors or needing their software, I appreciate their physical design is elegant for working with their own parts - there's nothing wasted.
The iFlash converter I used was for a single SD card, I was only planning on putting in a single SD card so that's all I got as it was the cheapest, and why not get a big huge battery. However, the SD card slot is taller off the PCB than a microSD slot and iFlash only use them on the multi-card JBOD adapters, that makes it conflict with the larger battery if I wanted to keep the slim casing. So then the options are to get a different iFlash, get a different battery that doesn't go into the SD card area, or as I did a new 'fat' 160GB case.
The iFlash converter I used was for a single SD card, I was only planning on putting in a single SD card so that's all I got as it was the cheapest, and why not get a big huge battery. However, the SD card slot is taller off the PCB than a microSD slot and iFlash only use them on the multi-card JBOD adapters, that makes it conflict with the larger battery if I wanted to keep the slim casing. So then the options are to get a different iFlash, get a different battery that doesn't go into the SD card area, or as I did a new 'fat' 160GB case.
I'd highly recommend Elite Obsolete Electronics [1] for anyone who is interested in buying or repairing iPods nowadays. I found my brother's old iPod Video in my desk about a year ago and have been using it as a music player using parts and upgrades I sourced from eoe.
They even have see-through faceplates and colored backplates, for those of us still nostalgic for late-90s early-00s see-through electronics in funky colors!
[1] https://eoe.works/
They even have see-through faceplates and colored backplates, for those of us still nostalgic for late-90s early-00s see-through electronics in funky colors!
[1] https://eoe.works/
Wow, Rockbox is one of those things I nearly completely forgot about. What a great blast from the past!
I had a Toshiba Gigabeat [0] (even typing that out brings back memories...) that I ran Rockbox on, I probably still have it somewhere in the basement. The Gigabeat was sort of like a precursor to the Microsoft Zune, it used this software that I think got superseded by Zune and my model of Gigabeat didn't last long once the Zune came out. Fun times.
0: https://www.cnet.com/reviews/toshiba-gigabeat-s30-review/
I had a Toshiba Gigabeat [0] (even typing that out brings back memories...) that I ran Rockbox on, I probably still have it somewhere in the basement. The Gigabeat was sort of like a precursor to the Microsoft Zune, it used this software that I think got superseded by Zune and my model of Gigabeat didn't last long once the Zune came out. Fun times.
0: https://www.cnet.com/reviews/toshiba-gigabeat-s30-review/
For everyone who loves the iPod, you've been able to convert iPods to flash for years now via an adapter. Stick Rockbox on it and you have an MP3 player than can hold > 1TB of data.
It's a bummer that iPod OS can't really handle more than 50k tracks. For large collections the Rockbox UI sort of falls apart. My goal at one point was to put my SBD collection on iPods, and using the iPod OS I needed about 6 iPods. It would have been less if the iPod could handle more tracks.
Maybe I'll take a hammer to Rockbox and start beating on it.
It's a bummer that iPod OS can't really handle more than 50k tracks. For large collections the Rockbox UI sort of falls apart. My goal at one point was to put my SBD collection on iPods, and using the iPod OS I needed about 6 iPods. It would have been less if the iPod could handle more tracks.
Maybe I'll take a hammer to Rockbox and start beating on it.
Awesome story. I absolutely loved using Rockbox on my iRiver H320. I think I still have it kicking around somewhere.
The first gen iPod had an html viewer?
yah this is the part that most people who owned a 1st gen spinwheel 5 button iPod g1 are trying to figure out ;) the only logical spot I could think of is maybe the copyright/TOC item?
That wouldn't have been accessible via disk mode, though, so you can't write to it without first rooting it.
No, it didn’t. I don’t think.
I assume they were referring to the first version they got Rockbox running on.
Does anyone have more details on that part of the story?
I assume they were referring to the first version they got Rockbox running on.
Does anyone have more details on that part of the story?
This pdf[0] shows an iPod can view notes, but says you need to store them as a .txt.
This O'Reilly snippet[1] claims the feature wasn't implemented until 2003, and even then explicitly states it could only store plain text.
EDIT: The Notes app on the touch can import html files, but that doesn't sync up with either rockbox or disk mode.
So I'm completely lost at what mechanic they're referring to. Even if we assume that this was a txt file and not html, that explicitly excludes the first gen iPod.
[0]: https://manuals.info.apple.com/MANUALS/0/MA282/en_US/iPod_cl...
[1]: https://www.oreilly.com/library/view/ipod-and-itunes/0596008...
This O'Reilly snippet[1] claims the feature wasn't implemented until 2003, and even then explicitly states it could only store plain text.
EDIT: The Notes app on the touch can import html files, but that doesn't sync up with either rockbox or disk mode.
So I'm completely lost at what mechanic they're referring to. Even if we assume that this was a txt file and not html, that explicitly excludes the first gen iPod.
[0]: https://manuals.info.apple.com/MANUALS/0/MA282/en_US/iPod_cl...
[1]: https://www.oreilly.com/library/view/ipod-and-itunes/0596008...
Reading down the thread they mention connecting to it over USB... the first iPods only talked Firewire didn't they? I had the 3rd gen (the odd-man-out design with the separate row of touch sensitive buttons above the wheel) and I distinctly remember the USB connection being a new and significant thing on that model.
Also, the first gen iPod didn't have encrypted firmware. It was just an unencrypted blob on the disk.
My favorite was how the first android phone was rooted. They left a root terminal running in the background, so for example if on your homescreen you typed "reboot" and hit enter, your phone would reboot. So all you needed to do was launch a telnet daemon and you could telnet in and do whatever you wanted to the device.
I wish there was something like this for the little square iPod nano, 6th gen I think? My daughter uses it at night to listen to stories on but it’s such a pain in the ass to manage via iTunes
Whoa this took me back to using iPodWizard.net for all the firmware changes I did to customize my iPod & the dual boot with Rockbox was neat too!!
Wish Apple reintroduced the iPod (classic, shuffle). Can’t listen music on my phone while running or playing sports (alone), it’s just too clumsy.
There's a plethora of devices ranging from $25 to thousands for playing exclusively music. The iPod was a nice piece of hardware, but for sports, I would just buy a cheap one and put my playlist on it.
I got this little iPod nano-shaped Chinese Mp3 player[1]. It plays music and uses .m3u playlist files that are easy enough to edit on your PC. You can even set bookmarks in MP3 files so if you have a large audiobook file, you can save your place in it. It has some idiosyncrasies (such as not playing songs in order by default; the alphabetization is weird) but the killer features are: it's small, and I have literally never once run out the battery. I do charge it occasionally, but even after several hours of hiking, the battery indicator is at 3/3 bars.
It takes a micro SD card so you can load music however you want and then just plug the SD card in
[1] https://www.amazon.com/gp/product/B01LZVDMEL/ref=ppx_yo_dt_b...
It takes a micro SD card so you can load music however you want and then just plug the SD card in
[1] https://www.amazon.com/gp/product/B01LZVDMEL/ref=ppx_yo_dt_b...
I feel like Apple Watch + AirPods is the spiritual successor. That's my running and gym setup, anyway.
Me too. I’d love an iPod with classic interface, but it pulls WiFi and Apple Music from my iCloud account and stores my library offline. Nice big output for high end headphones and high end DAC and they’d have a banger.
I loved rockbox on my sansa e200 series. That tetris clone was great.
A bit off-topic, but Mastodon really is so much more pleasant to browse through than Twitter (don't have an account with either).
You forget sometimes how bad the enshittification can get
You forget sometimes how bad the enshittification can get
My mind was a little less blown when I realized I misread Rockbox in the title for Roblox.