~~META: title=Toylino Galakto Player hacking and disassembly description=Disassembly and hacking Galakto Token cards keywords=seo, dokuwiki, disassembly, galakto, token, music, card, hack, hacking, MBR, audio, kids, Toniebox, alternative ~~ ====== Toylino Galakto Player ====== There is a German alternative to the famous Toniebox. It is called Galako Player from Toylino (created by Tiny Monster), which is sold at [[https://www.aldi-onlineshop.de/p/galakto-player-101024564/:|Aldi]] for less than 40โ‚ฌ. \\ It is an offline player without any wireless connectivity. \\ Althogh it is a player for the German market, I still like to do my write-ups in english. Use [[https://translate.google.com/translate?hl=en&sl=auto&tl=de&u=https://super-se.de/dokuwiki/disassembled_devices:toylino_galakto_player|Google Translate]] if you want. ===== Disclaimer ===== I do this for educational fun. I've seen the Galakto Tokens and just wondered what's inside. So I've decided on one of the available music tokens on Kleinanzeigen, which was German rapper "DIKKA", making rap intended for kids - (I am not much into audio books, except for [[https://de.wikipedia.org/wiki/Die_K%C3%A4nguru-Chroniken|Die Kรคnguru-Chroniken]]). \\ I ended up having the player too ๐Ÿคฆ I've put it in the disassembly section because it doesn't feel like a project. I just wanted to know what's inside the tokens, the writing up grew to what I have figured out. \\ I am a curious person and like to share knowledge. I love the interesting stuff you guys do and share, YOU keep being brilliant! :) ๐Ÿ—’๏ธ Note: I am not sponsored, I do not affiliate or try to do advertising even if providing links. I do not take any responsibility for external content. There is no piracy involved or encouraged here - I did only clone one token to itself as a POC. \\ Ultimately, I am here for freedom, long-living and to just play my own tune. โš ๏ธ I am in no sense responsible for what you to. Please think before doing and pressing return keys. If you feel I violate any of your rights, contact me. ===== Music Tokens ===== As Music Tokens / cards are the only way to play music with the player, I consider it the core part. As of 06/2025 there are 148 Galakto Tokens [[https://galakto.com/collections/audio-token|listed]], all of them are intended for children. Most of them are audio books or audio dramas, some are music. They cost between 10-12โ‚ฌ in the galakto store but can be found __cheaper in local Aldi__ store or as bundle [[https://www.aldi-onlineshop.de/search/?text=Galakto%20Token|online]]. As of 06/2025 there is no "creative card", on which you could load other content. Or has there always been one? ==== Music Tokens Hardware ==== The music tokens / cards connect to the pogo pins of the player and hold magnetically. \\ The plastic housing is welded and cannot be opened easily (I used a rotary tool to cut it open) \\ Looking at the PCB we can see a flash memory chip from SKhynix model **H9TQ64AAETAC** with 2GB. On the other side of PCB there is a USB 2.0 Flash Disk Controller IC, type **AU6989SNL-CA2** from ALCOR MICRO. On the left side there are pads for USB on the PCB. There are remains of broken off connection pins, which lead to the conclusion that these pins are probably used in production to put the content on. {{gallery>:disassembly:galakto:card}} ==== Music Tokens Pinout ==== The pinout is the following: \\ ^ Pin ^ Description ^ | VCC | +5V | | GND_EN | enable/wake pin for MCU, gets briged to GND | | GND | Ground | | D+ | USB data plus | | D- | USB data minus | | ?(P1) | either NP or goes to some BGA-pad of Flash IC | The POV of the PCB is the front of the token card (Flash IC is the backside of the card). So if you hold the token and look at the front then VCC is left. \\ :disassembly:galakto:card:pinout:dsc04884.jpg :disassembly:galakto:card:pinout:dsc05070_c.jpg So let's solder an ugly USB-cable onto our toy token quickly to see what is on the flash chip. \\ ==== Music Tokens Content ==== Galakto card is **2GB FAT32** formatted flash storage connected to a **USB 2.0 Flash Disk Controller** IC, with **no write protecion**. \\ Cloning the token to any other USB-Stick works just fine :) So you could solder a USB-Socket to the Player. \\ โš ๏ธ **WARNING: Always create a full block-level backup of the entire device!** Do not back up just a single partition (e.g. /dev/sdX1) - always clone the entire device (e.g. /dev/sdX) to preserve partition table and layout. \\ It is not possible to copy the bare files back to the partition. __If a .mp3 is copied back, you cannot listen to it anymore and not skip past it__ - even with the correct signature! \\ #>dd if=/dev/sdX of=full_backup.bin โš ๏ธ **WARNING: Always check which device/partition you use dd on! I am not responsible for any data loss. Remove unneeded USB storage devices to minimize risks of stupidity. Always think __before__ pressing return key.** \\ The device layout looks like this: #>fdisk -l /dev/sdX Disk /dev/sdb: 1.88 GiB, 2013265920 bytes, 3932160 sectors Disk model: Flash Disk Units: sectors of 1 * 512 = 512 bytes Sector size (logical/physical): 512 bytes / 512 bytes I/O size (minimum/optimal): 512 bytes / 512 bytes Disklabel type: dos Disk identifier: 0x6544f215 Device Boot Start End Sectors Size Id Type /dev/sdb1 8192 3932159 3923968 1.9G c W95 FAT32 (LBA) #>fsck.vfat -v /dev/sdb1 Boot sector contents: System ID "MSDOS5.0" Media byte 0xf8 (hard disk) 512 bytes per logical sector 8192 bytes per cluster 2806 reserved sectors First FAT starts at byte 1436672 (sector 2806) 2 FATs, 32 bit entries 7670272 bytes per FAT (= 14981 sectors) Root directory start at cluster 2 (arbitrary size) Data area starts at byte 16777216 (sector 32768) 243200 data clusters (1992294400 bytes) 63 sectors/track, 255 heads 8192 hidden sectors 3923968 sectors total Checking for unused clusters. Checking free cluster summary. /dev/sdb1: 46 files, 3533/243200 clusters \\ Following is the partition content of the music token "DIKKA Oh Yeah!" listed > tree A46B-9AAD A46B-9AAD โ””โ”€โ”€ System Volume Information โ”œโ”€โ”€ IndexerVolumeGuid โ”œโ”€โ”€ IndexVolumeGuid โ”‚ย ย  โ”œโ”€โ”€ 00000.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00000.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00000.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00001.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00001.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00001.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00002.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00002.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00002.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00003.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00003.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00003.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00004.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00004.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00004.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00005.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00005.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00005.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00006.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00006.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00006.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00007.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00007.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00007.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00008.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00008.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00008.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00009.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00009.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00009.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00010.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00010.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00010.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ 00011.mp3 โ”‚ย ย  โ”œโ”€โ”€ 00011.mp3.hashes โ”‚ย ย  โ”œโ”€โ”€ 00011.mp3.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ all-files.hashes โ”‚ย ย  โ”œโ”€โ”€ all-files.hashes.sig โ”‚ย ย  โ”œโ”€โ”€ check.txt โ”‚ย ย  โ”œโ”€โ”€ settings.properties โ”‚ย ย  โ”œโ”€โ”€ settings.properties.sig โ”‚ย ย  โ””โ”€โ”€ signature.txt โ””โ”€โ”€ WPSettings.dat 2 directories, 44 files Here are all the files except the actual mp3 music files (due to copyright): \\ {{:disassembly:galakto:dikka_no-audio.zip|Download Dikka ZIP (no audio)}} \\ === Description of files === ** Dikka music card is not encrypted, using 29MB in total for 11 songs with ~2-3MB each. \\ .mp3 files are unencrypted with 128 kbps / 44.1KHz (Cbr) \\ .hashes is sha256sum of mp3 file \\ .sig files look like ECDSA(?) encrypted hashes \\ check.txt contains all mp3 hashes \\ all-files.hashes are hashes of all files: mp3, hashes and sig \\ settings-properties contains info and settings for player (like max volume or LED colour) \\ signature.txt - probably an ECDSA cryptographic signature for verifying the integrity and authenticity of other files \\ IndexerVolumeGuid file and WPSettings.dat are files created by MS Windows (they probably use a PC to create the images?)** \\ It is strange to see that the main directory is called "System Volume Information". Normally it is used for system restore, indexing, shadow copies by MS Windows. Same with the subdir "IndexVolumeGuid", which is normally used for Search Indexing (normally not used on removable USB storages). The only explanation I can come up with is that this name scheme is used because normal Windows users can't see or delete these directories by default. \\ According to hex-dump of block device the tokens get cloned by Vinpower Digital machine. \\ The player does only play mp3-files which have correct hashes and signatures. Also the files cannot be copied manually onto the partition via copy command/file manager, they will not play and you cannot skip past them! Files must not be fragmented by FS. \\ I have tried cutting and copying a track back on FS and then reordering with [[http://www.anerty.net/software/file/DriveSort/|DriveSort]], which did not work. \\ ===== "Hacking" the toy token ===== To make your life easier, create your own toy token by soldering a USB-C socket on. \\ :disassembly:galakto:card:pinout:dsc05090.jpg If you don't want to cut up your token, you can alternatively open the player, solder an USB-A-port on and cut into the case for the socket - you could then even use regular USB2.0-sticks. I have rather sacrificed upgraded a token for toying around. \\ For dumping partitions once, the most simple way would be to stick tape with USB-wires onto the outer contacts (validate your dumps!). \\ The cleanest way would be to [[toylino_galakto_player#d_printed_token_adapter|3D print]] a token adapter for USB with pogo pins so you can connect the tokens nicely also to your USB-enabled stereo/TV/whatever. \\ ==== Gathered insides ==== ๐Ÿ’ก If you screw up with dd and write partition to block device, which leaves you with a device with ~3.99MB according to fdisk, don't panic, the easiest way is to reboot your linux OS. You will be able to repartition/rewriting dd backup. \\ ๐Ÿ” We don't have the private key to sign content (yet), so what can we do for now? \\ โŒ Just plain copying the tracks onto FS with their correct signature does not work. \\ โœ… Cloning the card onto another USB-stick via dd works just fine - the player plays from whatever USB2.0-stick. \\ ๐Ÿค” Destroying MBR or even zeroing partition table breaks playback. \\ โ“ MBR and FAT32 is used - so why can't content be copied back and forth without "breaking the files"? Why do we need block-copy by dd? \\ ๐Ÿ”“ Conclusion: MCU goes to first partition in table, but files are read raw and must not be fragmented by FS.\\ โœ… Resizing the partition to >=260MiB (absolute minimum size for fat32, 528MiB being min. standard) seems to work fine, player still plays content. \\ ๐Ÿ”ง There is lots of space left, so let's clone multiple partitions with other original content and just switch between the active partitions in MBR. \\ ๐ŸŽฏ See below how to hack the heck out of that. \\ ==== Multi-partition token ==== Wait, this is the "hacking" part?! \\ Following are steps to create a multi-partition token and swap between them. This POC is to show that you can have more than one token stored into a single one. The catch? You have to rewrite LBA addresses of partition table to tell the player which is the first partition, as it will only read from that. Why do that? Idk, I just have to take my linux machine out of my pocket/bag and rewrite MBR, so I don't have to carry around so many tokens. Or swap content with Peppa Pig for April Fool's Day (how mean!). Okok, it is a //"because I can/want"// and //"that seemed to be doable as a start"//, ok? Let's just start. \\ โš ๏ธ **WARNING: Always check which device/partition you use dd on! I am not responsible for any data loss. Remove unneeded USB storage devices to minimize risks of stupidity. Always think before pressing return key.** \\ replace /dev/sdX with your device! \\ ==0. create full backup == โš ๏ธ **Always create a full block-level backup of the entire device! Do not back up just a single partition (e.g. /dev/sdX1) - always clone the entire device (e.g. /dev/sdX) to preserve partition table and layout.** dd if=/dev/sdX of=full_backup.bin # lookup partition addresses fdisk -l /dev/sdX # lookup fat information fatresize -i /dev/sdX1 # or install sleuthkit and fsstat /dev/sdX1 ==1. Resize partition (>=528MiB) == Larger than 528MiB, because a FAT32 volume must have at least 65,525 clusters. \\ > Volume size (bytes) = clusters ร— sectors/cluster ร— bytes/sector \\ > Partition size (in sectors) = Reserved sectors + (Number of FATs ร— Sectors per FAT) + (Clusters ร— Sectors per cluster) ~528MiB is needed with cluster size 8KiB and 512 bytes per sector. \\ 260MiB seems to work too, but it's non-standard minimum. \\ # Unmount if needed umount /dev/sdX1 # DO NOT Resize FAT32 part first as normally #DO NOT fatresize /dev/sdX1 [size] # Resize the partition to match (from sector 8192, 1081344 sectors) parted /dev/sdX --script resizepart 1 1089535s ==1.5. fix FS == >FAT32 layout: >TotalSectors = Reserved + (NumFATs ร— FATSz32) + DataSectors >DataSectors = Clusters ร— SectorsPerCluster >Clusters = DataSectors / SectorsPerCluster you can manually hexedit boot sector fields: \\ ^Offset (hex) ^Field ^New Value for 528MiB ^description ^ | 0x13โ€“0x14 | BPB_TotSec16 | 00 00 | zero for FAT32 | | 0x20โ€“0x23 | BPB_TotSec32 (Total Secs) | 00 80 10 00 | 1081344 sectors = 528MiB | | 0x24โ€“0x27 | BPB_FATSz32 (Sectors/FAT) | 11 02 00 00 | Update if FAT size not >529 sectors per FAT | | 0x2Cโ€“0x2F | Root Cluster | 02 00 00 00 | Usually cluster 2 | | 0x03โ€“0x0A? | OEM Name | MSDOS5.0 | restore label | or alternatively # copy first sector (Boot Sector) dd if=/dev/sdX1 of=bootsect.bin bs=512 count=1 # Set BPB_TotSec16 = 0 (FAT32 always sets this to 0) printf '\x00\x00' | dd of=bootsect.bin bs=1 seek=$((0x13)) count=2 conv=notrunc # Set BPB_TotSec32 = 1,081,344 sectors = 0x00108000 printf '\x00\x80\x10\x00' | dd of=bootsect.bin bs=1 seek=$((0x20)) count=4 conv=notrunc # Set BPB_FATSz32 = 529 sectors = 0x00000211 printf '\x11\x02\x00\x00' | dd of=bootsect.bin bs=1 seek=$((0x24)) count=4 conv=notrunc # Set Root Cluster = 2 (usually unchanged) printf '\x02\x00\x00\x00' | dd of=bootsect.bin bs=1 seek=$((0x2C)) count=4 conv=notrunc #write bootsect back and override backup too dd if=bootsect.bin of=/dev/sdX1 bs=512 count=1 conv=notrunc dd if=bootsect.bin of=/dev/sdX1 bs=512 count=1 seek=6 conv=notrunc # Verify and fix FS if needed fsck.vfat -v /dev/sdX1 # FAQ: # Copy original over backup? -> yes (original is sector 0 and sector 6 is a backuo) ## Checking we can access the last sector of the filesystem: 0x41: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt. #-> 2) No action (because dirty bit was originally? set by my token?ikd) ##Free cluster summary wrong -> Correct, probably? ==2. Add second partition == # Backup a 528 MiB partition dd if=/dev/sdX1 of=part_backup.bin bs=512 count=1081344 # create second partition parted /dev/sdX --script mkpart primary fat32 532MiB 1060MiB # add a second 528MiB partition ==3. copy over partition == Take block backup of a partition and append after first partition: # Append backup to device with 1 MiB (2048 sectors) after first partition # 1081344 + 2048 padding = 1083392 1089536 dd if=other_backup.bin of=/dev/sdX bs=512 seek=1089536 conv=notrunc # if needed # Append second partition to partition table with # sfdisk. Format: start_sector, num_sectors, type echo "1089536,1081344,c" | sudo sfdisk --append /dev/sdX ==4. The Swap trick == Each partition entry in MBR is 16 bytes long, and the partition table starts at byte offset 446 (0x1BE). Therefore swap: \\ 1st partition entry: bytes 446โ€“461 (0x1BEโ€“0x1CD) \\ 2nd partition entry: bytes 462โ€“477 (0x1CEโ€“0x1DD) \\ 3rd partition entry: bytes 478โ€“493 (0x1DEโ€“0x1ED) \\ 4th partition entry: bytes 494โ€“509 (0x1EEโ€“0x1FD) \\ With this, we can use dd to swap partitions to which is first: # Have a backup of MBR dd if=/dev/sdX of=mbr_backup.bin bs=512 count=1 # Extract first partition entry dd if=mbr_backup.bin of=part1.bin bs=1 skip=446 count=16 # Extract second partition entry dd if=mbr_backup.bin of=part2.bin bs=1 skip=462 count=16 # Create copy of mbr_backup for swapping cp mbr_backup.bin mbr_swapped.bin # Write second partition entry over first dd if=part2.bin of=mbr_swapped.bin bs=1 seek=446 conv=notrunc # Write first partition entry over second dd if=part1.bin of=mbr_swapped.bin bs=1 seek=462 conv=notrunc # Write back MBR to USB storage dd if=mbr_swapped.bin of=/dev/sdX bs=512 count=1 or do it directly on /dev/sdX instead of mbr_swapped. To reverse just write back mbr_backup or change partition address accordingly. ==5. Flush & Wash & Rehash== Flush and __WASH YOUR HANDS WITH SOAP!__ **Soap works, you know.** ๐Ÿ’ฉ Do it ever so often in between when advisable. \\ sync sudo blockdev --flushbufs /dev/sdX sudo partprobe /dev/sdX Now it looks something like this: Device Boot Start End Sectors Size Id Type /dev/sdb1 1089536 2170879 1081344 528M c W95 FAT32 (LBA) /dev/sdb2 8192 1089535 1081344 582M c W95 FAT32 (LBA) โœ… Done, you now have switched to a second partition. You can have four primary partitions in MBR, 3+ fitting in the size of a single token - you 'just' have to switch between them manually. Rehash: To switch partitions //goto Step4:// \\ ๐Ÿ•บ๐ŸŽค ๐Ÿ”Š ๐ŸŽต //Oh, yeah! DIKKA, Digga//, done creating our toy token! ๐Ÿ See if there is some [[toylino_galakto_player#d_printed_token_adapter|3D printed docking station]] adapter for your tokens of your taste - to make things convenient. \\ **Further steps I can imagine:** \\ โง  upload a nice script for more convenient switching ๐Ÿ”ง \\ โง  write simple C (Arduino?๐Ÿ˜ฎโ€๐Ÿ’จyou really want that?) program for ESP32 or whatever to integrate into [[toylino_galakto_player#d_printed_token_adapter|3D printed docking station]] for easy switching via button (MCU as MITM to send switched MBR?) \\ ====custom content==== As the player cannot read fragmented tracks, let's look at the partition hexdump first. \\ I have searched for some characters in hexdump of files inside partition backup. In my Dikka partition the ordering is as follows, sorted by offsets in FS: 0x01004000 WPSettings.dat 0x01006000 IndexerVolumeGuid 0x0100A000 signature.txt 0x0100C000 settings.properties.sig 0x0100E020 settings.properties 0x01010000 check.txt 0x01012000 all-files-hashes.sig 0x01014000 all-files-hashes 0x01016000 00011.mp3.hashes 0x0101A000 00011.mp3 0x0101B000 00011.mp3.hashes.sig 0x0131A000 00009.mp3 0x01550000 00006.mp3 0x01BDA000 00008.mp3.hashes 0x01BDC000 00008.mp3.hashes.sig 0x01BDE000 00008.mp3 0x0245E000 00007.mp3.hashes 0x02460000 00007.mp3.hashes.sig 0x02462000 00007.mp3 0x027E2000 00006.mp3.hashes 0x027E4000 00006.mp3.hashes.sig 0x0321A000 00010.mp3.hashes 0x0321C000 00010.mp3.hashes.sig 0x0321E000 00010.mp3 0x03CDE000 00009.mp3.hashes 0x03CE0000 00009.mp3.hashes.sig 0x03D74000 00003.mp3 0x04F22000 00005.mp3.hashes 0x04F24000 00005.mp3.hashes.sig 0x04F26000 00005.mp3 0x06FA6000 00004.mp3.hashes 0x06FA8000 00004.mp3.hashes.sig 0x06FAA000 00004.mp3 0x075AA000 00003.mp3.hashes 0x075AC000 00003.mp3.hashes.sig 0x07774000 00000.mp3 0x094AE000 00002.mp3.hashes 0x094B0000 00002.mp3.hashes.sig 0x094B2000 00002.mp3 0x09B72000 00001.mp3.hashes 0x09B74000 00001.mp3.hashes.sig 0x09B76000 00001.mp3 0x0A047600 00000.mp3.hashes 0x0A047800 00000.mp3.hashes.sig Most of the times the signature of the hash is at +0x2000 with the mp3 following at 0x4000, but it is not consistent so the files are not specially sorted. Also the gap between each mp3 files varies a lot. We now know for sure that the data is not read raw but FAT32 table is regularly used by MCU - with the exception that data cannot be fragmented. \\ โง  how to block copy files in correct scheme in FS? ๐Ÿ”ง \\ -> We can always write the files in a raw mode with dd at their addresses. \\ โง  ๐Ÿง  [to be continued...๐Ÿ”ง] \\ What's next? For the real fun to begin we would need a possibility to sign the hashes of all files. Either somebody sees a flaw like \\ [[https://imgs.xkcd.com/comics/random_number.png]] \\ or what we really need is the private key which is somewhere in MCU or with the manufacturer. Anybody ever glitched and dumped an AC9713A6 MCU to find the needle in the hexdump?๐Ÿ“Œ Please ๐Ÿ‘‹๐Ÿ’ฌ๐Ÿ˜„ \\ ===== Hardware of Player ===== The case of the player is clipped, not glued. The 2000mAh Li-Ion 18650 1S battery is also not glued - nice! Inside the casing, there are two PCBs inside. First you need to take off the board containing USB-C port and potentiometer (which is for LED brightness). \\ The Mainboard contains an Jieli Technology **AC9713A6** MCU, which theoretically would support BT5.0 and WiFi: There is no antenna on the PCB though. The pogo pins for connecting the music token cards and the buttons are obvious. Right in the middle there is an IC labled **HT8731**, which is a 10W Boosted Class D amplifier. There is also a **WP25P21** adjustable current limited load switch next to three SOT-23 transistors, which are probably controlling the **eight 3528 RGB-LEDs** around the PCB. Above the pogo pins there is a SOT-23-6 IC labeled "**LPS 5VGA2**" with a small coil next to it. I assume it's a boost converter (LP6216?), I have not measured anything yet. To its left and right there are two unpopulated QFNโ€‘16 footprints. \\ The back of the PCB has only the two 3.5mm headphone jacks, two side buttons, the battery connector and the 12-pin connector for the secondary PCB (with labeled pinout, nice!:). What the array of square pads might be for? Who knows. Maybe a raster for the marker writing on it? ๐Ÿ˜… \\ The secondary PCB has an upright mounted USB-C connector and a LPS **LP4076B** linear charger for single-cell Li-Ion and Li-Polymer batteries. The board has an IC with an etched off surface and broken out I2C header, which is next to the potentiometer setting the brightness of the LEDs (the potentiometer is not labeled on the case of the player, only documented in the manual) {{gallery>:disassembly:galakto:player}} === PCB pinout === There are two nicely written down pinouts on the silkscreens of both PCBs - awesome! \\ But wait. They differ...they are mirrored...they complement each other! ๐Ÿคฏ \\ If the printed arrow at the pin header is taken as Pin1, then the text is upside down.\\ Pinout in view on main PCB (silkscreen text upside down): ^Pin# ^ 1st-Name ^ 2nd-Name ^ left row conclusion | ^Pin# ^ 1st-Name ^ 2nd-Name ^right row conclusion^ |2| Vol | LED_VOL | LED brightness poti | | 1* | VCC | BATT | | |4| SIGNAL| MCUBUS | from-or-to unlabled IC | | 3 | USB5V-DET | USBDET | detection for USB5V (ยฟ//and// ext-spk?) | |6| POWER | PWRON | power signal? | | 5 | NTC | NTC | Temp sensor for (ยฟext?) battery | |8| D- | USBD- | USB data- | | 7 | D+ | USBD+ | USB data+ | |10| B_ON | GND | bridged to GND? | | 9 | GND | GND | Ground | |12| SPK+ | SPK+ | Speaker+ | | 11 | SPK- | SPK- | Speaker- | Such complementing silkscreen labels are awesome! \\ === unlabled IC === Let's see if we can find out what the unlabeled IC with the I2C breakout on the secondary PCB is. Which MCU is hiding there? \\ โง  hook up I2C / UART pins \\ ==== Speaker addon ==== According to the manual, there is a second Li-Ion battery with also 2Ah (7.4Wh) inside. The speaker also has the ability for wireless charging with a frequency 87 โ€“ 205 kHz. \\ If we look at pogo pins solder joints of the second PCB of the galakto player, there is the pinout of the connection ring to the speaker on silkscreen: ^Pin# ^ Name ^ description^ || outer ring | | |1| PWRON | | |2| GND | Ground | |3| BATT | | |4| SPK+ | Speaker+ | |5| SPK- | Speaker- | |6| 5V | | || inner ring | | According to the Pinout you could probably just attach audio signal and trigger the PWRON ring to use it with other sources - you can even power them by the builtin battery. \\ โง  โ“ This might be your task ;) \\ I have not disassembled this part, yet even tried out. According to the pinout and the fact that it has its own USB-C port and charging LEDs, it has probably some standalone Li-Po battery charger IC and inductive charging circuit. \\ ===== Personal conclusion ===== Good that there is a cloudless alternative to the famous Toniebox. It is not cool that they use proprietary cards, though it is understandable, as it is intended for small children from the age of 3. \\ The case labeling of potentiometer for LED brightness is missing and only named in manual - I was careless and had to replace the 10K poti, because I thought it was a screw of the case :-D \\ Sometimes the track prev/next keys don't work (at least for me, maybe I have screwed around a bit too much with my token?) - re-plugging the token helps. \\ Good to see that music files are not encrypted - the signed hash files leave a bad taste in oneโ€™s mouth. Custom mp3 file playing is not possible. \\ Sad to see that the quality of the music files can be considered garbage from hi-fi perspective - the flash storage space would be big enough to store high resolution files on it. I assume that quality is cut down to 128kbps because of the processing power of the MCU. An idealist would have put the high-res files next to the lo-fi versions and sold a separate USB-adapter for the cards to be connected to PC or amps with USB. Wasted chance. \\ Awesome that they kept the useful labels on silkscreen (even complementing each other on pin header!) and have lots of test points *thumbs up*. Have not seen that to this extend in a long while. \\ Only wish I have is for the file signing keys ๐Ÿ˜ด๐Ÿ’ค \\ \\ ๐Ÿค  __Pro-Tip__: Print your own pogo pin USB-adapter and store your secret data - there is still ~1.9GB free space where nobody even imagines to look: the player still works fine :). Just make sure to fix the size of FS in partition after resizing! ==== Sound quality ==== The output of the 3.5mm headset jacks is flat. The .mp3 files of the token sound way better using the same earbuds on my Thinkpad. I assume they have chosen an "equalizer setting" suitable for audio books? They could have added custom EQ in their settings.properties so music albums sound better. \\ For the external speaker: I have not even tried out or unpacked the external speaker yet O.o \\ โง  Task: measure frequency output of audio jack ๐ŸŽผ๐ŸŽถ ===== Links and Infos ===== - AC9713A6 MCU datasheet: [[http://www.yunthinker.com/static/upload/file/20241225/1735097519585543.pdf]] \\ - AC9713A6 MCU reference schematics: [[http://www.yunthinker.com/static/upload/file/20241225/1735097514291728.pdf]] \\ - to flash JieLi MCUs you need "Jerry Tool" JL USB 4.0 Update tool (I have not bought it). Can be found on aliexpress, e.g. here [[https://aliexpress.com/item/1005003581831855.html]] or [[https://aliexpress.com/item/1005004678471938.html]] \\ - nice read-up: [[https://oshwlab.com/hawaii0707/jeli-color-silk-screen-developme]] \\ - AlcorMP tool: [[https://www.usbdev.ru/files/alcor/alcormp/]] \\ * alt. link: [[https://www.raed.net/file?id=798819|ALCOR_U2_MP_23.08.07.00.H_AHG-B.rar]] (found in web as usbdev was down) ===== 3D printed Token adapter ===== Tokens are just FAT32 formatted USB2.0 Flash sticks with unencrypted .mp3 files and "some key junk". We can print a docking station as an adapter for the neat tokens. I like the pogo pins they have used, so let's do that too *ordering popo pins?* \\ This way we can connect the tokens to USB quickly for switching and dumping partitions or connect them to USB capable stereo amps to have richer sound. Then you could be able to fast forward and reverse playback (galakto player can only skip complete tracks). ๐Ÿค”๐Ÿ’ญ And if you //own// more than one kid and one token (no piracy here!), you can have the other kid listen to a token too ๐Ÿ’ก Undisturbed time to prepare dinner ๐Ÿ˜…\\ โง  create stl model for 3D printing ๐Ÿ”ง \\ โง  solder up pogo pins with USB-C socket ๐Ÿ”ง \\ โง  profit and/or please contribute ;) \\ โง  bonus: integrate MCU with button for switching partitions \\ ===== ToDo ===== - take photos with better lighting \\ - hook up I2C / UART pins \\ - find out unlabeled IC \\ * 3D printing model with pogo pins and USB for token \\ - glitch AC9713A6 MCU and extract private key for custom content (achievable?) \\