disassembled_devices:galakto_player_toylino
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| disassembled_devices:galakto_player_toylino [2025/08/26 08:13] – removed - external edit (Unknown date) 127.0.0.1 | disassembled_devices:galakto_player_toylino [2025/12/01 08:00] (current) – ["Hacking" the toy token] admin | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| + | ~~META: | ||
| + | title=Galakto Player Toylino hacking and disassembly | ||
| + | description=Disassembly and hacking Galakto Token cards | ||
| + | keywords=SEO, | ||
| + | ~~ | ||
| + | ====== Galakto Player Toylino edition====== | ||
| + | |||
| + | There is a German alternative to the famous Toniebox. It is called Galakto Player - Toylino edition (created by Tiny Monster GmbH), which is sold at [[https:// | ||
| + | It is an offline player without any wireless connectivity. \\ | ||
| + | |||
| + | > "Auch etwas Vergleichbares zum Kreativ-Tonie fehlt noch, soll aber laut Galakto in Planung sein." | ||
| + | Source: [[https:// | ||
| + | Freely translated: | ||
| + | > Something comparable to the Creative-Tonie (a Token with custom content) is also still missing, but according to Galakto, it is in planning. | ||
| + | Or is it? Can we verify the claim and see if it's even possible with the chosen technical approach? Let's find out! \\ | ||
| + | |||
| + | Although it is a player for the German market, I still like to do my write-ups in English. Use [[https:// | ||
| + | |||
| + | ===== Disclaimer ===== | ||
| + | |||
| + | I do this for educational purposes and fun. I've seen the Galakto Tokens and just wondered what's inside. So in January 2025, I've decided on one of the available music tokens on Kleinanzeigen, | ||
| + | I ended up getting the player as well 🤦. I've put it in the disassembly section because it doesn' | ||
| + | I am a curious person and like to share knowledge. I love the interesting stuff you guys do and share, YOU keep being brilliant! :) | ||
| + | |||
| + | 🗒️ Note: I am not sponsored, I am not affiliated with anyone, and I do not engage in advertising, | ||
| + | Ultimately, I am here for freedom, longevity, and to play my own tune. \\ | ||
| + | |||
| + | ⚠️ I am in no way responsible for what you to. Please think before doing and pressing the return key. If you feel I violate any of your rights, contact me. \\ | ||
| + | |||
| + | ===== Music Tokens ===== | ||
| + | As Music Tokens / cards are the only way to play music with the player, I consider it the core component. As of 06/2025, there are 148 Galakto Tokens [[https:// | ||
| + | |||
| + | ==== Music Tokens Hardware ==== | ||
| + | |||
| + | The music tokens / cards connect to the pogo pins of the player and are held in place magnetically. \\ | ||
| + | The plastic housing is welded and cannot be opened easily (I used a rotary tool to cut it open) \\ | ||
| + | Looking at the PCB, we can see a flash memory chip from SKhynix model **H9TQ64AAETAC** with **2GB**. On the other side of the PCB, there is a USB 2.0 Flash Disk Controller IC, type **AU6989SNL-CA2** from ALCOR MICRO. On the left side, there are pads for USB on the PCB. There are remains of broken off connection pins, which lead to the conclusion that these pins are probably used in production to put the content on. | ||
| + | |||
| + | {{gallery>: | ||
| + | |||
| + | ==== Music Tokens Pinout ==== | ||
| + | |||
| + | The pinout is the following: \\ | ||
| + | |||
| + | ^ Pin ^ Description | ||
| + | | VCC | +5V | | ||
| + | | GND_EN | ||
| + | | GND | Ground | ||
| + | | D+ | USB data plus | | ||
| + | | D- | USB data minus | | ||
| + | | ?(P1) | either NP or goes to some BGA-pad of Flash IC | | ||
| + | |||
| + | |||
| + | The POV of the PCB is the front of the token card (Flash IC is the backside of the card). So if you hold the token and look at the front, then VCC is left. \\ | ||
| + | |||
| + | < | ||
| + | : | ||
| + | : | ||
| + | </ | ||
| + | |||
| + | |||
| + | So let's solder quickly a USB-cable onto our toy token to see what is on the flash chip. \\ | ||
| + | |||
| + | ==== Music Tokens Content ==== | ||
| + | Galakto card is **2GB FAT32** formatted flash storage connected to a **USB 2.0 Flash Disk Controller** IC, with **no write protecion**. \\ | ||
| + | Cloning the token to any other USB-Stick works just fine :) Therefore, you could solder a USB-Socket to the Player. \\ | ||
| + | |||
| + | ⚠️ **WARNING: Always create a full block-level backup of the entire device!** | ||
| + | Do not back up just a single partition (e.g. /dev/sdX1) - always clone the entire device (e.g. /dev/sdX) to preserve partition table and layout. \\ | ||
| + | It is not possible to copy the bare files back to the partition. __If a .mp3 is copied back, you cannot listen to it anymore and not skip past it__ - even with the correct signature! \\ | ||
| + | |||
| + | <code bash> | ||
| + | #>dd if=/dev/sdX of=full_backup.bin | ||
| + | </ | ||
| + | |||
| + | ⚠️ **WARNING: Always check which device/ | ||
| + | |||
| + | The device layout looks like this: | ||
| + | <hidden Show content> | ||
| + | <code bash> | ||
| + | #>fdisk -l /dev/sdX | ||
| + | Disk /dev/sdb: 1.88 GiB, 2013265920 bytes, 3932160 sectors | ||
| + | Disk model: Flash Disk | ||
| + | Units: sectors of 1 * 512 = 512 bytes | ||
| + | Sector size (logical/ | ||
| + | I/O size (minimum/ | ||
| + | Disklabel type: dos | ||
| + | Disk identifier: 0x6544f215 | ||
| + | |||
| + | Device | ||
| + | / | ||
| + | |||
| + | #> | ||
| + | Boot sector contents: | ||
| + | System ID " | ||
| + | Media byte 0xf8 (hard disk) | ||
| + | 512 bytes per logical sector | ||
| + | 8192 bytes per cluster | ||
| + | 2806 reserved sectors | ||
| + | First FAT starts at byte 1436672 (sector 2806) | ||
| + | 2 FATs, 32 bit entries | ||
| + | | ||
| + | Root directory start at cluster 2 (arbitrary size) | ||
| + | Data area starts at byte 16777216 (sector 32768) | ||
| + | 243200 data clusters (1992294400 bytes) | ||
| + | 63 sectors/ | ||
| + | 8192 hidden sectors | ||
| + | | ||
| + | Checking for unused clusters. | ||
| + | Checking free cluster summary. | ||
| + | /dev/sdb1: 46 files, 3533/243200 clusters | ||
| + | </ | ||
| + | </ | ||
| + | \\ | ||
| + | |||
| + | Following is the partition content of the music token "DIKKA Oh Yeah!" listed | ||
| + | |||
| + | <hidden Show content> | ||
| + | <code bash> | ||
| + | > tree A46B-9AAD | ||
| + | A46B-9AAD | ||
| + | └── System Volume Information | ||
| + | ├── IndexerVolumeGuid | ||
| + | ├── IndexVolumeGuid | ||
| + | │ ├── 00000.mp3 | ||
| + | │ ├── 00000.mp3.hashes | ||
| + | │ ├── 00000.mp3.hashes.sig | ||
| + | │ ├── 00001.mp3 | ||
| + | │ ├── 00001.mp3.hashes | ||
| + | │ ├── 00001.mp3.hashes.sig | ||
| + | │ ├── 00002.mp3 | ||
| + | │ ├── 00002.mp3.hashes | ||
| + | │ ├── 00002.mp3.hashes.sig | ||
| + | │ ├── 00003.mp3 | ||
| + | │ ├── 00003.mp3.hashes | ||
| + | │ ├── 00003.mp3.hashes.sig | ||
| + | │ ├── 00004.mp3 | ||
| + | │ ├── 00004.mp3.hashes | ||
| + | │ ├── 00004.mp3.hashes.sig | ||
| + | │ ├── 00005.mp3 | ||
| + | │ ├── 00005.mp3.hashes | ||
| + | │ ├── 00005.mp3.hashes.sig | ||
| + | │ ├── 00006.mp3 | ||
| + | │ ├── 00006.mp3.hashes | ||
| + | │ ├── 00006.mp3.hashes.sig | ||
| + | │ ├── 00007.mp3 | ||
| + | │ ├── 00007.mp3.hashes | ||
| + | │ ├── 00007.mp3.hashes.sig | ||
| + | │ ├── 00008.mp3 | ||
| + | │ ├── 00008.mp3.hashes | ||
| + | │ ├── 00008.mp3.hashes.sig | ||
| + | │ ├── 00009.mp3 | ||
| + | │ ├── 00009.mp3.hashes | ||
| + | │ ├── 00009.mp3.hashes.sig | ||
| + | │ ├── 00010.mp3 | ||
| + | │ ├── 00010.mp3.hashes | ||
| + | │ ├── 00010.mp3.hashes.sig | ||
| + | │ ├── 00011.mp3 | ||
| + | │ ├── 00011.mp3.hashes | ||
| + | │ ├── 00011.mp3.hashes.sig | ||
| + | │ ├── all-files.hashes | ||
| + | │ ├── all-files.hashes.sig | ||
| + | │ ├── check.txt | ||
| + | │ ├── settings.properties | ||
| + | │ ├── settings.properties.sig | ||
| + | │ └── signature.txt | ||
| + | └── WPSettings.dat | ||
| + | |||
| + | 2 directories, | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | Here are all the files except the actual mp3 music files (due to copyright): \\ | ||
| + | {{: | ||
| + | === Description of files === | ||
| + | |||
| + | ** | ||
| + | Dikka music card is not encrypted, using 29MB in total for 11 songs with ~2-3MB each. \\ | ||
| + | .mp3 files are unencrypted with 128 kbps / 44.1KHz (Cbr) \\ | ||
| + | .hashes is sha256sum of mp3 file \\ | ||
| + | .sig files look like a classic ASN.1 DER-encoded ECDSA (Elliptic Curve Digital Signature Algorithm) signature**, | ||
| + | > 30 = SEQUENCE | ||
| + | > 46 = total length | ||
| + | > 02 21 = INTEGER (r, 33 bytes) | ||
| + | > 02 21 = INTEGER (s, 33 bytes) | ||
| + | // | ||
| + | // | ||
| + | // | ||
| + | // | ||
| + | > 30 — ASN.1 SEQUENCE tag. | ||
| + | > 45 — Length of the sequence (69 bytes). | ||
| + | > 02 21 — First INTEGER of 33 bytes → this is the r component of the ECDSA signature. | ||
| + | > 02 20 — Second INTEGER of 32 bytes → this is the s component. | ||
| + | What is it for? Actually, I haven' | ||
| + | |||
| + | // | ||
| + | |||
| + | It is strange to see that the main directory is called " | ||
| + | According to hex-dump of block device the tokens get cloned by Vinpower Digital machine. \\ | ||
| + | |||
| + | The player does only play mp3-files which have correct hashes and signatures. Also the files cannot be copied manually onto the partition via copy command/ | ||
| + | I have tried cutting and copying a track back on FS and then reordering with [[http:// | ||
| + | |||
| + | ===== " | ||
| + | To make your life easier, create your own toy token by soldering a USB-C socket on. \\ | ||
| + | < | ||
| + | : | ||
| + | </ | ||
| + | |||
| + | I have also tried to use GPT-4o to alter the packaging style, but it is actually better with creating content instead of changing it. Which one do you like best? \\ | ||
| + | |||
| + | {{gallery>: | ||
| + | |||
| + | If you don't want to cut up your token, you can alternatively open the player, solder a USB-A-port on and cut into the case for the socket - you could then even use regular USB2.0-sticks. Keep in mind that you need to do something with the "token connection detection" | ||
| + | For dumping partitions once, the most simple way would be to stick tape with USB-wires onto the outer contacts (validate your dumps!). \\ | ||
| + | The cleanest way would be to [[galakto_player_toylino# | ||
| + | |||
| + | ==== Gathered insides ==== | ||
| + | 💡 If you screw up with dd and write partition to block device, which leaves you with a device with ~3.99MB according to fdisk, don't panic, the easiest way is to reboot your linux OS. You will be able to repartition/ | ||
| + | 🔍 We don't have the private key to sign content, so what can we do for now? \\ | ||
| + | ❌ Just plain copying the tracks onto FS with their correct signature does not work. \\ | ||
| + | ✅ Cloning the card onto another USB-stick via dd works just fine - the player plays from whatever USB2.0-stick. \\ | ||
| + | 🤔 Destroying MBR or even zeroing partition table breaks playback. \\ | ||
| + | ❓ MBR and FAT32 is used - so why can't content be copied back and forth without " | ||
| + | 🔓 Conclusion: MCU goes to first partition in table, but files are read raw and must not be fragmented by FS.\\ | ||
| + | ✅ Resizing the partition to >=260MiB (absolute minimum size for fat32, 528MiB being min. standard) seems to work fine, player still plays content. \\ | ||
| + | 🔧 There is lots of space left, so let's clone multiple partitions with other original content and just switch between the active partitions in MBR. \\ | ||
| + | 🎯 See below how to hack the heck out of that. \\ | ||
| + | |||
| + | |||
| + | ==== Multi-partition token ==== | ||
| + | Wait, this is the " | ||
| + | So, following are steps to create a multi-partition token and swap between them. This POC is to show that you can have more than one token stored into a single one. The catch? You have to rewrite LBA addresses of partition table to tell the player which is the first partition, as it will only read from that. Why do that? Idk, I just have to take my linux machine out of my pocket/bag and rewrite MBR, so I don't have to carry around so many tokens. Or swap content with Peppa Pig for April Fool's Day (how mean!). Okok, it is a //" | ||
| + | |||
| + | ⚠️ **WARNING: Always check which device/ | ||
| + | replace /dev/sdX with your device! \\ | ||
| + | |||
| + | ==0. create full backup == | ||
| + | |||
| + | ⚠️ **Always create a full block-level backup of the entire device! Do not back up just a single partition (e.g. /dev/sdX1) - always clone the entire device (e.g. /dev/sdX) to preserve partition table and layout.** | ||
| + | <code bash> | ||
| + | dd if=/dev/sdX of=full_backup.bin | ||
| + | # lookup partition addresses | ||
| + | fdisk -l /dev/sdX | ||
| + | # lookup fat information | ||
| + | fatresize -i /dev/sdX1 | ||
| + | # or install sleuthkit and | ||
| + | fsstat /dev/sdX1 | ||
| + | |||
| + | </ | ||
| + | |||
| + | ==1. Resize partition (> | ||
| + | Larger than 528MiB, because a FAT32 volume must have at least 65,525 clusters. \\ | ||
| + | > Volume size (bytes) = clusters × sectors/ | ||
| + | > Partition size (in sectors) = Reserved sectors + (Number of FATs × Sectors per FAT) + (Clusters × Sectors per cluster) | ||
| + | ~528MiB is needed with cluster size 8KiB and 512 bytes per sector. \\ | ||
| + | 260MiB seems to work too, but it's non-standard minimum. \\ | ||
| + | <code bash> | ||
| + | # Unmount if needed | ||
| + | umount /dev/sdX1 | ||
| + | |||
| + | # DO NOT Resize FAT32 part first as normally | ||
| + | #DO NOT fatresize /dev/sdX1 [size] | ||
| + | |||
| + | # Resize the partition to match (from sector 8192, 1081344 sectors) | ||
| + | parted /dev/sdX --script resizepart 1 1089535s | ||
| + | </ | ||
| + | |||
| + | ==1.5. fix FS == | ||
| + | |||
| + | >FAT32 layout: | ||
| + | > | ||
| + | > | ||
| + | > | ||
| + | |||
| + | you can manually hexedit boot sector fields: \\ | ||
| + | ^Offset (hex) ^Field ^New Value for 528MiB ^description ^ | ||
| + | | 0x20–0x23 | BPB_TotSec32 (Total Secs) | 00 80 10 00 | 1081344 sectors = 528MiB | | ||
| + | | 0x24–0x27 | BPB_FATSz32 (Sectors/ | ||
| + | < | ||
| + | < | ||
| + | < | ||
| + | |||
| + | or alternatively use commands: | ||
| + | <code bash> | ||
| + | # copy first sector (Boot Sector) | ||
| + | dd if=/ | ||
| + | |||
| + | # Set BPB_TotSec32 = 1,081,344 sectors = 0x00108000 | ||
| + | printf ' | ||
| + | |||
| + | # Set BPB_FATSz32 = 529 sectors = 0x00000211 | ||
| + | printf ' | ||
| + | |||
| + | # Do not change BPB_TotSec16 | ||
| + | # Do not change Root Cluster | ||
| + | |||
| + | #write bootsect back and override backup too | ||
| + | dd if=bootsect.bin of=/ | ||
| + | dd if=bootsect.bin of=/ | ||
| + | </ | ||
| + | |||
| + | < | ||
| + | # Verify and fix FS if needed | ||
| + | fsck.vfat -v /dev/sdX1 | ||
| + | # FAQ: | ||
| + | # Copy original over backup? -> yes (original is sector 0 and sector 6 is a backuo) | ||
| + | ## Checking we can access the last sector of the filesystem: 0x41: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt. | ||
| + | #-> 2) No action (because dirty bit was originally? set by my token?ikd) | ||
| + | ##Free cluster summary wrong -> Correct, probably? | ||
| + | |||
| + | </ | ||
| + | |||
| + | ==2. Add second partition == | ||
| + | |||
| + | <code bash> | ||
| + | # Backup a 528 MiB partition | ||
| + | dd if=/ | ||
| + | |||
| + | # create second partition | ||
| + | parted /dev/sdX --script mkpart primary fat32 532MiB 1060MiB # add a second 528MiB partition | ||
| + | </ | ||
| + | |||
| + | ==3. copy over partition == | ||
| + | Take block backup of a partition and append after first partition: | ||
| + | <code bash> | ||
| + | |||
| + | # Append backup to device with 1 MiB (2048 sectors) after first partition | ||
| + | # < | ||
| + | dd if=other_backup.bin of=/dev/sdX bs=512 seek=1089536 conv=notrunc | ||
| + | |||
| + | # if needed | ||
| + | # Append second partition to partition table with | ||
| + | # sfdisk. Format: start_sector, | ||
| + | echo " | ||
| + | </ | ||
| + | |||
| + | ==4. The Swap trick == | ||
| + | |||
| + | Each partition entry in MBR is 16 bytes long, and the partition table starts at byte offset 446 (0x1BE). Therefore swap: \\ | ||
| + | |||
| + | 1st partition entry: bytes 446–461 (0x1BE–0x1CD) \\ | ||
| + | 2nd partition entry: bytes 462–477 (0x1CE–0x1DD) \\ | ||
| + | 3rd partition entry: bytes 478–493 (0x1DE–0x1ED) \\ | ||
| + | 4th partition entry: bytes 494–509 (0x1EE–0x1FD) \\ | ||
| + | |||
| + | With this, we can use dd to swap partitions to which is first: | ||
| + | <code bash> | ||
| + | # Have a backup of MBR | ||
| + | dd if=/dev/sdX of=mbr_backup.bin bs=512 count=1 | ||
| + | # Extract first partition entry | ||
| + | dd if=mbr_backup.bin of=part1.bin bs=1 skip=446 count=16 | ||
| + | # Extract second partition entry | ||
| + | dd if=mbr_backup.bin of=part2.bin bs=1 skip=462 count=16 | ||
| + | # Create copy of mbr_backup for swapping | ||
| + | cp mbr_backup.bin mbr_swapped.bin | ||
| + | # Write second partition entry over first | ||
| + | dd if=part2.bin of=mbr_swapped.bin bs=1 seek=446 conv=notrunc | ||
| + | # Write first partition entry over second | ||
| + | dd if=part1.bin of=mbr_swapped.bin bs=1 seek=462 conv=notrunc | ||
| + | # Write back MBR to USB storage | ||
| + | dd if=mbr_swapped.bin of=/dev/sdX bs=512 count=1 | ||
| + | </ | ||
| + | or do it directly on /dev/sdX instead of mbr_swapped. To reverse, just write back mbr_backup or change partition address accordingly. | ||
| + | |||
| + | ==5. Flush & Wash & Rehash== | ||
| + | Flush and __WASH YOUR HANDS WITH SOAP!__ **Soap works, you know.** 💩 Do it ever so often in between when advisable. \\ | ||
| + | <code bash> | ||
| + | sync | ||
| + | sudo blockdev --flushbufs /dev/sdX | ||
| + | sudo partprobe /dev/sdX | ||
| + | </ | ||
| + | |||
| + | Now it looks something like this: | ||
| + | <code bash> | ||
| + | Device | ||
| + | / | ||
| + | / | ||
| + | </ | ||
| + | |||
| + | |||
| + | ✅ Done, you now have switched to a second partition. You can have four primary partitions in MBR, 3+ fitting in the size of a single token - you ' | ||
| + | |||
| + | 🕺🎤 🔊 🎵 //Oh, yeah! DIKKA, Digga//, done creating our toy token! 🏁 | ||
| + | |||
| + | See if there is some [[galakto_player_toylino# | ||
| + | |||
| + | **Further steps I can imagine:** \\ | ||
| + | ⧠ upload a nice script for more convenient switching 🔧 \\ | ||
| + | ⧠ write simple C (Arduino? | ||
| + | |||
| + | ====custom content==== | ||
| + | As the player cannot read fragmented tracks, let's look at the partition hexdump first. \\ | ||
| + | I have searched for some characters in hexdump of files inside partition backup. | ||
| + | In my Dikka partition the ordering is as follows, sorted by offsets in FS: | ||
| + | |||
| + | <hidden Show content> | ||
| + | < | ||
| + | 0x01004000 | ||
| + | 0x01006000 | ||
| + | 0x0100A000 | ||
| + | 0x0100C000 | ||
| + | 0x0100E020 | ||
| + | 0x01010000 | ||
| + | 0x01012000 | ||
| + | 0x01014000 | ||
| + | 0x01016000 | ||
| + | 0x0101A000 | ||
| + | 0x0101B000 | ||
| + | 0x0131A000 | ||
| + | 0x01550000 | ||
| + | 0x01BDA000 | ||
| + | 0x01BDC000 | ||
| + | 0x01BDE000 | ||
| + | 0x0245E000 | ||
| + | 0x02460000 | ||
| + | 0x02462000 | ||
| + | 0x027E2000 | ||
| + | 0x027E4000 | ||
| + | 0x0321A000 | ||
| + | 0x0321C000 | ||
| + | 0x0321E000 | ||
| + | 0x03CDE000 | ||
| + | 0x03CE0000 | ||
| + | 0x03D74000 | ||
| + | 0x04F22000 | ||
| + | 0x04F24000 | ||
| + | 0x04F26000 | ||
| + | 0x06FA6000 | ||
| + | 0x06FA8000 | ||
| + | 0x06FAA000 | ||
| + | 0x075AA000 | ||
| + | 0x075AC000 | ||
| + | 0x07774000 | ||
| + | 0x094AE000 | ||
| + | 0x094B0000 | ||
| + | 0x094B2000 | ||
| + | 0x09B72000 | ||
| + | 0x09B74000 | ||
| + | 0x09B76000 | ||
| + | 0x0A047600 | ||
| + | 0x0A047800 | ||
| + | </ | ||
| + | </ | ||
| + | |||
| + | Most of the times the signature of the hash is at +0x2000 with the mp3 following at 0x4000, but it is not consistent so the files are not specially sorted. Also the gap between each mp3 files varies a lot. We now know for sure that the data is not read raw but FAT32 table is regularly used by MCU - with the exception that data cannot be fragmented. \\ | ||
| + | |||
| + | ⧠ how to block copy files in correct scheme in FS? 🔧 \\ | ||
| + | -> We can always write the files in a raw mode with dd at their addresses. \\ | ||
| + | |||
| + | ⧠ 🧠 [to be continued...🔧] \\ | ||
| + | What's next? For the real fun to begin we would need a possibility to either sign the hashes (unlikely) or patch for the (yet to be) dumped firmware. \\ | ||
| + | It would be easier if the manufacturer would hand out the private key - why are files signed anyways? \\ | ||
| + | Anybody ever glitched and dumped an AC9713A6 MCU to find the needle in the hexdump for ' | ||
| + | |||
| + | |||
| + | ===== Hardware of Player ===== | ||
| + | |||
| + | The case of the player is clipped, not glued. The 2000mAh Li-Ion 18650 1S battery is also not glued - nice! Inside the casing, there are two PCBs inside. First you need to take off the board containing USB-C port and potentiometer (which is for LED brightness). | ||
| + | |||
| + | The Mainboard contains a **Jieli Technology AC9713A6** MCU, which theoretically would support BT5.0 and WiFi: There is no antenna on the PCB though. | ||
| + | The pogo pins for connecting the music token cards and the buttons are obvious. Right in the middle there is an IC labled **HT8731**, which is a 10W Boosted Class D amplifier. | ||
| + | There is also a **WP25P21** adjustable current limited load switch next to three SOT-23 transistors, | ||
| + | Above the pogo pins there is a SOT-23-6 IC labeled "**LPS 5VGA2**" | ||
| + | To its left and right there are two unpopulated QFN‑16 footprints. \\ | ||
| + | The back of the PCB has only the two 3.5mm headphone jacks, two side buttons, the battery connector and the 12-pin connector for the secondary PCB (with labeled pinout, nice!:). What the array of square pads might be for? There are vias for thermal dissipation of the amp, the pads are tin-plated, the battery lies on top. But why squares? Who knows. Maybe a raster for the marker writing on it? 😅 \\ | ||
| + | |||
| + | The secondary PCB has an upright mounted USB-C connector and a LPS **LP4076B** linear charger for single-cell Li-Ion and Li-Polymer batteries. The board has an unlabled IC with an etched off surface and broken out I2C header, which is next to the potentiometer setting the brightness of the LEDs ( - BTW: the potentiometer is not labeled on the case of the player, only documented in the manual) | ||
| + | |||
| + | |||
| + | {{gallery>: | ||
| + | |||
| + | === PCB pinout === | ||
| + | |||
| + | There are two nicely written down pinouts on the silkscreens of both PCBs - awesome! \\ | ||
| + | But wait. They differ...they are mirrored...they complement each other! 🤯 \\ | ||
| + | If the printed arrow at the pin header is taken as Pin1, then the text is upside down.\\ | ||
| + | |||
| + | Pinout in view on main PCB (silkscreen text upside down): | ||
| + | |||
| + | ^Pin# ^ 1st-Name ^ 2nd-Name | ||
| + | |2| Vol | LED_VOL | LED brightness poti | | 1* | VCC | BATT | | | ||
| + | |4| SIGNAL| MCUBUS | from-or-to unlabled IC | | 3 | USB5V-DET | USBDET | detection for USB5V (¿//and// ext-spk? | ||
| + | |6| POWER | PWRON | power signal? | | 5 | NTC | NTC | Temp sensor for (¿ext?) battery | ||
| + | |8| D- | USBD- | USB data- | | 7 | D+ | USBD+ | USB data+ | | ||
| + | |10| B_ON | GND | bridged to GND? | | 9 | GND | GND | Ground | | ||
| + | |12| SPK+ | SPK+ | Speaker+ | ||
| + | |||
| + | Such complementing silkscreen labels are awesome! | ||
| + | |||
| + | === unlabeled IC === | ||
| + | |||
| + | The unlabeled IC looks like an MCU. I've hooked up a logic analyzer and another MCU to the I2C port of the unlabeled IC on the secondary PCB. Unfortunately the I2C breakout seems to be unused, there is no data at all, no matter if pull-up resistors are being used or not. \\ | ||
| + | |||
| + | ==== Speaker addon ==== | ||
| + | According to the manual, there is a second Li-Ion battery with also 2Ah (7.4Wh) inside. The speaker also has the ability for wireless charging with a frequency 87 – 205 kHz. \\ | ||
| + | If we look at pogo pins solder joints of the second PCB of the galakto player, there is the pinout of the connection ring to the speaker on silkscreen: | ||
| + | |||
| + | ^Pin# ^ Name ^ description^ | ||
| + | || outer ring | | | ||
| + | |1| PWRON | | | ||
| + | |2| GND | Ground | ||
| + | |3| BATT | | | ||
| + | |4| SPK+ | Speaker+ | | ||
| + | |5| SPK- | Speaker- | | ||
| + | |6| 5V | ||
| + | || inner ring | | | ||
| + | |||
| + | According to the Pinout you could probably just attach audio signal and trigger the PWRON ring to use it with other sources - you can even power them by the builtin battery. \\ | ||
| + | |||
| + | ⧠ ❓ This might be your task ;) \\ | ||
| + | I have not disassembled this part, yet even tried out. According to the pinout and the fact that it has its own USB-C port and charging LEDs, it has probably some standalone Li-Po battery charger IC and inductive charging circuit. \\ | ||
| + | |||
| + | |||
| + | ===== Personal conclusion ===== | ||
| + | Good that there is a cloudless alternative to the famous Toniebox. I still have not understood what " | ||
| + | It is not cool that they use proprietary cards, though it is understandable, | ||
| + | The case labeling of potentiometer for LED brightness is missing and only named in the manual - I was careless and had to replace the 10K poti, because I thought it was a screw of the case :'D \\ | ||
| + | I like the idea with the LEDs, they even change color on certain points in time of tracks - the patters are in a text file, which is sadly signed too. \\ | ||
| + | Sometimes the track prev/next keys don't work (at least for me, maybe I have screwed around a bit too much with my token?) - re-plugging the token helps. \\ | ||
| + | Good to see that music files are not encrypted - the signed hashes for each file leave a bad taste in ones mouth. Custom mp3 file playing is not possible. \\ | ||
| + | Sad to see that the quality of the music files can be considered garbage from Hi-Fi perspective - the flash storage space would be big enough to store high resolution files on it. I assume that quality is cut down to 128kbps because of the processing power of the MCU. An idealist would have put the high-res files next to the Lo-Fi versions and sold a separate USB-adapter for the cards to be connected to PC or amps with USB: A chance wasted. \\ | ||
| + | Nice that there are two headphone sockets so the player can simultaneously be used by two kids. \\ | ||
| + | Awesome that they kept the useful labels on silkscreen (even complementing each other on pin header!) and have lots of test points *thumbs up*. Have not seen that to this extend in a while. \\ | ||
| + | Only wish I have is for the file signing keys 😴💤 \\ | ||
| + | |||
| + | **So, will there ever be custom content for the tokens?** Either the manufacturer releases the private keys for signing files (which is unlikely, then they would not have needed to do it in the first place!) or they release a client software which signs the hashes of the files on a server and sends back the signature files. The software then would still need to block copy those files, as we have learned previously (copying back files breaks them). Patching out the DRM system would only be possible via USB/Token by the user, as there is no wireless connectivity. I still think there never will be official custom content for Galakto player. @Tiny Monster GmbH: Prove me wrong. \\ | ||
| + | **Final thought:** It is a system with DRM which is a K.O. - I would not recommend buying anything with DRM (are there even any alternatives available on the market?). I cannot recommend buying the tokens for the music alone either, due to the Lo-Fi quality of the mp3 files. __Avoid__. \\ | ||
| + | |||
| + | At least we have created a multi-token and proved that it would be theoretically possible to store more than one album on a token - sad that the firmware is probably not able to switch between them by itself. \\ | ||
| + | |||
| + | \\ | ||
| + | 🤠 __Pro-Tip__: | ||
| + | |||
| + | ==== Sound quality ==== | ||
| + | The output of the 3.5mm headphone jacks is flat. The .mp3 files of the token sound way better using the same earbuds on my Thinkpad. I assume they have chosen an " | ||
| + | Still, the Lo-Fi 128kbps mp3-files are low quality. \\ | ||
| + | For the external speaker: It has a decent sound (even with low frequencies) and is not flat at all like the headphone jacks. \\ | ||
| + | Question: Why has headphone jack flat sound but not the attachment speaker? \\ | ||
| + | |||
| + | ⧠ Task: measure frequency output of audio jack 🎼🎶 | ||
| + | |||
| + | |||
| + | ===== Links and Infos ===== | ||
| + | - AC9713A6 MCU datasheet: [[http:// | ||
| + | - AC9713A6 MCU reference schematics: [[http:// | ||
| + | - to flash JieLi MCUs you need "Jerry Tool" JL USB 4.0 Update tool (I have not bought it). Can be found on aliexpress, e.g. here | ||
| + | [[https:// | ||
| + | or | ||
| + | [[https:// | ||
| + | - nice read-up: [[https:// | ||
| + | - AlcorMP tool: [[https:// | ||
| + | * alt. link: [[https:// | ||
| + | |||
| + | ===== 3D printed Token adapter ===== | ||
| + | Tokens are just FAT32 formatted USB2.0 Flash sticks with unencrypted .mp3 files and "some key junk". We can print a docking station as an adapter for the neat tokens. I like the pogo pins they have used, so let's do that too *ordering popo pins?* \\ | ||
| + | This way we can connect the tokens to USB quickly for switching and dumping partitions or connect them to USB capable stereo amps to have richer sound. Then you could be able to fast forward and reverse playback (galakto player can only skip complete tracks). 🤔💭 And if you //own// more than one kid and one token (no piracy here!), you can have the other kid listen to a token too 💡 Undisturbed time to prepare dinner 😅\\ | ||
| + | |||
| + | ⧠ create stl model for 3D printing 🔧 \\ | ||
| + | ⧠ solder up pogo pins with USB-C socket 🔧 \\ | ||
| + | ⧠ profit and/or please contribute ;) \\ | ||
| + | ⧠ bonus: integrate MCU with button for switching partitions \\ | ||
| + | ===== ToDo ===== | ||
| + | - < | ||
| + | - find out unlabeled IC \\ | ||
| + | * 3D printing model with pogo pins and USB for token \\ | ||
| + | - glitch AC9713A6 MCU to dump firmware (achievable? | ||