disassembled_devices:galakto_player_toylino
Differences
This shows you the differences between two versions of the page.
| Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
| disassembled_devices:galakto_player_toylino [2025/08/26 08:23] – [Personal conclusion] admin | disassembled_devices:galakto_player_toylino [2025/12/01 08:00] (current) – ["Hacking" the toy token] admin | ||
|---|---|---|---|
| Line 16: | Line 16: | ||
| Or is it? Can we verify the claim and see if it's even possible with the chosen technical approach? Let's find out! \\ | Or is it? Can we verify the claim and see if it's even possible with the chosen technical approach? Let's find out! \\ | ||
| - | Although it is a player for the German market, I still like to do my write-ups in english. Use [[https:// | + | Although it is a player for the German market, I still like to do my write-ups in English. Use [[https:// |
| ===== Disclaimer ===== | ===== Disclaimer ===== | ||
| - | I do this for educational fun. I've seen the Galakto Tokens and just wondered what's inside. So in January 2025, I've decided on one of the available music tokens on Kleinanzeigen, | + | I do this for educational |
| - | I ended up having | + | I ended up getting |
| I am a curious person and like to share knowledge. I love the interesting stuff you guys do and share, YOU keep being brilliant! :) | I am a curious person and like to share knowledge. I love the interesting stuff you guys do and share, YOU keep being brilliant! :) | ||
| - | 🗒️ Note: I am not sponsored, I do not affiliate or try to do advertising even if providing links. I do not take any responsibility for external content. There is no piracy involved or encouraged here - I did only clone one token to itself as a POC. \\ | + | 🗒️ Note: I am not sponsored, I am not affiliated with anyone, and I do not engage in advertising, even when providing links. I do not take any responsibility for external content. There is no piracy involved or encouraged here - I did only clone one token to itself as a POC. \\ |
| - | Ultimately, I am here for freedom, | + | Ultimately, I am here for freedom, |
| - | ⚠️ I am in no sense responsible for what you to. Please think before doing and pressing return | + | ⚠️ I am in no way responsible for what you to. Please think before doing and pressing |
| ===== Music Tokens ===== | ===== Music Tokens ===== | ||
| - | As Music Tokens / cards are the only way to play music with the player, I consider it the core part. As of 06/2025 there are 148 Galakto Tokens [[https:// | + | As Music Tokens / cards are the only way to play music with the player, I consider it the core component. As of 06/2025, there are 148 Galakto Tokens [[https:// |
| ==== Music Tokens Hardware ==== | ==== Music Tokens Hardware ==== | ||
| - | The music tokens / cards connect to the pogo pins of the player and hold magnetically. | + | The music tokens / cards connect to the pogo pins of the player and are held in place magnetically. \\ |
| The plastic housing is welded and cannot be opened easily (I used a rotary tool to cut it open) \\ | The plastic housing is welded and cannot be opened easily (I used a rotary tool to cut it open) \\ | ||
| - | Looking at the PCB we can see a flash memory chip from SKhynix model **H9TQ64AAETAC** with **2GB**. On the other side of PCB there is a USB 2.0 Flash Disk Controller IC, type **AU6989SNL-CA2** from ALCOR MICRO. On the left side there are pads for USB on the PCB. There are remains of broken off connection pins, which lead to the conclusion that these pins are probably used in production to put the content on. | + | Looking at the PCB, we can see a flash memory chip from SKhynix model **H9TQ64AAETAC** with **2GB**. On the other side of the PCB, there is a USB 2.0 Flash Disk Controller IC, type **AU6989SNL-CA2** from ALCOR MICRO. On the left side, there are pads for USB on the PCB. There are remains of broken off connection pins, which lead to the conclusion that these pins are probably used in production to put the content on. |
| {{gallery>: | {{gallery>: | ||
| Line 53: | Line 53: | ||
| - | The POV of the PCB is the front of the token card (Flash IC is the backside of the card). So if you hold the token and look at the front then VCC is left. \\ | + | The POV of the PCB is the front of the token card (Flash IC is the backside of the card). So if you hold the token and look at the front, then VCC is left. \\ |
| < | < | ||
| Line 61: | Line 61: | ||
| - | So let's solder | + | So let's solder |
| ==== Music Tokens Content ==== | ==== Music Tokens Content ==== | ||
| Galakto card is **2GB FAT32** formatted flash storage connected to a **USB 2.0 Flash Disk Controller** IC, with **no write protecion**. \\ | Galakto card is **2GB FAT32** formatted flash storage connected to a **USB 2.0 Flash Disk Controller** IC, with **no write protecion**. \\ | ||
| - | Cloning the token to any other USB-Stick works just fine :) So you could solder a USB-Socket to the Player. \\ | + | Cloning the token to any other USB-Stick works just fine :) Therefore, |
| ⚠️ **WARNING: Always create a full block-level backup of the entire device!** | ⚠️ **WARNING: Always create a full block-level backup of the entire device!** | ||
| Line 196: | Line 197: | ||
| // | // | ||
| - | It is strange to see that the main directory is called " | + | It is strange to see that the main directory is called " |
| According to hex-dump of block device the tokens get cloned by Vinpower Digital machine. \\ | According to hex-dump of block device the tokens get cloned by Vinpower Digital machine. \\ | ||
| Line 212: | Line 213: | ||
| {{gallery>: | {{gallery>: | ||
| - | If you don't want to cut up your token, you can alternatively open the player, solder | + | If you don't want to cut up your token, you can alternatively open the player, solder |
| For dumping partitions once, the most simple way would be to stick tape with USB-wires onto the outer contacts (validate your dumps!). \\ | For dumping partitions once, the most simple way would be to stick tape with USB-wires onto the outer contacts (validate your dumps!). \\ | ||
| The cleanest way would be to [[galakto_player_toylino# | The cleanest way would be to [[galakto_player_toylino# | ||
| Line 362: | Line 363: | ||
| dd if=mbr_swapped.bin of=/dev/sdX bs=512 count=1 | dd if=mbr_swapped.bin of=/dev/sdX bs=512 count=1 | ||
| </ | </ | ||
| - | or do it directly on /dev/sdX instead of mbr_swapped. To reverse just write back mbr_backup or change partition address accordingly. | + | or do it directly on /dev/sdX instead of mbr_swapped. To reverse, just write back mbr_backup or change partition address accordingly. |
| ==5. Flush & Wash & Rehash== | ==5. Flush & Wash & Rehash== | ||
| Line 459: | Line 460: | ||
| The case of the player is clipped, not glued. The 2000mAh Li-Ion 18650 1S battery is also not glued - nice! Inside the casing, there are two PCBs inside. First you need to take off the board containing USB-C port and potentiometer (which is for LED brightness). | The case of the player is clipped, not glued. The 2000mAh Li-Ion 18650 1S battery is also not glued - nice! Inside the casing, there are two PCBs inside. First you need to take off the board containing USB-C port and potentiometer (which is for LED brightness). | ||
| - | The Mainboard contains | + | The Mainboard contains |
| The pogo pins for connecting the music token cards and the buttons are obvious. Right in the middle there is an IC labled **HT8731**, which is a 10W Boosted Class D amplifier. | The pogo pins for connecting the music token cards and the buttons are obvious. Right in the middle there is an IC labled **HT8731**, which is a 10W Boosted Class D amplifier. | ||
| - | There is also a **WP25P21** adjustable current limited load switch next to three SOT-23 transistors, | + | There is also a **WP25P21** adjustable current limited load switch next to three SOT-23 transistors, |
| Above the pogo pins there is a SOT-23-6 IC labeled "**LPS 5VGA2**" | Above the pogo pins there is a SOT-23-6 IC labeled "**LPS 5VGA2**" | ||
| To its left and right there are two unpopulated QFN‑16 footprints. \\ | To its left and right there are two unpopulated QFN‑16 footprints. \\ | ||
| The back of the PCB has only the two 3.5mm headphone jacks, two side buttons, the battery connector and the 12-pin connector for the secondary PCB (with labeled pinout, nice!:). What the array of square pads might be for? There are vias for thermal dissipation of the amp, the pads are tin-plated, the battery lies on top. But why squares? Who knows. Maybe a raster for the marker writing on it? 😅 \\ | The back of the PCB has only the two 3.5mm headphone jacks, two side buttons, the battery connector and the 12-pin connector for the secondary PCB (with labeled pinout, nice!:). What the array of square pads might be for? There are vias for thermal dissipation of the amp, the pads are tin-plated, the battery lies on top. But why squares? Who knows. Maybe a raster for the marker writing on it? 😅 \\ | ||
| - | The secondary PCB has an upright mounted USB-C connector and a LPS **LP4076B** linear charger for single-cell Li-Ion and Li-Polymer batteries. The board has an IC with an etched off surface and broken out I2C header, which is next to the potentiometer setting the brightness of the LEDs (the potentiometer is not labeled on the case of the player, only documented in the manual) | + | The secondary PCB has an upright mounted USB-C connector and a LPS **LP4076B** linear charger for single-cell Li-Ion and Li-Polymer batteries. The board has an unlabled |
| Line 489: | Line 490: | ||
| Such complementing silkscreen labels are awesome! | Such complementing silkscreen labels are awesome! | ||
| - | === unlabled | + | === unlabeled |
| - | Let's see if we can find out what the unlabeled IC with the I2C breakout | + | |
| - | ⧠ hook up I2C / UART pins \\ | + | The unlabeled IC looks like an MCU. I've hooked up a logic analyzer and another MCU to the I2C port of the unlabeled IC on the secondary PCB. Unfortunately the I2C breakout seems to be unused, |
| ==== Speaker addon ==== | ==== Speaker addon ==== | ||
| Line 517: | Line 518: | ||
| It is not cool that they use proprietary cards, though it is understandable, | It is not cool that they use proprietary cards, though it is understandable, | ||
| The case labeling of potentiometer for LED brightness is missing and only named in the manual - I was careless and had to replace the 10K poti, because I thought it was a screw of the case :'D \\ | The case labeling of potentiometer for LED brightness is missing and only named in the manual - I was careless and had to replace the 10K poti, because I thought it was a screw of the case :'D \\ | ||
| - | I like the idea with the LEDs - they could have optionally made it colour switchable with IMY format or frequency EQ. \\ | + | I like the idea with the LEDs, they even change color on certain points in time of tracks - the patters are in a text file, which is sadly signed too. \\ |
| Sometimes the track prev/next keys don't work (at least for me, maybe I have screwed around a bit too much with my token?) - re-plugging the token helps. \\ | Sometimes the track prev/next keys don't work (at least for me, maybe I have screwed around a bit too much with my token?) - re-plugging the token helps. \\ | ||
| - | Good to see that music files are not encrypted - the signed | + | Good to see that music files are not encrypted - the signed |
| Sad to see that the quality of the music files can be considered garbage from Hi-Fi perspective - the flash storage space would be big enough to store high resolution files on it. I assume that quality is cut down to 128kbps because of the processing power of the MCU. An idealist would have put the high-res files next to the Lo-Fi versions and sold a separate USB-adapter for the cards to be connected to PC or amps with USB: A chance wasted. \\ | Sad to see that the quality of the music files can be considered garbage from Hi-Fi perspective - the flash storage space would be big enough to store high resolution files on it. I assume that quality is cut down to 128kbps because of the processing power of the MCU. An idealist would have put the high-res files next to the Lo-Fi versions and sold a separate USB-adapter for the cards to be connected to PC or amps with USB: A chance wasted. \\ | ||
| Nice that there are two headphone sockets so the player can simultaneously be used by two kids. \\ | Nice that there are two headphone sockets so the player can simultaneously be used by two kids. \\ | ||
| Line 534: | Line 535: | ||
| ==== Sound quality ==== | ==== Sound quality ==== | ||
| - | The output of the 3.5mm headset | + | The output of the 3.5mm headphone |
| Still, the Lo-Fi 128kbps mp3-files are low quality. \\ | Still, the Lo-Fi 128kbps mp3-files are low quality. \\ | ||
| - | For the external speaker: | + | For the external speaker: |
| + | Question: Why has headphone jack flat sound but not the attachment speaker? | ||
| ⧠ Task: measure frequency output of audio jack 🎼🎶 | ⧠ Task: measure frequency output of audio jack 🎼🎶 | ||
| Line 561: | Line 563: | ||
| ⧠ bonus: integrate MCU with button for switching partitions \\ | ⧠ bonus: integrate MCU with button for switching partitions \\ | ||
| ===== ToDo ===== | ===== ToDo ===== | ||
| - | - take photos with better lighting | + | - <del>take photos with better lighting</del> (I've sold the player) |
| - | - hook up I2C / UART pins \\ | + | |
| - find out unlabeled IC \\ | - find out unlabeled IC \\ | ||
| * 3D printing model with pogo pins and USB for token \\ | * 3D printing model with pogo pins and USB for token \\ | ||
| - glitch AC9713A6 MCU to dump firmware (achievable? | - glitch AC9713A6 MCU to dump firmware (achievable? | ||
disassembled_devices/galakto_player_toylino.1756189426.txt.gz · Last modified: by admin