Martin's DokuWiki

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
~~META:
title=Galakto Player Toylino hacking and disassembly
description=Disassembly and hacking Galakto Token cards
keywords=SEO, dokuwiki, disassembly, galakto, token, music, card, hack, hacking, MBR, audio, kids, toylino, Toniebox, alternative
~~

====== Galakto Player Toylino edition======

There is a German alternative to the famous Toniebox. It is called Galakto Player - Toylino edition (created by Tiny Monster GmbH), which is sold at [[https://www.aldi-onlineshop.de/p/galakto-player-101024564/|Aldi]] for less than <del>40€</del> 30€. \\ 
It is an offline player without any wireless connectivity. \\ 

> "Auch etwas Vergleichbares zum Kreativ-Tonie fehlt noch, soll aber laut Galakto in Planung sein."
Source: [[https://www.familie.de/testberichte/galakto-player-jetzt-bei-aldi-unsere-erfahrung-mit-der-toniebox-alternative--01HWMW83A1D4D625JB1APPKGQV|familie.de]] \\
Freely translated: 
> Something comparable to the Creative-Tonie (a Token with custom content) is also still missing, but according to Galakto, it is in planning.
Or is it? Can we verify the claim and see if it's even possible with the chosen technical approach? Let's find out! \\

Although it is a player for the German market, I still like to do my write-ups in english. Use [[https://translate.google.com/translate?hl=en&sl=auto&tl=de&u=https://super-se.de/dokuwiki/disassembled_devices:toylino_galakto_player|Google Translate]] if you want. \\

===== Disclaimer =====

I do this for educational fun. I've seen the Galakto Tokens and just wondered what's inside. So in January 2025, I've decided on one of the available music tokens on Kleinanzeigen, which was German rapper "DIKKA", making rap intended for kids - (I am not much into audio books, except for [[https://de.wikipedia.org/wiki/Die_K%C3%A4nguru-Chroniken|Die Känguru-Chroniken]]). \\
I ended up having the player too 🤦 I've put it in the disassembly section because it doesn't feel like a project. I just wanted to know what's inside the tokens, the writing up grew to what I have figured out. \\
I am a curious person and like to share knowledge. I love the interesting stuff you guys do and share, YOU keep being brilliant! :) 

🗒️ Note: I am not sponsored, I do not affiliate or try to do advertising even if providing links. I do not take any responsibility for external content. There is no piracy involved or encouraged here - I did only clone one token to itself as a POC. \\
Ultimately, I am here for freedom, long-living and to just play my own tune. 

⚠️ I am in no sense responsible for what you to. Please think before doing and pressing return keys. If you feel I violate any of your rights, contact me.

===== Music Tokens =====
As Music Tokens / cards are the only way to play music with the player, I consider it the core part. As of 06/2025 there are 148 Galakto Tokens [[https://galakto.com/collections/audio-token|listed]], all of them are intended for children. Most of them are audio books or audio dramas, some are music. They cost between 10-12€ in the galakto store but can be found __cheaper in local Aldi__ store or as bundle [[https://www.aldi-onlineshop.de/search/?text=Galakto%20Token|online]]. As of 06/2025 there is no "creative card", on which you could load other content. Or has there always been one?

==== Music Tokens Hardware ====

The music tokens / cards connect to the pogo pins of the player and hold magnetically.  \\ 
The plastic housing is welded and cannot be opened easily (I used a rotary tool to cut it open) \\ 
Looking at the PCB we can see a flash memory chip from SKhynix model **H9TQ64AAETAC** with **2GB**. On the other side of PCB there is a USB 2.0 Flash Disk Controller IC, type **AU6989SNL-CA2** from ALCOR MICRO. On the left side there are pads for USB on the PCB. There are remains of broken off connection pins, which lead to the conclusion that these pins are probably used in production to put the content on. 

{{gallery>:disassembly:galakto:card}}

==== Music Tokens Pinout ====

The pinout is the following: \\ 

^ Pin       ^ Description       ^
| VCC   | +5V   |
| GND_EN   | enable/wake pin for MCU, gets briged to GND  |
| GND   | Ground   |
| D+   | USB data plus   |
| D-   | USB data minus   |
| ?(P1)   | either NP or goes to some BGA-pad of Flash IC |


The POV of the PCB is the front of the token card (Flash IC is the backside of the card). So if you hold the token and look at the front then VCC is left. \\

<gallery>
:disassembly:galakto:card:pinout:dsc04884.jpg
:disassembly:galakto:card:pinout:dsc05070_c.jpg
</gallery>


So let's solder an ugly USB-cable onto our toy token quickly to see what is on the flash chip. \\ 
==== Music Tokens Content ====
Galakto card is **2GB FAT32** formatted flash storage connected to a **USB 2.0 Flash Disk Controller** IC, with **no write protecion**. \\ 
Cloning the token to any other USB-Stick works just fine :) So you could solder a USB-Socket to the Player. \\

⚠️ **WARNING: Always create a full block-level backup of the entire device!**
Do not back up just a single partition (e.g. /dev/sdX1) - always clone the entire device (e.g. /dev/sdX) to preserve partition table and layout. \\
It is not possible to copy the bare files back to the partition. __If a .mp3 is copied back, you cannot listen to it anymore and not skip past it__ - even with the correct signature! \\

<code bash>
#>dd if=/dev/sdX of=full_backup.bin
</code>

⚠️ **WARNING: Always check which device/partition you use dd on! I am not responsible for any data loss. Remove unneeded USB storage devices to minimize risks of stupidity. Always think __before__ pressing return key.** \\

The device layout looks like this:
<hidden Show content>
<code bash>
#>fdisk -l /dev/sdX
Disk /dev/sdb: 1.88 GiB, 2013265920 bytes, 3932160 sectors
Disk model: Flash Disk      
Units: sectors of 1 * 512 = 512 bytes
Sector size (logical/physical): 512 bytes / 512 bytes
I/O size (minimum/optimal): 512 bytes / 512 bytes
Disklabel type: dos
Disk identifier: 0x6544f215

Device     Boot Start     End Sectors  Size Id Type
/dev/sdb1        8192 3932159 3923968  1.9G  c W95 FAT32 (LBA)

#>fsck.vfat -v /dev/sdb1
Boot sector contents:
System ID "MSDOS5.0"
Media byte 0xf8 (hard disk)
       512 bytes per logical sector
      8192 bytes per cluster
      2806 reserved sectors
First FAT starts at byte 1436672 (sector 2806)
         2 FATs, 32 bit entries
   7670272 bytes per FAT (= 14981 sectors)
Root directory start at cluster 2 (arbitrary size)
Data area starts at byte 16777216 (sector 32768)
    243200 data clusters (1992294400 bytes)
63 sectors/track, 255 heads
      8192 hidden sectors
   3923968 sectors total
Checking for unused clusters.
Checking free cluster summary.
/dev/sdb1: 46 files, 3533/243200 clusters
</code>
</hidden>
\\

Following is the partition content of the music token "DIKKA Oh Yeah!" listed

<hidden Show content>
<code bash>
> tree A46B-9AAD
A46B-9AAD
└── System Volume Information
    ├── IndexerVolumeGuid
    ├── IndexVolumeGuid
    │   ├── 00000.mp3
    │   ├── 00000.mp3.hashes
    │   ├── 00000.mp3.hashes.sig
    │   ├── 00001.mp3
    │   ├── 00001.mp3.hashes
    │   ├── 00001.mp3.hashes.sig
    │   ├── 00002.mp3
    │   ├── 00002.mp3.hashes
    │   ├── 00002.mp3.hashes.sig
    │   ├── 00003.mp3
    │   ├── 00003.mp3.hashes
    │   ├── 00003.mp3.hashes.sig
    │   ├── 00004.mp3
    │   ├── 00004.mp3.hashes
    │   ├── 00004.mp3.hashes.sig
    │   ├── 00005.mp3
    │   ├── 00005.mp3.hashes
    │   ├── 00005.mp3.hashes.sig
    │   ├── 00006.mp3
    │   ├── 00006.mp3.hashes
    │   ├── 00006.mp3.hashes.sig
    │   ├── 00007.mp3
    │   ├── 00007.mp3.hashes
    │   ├── 00007.mp3.hashes.sig
    │   ├── 00008.mp3
    │   ├── 00008.mp3.hashes
    │   ├── 00008.mp3.hashes.sig
    │   ├── 00009.mp3
    │   ├── 00009.mp3.hashes
    │   ├── 00009.mp3.hashes.sig
    │   ├── 00010.mp3
    │   ├── 00010.mp3.hashes
    │   ├── 00010.mp3.hashes.sig
    │   ├── 00011.mp3
    │   ├── 00011.mp3.hashes
    │   ├── 00011.mp3.hashes.sig
    │   ├── all-files.hashes
    │   ├── all-files.hashes.sig
    │   ├── check.txt
    │   ├── settings.properties
    │   ├── settings.properties.sig
    │   └── signature.txt
    └── WPSettings.dat

2 directories, 44 files
</code>
</hidden>

Here are all the files except the actual mp3 music files (due to copyright): \\
{{:disassembly:galakto:dikka_no-audio.zip|Download Dikka ZIP (no audio)}} \\
=== Description of files ===

**
Dikka music card is not encrypted, using 29MB in total for 11 songs with ~2-3MB each. \\ 
.mp3 files are unencrypted with 128 kbps / 44.1KHz (Cbr) \\ 
.hashes is sha256sum of mp3 file \\ 
.sig files look like a classic ASN.1 DER-encoded ECDSA (Elliptic Curve Digital Signature Algorithm) signature**, e.g. containing:
>    30 = SEQUENCE
>    46 = total length
>    02 21 = INTEGER (r, 33 bytes)
>    02 21 = INTEGER (s, 33 bytes)
//**check.txt**// contains all mp3 hashes \\ 
//**all-files.hashes**// are hashes of all files: mp3, hashes and sig \\ 
//**settings.properties**// contains info and settings for player (like max volume or LED colour) \\ 
//**signature.txt**//: looks like DER-encoded ECDSA signature using the secp256r1 or secp256k1 curve (standard 256-bit ECC). 
>    30 — ASN.1 SEQUENCE tag.
>    45 — Length of the sequence (69 bytes).
>    02 21 — First INTEGER of 33 bytes → this is the r component of the ECDSA signature.
>    02 20 — Second INTEGER of 32 bytes → this is the s component.
What is it for? Actually, I haven't investigated further. \\ 

//IndexerVolumeGuid file and WPSettings.dat// are files created by MS Windows (they probably use a PC to create the images?) \\ \\

It is strange to see that the main directory is called "System Volume Information". Normally it is used for system restore, indexing, shadow copies by MS Windows. Same with the subdir "IndexVolumeGuid", which is normally used for Search Indexing (normally not used on removable USB storages). The only explanation I can come up with is that this name scheme is used because normal Windows users can't see or delete these directories by default. \\
According to hex-dump of block device the tokens get cloned by Vinpower Digital machine. \\

The player does only play mp3-files which have correct hashes and signatures. Also the files cannot be copied manually onto the partition via copy command/file manager, they will not play and you cannot skip past them! Files must not be fragmented by FS. \\
I have tried cutting and copying a track back on FS and then reordering with [[http://www.anerty.net/software/file/DriveSort/|DriveSort]], which did not work. \\

===== "Hacking" the toy token =====
To make your life easier, create your own toy token by soldering a USB-C socket on. \\
<gallery>
:disassembly:galakto:card:pinout:dsc05090.jpg
</gallery>

I have also tried to use GPT-4o to alter the packaging style, but it is actually better with creating content instead of changing it. Which one do you like best? \\

{{gallery>:disassembly:galakto:card:cover}}

If you don't want to cut up your token, you can alternatively open the player, solder an USB-A-port on and cut into the case for the socket - you could then even use regular USB2.0-sticks. I have rather <del>sacrificed</del> upgraded a token for toying around. \\
For dumping partitions once, the most simple way would be to stick tape with USB-wires onto the outer contacts (validate your dumps!). \\
The cleanest way would be to [[galakto_player_toylino#d_printed_token_adapter|3D print]] a token adapter for USB with pogo pins so you can connect the tokens nicely also to your USB-enabled stereo/TV/whatever. \\

==== Gathered insides ====
💡 If you screw up with dd and write partition to block device, which leaves you with a device with ~3.99MB according to fdisk, don't panic, the easiest way is to reboot your linux OS. You will be able to repartition/rewriting dd backup. \\
🔍 We don't have the private key to sign content, so what can we do for now? \\
❌ Just plain copying the tracks onto FS with their correct signature does not work. \\
✅ Cloning the card onto another USB-stick via dd works just fine - the player plays from whatever USB2.0-stick. \\
🤔 Destroying MBR or even zeroing partition table breaks playback. \\
❓ MBR and FAT32 is used - so why can't content be copied back and forth without "breaking the files"? Why do we need block-copy by dd? \\
🔓 Conclusion: MCU goes to first partition in table, but files are read raw and must not be fragmented by FS.\\
✅ Resizing the partition to >=260MiB (absolute minimum size for fat32, 528MiB being min. standard) seems to work fine, player still plays content. \\
🔧 There is lots of space left, so let's clone multiple partitions with other original content and just switch between the active partitions in MBR. \\
🎯 See below how to hack the heck out of that. \\


==== Multi-partition token ====
Wait, this is the "hacking" part?! Well, we cannot get the private key and I won't spend my time trying to patch the MCU. \\
So, following are steps to create a multi-partition token and swap between them. This POC is to show that you can have more than one token stored into a single one. The catch? You have to rewrite LBA addresses of partition table to tell the player which is the first partition, as it will only read from that. Why do that? Idk, I just have to take my linux machine out of my pocket/bag and rewrite MBR, so I don't have to carry around so many tokens. Or swap content with Peppa Pig for April Fool's Day (how mean!). Okok, it is a //"because I can/want"// and //"that seemed to be doable as a start"//, ok? Let's just start. \\

⚠️ **WARNING: Always check which device/partition you use dd on! I am not responsible for any data loss. Remove unneeded USB storage devices to minimize risks of stupidity. Always think before pressing return key.** \\
replace /dev/sdX with your device! \\

==0. create full backup ==

⚠️ **Always create a full block-level backup of the entire device! Do not back up just a single partition (e.g. /dev/sdX1) - always clone the entire device (e.g. /dev/sdX) to preserve partition table and layout.**
<code bash>
dd if=/dev/sdX of=full_backup.bin
# lookup partition addresses
fdisk -l /dev/sdX
# lookup fat information
fatresize -i /dev/sdX1
# or install sleuthkit and
fsstat /dev/sdX1

</code>

==1. Resize partition (>=528MiB) ==
Larger than 528MiB, because a FAT32 volume must have at least 65,525 clusters. \\
> Volume size (bytes) = clusters × sectors/cluster × bytes/sector \\
> Partition size (in sectors) = Reserved sectors + (Number of FATs × Sectors per FAT) + (Clusters × Sectors per cluster)
~528MiB is needed with cluster size 8KiB and 512 bytes per sector. \\
260MiB seems to work too, but it's non-standard minimum. \\
<code bash>
# Unmount if needed
umount /dev/sdX1

# DO NOT Resize FAT32 part first as normally
#DO NOT fatresize /dev/sdX1 [size]

# Resize the partition to match (from sector 8192, 1081344 sectors)
parted /dev/sdX --script resizepart 1 1089535s
</code>

==1.5. fix FS ==

>FAT32 layout:
>TotalSectors = Reserved + (NumFATs × FATSz32) + DataSectors
>DataSectors = Clusters × SectorsPerCluster
>Clusters = DataSectors / SectorsPerCluster

you can manually hexedit boot sector fields: \\
^Offset (hex) ^Field ^New Value for 528MiB ^description ^
| 0x20–0x23 | BPB_TotSec32 (Total Secs) | 00 80 10 00 | 1081344 sectors = 528MiB | 
| 0x24–0x27 | BPB_FATSz32 (Sectors/FAT) | 11 02 00 00 | Update if FAT size not >529 sectors per FAT | 
<del>| 0x13–0x14 | BPB_TotSec16 | 00 00 | zero for FAT32 | </del> \\
<del>| 0x2C–0x2F | Root Cluster | 02 00 00 00 | Usually cluster 2 | </del> \\
<del>| 0x03–0x0A? | OEM Name | MSDOS5.0 | restore label | </del> \\

or alternatively use commands:
<code bash>
# copy first sector (Boot Sector)
dd if=/dev/sdX1 of=bootsect.bin bs=512 count=1

# Set BPB_TotSec32 = 1,081,344 sectors = 0x00108000
printf '\x00\x80\x10\x00' | dd of=bootsect.bin bs=1 seek=$((0x20)) count=4 conv=notrunc

# Set BPB_FATSz32 = 529 sectors = 0x00000211
printf '\x11\x02\x00\x00' | dd of=bootsect.bin bs=1 seek=$((0x24)) count=4 conv=notrunc

# Do not change BPB_TotSec16 
# Do not change Root Cluster

#write bootsect back and override backup too
dd if=bootsect.bin of=/dev/sdX1 bs=512 count=1 conv=notrunc
dd if=bootsect.bin of=/dev/sdX1 bs=512 count=1 seek=6 conv=notrunc
</code>

<code>
# Verify and fix FS if needed
fsck.vfat -v /dev/sdX1
# FAQ: 
# Copy original over backup? -> yes (original is sector 0 and sector 6 is a backuo)
## Checking we can access the last sector of the filesystem: 0x41: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt.
#-> 2) No action (because dirty bit was originally? set by my token?ikd)
##Free cluster summary wrong -> Correct, probably?

</code>

==2. Add second partition ==

<code bash>
# Backup a 528 MiB partition
dd if=/dev/sdX1 of=part_backup.bin bs=512 count=1081344

# create second partition
parted /dev/sdX --script mkpart primary fat32 532MiB 1060MiB # add a second 528MiB partition
</code>

==3. copy over partition ==
Take block backup of a partition and append after first partition: 
<code bash>

# Append backup to device with 1 MiB (2048 sectors) after first partition
# <del>1081344 + 2048 padding = 1083392</del> 1089536
dd if=other_backup.bin of=/dev/sdX bs=512 seek=1089536 conv=notrunc

# if needed
# Append second partition to partition table with
# sfdisk. Format: start_sector, num_sectors, type
echo "1089536,1081344,c" | sudo sfdisk --append /dev/sdX
</code>

==4. The Swap trick ==

Each partition entry in MBR is 16 bytes long, and the partition table starts at byte offset 446 (0x1BE). Therefore swap: \\

 1st partition entry: bytes 446–461 (0x1BE–0x1CD) \\
 2nd partition entry: bytes 462–477 (0x1CE–0x1DD) \\
 3rd partition entry: bytes 478–493 (0x1DE–0x1ED) \\
 4th partition entry: bytes 494–509 (0x1EE–0x1FD) \\

With this, we can use dd to swap partitions to which is first:
<code bash> 
# Have a backup of MBR
dd if=/dev/sdX of=mbr_backup.bin bs=512 count=1
# Extract first partition entry
dd if=mbr_backup.bin of=part1.bin bs=1 skip=446 count=16
# Extract second partition entry
dd if=mbr_backup.bin of=part2.bin bs=1 skip=462 count=16
# Create copy of mbr_backup for swapping
cp mbr_backup.bin mbr_swapped.bin
# Write second partition entry over first
dd if=part2.bin of=mbr_swapped.bin bs=1 seek=446 conv=notrunc
# Write first partition entry over second
dd if=part1.bin of=mbr_swapped.bin bs=1 seek=462 conv=notrunc
# Write back MBR to USB storage
dd if=mbr_swapped.bin of=/dev/sdX bs=512 count=1
</code>
or do it directly on /dev/sdX instead of mbr_swapped. To reverse just write back mbr_backup or change partition address accordingly.

==5. Flush & Wash & Rehash==
Flush and __WASH YOUR HANDS WITH SOAP!__ **Soap works, you know.** 💩 Do it ever so often in between when advisable. \\
<code bash>
sync
sudo blockdev --flushbufs /dev/sdX
sudo partprobe /dev/sdX
</code>

Now it looks something like this:
<code bash>
Device     Boot   Start      End  Sectors  Size Id Type
/dev/sdb1       1089536  2170879  1081344  528M  c W95 FAT32 (LBA)
/dev/sdb2          8192  1089535  1081344  582M  c W95 FAT32 (LBA)
</code>


✅ Done, you now have switched to a second partition. You can have four primary partitions in MBR, 3+ fitting in the size of a single token - you 'just' have to switch between them manually. Rehash: **To switch partitions //goto Step4.//** \\

🕺🎤 🔊 🎵 //Oh, yeah! DIKKA, Digga//, done creating our toy token! 🏁

See if there is some [[galakto_player_toylino#d_printed_token_adapter|3D printed docking station]] adapter for your tokens of your taste - to make things convenient. \\

**Further steps I can imagine:** \\
⧠ upload a nice script for more convenient switching 🔧 \\
⧠ write simple C (Arduino?😮‍💨you really want that?) program for ESP32 or whatever to integrate into [[galakto_player_toylino#d_printed_token_adapter|3D printed docking station]] for easy switching via button (MCU as MITM to send switched MBR?) \\

====custom content====
As the player cannot read fragmented tracks, let's look at the partition hexdump first. \\
I have searched for some characters in hexdump of files inside partition backup. 
In my Dikka partition the ordering is as follows, sorted by offsets in FS: 

<hidden Show content>
<code>
0x01004000  WPSettings.dat
0x01006000  IndexerVolumeGuid
0x0100A000  signature.txt
0x0100C000  settings.properties.sig
0x0100E020  settings.properties
0x01010000  check.txt
0x01012000  all-files-hashes.sig
0x01014000  all-files-hashes
0x01016000  00011.mp3.hashes
0x0101A000  00011.mp3
0x0101B000  00011.mp3.hashes.sig
0x0131A000  00009.mp3
0x01550000  00006.mp3
0x01BDA000  00008.mp3.hashes
0x01BDC000  00008.mp3.hashes.sig
0x01BDE000  00008.mp3
0x0245E000  00007.mp3.hashes
0x02460000  00007.mp3.hashes.sig
0x02462000  00007.mp3
0x027E2000  00006.mp3.hashes
0x027E4000  00006.mp3.hashes.sig
0x0321A000  00010.mp3.hashes
0x0321C000  00010.mp3.hashes.sig
0x0321E000  00010.mp3
0x03CDE000  00009.mp3.hashes
0x03CE0000  00009.mp3.hashes.sig
0x03D74000  00003.mp3
0x04F22000  00005.mp3.hashes
0x04F24000  00005.mp3.hashes.sig
0x04F26000  00005.mp3
0x06FA6000  00004.mp3.hashes
0x06FA8000  00004.mp3.hashes.sig
0x06FAA000  00004.mp3
0x075AA000  00003.mp3.hashes
0x075AC000  00003.mp3.hashes.sig
0x07774000  00000.mp3
0x094AE000  00002.mp3.hashes
0x094B0000  00002.mp3.hashes.sig
0x094B2000  00002.mp3
0x09B72000  00001.mp3.hashes
0x09B74000  00001.mp3.hashes.sig
0x09B76000  00001.mp3
0x0A047600  00000.mp3.hashes
0x0A047800  00000.mp3.hashes.sig
</code> 
</hidden>

Most of the times the signature of the hash is at +0x2000 with the mp3 following at 0x4000, but it is not consistent so the files are not specially sorted. Also the gap between each mp3 files varies a lot. We now know for sure that the data is not read raw but FAT32 table is regularly used by MCU - with the exception that data cannot be fragmented. \\

⧠ how to block copy files in correct scheme in FS? 🔧 \\
-> We can always write the files in a raw mode with dd at their addresses. \\

⧠ 🧠 [to be continued...🔧] \\
What's next? For the real fun to begin we would need a possibility to either sign the hashes (unlikely) or patch for the (yet to be) dumped firmware. \\
It would be easier if the manufacturer would hand out the private key - why are files signed anyways? \\
Anybody ever glitched and dumped an AC9713A6 MCU to find the needle in the hexdump for 'fixing'?📌 Please 👋💬😄 \\


===== Hardware of Player =====

The case of the player is clipped, not glued. The 2000mAh Li-Ion 18650 1S battery is also not glued - nice! Inside the casing, there are two PCBs inside. First you need to take off the board containing USB-C port and potentiometer (which is for LED brightness).  \\

The Mainboard contains a **Jieli Technology AC9713A6** MCU, which theoretically would support BT5.0 and WiFi: There is no antenna on the PCB though. 
The pogo pins for connecting the music token cards and the buttons are obvious. Right in the middle there is an IC labled **HT8731**, which is a 10W Boosted Class D amplifier. 
There is also a **WP25P21** adjustable current limited load switch next to three SOT-23 transistors, which are probably controlling(?) the **eight 3528 RGB-LEDs** around the PCB. \\
Above the pogo pins there is a SOT-23-6 IC labeled "**LPS 5VGA2**" with a small coil next to it. I assume it's a boost converter (LP6216?), I have not measured anything yet. 
To its left and right there are two unpopulated QFN‑16 footprints. \\
The back of the PCB has only the two 3.5mm headphone jacks, two side buttons, the battery connector and the 12-pin connector for the secondary PCB (with labeled pinout, nice!:). What the array of square pads might be for? There are vias for thermal dissipation of the amp, the pads are tin-plated, the battery lies on top.  But why squares? Who knows. Maybe a raster for the marker writing on it? 😅 \\

The secondary PCB has an upright mounted USB-C connector and a LPS **LP4076B** linear charger for single-cell Li-Ion and Li-Polymer batteries. The board has an unlabled IC with an etched off surface and broken out I2C header, which is next to the potentiometer setting the brightness of the LEDs ( - BTW: the potentiometer is not labeled on the case of the player, only documented in the manual)


{{gallery>:disassembly:galakto:player}}

=== PCB pinout ===

There are two nicely written down pinouts on the silkscreens of both PCBs - awesome! \\
But wait. They differ...they are mirrored...they complement each other! 🤯 \\
If the printed arrow at the pin header is taken as Pin1, then the text is upside down.\\

Pinout in view on main PCB (silkscreen text upside down):

^Pin# ^ 1st-Name ^ 2nd-Name      ^ left row conclusion  | ^Pin#  ^ 1st-Name ^ 2nd-Name   ^right row conclusion^
|2| Vol   | LED_VOL | LED brightness poti | | 1* | VCC | BATT |   |
|4| SIGNAL| MCUBUS | from-or-to unlabled IC | | 3  | USB5V-DET | USBDET | detection for USB5V (¿//and// ext-spk?)  |
|6| POWER | PWRON | power signal? | | 5  | NTC       | NTC | Temp sensor for (¿ext?) battery  | 
|8| D-    | USBD- | USB data-  | | 7  | D+  | USBD+ | USB data+ |
|10| B_ON  | GND  | bridged to GND?  | | 9  | GND  | GND | Ground |
|12| SPK+ | SPK+  | Speaker+   | | 11 | SPK- | SPK- | Speaker- |

Such complementing silkscreen labels are awesome!  \\

=== unlabled IC ===
Let's see if we can find out what the unlabeled IC with the I2C breakout on the secondary PCB is. Which MCU is hiding there? \\
⧠ hook up I2C / UART pins \\

==== Speaker addon ====
According to the manual, there is a second Li-Ion battery with also 2Ah (7.4Wh) inside. The speaker also has the ability for wireless charging with a frequency 87 – 205 kHz. \\
If we look at pogo pins solder joints of the second PCB of the galakto player, there is the pinout of the connection ring to the speaker on silkscreen:

^Pin# ^ Name   ^ description^
|| outer ring | |
|1| PWRON |  |
|2| GND  | Ground   |
|3| BATT |          |
|4| SPK+ | Speaker+ |
|5| SPK- | Speaker- |
|6| 5V   |   |
|| inner ring | | 

According to the Pinout you could probably just attach audio signal and trigger the PWRON ring to use it with other sources - you can even power them by the builtin battery. \\

⧠ ❓ This might be your task ;) \\
I have not disassembled this part, yet even tried out. According to the pinout and the fact that it has its own USB-C port and charging LEDs, it has probably some standalone Li-Po battery charger IC and inductive charging circuit. \\


===== Personal conclusion =====
Good that there is a cloudless alternative to the famous Toniebox. I still have not understood what "Toylino edition" means: Are there other players planned too? \\
It is not cool that they use proprietary cards, though it is understandable, as it is intended for small children from the age of 3. \\ 
The case labeling of potentiometer for LED brightness is missing and only named in the manual - I was careless and had to replace the 10K poti, because I thought it was a screw of the case :'D \\
I like the idea with the LEDs - they could have optionally made it colour switchable with IMY format or frequency EQ. \\
Sometimes the track prev/next keys don't work (at least for me, maybe I have screwed around a bit too much with my token?) - re-plugging the token helps. \\
Good to see that music files are not encrypted - the signed hash files leave a bad taste in one’s mouth. Custom mp3 file playing is not possible. \\
Sad to see that the quality of the music files can be considered garbage from Hi-Fi perspective - the flash storage space would be big enough to store high resolution files on it. I assume that quality is cut down to 128kbps because of the processing power of the MCU. An idealist would have put the high-res files next to the Lo-Fi versions and sold a separate USB-adapter for the cards to be connected to PC or amps with USB: A chance wasted. \\
Nice that there are two headphone sockets so the player can simultaneously be used by two kids. \\
Awesome that they kept the useful labels on silkscreen (even complementing each other on pin header!) and have lots of test points *thumbs up*. Have not seen that to this extend in a while. \\ 
Only wish I have is for the file signing keys 😴💤 \\

**So, will there ever be custom content for the tokens?** Either the manufacturer releases the private keys for signing files (which is unlikely, then they would not have needed to do it in the first place!) or they release a client software which signs the hashes of the files on a server and sends back the signature files. The software then would still need to block copy those files, as we have learned previously (copying back files breaks them). Patching out the DRM system would only be possible via USB/Token by the user, as there is no wireless connectivity. I still think there never will be official custom content for Galakto player. @Tiny Monster GmbH: Prove me wrong. \\
**Final thought:** It is a system with DRM which is a K.O. - I would not recommend buying anything with DRM (are there even any alternatives available on the market?). I cannot recommend buying the tokens for the music alone either, due to the Lo-Fi quality of the mp3 files. __Avoid__. \\

At least we have created a multi-token and proved that it would be theoretically possible to store more than one album on a token - sad that the firmware is probably not able to switch between them by itself. \\
 
\\
🤠 __Pro-Tip__: If you already have token, print your own pogo pin USB-adapter and store your secret data - there is still ~1.9GB free space where nobody even imagines to look: the player still works fine :). Just make sure to fix the size of FS in partition after resizing!

==== Sound quality ====
The output of the 3.5mm headset jacks is flat. The .mp3 files of the token sound way better using the same earbuds on my Thinkpad. I assume they have chosen an "equalizer setting" suitable for audio books? They could have added custom EQ in their settings.properties so music albums sound better. \\
Still, the Lo-Fi 128kbps mp3-files are low quality. \\
For the external speaker: I have not even tried out or unpacked the external speaker yet O.o \\

⧠ Task: measure frequency output of audio jack 🎼🎶


===== Links and Infos =====
- AC9713A6 MCU datasheet: [[http://www.yunthinker.com/static/upload/file/20241225/1735097519585543.pdf]] \\
- AC9713A6 MCU reference schematics: [[http://www.yunthinker.com/static/upload/file/20241225/1735097514291728.pdf]] \\
- to flash JieLi MCUs you need "Jerry Tool" JL USB 4.0 Update tool (I have not bought it). Can be found on aliexpress, e.g. here
[[https://aliexpress.com/item/1005003581831855.html]]
or 
[[https://aliexpress.com/item/1005004678471938.html]] \\
- nice read-up: [[https://oshwlab.com/hawaii0707/jeli-color-silk-screen-developme]] \\ 
- AlcorMP tool: [[https://www.usbdev.ru/files/alcor/alcormp/]] \\ 
* alt. link: [[https://www.raed.net/file?id=798819|ALCOR_U2_MP_23.08.07.00.H_AHG-B.rar]] (found in web as usbdev was down)

===== 3D printed Token adapter =====
Tokens are just FAT32 formatted USB2.0 Flash sticks with unencrypted .mp3 files and "some key junk". We can print a docking station as an adapter for the neat tokens. I like the pogo pins they have used, so let's do that too *ordering popo pins?* \\
This way we can connect the tokens to USB quickly for switching and dumping partitions or connect them to USB capable stereo amps to have richer sound. Then you could be able to fast forward and reverse playback (galakto player can only skip complete tracks). 🤔💭 And if you //own// more than one kid and one token (no piracy here!), you can have the other kid listen to a token too 💡 Undisturbed time to prepare dinner 😅\\

⧠ create stl model for 3D printing 🔧 \\
⧠ solder up pogo pins with USB-C socket 🔧 \\
⧠ profit and/or please contribute ;) \\
⧠ bonus: integrate MCU with button for switching partitions \\
===== ToDo =====
- take photos with better lighting \\
- hook up I2C / UART pins \\
- find out unlabeled IC \\
* 3D printing model with pogo pins and USB for token \\ 
- glitch AC9713A6 MCU to dump firmware (achievable?) \\