Table of Contents
Toylino Galakto Player
There is a German alternative to the famous Toniebox. It is called Galako Player from Toylino (created by Tiny Monster), which is sold at Aldi for less than 40€.
It is an offline player without any wireless connectivity.
Althogh it is a player for the German market, I still like to do my write-ups in english. Use Google Translate if you want.
Disclaimer
I do this for educational fun. I've seen the Galakto Tokens and just wondered what's inside. So I've
decided on one of the available music tokens on Kleinanzeigen, which was German rapper “DIKKA”, making rap intended for kids - (I am not much into audio books, except for Die Känguru-Chroniken).
I ended up having the player too 🤦 I've put it in the disassembly section because it doesn't feel like a project. I just wanted to know what's inside the tokens, the writing up grew to what I have figured out.
I am a curious person and like to share knowledge. I love the interesting stuff you guys do and share, YOU keep being brilliant! :)
🗒️ Note: I am not sponsored, I do not affiliate or try to do advertising even if providing links. I do not take any responsibility for external content. There is no piracy involved or encouraged here - I did only clone one token to itself as a POC.
Ultimately, I am here for freedom, long-living and to just play my own tune.
⚠️ I am in no sense responsible for what you to. Please think before doing and pressing return keys. If you feel I violate any of your rights, contact me.
Music Tokens
As Music Tokens / cards are the only way to play music with the player, I consider it the core part. As of 06/2025 there are 148 Galakto Tokens listed, all of them are intended for children. Most of them are audio books or audio dramas, some are music. They cost between 10-12€ in the galakto store but can be found cheaper in local Aldi store or as bundle online. As of 06/2025 there is no “creative card”, on which you could load other content. Or has there always been one?
Music Tokens Hardware
The music tokens / cards connect to the pogo pins of the player and hold magnetically.
The plastic housing is welded and cannot be opened easily (I used a rotary tool to cut it open)
Looking at the PCB we can see a flash memory chip from SKhynix model H9TQ64AAETAC with 2GB. On the other side of PCB there is a USB 2.0 Flash Disk Controller IC, type AU6989SNL-CA2 from ALCOR MICRO. On the left side there are pads for USB on the PCB. There are remains of broken off connection pins, which lead to the conclusion that these pins are probably used in production to put the content on.
Music Tokens Pinout
The pinout is the following:
| Pin | Description |
|---|---|
| VCC | +5V |
| GND_EN | enable/wake pin for MCU, gets briged to GND |
| GND | Ground |
| D+ | USB data plus |
| D- | USB data minus |
| ?(P1) | either NP or goes to some BGA-pad of Flash IC |
The POV of the PCB is the front of the token card (Flash IC is the backside of the card). So if you hold the token and look at the front then VCC is left.
So let's solder an ugly USB-cable onto our toy token quickly to see what is on the flash chip.
Music Tokens Content
Galakto card is 2GB FAT32 formatted flash storage connected to a USB 2.0 Flash Disk Controller IC, with no write protecion.
Cloning the token to any other USB-Stick works just fine :) So you could solder a USB-Socket to the Player.
⚠️ WARNING: Always create a full block-level backup of the entire device!
Do not back up just a single partition (e.g. /dev/sdX1) - always clone the entire device (e.g. /dev/sdX) to preserve partition table and layout.
It is not possible to copy the bare files back to the partition. If a .mp3 is copied back, you cannot listen to it anymore and not skip past it - even with the correct signature!
#>dd if=/dev/sdX of=full_backup.bin
⚠️ WARNING: Always check which device/partition you use dd on! I am not responsible for any data loss. Remove unneeded USB storage devices to minimize risks of stupidity. Always think before pressing return key.
The device layout looks like this:
Following is the partition content of the music token “DIKKA Oh Yeah!” listed
Here are all the files except the actual mp3 music files (due to copyright):
Download Dikka ZIP (no audio)
Description of files
Dikka music card is not encrypted, using 29MB in total for 11 songs with ~2-3MB each.
.mp3 files are unencrypted with 128 kbps / 44.1KHz (Cbr)
.hashes is sha256sum of mp3 file
.sig files look like ECDSA(?) encrypted hashes
check.txt contains all mp3 hashes
all-files.hashes are hashes of all files: mp3, hashes and sig
settings-properties contains info and settings for player (like max volume or LED colour)
signature.txt - probably an ECDSA cryptographic signature for verifying the integrity and authenticity of other files
IndexerVolumeGuid file and WPSettings.dat are files created by MS Windows (they probably use a PC to create the images?)
It is strange to see that the main directory is called “System Volume Information”. Normally it is used for system restore, indexing, shadow copies by MS Windows. Same with the subdir “IndexVolumeGuid”, which is normally used for Search Indexing (normally not used on removable USB storages). The only explanation I can come up with is that this name scheme is used because normal Windows users can't see or delete these directories by default.
According to hex-dump of block device the tokens get cloned by Vinpower Digital machine.
The player does only play mp3-files which have correct hashes and signatures. Also the files cannot be copied manually onto the partition via copy command/file manager, they will not play and you cannot skip past them! Files must not be fragmented by FS.
I have tried cutting and copying a track back on FS and then reordering with DriveSort, which did not work.
"Hacking" the toy token
To make your life easier, create your own toy token by soldering a USB-C socket on.
If you don't want to cut up your token, you can alternatively open the player, solder an USB-A-port on and cut into the case for the socket - you could then even use regular USB2.0-sticks. I have rather sacrificed upgraded a token for toying around.
For dumping partitions once, the most simple way would be to stick tape with USB-wires onto the outer contacts (validate your dumps!).
The cleanest way would be to 3D print a token adapter for USB with pogo pins so you can connect the tokens nicely also to your USB-enabled stereo/TV/whatever.
Gathered insides
💡 If you screw up with dd and write partition to block device, which leaves you with a device with ~3.99MB according to fdisk, don't panic, the easiest way is to reboot your linux OS. You will be able to repartition/rewriting dd backup.
🔍 We don't have the private key to sign content (yet), so what can we do for now?
❌ Just plain copying the tracks onto FS with their correct signature does not work.
✅ Cloning the card onto another USB-stick via dd works just fine - the player plays from whatever USB2.0-stick.
🤔 Destroying MBR or even zeroing partition table breaks playback.
❓ MBR and FAT32 is used - so why can't content be copied back and forth without “breaking the files”? Why do we need block-copy by dd?
🔓 Conclusion: MCU goes to first partition in table, but files are read raw and must not be fragmented by FS.
✅ Resizing the partition to >=260MiB (absolute minimum size for fat32, 528MiB being min. standard) seems to work fine, player still plays content.
🔧 There is lots of space left, so let's clone multiple partitions with other original content and just switch between the active partitions in MBR.
🎯 See below how to hack the heck out of that.
Multi-partition token
Wait, this is the “hacking” part?!
Following are steps to create a multi-partition token and swap between them. This POC is to show that you can have more than one token stored into a single one. The catch? You have to rewrite LBA addresses of partition table to tell the player which is the first partition, as it will only read from that. Why do that? Idk, I just have to take my linux machine out of my pocket/bag and rewrite MBR, so I don't have to carry around so many tokens. Or swap content with Peppa Pig for April Fool's Day (how mean!). Okok, it is a “because I can/want” and “that seemed to be doable as a start”, ok? Let's just start.
⚠️ WARNING: Always check which device/partition you use dd on! I am not responsible for any data loss. Remove unneeded USB storage devices to minimize risks of stupidity. Always think before pressing return key.
replace /dev/sdX with your device!
0. create full backup
⚠️ Always create a full block-level backup of the entire device! Do not back up just a single partition (e.g. /dev/sdX1) - always clone the entire device (e.g. /dev/sdX) to preserve partition table and layout.
dd if=/dev/sdX of=full_backup.bin # lookup partition addresses fdisk -l /dev/sdX # lookup fat information fatresize -i /dev/sdX1 # or install sleuthkit and fsstat /dev/sdX1
1. Resize partition (>=528MiB)
Larger than 528MiB, because a FAT32 volume must have at least 65,525 clusters.
Volume size (bytes) = clusters × sectors/cluster × bytes/sector
Partition size (in sectors) = Reserved sectors + (Number of FATs × Sectors per FAT) + (Clusters × Sectors per cluster)
~528MiB is needed with cluster size 8KiB and 512 bytes per sector.
260MiB seems to work too, but it's non-standard minimum.
# Unmount if needed umount /dev/sdX1 # DO NOT Resize FAT32 part first as normally #DO NOT fatresize /dev/sdX1 [size] # Resize the partition to match (from sector 8192, 1081344 sectors) parted /dev/sdX --script resizepart 1 1089535s
1.5. fix FS
FAT32 layout:
TotalSectors = Reserved + (NumFATs × FATSz32) + DataSectors
DataSectors = Clusters × SectorsPerCluster
Clusters = DataSectors / SectorsPerCluster
you can manually hexedit boot sector fields:
| Offset (hex) | Field | New Value for 528MiB | description |
|---|
| 0x13–0x14 | BPB_TotSec16 | 00 00 | zero for FAT32 |
| 0x20–0x23 | BPB_TotSec32 (Total Secs) | 00 80 10 00 | 1081344 sectors = 528MiB |
| 0x24–0x27 | BPB_FATSz32 (Sectors/FAT) | 11 02 00 00 | Update if FAT size not >529 sectors per FAT |
| 0x2C–0x2F | Root Cluster | 02 00 00 00 | Usually cluster 2 |
| 0x03–0x0A? | OEM Name | MSDOS5.0 | restore label |
or alternatively
# copy first sector (Boot Sector) dd if=/dev/sdX1 of=bootsect.bin bs=512 count=1 <del># Set BPB_TotSec16 = 0 (FAT32 always sets this to 0) printf '\x00\x00' | dd of=bootsect.bin bs=1 seek=$((0x13)) count=2 conv=notrunc</del> # Set BPB_TotSec32 = 1,081,344 sectors = 0x00108000 printf '\x00\x80\x10\x00' | dd of=bootsect.bin bs=1 seek=$((0x20)) count=4 conv=notrunc # Set BPB_FATSz32 = 529 sectors = 0x00000211 printf '\x11\x02\x00\x00' | dd of=bootsect.bin bs=1 seek=$((0x24)) count=4 conv=notrunc <del># Set Root Cluster = 2 (usually unchanged) printf '\x02\x00\x00\x00' | dd of=bootsect.bin bs=1 seek=$((0x2C)) count=4 conv=notrunc</del> #write bootsect back and override backup too dd if=bootsect.bin of=/dev/sdX1 bs=512 count=1 conv=notrunc dd if=bootsect.bin of=/dev/sdX1 bs=512 count=1 seek=6 conv=notrunc
# Verify and fix FS if needed fsck.vfat -v /dev/sdX1 # FAQ: # Copy original over backup? -> yes (original is sector 0 and sector 6 is a backuo) ## Checking we can access the last sector of the filesystem: 0x41: Dirty bit is set. Fs was not properly unmounted and some data may be corrupt. #-> 2) No action (because dirty bit was originally? set by my token?ikd) ##Free cluster summary wrong -> Correct, probably?
2. Add second partition
# Backup a 528 MiB partition dd if=/dev/sdX1 of=part_backup.bin bs=512 count=1081344 # create second partition parted /dev/sdX --script mkpart primary fat32 532MiB 1060MiB # add a second 528MiB partition
3. copy over partition
Take block backup of a partition and append after first partition:
# Append backup to device with 1 MiB (2048 sectors) after first partition # <del>1081344 + 2048 padding = 1083392</del> 1089536 dd if=other_backup.bin of=/dev/sdX bs=512 seek=1089536 conv=notrunc # if needed # Append second partition to partition table with # sfdisk. Format: start_sector, num_sectors, type echo "1089536,1081344,c" | sudo sfdisk --append /dev/sdX
4. The Swap trick
Each partition entry in MBR is 16 bytes long, and the partition table starts at byte offset 446 (0x1BE). Therefore swap:
1st partition entry: bytes 446–461 (0x1BE–0x1CD)
2nd partition entry: bytes 462–477 (0x1CE–0x1DD)
3rd partition entry: bytes 478–493 (0x1DE–0x1ED)
4th partition entry: bytes 494–509 (0x1EE–0x1FD)
With this, we can use dd to swap partitions to which is first:
# Have a backup of MBR dd if=/dev/sdX of=mbr_backup.bin bs=512 count=1 # Extract first partition entry dd if=mbr_backup.bin of=part1.bin bs=1 skip=446 count=16 # Extract second partition entry dd if=mbr_backup.bin of=part2.bin bs=1 skip=462 count=16 # Create copy of mbr_backup for swapping cp mbr_backup.bin mbr_swapped.bin # Write second partition entry over first dd if=part2.bin of=mbr_swapped.bin bs=1 seek=446 conv=notrunc # Write first partition entry over second dd if=part1.bin of=mbr_swapped.bin bs=1 seek=462 conv=notrunc # Write back MBR to USB storage dd if=mbr_swapped.bin of=/dev/sdX bs=512 count=1
or do it directly on /dev/sdX instead of mbr_swapped. To reverse just write back mbr_backup or change partition address accordingly.
5. Flush & Wash & Rehash
Flush and WASH YOUR HANDS WITH SOAP! Soap works, you know. 💩 Do it ever so often in between when advisable.
sync sudo blockdev --flushbufs /dev/sdX sudo partprobe /dev/sdX
Now it looks something like this:
Device Boot Start End Sectors Size Id Type /dev/sdb1 1089536 2170879 1081344 528M c W95 FAT32 (LBA) /dev/sdb2 8192 1089535 1081344 582M c W95 FAT32 (LBA)
✅ Done, you now have switched to a second partition. You can have four primary partitions in MBR, 3+ fitting in the size of a single token - you 'just' have to switch between them manually. Rehash: To switch partitions goto Step4:
🕺🎤 🔊 🎵 Oh, yeah! DIKKA, Digga, done creating our toy token! 🏁
See if there is some 3D printed docking station adapter for your tokens of your taste - to make things convenient.
Further steps I can imagine:
⧠ upload a nice script for more convenient switching 🔧
⧠ write simple C (Arduino?😮💨you really want that?) program for ESP32 or whatever to integrate into 3D printed docking station for easy switching via button (MCU as MITM to send switched MBR?)
custom content
As the player cannot read fragmented tracks, let's look at the partition hexdump first.
I have searched for some characters in hexdump of files inside partition backup.
In my Dikka partition the ordering is as follows, sorted by offsets in FS:
Most of the times the signature of the hash is at +0x2000 with the mp3 following at 0x4000, but it is not consistent so the files are not specially sorted. Also the gap between each mp3 files varies a lot. We now know for sure that the data is not read raw but FAT32 table is regularly used by MCU - with the exception that data cannot be fragmented.
⧠ how to block copy files in correct scheme in FS? 🔧
→ We can always write the files in a raw mode with dd at their addresses.
⧠ 🧠 [to be continued…🔧]
What's next? For the real fun to begin we would need a possibility to sign the hashes of all files. Either somebody sees a flaw like
https://imgs.xkcd.com/comics/random_number.png
or what we really need is the private key which is somewhere in MCU or with the manufacturer. Anybody ever glitched and dumped an AC9713A6 MCU to find the needle in the hexdump?📌 Please 👋💬😄
Hardware of Player
The case of the player is clipped, not glued. The 2000mAh Li-Ion 18650 1S battery is also not glued - nice! Inside the casing, there are two PCBs inside. First you need to take off the board containing USB-C port and potentiometer (which is for LED brightness).
The Mainboard contains an Jieli Technology AC9713A6 MCU, which theoretically would support BT5.0 and WiFi: There is no antenna on the PCB though.
The pogo pins for connecting the music token cards and the buttons are obvious. Right in the middle there is an IC labled HT8731, which is a 10W Boosted Class D amplifier.
There is also a WP25P21 adjustable current limited load switch next to three SOT-23 transistors, which are probably controlling the eight 3528 RGB-LEDs around the PCB.
Above the pogo pins there is a SOT-23-6 IC labeled “LPS 5VGA2” with a small coil next to it. I assume it's a boost converter (LP6216?), I have not measured anything yet.
To its left and right there are two unpopulated QFN‑16 footprints.
The back of the PCB has only the two 3.5mm headphone jacks, two side buttons, the battery connector and the 12-pin connector for the secondary PCB (with labeled pinout, nice!:). What the array of square pads might be for? Who knows. Maybe a raster for the marker writing on it? 😅
The secondary PCB has an upright mounted USB-C connector and a LPS LP4076B linear charger for single-cell Li-Ion and Li-Polymer batteries. The board has an IC with an etched off surface and broken out I2C header, which is next to the potentiometer setting the brightness of the LEDs (the potentiometer is not labeled on the case of the player, only documented in the manual)
PCB pinout
There are two nicely written down pinouts on the silkscreens of both PCBs - awesome!
But wait. They differ…they are mirrored…they complement each other! 🤯
If the printed arrow at the pin header is taken as Pin1, then the text is upside down.
Pinout in view on main PCB (silkscreen text upside down):
| Pin# | 1st-Name | 2nd-Name | left row conclusion | Pin# | 1st-Name | 2nd-Name | right row conclusion | |
|---|---|---|---|---|---|---|---|---|
| 2 | Vol | LED_VOL | LED brightness poti | 1* | VCC | BATT | ||
| 4 | SIGNAL | MCUBUS | from-or-to unlabled IC | 3 | USB5V-DET | USBDET | detection for USB5V (¿and ext-spk?) | |
| 6 | POWER | PWRON | power signal? | 5 | NTC | NTC | Temp sensor for (¿ext?) battery | |
| 8 | D- | USBD- | USB data- | 7 | D+ | USBD+ | USB data+ | |
| 10 | B_ON | GND | bridged to GND? | 9 | GND | GND | Ground | |
| 12 | SPK+ | SPK+ | Speaker+ | 11 | SPK- | SPK- | Speaker- |
Such complementing silkscreen labels are awesome!
unlabled IC
Let's see if we can find out what the unlabeled IC with the I2C breakout on the secondary PCB is. Which MCU is hiding there?
⧠ hook up I2C / UART pins
Speaker addon
According to the manual, there is a second Li-Ion battery with also 2Ah (7.4Wh) inside. The speaker also has the ability for wireless charging with a frequency 87 – 205 kHz.
If we look at pogo pins solder joints of the second PCB of the galakto player, there is the pinout of the connection ring to the speaker on silkscreen:
| Pin# | Name | description |
|---|---|---|
| outer ring | ||
| 1 | PWRON | |
| 2 | GND | Ground |
| 3 | BATT | |
| 4 | SPK+ | Speaker+ |
| 5 | SPK- | Speaker- |
| 6 | 5V | |
| inner ring |
According to the Pinout you could probably just attach audio signal and trigger the PWRON ring to use it with other sources - you can even power them by the builtin battery.
⧠ ❓ This might be your task ;)
I have not disassembled this part, yet even tried out. According to the pinout and the fact that it has its own USB-C port and charging LEDs, it has probably some standalone Li-Po battery charger IC and inductive charging circuit.
Personal conclusion
Good that there is a cloudless alternative to the famous Toniebox. It is not cool that they use proprietary cards, though it is understandable, as it is intended for small children from the age of 3.
The case labeling of potentiometer for LED brightness is missing and only named in manual - I was careless and had to replace the 10K poti, because I thought it was a screw of the case 
Sometimes the track prev/next keys don't work (at least for me, maybe I have screwed around a bit too much with my token?) - re-plugging the token helps.
Good to see that music files are not encrypted - the signed hash files leave a bad taste in one’s mouth. Custom mp3 file playing is not possible.
Sad to see that the quality of the music files can be considered garbage from hi-fi perspective - the flash storage space would be big enough to store high resolution files on it. I assume that quality is cut down to 128kbps because of the processing power of the MCU. An idealist would have put the high-res files next to the lo-fi versions and sold a separate USB-adapter for the cards to be connected to PC or amps with USB. Wasted chance.
Awesome that they kept the useful labels on silkscreen (even complementing each other on pin header!) and have lots of test points *thumbs up*. Have not seen that to this extend in a long while.
Only wish I have is for the file signing keys 😴💤
🤠 Pro-Tip: Print your own pogo pin USB-adapter and store your secret data - there is still ~1.9GB free space where nobody even imagines to look: the player still works fine :). Just make sure to fix the size of FS in partition after resizing!
Sound quality
The output of the 3.5mm headset jacks is flat. The .mp3 files of the token sound way better using the same earbuds on my Thinkpad. I assume they have chosen an “equalizer setting” suitable for audio books? They could have added custom EQ in their settings.properties so music albums sound better.
For the external speaker: I have not even tried out or unpacked the external speaker yet O.o
⧠ Task: measure frequency output of audio jack 🎼🎶
Links and Infos
- AC9713A6 MCU datasheet: http://www.yunthinker.com/static/upload/file/20241225/1735097519585543.pdf
- AC9713A6 MCU reference schematics: http://www.yunthinker.com/static/upload/file/20241225/1735097514291728.pdf
- to flash JieLi MCUs you need “Jerry Tool” JL USB 4.0 Update tool (I have not bought it). Can be found on aliexpress, e.g. here
https://aliexpress.com/item/1005003581831855.html
or
https://aliexpress.com/item/1005004678471938.html
- nice read-up: https://oshwlab.com/hawaii0707/jeli-color-silk-screen-developme
- AlcorMP tool: https://www.usbdev.ru/files/alcor/alcormp/
* alt. link: ALCOR_U2_MP_23.08.07.00.H_AHG-B.rar (found in web as usbdev was down)
3D printed Token adapter
Tokens are just FAT32 formatted USB2.0 Flash sticks with unencrypted .mp3 files and “some key junk”. We can print a docking station as an adapter for the neat tokens. I like the pogo pins they have used, so let's do that too *ordering popo pins?*
This way we can connect the tokens to USB quickly for switching and dumping partitions or connect them to USB capable stereo amps to have richer sound. Then you could be able to fast forward and reverse playback (galakto player can only skip complete tracks). 🤔💭 And if you own more than one kid and one token (no piracy here!), you can have the other kid listen to a token too 💡 Undisturbed time to prepare dinner 😅
⧠ create stl model for 3D printing 🔧
⧠ solder up pogo pins with USB-C socket 🔧
⧠ profit and/or please contribute ;)
⧠ bonus: integrate MCU with button for switching partitions
ToDo
- take photos with better lighting
- hook up I2C / UART pins
- find out unlabeled IC
* 3D printing model with pogo pins and USB for token
- glitch AC9713A6 MCU and extract private key for custom content (achievable?)