Npower Fusion

At the end of December, I bought an NPower Fusion from Woot for $10.

It’s a media player manufactured by Memorex for Nickelodeon with a SpongeBob Square Pants theme. The player originally sold for $99 when it was released two years ago, so the technology is relatively current. The display is 320×240 (same as the iPhone), it supports WMV9 video, MP3 audio, and java apps (CLDC 1.1, MIDP2), and it includes a lithium-polymer battery. Overall, this looks to be a nice toy to hack and not a bad platform to run simple java programs as-is.

There are several useful pages about the fusion, my favorite being a cool blog post showing a disassembly of the device. As can be seen in the article, the fusion contains a Telechips TCC8200, which has a very capable ARM9 core at 200MHz. For reference, the Nintendo DS has a dual core chip with a similar ARM9 core at 67MHz and an ARM7 core at 33.5MHz. Much thanks to Hunter for his post.

I’ve also found numerous articles covering specific topics like converting videos the proper Windows Media format (WMV9, WMA8) for playback on the fusion. Unfortunately, I’ve had no luck converting in Ubuntu 😦 I have been able to convert videos to wmv using ffmpeg or mencoder, then sync them to the fusion via Windows Media Player. Here are some good fusion links:
http://npowerfusion.blogspot.com/
http://npowerfusiontutorials.blogspot.com/

Now I’d like to share some info of my own. I’d very much like to port Rockbox to this player, so I looked around on the official website for a firmware update. It’s my understanding that a common approach to running custom software on a device like this is to modify a firmware image and load it onto the device through its own update process. Unfortunately, there was no firmware to be found

Regardless, I next began looking for the update mechanism. I have a Sansa c140 music player which contains a Telechips TCC770 and it enters an update mode when a specific button combination is held as it is plugged into the USB port. This update mode is special because it loads the firmware image into RAM without writing it to flash, making it possible to test a hacked firmware without risk of bricking the device. There is a tool in the Rockbox repository called tcctool which performs the firmware copy while in this mode. Additionally, there is a test mode that begins when the c140 is powered on with a different key combo held.

With some trial and error, I discovered both modes on the fusion =) Holding the “-” and “+” keys while powering on the device enters the production test mode, which allows you to check the functionality of your device (screen, keys, audio, etc).

Holding the “bent left arrow” on the top of the fusion while plugging it into a PC will boot it into *what I believe to be* a firmware update mode. Let me explain…

Similar to the Sansa c140, when you plug the fusion into the USB port it ordinarily appears as a storage device and accepts files as expected. When both devices enter this alternate “update” mode however, they don’t act like storage devices. Instead, they identify themselves to the PC as “Telechips, Inc.” devices, with a different (manufacturerID:productID) combination. From Linux, you can observe this difference by executing “lsusb” at a shell. Here’s the output when the device is connected as usual:

~$ lsusb
...
Bus 002 Device 004: ID 0aa6:6511 Perception Digital, Ltd
...

Here is what you see when you’ve connected in update mode:

~$ lsusb
...
Bus 002 Device 003: ID 140e:b051 Telechips, Inc.
...

Interestingly, the product ID is 0xb051, which is identical to that of the iRiver X20. It’s possible they are based on the same platform as well. Since I haven’t found a firmware image yet, hacking the fusion will be much more difficult, but the hidden update mode and the potential to use the the iRiver X20 firmware as a starting point is promising.