5 ms·

iPod Classic 6G in QEMU

161 points by dmonterocrespo 27d ago

dmonterocrespo 27d ago
I've been developing a QEMU emulator for the iPod Classic 6G (Samsung S5L8702) that boots the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound. There were four different errors, and the last one was my fault in a way that I found amusing enough to write about. For months I've been trying to emulate the iPod Classic 6G I have in my drawer, without success. After a long time, I finally managed to get it running, although it's still somewhat rough. In QEMU, I managed to boot the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound. One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. I have an iPod Classic 6G from 2008. With the help of Claude Code, I was able to create code to extract it using emCORE. I extracted the contents of the flash memory and decrypted the image myself. and the boot ROM cannot be read from the running device. I confirmed the latter the hard way, and along the way, my iPod restarted several times (pressing the center and menu buttons for 5 seconds to restart it). There is no datasheet for the SoC. Each model register that allows unlocking some part of the guest is derived from a write operation performed by the guest itself, Code and notes, including the ~16 hypotheses I had to retract along the way
- smith7018 24d ago
  Great work! I'm the guy that's working on recompiling the iPod games for modern systems (I'm mentioned by the top comment in your Reddit post). Have you tried installing the games in the emulator? If so, this would be a huge step in figuring out the DRM so people can dump their own games. That would lead to more games being supported in siggifly's 5.5G emulator [1] and eventually the games can be brought to more modern platforms. [1] https://github.com/siggifly/ipod-emulator/ https://github.com/siggifly/ipod-emulator/ I made the PR that allowed it to run dumped games fwiw
  - dmonterocrespo 23d ago
    I saw your work and I thought it was excellent; that's another step I want to take: being able to run the games and the cover flow! We're one step away from making the iPod free forever.
  - robotnikman 23d ago
    Oh nice! There were 2 games I loved playing on my iPod Nano I would love to try again -Spore, basically the first phase of PC Spore game, was still fun though. -This one game which was like guitar hero, but used the clickwheel and would automatically generate tracks from your songs.
    - smith7018 23d ago
      Do you remember if it was named Musika? [1] If so, that game has actually been decrypted so I could work on a recomp. There's also Phase [2] which seems like the more likely pick. Unfortunately, it was never decrypted. I modeled out the Metadata db structure that the iPod OS exposed to games that represented its iTunesDB so I should be able to support custom songs/albums in a recomp in the future. Long term, I'd love to be able to BYO API key for Spotify and expose your Spotify library to the game as your "iPod's" music. I feel like that would modernize the experience. I'll get there when work calms down and I'm no longer working 60 hour work weeks :( [1] https://www.youtube.com/watch?v=XfuF_i7N2M4 https://www.youtube.com/watch?v=XfuF_i7N2M4 [2] https://www.youtube.com/watch?v=9scEk1_lQXc https://www.youtube.com/watch?v=9scEk1_lQXc
      - robotnikman 22d ago
        Yep, it would be Phase. Anyways thanks again for all your hard work, it brings me some good nostalgia since my iPod is long gone now.
- Retr0id 24d ago
  > including the ~16 hypotheses I had to retract along the way If you're going to paste raw claude output, please at least replace "I" with "Claude".
  - sosull 24d ago
    But that was the single hardest claim in the model register!
  - znpy 24d ago
    Really sounds like: If you’re going to paste raw executable binaries, please at least replace “I” with “the compiler”
    - Retr0id 24d ago
      More like, don't commit compiled executables to git.
      - goodmythical 24d ago
        Right, because no one does that.
        Retr0id 24d ago
        Hence the equivalence.
        goodmythical 23d ago
        I think one of us missed the sarcasm. Lots of people post compiled binaries to git, so you can't really use that as a "you shouldn't forget to mention LLM use because you shouldn't submit compiled binaries" because lots of people do it in order to use it as a distribution channel rather than requiring users to compile it themselves or requiring the author(s) to host the binaries elsewhere.
- q3k 24d ago
  > One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. wInd3x can decrypt it. > and the boot ROM cannot be read from the running device Yes it can, you just need to turn on the right clock gate. I'm so tired of AI slop. We've been reverse engineering these SoCs slowly and carefully for years, but this is what ends up getting published and shared.
  - CursedSilicon 23d ago
    Careful now. Criticizing the slop machine is a great way to get harassed on this site
  - kjs3 23d ago
    Humans doing work is soooo 2021. Only luddites and haters do that. /s
    - dmonterocrespo 23d ago
      We can all combine our own knowledge, enthusiasm, and AI to do amazing things. It's like using better computers with better processors. For programming, I could perfectly well use a PC from 2001.
  - dmonterocrespo 23d ago
    I used AI, and I mention it in the post. I'm also an engineer at IBM, and I know a bit about operating systems and embedded systems, which helps me understand and decipher parts of the iPod. I also have a small workshop where I was able to repair an iPod that had been broken for a few years. The community is truly amazing, and it supported me in subsequent research such as freemyipod and https://github.com/devos50/qemu-ios https://github.com/devos50/qemu-ios
    - nvme0n1p1 23d ago
      And with all those credentials, you couldn't even be bothered to write an accurate summary? That makes it look worse, not better.
dmonterocrespo 26d ago
One of the things that gave me a lot of trouble was unlocking the music player. Reverse engineering it was really difficult. I investigated many possible variations, tried searching on https://freemyipod.org https://freemyipod.org for memory register information, but there was nothing for this particular iPod that could help me with the music player. Now I'm trying to unlock Cover Flow, which is something I really liked the first time I saw it on my iPod.
- MarkWayneNewton 24d ago
  CoverFlow originally was a 3rd party 'mod' that Apple bought at some point. My memory is hazy... https://github.com/davidtphung/coverflow-media https://github.com/davidtphung/coverflow-media https://512pixels.net/2023/10/the-history-of-cover-flow/ https://512pixels.net/2023/10/the-history-of-cover-flow/
  - dmonterocrespo 23d ago
    I didn't know that, it's a good fact. When I had my iPod 6G, that album art animation looked amazing.I haven't been able to unlock it because it has many upgrade directions that I haven't been able to decipher
ChrisRR 24d ago
It's a rarity to see a comments section in r/emulation that isn't just endless screaming about AI code
- amelius 24d ago
  Why is it a problem? Sounds to me like emulation is a very good fit for AI.
  - Cthulhu_ 24d ago
    I can imagine some people feel like it's cheating because they did it the hard way. I have much respect for those people and their skillset and I hope AI doesn't discourage them.
    - phoghed 24d ago
      Hopefully as AI coding continues to improve they’ll come to view it like chess players do Stockfish
      - protonbob 24d ago
        But playing chess is a game already.
    - goodmythical 24d ago
      Yeah, I'm really pissed at all these car drivers doing marathons in 26 minutes because I've been working on it for years and can't get my time below 4 hrs.
      - dmonterocrespo 23d ago
        Even though I used AI, it took me months to decipher parts of the emulation. I had to study, and I loved learning things I didn't know. It's also a very beautiful learning path; everything related to technology is magical. Engineers from all over the world are trying to revive the iPod and products that are no longer commercially available.
villgax 24d ago
I was deep into customizing iPod firmware almost 20yrs ago in 7th grade or something. Anyone looking for FW/IPSW https://www.felixbruns.de/iPod/firmware/ https://www.felixbruns.de/iPod/firmware/
- edude03 23d ago
  felixbruns.de that's a domain I haven't seen in ages (probably also like 20 years)
devhunt-org 24d ago
How close is the emulation to being usable as an actual music player?
- jgbuddy 24d ago
  Seems to be 100% implemented. Very cool
- dmonterocrespo 23d ago
  Some improvements are still needed, but the idea is to run the original Apple firmware without modifications. I'd like to be able to run it on a Raspberry Pi Zero someday... a very thin layer will lift the iPod Classic 6G emulator
deleted 24d ago
[deleted]
throwaway85825 23d ago
An emulator for old iPhones would be even better. There were a ton of great paid games in that era before the app store just became a slop casino.
- dmonterocrespo 23d ago
  I think the community is very close to achieving it
- dmonterocrespo 23d ago
  https://www.reddit.com/r/programming/comments/1js8gqz/emulating_an_iphone_in_qemu/?tl=es-419 https://www.reddit.com/r/programming/comments/1js8gqz/emulat...
dmonterocrespo 23d ago
Here are some details about how I made the iPod Classic 6G emulator and what I encountered along the way: https://x.com/DMonteroCrespo1/status/2095882094455009695 https://x.com/DMonteroCrespo1/status/2095882094455009695

161 points by dmonterocrespo 27d ago

I've been developing a QEMU emulator for the iPod Classic 6G (Samsung S5L8702) that boots the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound. There were four different errors, and the last one was my fault in a way that I found amusing enough to write about. For months I've been trying to emulate the iPod Classic 6G I have in my drawer, without success. After a long time, I finally managed to get it running, although it's still somewhat rough. In QEMU, I managed to boot the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound. One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. I have an iPod Classic 6G from 2008. With the help of Claude Code, I was able to create code to extract it using emCORE. I extracted the contents of the flash memory and decrypted the image myself. and the boot ROM cannot be read from the running device. I confirmed the latter the hard way, and along the way, my iPod restarted several times (pressing the center and menu buttons for 5 seconds to restart it). There is no datasheet for the SoC. Each model register that allows unlocking some part of the guest is derived from a write operation performed by the guest itself, Code and notes, including the ~16 hypotheses I had to retract along the way

smith7018 24d ago
Great work! I'm the guy that's working on recompiling the iPod games for modern systems (I'm mentioned by the top comment in your Reddit post). Have you tried installing the games in the emulator? If so, this would be a huge step in figuring out the DRM so people can dump their own games. That would lead to more games being supported in siggifly's 5.5G emulator [1] and eventually the games can be brought to more modern platforms. [1] https://github.com/siggifly/ipod-emulator/ https://github.com/siggifly/ipod-emulator/ I made the PR that allowed it to run dumped games fwiw
- dmonterocrespo 23d ago
  I saw your work and I thought it was excellent; that's another step I want to take: being able to run the games and the cover flow! We're one step away from making the iPod free forever.
- robotnikman 23d ago
  Oh nice! There were 2 games I loved playing on my iPod Nano I would love to try again -Spore, basically the first phase of PC Spore game, was still fun though. -This one game which was like guitar hero, but used the clickwheel and would automatically generate tracks from your songs.
  - smith7018 23d ago
    Do you remember if it was named Musika? [1] If so, that game has actually been decrypted so I could work on a recomp. There's also Phase [2] which seems like the more likely pick. Unfortunately, it was never decrypted. I modeled out the Metadata db structure that the iPod OS exposed to games that represented its iTunesDB so I should be able to support custom songs/albums in a recomp in the future. Long term, I'd love to be able to BYO API key for Spotify and expose your Spotify library to the game as your "iPod's" music. I feel like that would modernize the experience. I'll get there when work calms down and I'm no longer working 60 hour work weeks :( [1] https://www.youtube.com/watch?v=XfuF_i7N2M4 https://www.youtube.com/watch?v=XfuF_i7N2M4 [2] https://www.youtube.com/watch?v=9scEk1_lQXc https://www.youtube.com/watch?v=9scEk1_lQXc
    - robotnikman 22d ago
      Yep, it would be Phase. Anyways thanks again for all your hard work, it brings me some good nostalgia since my iPod is long gone now.
Retr0id 24d ago
> including the ~16 hypotheses I had to retract along the way If you're going to paste raw claude output, please at least replace "I" with "Claude".
- sosull 24d ago
  But that was the single hardest claim in the model register!
- znpy 24d ago
  Really sounds like: If you’re going to paste raw executable binaries, please at least replace “I” with “the compiler”
  - Retr0id 24d ago
    More like, don't commit compiled executables to git.
    - goodmythical 24d ago
      Right, because no one does that.
      - Retr0id 24d ago
        Hence the equivalence.
        goodmythical 23d ago
        I think one of us missed the sarcasm. Lots of people post compiled binaries to git, so you can't really use that as a "you shouldn't forget to mention LLM use because you shouldn't submit compiled binaries" because lots of people do it in order to use it as a distribution channel rather than requiring users to compile it themselves or requiring the author(s) to host the binaries elsewhere.
q3k 24d ago
> One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. wInd3x can decrypt it. > and the boot ROM cannot be read from the running device Yes it can, you just need to turn on the right clock gate. I'm so tired of AI slop. We've been reverse engineering these SoCs slowly and carefully for years, but this is what ends up getting published and shared.
- CursedSilicon 23d ago
  Careful now. Criticizing the slop machine is a great way to get harassed on this site
- kjs3 23d ago
  Humans doing work is soooo 2021. Only luddites and haters do that. /s
  - dmonterocrespo 23d ago
    We can all combine our own knowledge, enthusiasm, and AI to do amazing things. It's like using better computers with better processors. For programming, I could perfectly well use a PC from 2001.
- dmonterocrespo 23d ago
  I used AI, and I mention it in the post. I'm also an engineer at IBM, and I know a bit about operating systems and embedded systems, which helps me understand and decipher parts of the iPod. I also have a small workshop where I was able to repair an iPod that had been broken for a few years. The community is truly amazing, and it supported me in subsequent research such as freemyipod and https://github.com/devos50/qemu-ios https://github.com/devos50/qemu-ios
  - nvme0n1p1 23d ago
    And with all those credentials, you couldn't even be bothered to write an accurate summary? That makes it look worse, not better.

dmonterocrespo 26d ago

One of the things that gave me a lot of trouble was unlocking the music player. Reverse engineering it was really difficult. I investigated many possible variations, tried searching on https://freemyipod.org https://freemyipod.org for memory register information, but there was nothing for this particular iPod that could help me with the music player. Now I'm trying to unlock Cover Flow, which is something I really liked the first time I saw it on my iPod.

MarkWayneNewton 24d ago
CoverFlow originally was a 3rd party 'mod' that Apple bought at some point. My memory is hazy... https://github.com/davidtphung/coverflow-media https://github.com/davidtphung/coverflow-media https://512pixels.net/2023/10/the-history-of-cover-flow/ https://512pixels.net/2023/10/the-history-of-cover-flow/
- dmonterocrespo 23d ago
  I didn't know that, it's a good fact. When I had my iPod 6G, that album art animation looked amazing.I haven't been able to unlock it because it has many upgrade directions that I haven't been able to decipher

ChrisRR 24d ago

It's a rarity to see a comments section in r/emulation that isn't just endless screaming about AI code

amelius 24d ago
Why is it a problem? Sounds to me like emulation is a very good fit for AI.
- Cthulhu_ 24d ago
  I can imagine some people feel like it's cheating because they did it the hard way. I have much respect for those people and their skillset and I hope AI doesn't discourage them.
  - phoghed 24d ago
    Hopefully as AI coding continues to improve they’ll come to view it like chess players do Stockfish
    - protonbob 24d ago
      But playing chess is a game already.
  - goodmythical 24d ago
    Yeah, I'm really pissed at all these car drivers doing marathons in 26 minutes because I've been working on it for years and can't get my time below 4 hrs.
    - dmonterocrespo 23d ago
      Even though I used AI, it took me months to decipher parts of the emulation. I had to study, and I loved learning things I didn't know. It's also a very beautiful learning path; everything related to technology is magical. Engineers from all over the world are trying to revive the iPod and products that are no longer commercially available.

villgax 24d ago

I was deep into customizing iPod firmware almost 20yrs ago in 7th grade or something. Anyone looking for FW/IPSW https://www.felixbruns.de/iPod/firmware/ https://www.felixbruns.de/iPod/firmware/

edude03 23d ago
felixbruns.de that's a domain I haven't seen in ages (probably also like 20 years)

devhunt-org 24d ago

How close is the emulation to being usable as an actual music player?

jgbuddy 24d ago
Seems to be 100% implemented. Very cool
dmonterocrespo 23d ago
Some improvements are still needed, but the idea is to run the original Apple firmware without modifications. I'd like to be able to run it on a Raspberry Pi Zero someday... a very thin layer will lift the iPod Classic 6G emulator

deleted 24d ago

[deleted]

throwaway85825 23d ago

An emulator for old iPhones would be even better. There were a ton of great paid games in that era before the app store just became a slop casino.

dmonterocrespo 23d ago
I think the community is very close to achieving it
dmonterocrespo 23d ago
https://www.reddit.com/r/programming/comments/1js8gqz/emulating_an_iphone_in_qemu/?tl=es-419 https://www.reddit.com/r/programming/comments/1js8gqz/emulat...

dmonterocrespo 23d ago

Here are some details about how I made the iPod Classic 6G emulator and what I encountered along the way: https://x.com/DMonteroCrespo1/status/2095882094455009695 https://x.com/DMonteroCrespo1/status/2095882094455009695