3 ms·

I've been developing a QEMU emulator for the iPod Classic 6G (Samsung S5L8702) that boots the original, unmodified Apple retailOS. Navigation, the disc, the scr

I've been developing a QEMU emulator for the iPod Classic 6G (Samsung S5L8702) that boots the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound. There were four different errors, and the last one was my fault in a way that I found amusing enough to write about. For months I've been trying to emulate the iPod Classic 6G I have in my drawer, without success. After a long time, I finally managed to get it running, although it's still somewhat rough. In QEMU, I managed to boot the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound. One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. I have an iPod Classic 6G from 2008. With the help of Claude Code, I was able to create code to extract it using emCORE. I extracted the contents of the flash memory and decrypted the image myself. and the boot ROM cannot be read from the running device. I confirmed the latter the hard way, and along the way, my iPod restarted several times (pressing the center and menu buttons for 5 seconds to restart it). There is no datasheet for the SoC. Each model register that allows unlocking some part of the guest is derived from a write operation performed by the guest itself, Code and notes, including the ~16 hypotheses I had to retract along the way

smith7018 23d ago
Great work! I'm the guy that's working on recompiling the iPod games for modern systems (I'm mentioned by the top comment in your Reddit post). Have you tried installing the games in the emulator? If so, this would be a huge step in figuring out the DRM so people can dump their own games. That would lead to more games being supported in siggifly's 5.5G emulator [1] and eventually the games can be brought to more modern platforms. [1] https://github.com/siggifly/ipod-emulator/ https://github.com/siggifly/ipod-emulator/ I made the PR that allowed it to run dumped games fwiw
- dmonterocrespo 23d ago
  I saw your work and I thought it was excellent; that's another step I want to take: being able to run the games and the cover flow! We're one step away from making the iPod free forever.
- robotnikman 23d ago
  Oh nice! There were 2 games I loved playing on my iPod Nano I would love to try again -Spore, basically the first phase of PC Spore game, was still fun though. -This one game which was like guitar hero, but used the clickwheel and would automatically generate tracks from your songs.
  - smith7018 23d ago
    Do you remember if it was named Musika? [1] If so, that game has actually been decrypted so I could work on a recomp. There's also Phase [2] which seems like the more likely pick. Unfortunately, it was never decrypted. I modeled out the Metadata db structure that the iPod OS exposed to games that represented its iTunesDB so I should be able to support custom songs/albums in a recomp in the future. Long term, I'd love to be able to BYO API key for Spotify and expose your Spotify library to the game as your "iPod's" music. I feel like that would modernize the experience. I'll get there when work calms down and I'm no longer working 60 hour work weeks :( [1] https://www.youtube.com/watch?v=XfuF_i7N2M4 https://www.youtube.com/watch?v=XfuF_i7N2M4 [2] https://www.youtube.com/watch?v=9scEk1_lQXc https://www.youtube.com/watch?v=9scEk1_lQXc
    - robotnikman 22d ago
      Yep, it would be Phase. Anyways thanks again for all your hard work, it brings me some good nostalgia since my iPod is long gone now.
Retr0id 23d ago
> including the ~16 hypotheses I had to retract along the way If you're going to paste raw claude output, please at least replace "I" with "Claude".
- sosull 23d ago
  But that was the single hardest claim in the model register!
- znpy 23d ago
  Really sounds like: If you’re going to paste raw executable binaries, please at least replace “I” with “the compiler”
  - Retr0id 23d ago
    More like, don't commit compiled executables to git.
    - goodmythical 23d ago
      Right, because no one does that.
      - Retr0id 23d ago
        Hence the equivalence.
        goodmythical 23d ago
        I think one of us missed the sarcasm. Lots of people post compiled binaries to git, so you can't really use that as a "you shouldn't forget to mention LLM use because you shouldn't submit compiled binaries" because lots of people do it in order to use it as a distribution channel rather than requiring users to compile it themselves or requiring the author(s) to host the binaries elsewhere.
q3k 23d ago
> One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. wInd3x can decrypt it. > and the boot ROM cannot be read from the running device Yes it can, you just need to turn on the right clock gate. I'm so tired of AI slop. We've been reverse engineering these SoCs slowly and carefully for years, but this is what ends up getting published and shared.
- CursedSilicon 23d ago
  Careful now. Criticizing the slop machine is a great way to get harassed on this site
- kjs3 23d ago
  Humans doing work is soooo 2021. Only luddites and haters do that. /s
  - dmonterocrespo 23d ago
    We can all combine our own knowledge, enthusiasm, and AI to do amazing things. It's like using better computers with better processors. For programming, I could perfectly well use a PC from 2001.
- dmonterocrespo 23d ago
  I used AI, and I mention it in the post. I'm also an engineer at IBM, and I know a bit about operating systems and embedded systems, which helps me understand and decipher parts of the iPod. I also have a small workshop where I was able to repair an iPod that had been broken for a few years. The community is truly amazing, and it supported me in subsequent research such as freemyipod and https://github.com/devos50/qemu-ios https://github.com/devos50/qemu-ios
  - nvme0n1p1 23d ago
    And with all those credentials, you couldn't even be bothered to write an accurate summary? That makes it look worse, not better.

smith7018 23d ago

Great work! I'm the guy that's working on recompiling the iPod games for modern systems (I'm mentioned by the top comment in your Reddit post). Have you tried installing the games in the emulator? If so, this would be a huge step in figuring out the DRM so people can dump their own games. That would lead to more games being supported in siggifly's 5.5G emulator [1] and eventually the games can be brought to more modern platforms. [1] https://github.com/siggifly/ipod-emulator/ https://github.com/siggifly/ipod-emulator/ I made the PR that allowed it to run dumped games fwiw

dmonterocrespo 23d ago
I saw your work and I thought it was excellent; that's another step I want to take: being able to run the games and the cover flow! We're one step away from making the iPod free forever.
robotnikman 23d ago
Oh nice! There were 2 games I loved playing on my iPod Nano I would love to try again -Spore, basically the first phase of PC Spore game, was still fun though. -This one game which was like guitar hero, but used the clickwheel and would automatically generate tracks from your songs.
- smith7018 23d ago
  Do you remember if it was named Musika? [1] If so, that game has actually been decrypted so I could work on a recomp. There's also Phase [2] which seems like the more likely pick. Unfortunately, it was never decrypted. I modeled out the Metadata db structure that the iPod OS exposed to games that represented its iTunesDB so I should be able to support custom songs/albums in a recomp in the future. Long term, I'd love to be able to BYO API key for Spotify and expose your Spotify library to the game as your "iPod's" music. I feel like that would modernize the experience. I'll get there when work calms down and I'm no longer working 60 hour work weeks :( [1] https://www.youtube.com/watch?v=XfuF_i7N2M4 https://www.youtube.com/watch?v=XfuF_i7N2M4 [2] https://www.youtube.com/watch?v=9scEk1_lQXc https://www.youtube.com/watch?v=9scEk1_lQXc
  - robotnikman 22d ago
    Yep, it would be Phase. Anyways thanks again for all your hard work, it brings me some good nostalgia since my iPod is long gone now.

Retr0id 23d ago

> including the ~16 hypotheses I had to retract along the way If you're going to paste raw claude output, please at least replace "I" with "Claude".

sosull 23d ago
But that was the single hardest claim in the model register!
znpy 23d ago
Really sounds like: If you’re going to paste raw executable binaries, please at least replace “I” with “the compiler”
- Retr0id 23d ago
  More like, don't commit compiled executables to git.
  - goodmythical 23d ago
    Right, because no one does that.
    - Retr0id 23d ago
      Hence the equivalence.
      - goodmythical 23d ago
        I think one of us missed the sarcasm. Lots of people post compiled binaries to git, so you can't really use that as a "you shouldn't forget to mention LLM use because you shouldn't submit compiled binaries" because lots of people do it in order to use it as a distribution channel rather than requiring users to compile it themselves or requiring the author(s) to host the binaries elsewhere.

q3k 23d ago

> One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. wInd3x can decrypt it. > and the boot ROM cannot be read from the running device Yes it can, you just need to turn on the right clock gate. I'm so tired of AI slop. We've been reverse engineering these SoCs slowly and carefully for years, but this is what ends up getting published and shared.

CursedSilicon 23d ago
Careful now. Criticizing the slop machine is a great way to get harassed on this site
kjs3 23d ago
Humans doing work is soooo 2021. Only luddites and haters do that. /s
- dmonterocrespo 23d ago
  We can all combine our own knowledge, enthusiasm, and AI to do amazing things. It's like using better computers with better processors. For programming, I could perfectly well use a PC from 2001.
dmonterocrespo 23d ago
I used AI, and I mention it in the post. I'm also an engineer at IBM, and I know a bit about operating systems and embedded systems, which helps me understand and decipher parts of the iPod. I also have a small workshop where I was able to repair an iPod that had been broken for a few years. The community is truly amazing, and it supported me in subsequent research such as freemyipod and https://github.com/devos50/qemu-ios https://github.com/devos50/qemu-ios
- nvme0n1p1 23d ago
  And with all those credentials, you couldn't even be bothered to write an accurate summary? That makes it look worse, not better.