Sony MZ-N1 Firmware Reverse Engineering Feat

April, 2002

We interviewed Sasha Breginski, head of Pony Engineering, Moscow,
on the topic of his team's reverse engineering of the Sony MZ-N1


Sasha Breginski
Sasha Breginski
Hacker Extraordinaire

MDCP: Congratulations on your reverse engineering work! It is a real tour de force. What capabilities have you added to the Sony MZ-N1?

SB: Well, is not simply case of added capabilities. Also, we have deleted several functions as well. But first let's looking at new features: Full support for recording and playback of native MP3 audio data. Recordings are non-VBR mode only, in bitrates from 32 to 224kbps. Playback handles bitrates from 16 to 320kbps, including VBR. Users have unrestricted download and upload of audio from and to PC. PC has read/write access to raw data blocks on MD media, allowing use as file storage medium. However we could not change ECC protection beyond existing level for Audio data, so data is not so well error-protected for normal computer-file storage.

MDCP: That's amazing! But how could you add these capabilities to a finished product?

SB: Sony MZ-N1 is first MD portable from Sony with DSP code in flash-memory. Diagnostic mode for machine allows flash-ROM update (See CXD2677-202GA closeup showing FLASH memory control pins). We were able to obtain flash-ROM upgrade floppy through consumer electronics agencies of blackmarket arms-merchants. Then we set to work disassembling floppy contents. Seems Sony Japan programmers are super-clever, or maybe incredibly-bad. Many many functions are packed into only 1MB of flash memory, but program counter jumps around like particle in electron-cloud. Disassembling existing Sony code took several months. Finally we were asking help of 1970's-era game machine programmer to understand program "folding".
DSP
Chip pinout closeup
DSP Chip Flash pinout closeup

MDCP: Were you able to decipher the MagicGate protocol?

SB: No, we decided from the beginning to ignore MagicGate. Whole point of project is to give users functions and capabilities they are actually looking for. Sony makes most beautiful portable audio hardware in whole world, then puts every kind of software roadblocks in and make it nearly impossible to do user's daily and necessary audio tasks. It seems so stupid! We thought, why not take good Sony hardware and give it good software too?

MDCP: Well, Sony has the artist's interests to look out for too.

SB: Ha! Such a big joke! If Sony is wanting to be helping the artist, then why not having capability for audio upload to PC with NetMD? Why is small-time artist having to stand on head to get homemade Minidisc recording onto Internet or sending in email? MD is practically computer storage format, but still users are having to use analog audio cables, pushing "play" on MD unit and "record" on PC and waiting around to push "stop" exactly when finished. NetMD hardware is all full-duplex inside, only Sony decision on software is keeping artists from easily moving recordings to PC. And anyway, nobody in right mind would use MD to circumventing copy-protection when you can easily copy audio tracks directly from CD and convert to MP3 using any basic PC. Involving Minidisc for this is a huge, unneccessary detour!

MDCP: Well, let's get back to your amazing MD-crack. So there is no support for MagicGate?

SB: No, MagicGate is protected so well, with unique hardware key written into flash memory of every unit. We simply deleted all MagicGate code. So you cannot use OpenMG Jukebox with our version of MZ-N1. However, we offer opensource library for download and upload of raw audio, and you can mount the MD media as a filesystem under Windows, so anyway the connection is now much more convenient than with Sony Jukebox software.

MDCP: You mention that some capabilities were removed, what are these?

SB: Well, biggest change is that we took out support for ATRAC and that means we lose compatability with existing, recorded MDs.

MDCP: That's pretty serious, you mean people who make the upgrade can no longer play their old discs?

SB: Not quite so bad as that. Modification consists of two boot MDs for firmware reload. One disc returns unit to factory specification, the other to our "MP3 player" version. By the way, we call our modified firmware version of Sony MZ-N1 the "Pony MP3-N1".

MDCP: But how can you just ignore ATRAC? You are losing compatibility with the entire existing base of recorded MD audio.

SB: Losing compatibility with proprietary, crippled, niche format is not our worrying! MP3 is much much bigger than Minidisc and now having beautiful little disc-based portable player/recorder handling MP3 we are sure it will soon be more popular than original ATRAC Minidisc. "Left on the junk-heap of history" was said by your politicians about closed, corrupted Communist system of USSR -- it is just the same for ATRAC and other closed formats. Old Soviet system and closed ATRAC are strictly about control of masses by powerful few. And now with Internet, and open formats, who will be wanting to stay with the old systems? Only thing you have to keep open is freedom for hacking, and actually we are worrying about this for America.

MDCP: But couldn't you have left the ATRAC codec intact?

SB: Once you are handling ATRAC, it is like written invitation for Sony to come after you for license and patent infractions. Russian hackers and progressives are now fearing that Americans are living under some kind of Capitalist Dictatorship. Only ones saying what American people are allowed to do with electronics equipment are huge corporations with big lawyers and expensive lobbyists. Fellow who I graduated from school with went to America and gave academic talk on copy-protection technology, suddenly he is in jail for breaking encryption technology! Totally amazing -- this is kind of thing Americans used to say could only happen in Russia! At least here we are free to say what we like about our discoveries while digging into a piece of electronic equipment.

MDCP: Well, thank you for your hard work and also your political commentary. Will you be making your MP3-N1 hack available for download over the Internet?

SB: Yes, certainly, it is free for everyone. Please see ************ for downloading and the firmware upload instructions via Diagnostic-mode.

(Unfortunately our lawyers have advised us to remove the Web URL to avoid prosecution for contributory infringement of the Digital Millennium Copyright Act ["DMCA"] -Ed.)

Sorry Folks -- April Fools! -Ed.


Return to the MiniDisc Community Page.