More 510/610 Hacking Fun

[Damage]

Per hunterd's thread testing 62 bits, I decided to fiddle around a bit with the 61 bit and found the following. The bits 0-3 I probably need to test a bit more, since I didn't zero out the bits 7-4--I'm not sure as of this point if the two sets of bits can have negative interaction with one another but I doubt that is the case. Here then is the result:

In case anyone is confused as how the bits are arranged, the first four bits (7-4) enables such goodies as the 6-Band EQ, AU OUT, etc. as you can see. The second 4-bits seems to define regional functions, such as Katakana editing and service model entry:

the last four bits I enabled the Line out and 6-Band EQ amongst other things. I can easily assume that setting the first byte to 0 will have no changes to my observations, but that's just a minor assumption on my part. Anyone who's bored and brave enough to try out the changes are welcome to do so.

74 (0111 0100):
Bit 2 changes EDIT menu options to Move and Erase only, no naming, R-SET only shows Cancel, changes service entry to EURO or 710 Model Service Entry (That is, hold Stop, use the remote to enter the sequence. LCD remotes work). Don't know if this changes the output as well.
78 (0111 1000) Unknown what changes if any. No obvious changes observed.
72 (0111 0010) Enables the katakana entry and 6-band, line out
71 (0111 0001) sets output at line out, no menu entry on unit, volume keys disabled per Line Out entry, useful as a home "deck" player unit, but nothing else really. I believe this also screws with the Service Entry to bit 2's method of entry as well, but I'm not sure of this (I didn't jot it down).

-- As for Bits 7- --

60 (0110 0000) 6 Band, 2 Custom EQ, AU OUT
80 (1000 0000) Same as normal? No observed changes.
40 (0100 0000) Enables AU OUT only.
20 (0010 0000) No output, 6-band EQ
10 (0001 0000) Enables TITLE in the DISP menu, only useful with LCD remotes: it scrolls the disk title then track title in sequence.

--
My findings:
Whoever said that 510s and 610s cannot display Katakana are wrong, but they can not display Hiraganas nor Kanjis (minor dissapointment). As such, I can also assume that 410s could be hacked via holding stop and using the remote--except that 410s can't use the remote... Someone want's to give it a try using the joypad?

I also wonder if SONY is using the F-bits to set regional settings as well (ie European vs. US/Asian). If that is the case, are the output levels also controlled by the F-bits? It wouldn't be much of a stretch.

Just piling on to what was alreadly reported. By the by, I'd love to see how the bits are set on the N10 or 910 models,l and see if the PDM and other fancy saving functions can be enabled via some discreet hacking efforts... Can't hurt to dream, no?

Edit: added Bit 4's function

[bertrik]

I noticed that setting bit 4 in register 0x61 added the option TITLE in the DISP menu. However it does not seem to do anything useful on my MZ-N510.

I think we should have a central table somewhere with the effect of all bits for all models that have been figured out until now. Perhaps write a very simple program that the average user can use to calculate the hex number from the individual bits.

I also wonder if some of the bits (like bits 1, 2, 4 or 5 in register 62) have effect on NetMD upload/download capabilities, like allowing download of encrypted data, allowing edits on protected tracks or even upload. I can imagine such possibilities exist for testing purposes.

[Daijoubu]

The output level isn't set by the firmware, the PCB componment are differents (some resistors and capacitors)

ur exploration of hacking is highly appreciated .

~EO

[hunterd]

Nice job Damage. I see that it's more dangerous to mess with the 61 byte than the 62

Originally posted by bertrik
I also wonder if some of the bits (like bits 1, 2, 4 or 5 in register 62) have effect on NetMD upload/download capabilities, like allowing download of encrypted data, allowing edits on protected tracks or even upload. I can imagine such possibilities exist for testing purposes.

Usually, the value I use sets the same bits as the original value + the bits I want to set. So basicly, when you hack, try to be as close as the original value.

HunterD

[Damage]

As so long as you have a remote, you're relatively safe in mucking around 61 bits. I've noted how to get into the service mode again if you do screw up (Hold On, Press Stop on Unit, enter the code on the remote using jog lever) so it should provide some relief for those of you who screwed up your 61 and 62 values. Of course, if you fiddled around with your LASER or other settings, well, that's another story altogether.

I'd still like to see what the entire NVRam values are like on a N10/910 to see one can enable PDM on the 610/510. That'd probably make my day.

[Daijoubu]

If you take a look at the schematics, you'll notice there'S no eeprom on the 510/610

[KRHAiNOS]

Originally posted by Daijoubu
If you take a look at the schematics, you'll notice there'S no eeprom on the 510/610

Oh? How does the things get stored then? .. Flash ROM? Voodoo? MRAM? ... Now I'm curious ...

[MDX-400]

Originally posted by KRHAiNOS


Oh? How does the things get stored then? .. Flash ROM? Voodoo? MRAM? ... Now I'm curious ...

The units [N510/NF610] have NVRAM but I think (judging by Daijoubu's comment) that N1/N10/N910s store PDM info in an EEPROM which isn't there on the N510/NF610... This is likely the same reason why a hacked N707 can't use PDM eventhough it shows up in the menu... (It is either because of that or because of power management).

Roland M.

[KRHAiNOS]

Originally posted by MDX-400


The units [N510/NF610] have NVRAM but I think (judging by Daijoubu's comment) that N1/N10/N910s store PDM info in an EEPROM which isn't there on the N510/NF610... This is likely the same reason why a hacked N707 can't use PDM eventhough it shows up in the menu... (It is either because of that or because of power management).

Roland M.

So to anwer my question of "How does it ..." : It doesn't, that's why them features don't work (properly)