Changing the voice menu of a portable speaker

Greetings dear reader! In this article I will try to tell you how I managed to modify the portable speaker firmware, despite the fact that I am not a programmer. Surely for someone the idea will not be new, but when I faced this task I did not find a quick answer. At the end of the article I wrote down the video if anyone is too lazy to read.


So, there is a kind of portable speaker (in this case, DEXP Phill), its main drawback is that the manufacturer stuck a voice menu at the maximum volume into a screaming voice that cannot be turned off or quieter. What is the same let's look at what's inside.

Speakers and battery:
')

These two microcircuits are sound power amplifiers (UMZCH):


Here is a large, multi-legged microcircuit - the player itself, at the bottom of the battery charge controller and in the middle of a 25q40ATIG 512 kB SPI-flash memory (4 mbps):


It seems to me logical to assume that the voice menu files are protected in this flash drive, among other things. Ok, we take the programmer CH341A desoldering chip and read the contents.

The chip can not solder and just hold:


Why choose CH341A? 1) It reads 25 series of flash drives, 2) costs ~ 2USD.


So, reading the data, we received a binary (bin) file of 512 KB in size in which at first glance nothing is clear:


If anyone does not know, then here are shown: on the left - the addresses of memory cells, in the middle - bytes (data) presented in hexadecimal, where the maximum value of FF, or 255 in decimal. On the right, the editor substitutes the ACSII characters, which sometimes help a lot!

If you open any mp3 file in the hex editor, and before the heap also google on the ID3 tag device it becomes clear where the dog is buried where and how you can search for these same mp3 files of the voice menu.


All mp3 files with ID3v2 begin with a sequence of bytes 49 44, because ID3v2 is written at the beginning of the file - this is the first key. ID3v1 - spelled at the end - this is the second key. I was lucky, either because of the excess memory, or laziness, the programmers did not delete the ID3 tags and byte by byte, I fished out the files I needed. I explain: we find the initial and final bytes, select, copy to a new hex file and save with the mp3 extension:


I was surprised to find many other voice files in the firmware. For example, the numbers are voiced, though in English, and later I understood why they are needed: the speaker has bluetooth and when it is connected to the phone, it pronounces the incoming number during a call. Curve localization. By the way, this is how the monstrous dynamic compression was the dubbing:


The quick-witted reader, probably already understood what to do next, there are two ways: change the volume of the original files, do something like this:


Or replace with something more worthy. I picked up in the free music banks new sounds. Here the main thing is to fit the size of the file being replaced: less is possible, more is not. It well reduces the size of resampling (for example, from 44100 -> 22050) and the bitrate itself, but quality is a compromise. Then we do everything in reverse order: open new mp3 files in the hex editor, copy them to the right places in the firmware, save the firmware, write to the microcircuit, solder the microcircuit into place, assemble the column. Profit.

To make a new file the size of bytes in bytes with replaceable impossible. It's easier to make it smaller, and fill in the remains of the old 0x00 (with zeros). In other words, you must first select the entire replaced area, fill in 0x00, and then insert new data with replacement (zeros) without shifting the memory cells and changing the size of the final firmware file.

Conclusion

Important note: specifically, in my case, the CH341A programmer could only read 25Q40ATIG, could not write it. it is not in the list of supported. So I had to buy an analogue: 25Q40BVSIG with which everything turned out.

Promised video: