I've been developing a QEMU emulator for the iPod Classic 6G (Samsung S5L8702) that boots the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound. There were four different errors, and the last one was my fault in a way that I found amusing enough to write about.
For months I've been trying to emulate the iPod Classic 6G I have in my drawer, without success. After a long time, I finally managed to get it running, although it's still somewhat rough. In QEMU, I managed to boot the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound.
One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. I have an iPod Classic 6G from 2008. With the help of Claude Code, I was able to create code to extract it using emCORE. I extracted the contents of the flash memory and decrypted the image myself.
and the boot ROM cannot be read from the running device. I confirmed the latter the hard way, and along the way, my iPod restarted several times (pressing the center and menu buttons for 5 seconds to restart it).
There is no datasheet for the SoC. Each model register that allows unlocking some part of the guest is derived from a write operation performed by the guest itself,
Code and notes, including the ~16 hypotheses I had to retract along the way
Great work! I'm the guy that's working on recompiling the iPod games for modern systems (I'm mentioned by the top comment in your Reddit post). Have you tried installing the games in the emulator? If so, this would be a huge step in figuring out the DRM so people can dump their own games. That would lead to more games being supported in siggifly's 5.5G emulator [1] and eventually the games can be brought to more modern platforms.
> One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download.
wInd3x can decrypt it.
> and the boot ROM cannot be read from the running device
Yes it can, you just need to turn on the right clock gate.
I'm so tired of AI slop. We've been reverse engineering these SoCs slowly and carefully for years, but this is what ends up getting published and shared.
One of the things that gave me a lot of trouble was unlocking the music player. Reverse engineering it was really difficult. I investigated many possible variations, tried searching on https://freemyipod.org for memory register information, but there was nothing for this particular iPod that could help me with the music player. Now I'm trying to unlock Cover Flow, which is something I really liked the first time I saw it on my iPod.
I think another problem is: vibecoded emulators (like this one seems to be?) are likely to be a stunt, a cool project, but will not be maintained. Upstreaming this to qemu requires at least some human effort, and it is not very likely to happen. So we are left with a cool trick.
I can imagine some people feel like it's cheating because they did it the hard way. I have much respect for those people and their skillset and I hope AI doesn't discourage them.
For months I've been trying to emulate the iPod Classic 6G I have in my drawer, without success. After a long time, I finally managed to get it running, although it's still somewhat rough. In QEMU, I managed to boot the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound.
One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. I have an iPod Classic 6G from 2008. With the help of Claude Code, I was able to create code to extract it using emCORE. I extracted the contents of the flash memory and decrypted the image myself.
and the boot ROM cannot be read from the running device. I confirmed the latter the hard way, and along the way, my iPod restarted several times (pressing the center and menu buttons for 5 seconds to restart it).
There is no datasheet for the SoC. Each model register that allows unlocking some part of the guest is derived from a write operation performed by the guest itself,
Code and notes, including the ~16 hypotheses I had to retract along the way
[1] https://github.com/siggifly/ipod-emulator/ I made the PR that allowed it to run dumped games fwiw
If you're going to paste raw claude output, please at least replace "I" with "Claude".
wInd3x can decrypt it.
> and the boot ROM cannot be read from the running device
Yes it can, you just need to turn on the right clock gate.
I'm so tired of AI slop. We've been reverse engineering these SoCs slowly and carefully for years, but this is what ends up getting published and shared.
https://github.com/davidtphung/coverflow-media
https://512pixels.net/2023/10/the-history-of-cover-flow/
https://old.reddit.com/r/emulation/comments/1wbapys/zevora_e... https://old.reddit.com/r/emulation/comments/1w8b6rk/ruzu_is_... https://old.reddit.com/r/emulation/comments/1vz9na6/pc_ports...
Anyone looking for FW/IPSW https://www.felixbruns.de/iPod/firmware/