I've been developing a QEMU emulator for the iPod Classic 6G (Samsung S5L8702) that boots the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound. There were four different errors, and the last one was my fault in a way that I found amusing enough to write about.
For months I've been trying to emulate the iPod Classic 6G I have in my drawer, without success. After a long time, I finally managed to get it running, although it's still somewhat rough. In QEMU, I managed to boot the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound.
One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. I have an iPod Classic 6G from 2008. With the help of Claude Code, I was able to create code to extract it using emCORE. I extracted the contents of the flash memory and decrypted the image myself.
and the boot ROM cannot be read from the running device. I confirmed the latter the hard way, and along the way, my iPod restarted several times (pressing the center and menu buttons for 5 seconds to restart it).
There is no datasheet for the SoC. Each model register that allows unlocking some part of the guest is derived from a write operation performed by the guest itself,
Code and notes, including the ~16 hypotheses I had to retract along the way
Great work! I'm the guy that's working on recompiling the iPod games for modern systems (I'm mentioned by the top comment in your Reddit post). Have you tried installing the games in the emulator? If so, this would be a huge step in figuring out the DRM so people can dump their own games. That would lead to more games being supported in siggifly's 5.5G emulator [1] and eventually the games can be brought to more modern platforms.
I saw your work and I thought it was excellent; that's another step I want to take: being able to run the games and the cover flow! We're one step away from making the iPod free forever.
Do you remember if it was named Musika? [1] If so, that game has actually been decrypted so I could work on a recomp. There's also Phase [2] which seems like the more likely pick. Unfortunately, it was never decrypted. I modeled out the Metadata db structure that the iPod OS exposed to games that represented its iTunesDB so I should be able to support custom songs/albums in a recomp in the future. Long term, I'd love to be able to BYO API key for Spotify and expose your Spotify library to the game as your "iPod's" music. I feel like that would modernize the experience. I'll get there when work calms down and I'm no longer working 60 hour work weeks :(
I think one of us missed the sarcasm. Lots of people post compiled binaries to git, so you can't really use that as a "you shouldn't forget to mention LLM use because you shouldn't submit compiled binaries" because lots of people do it in order to use it as a distribution channel rather than requiring users to compile it themselves or requiring the author(s) to host the binaries elsewhere.
Hi, I wrote that note by hand; I didn't use Claude. The hypotheses were based on the fact that other emulations used different paths to reach the playback device. For example, I analyzed Rockbox to see how they managed to play music on this chip. I did use Claude and Gemini to investigate and create the emulator code
> One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download.
wInd3x can decrypt it.
> and the boot ROM cannot be read from the running device
Yes it can, you just need to turn on the right clock gate.
I'm so tired of AI slop. We've been reverse engineering these SoCs slowly and carefully for years, but this is what ends up getting published and shared.
We can all combine our own knowledge, enthusiasm, and AI to do amazing things. It's like using better computers with better processors. For programming, I could perfectly well use a PC from 2001.
I used AI, and I mention it in the post. I'm also an engineer at IBM, and I know a bit about operating systems and embedded systems, which helps me understand and decipher parts of the iPod. I also have a small workshop where I was able to repair an iPod that had been broken for a few years. The community is truly amazing, and it supported me in subsequent research such as freemyipod and https://github.com/devos50/qemu-ios
It's free_my_ipod and devos50 is not capitalized like (it makes no sense if you knew that it's a derivative of a last name).
You might say all these things but I can't see anything but disrespect if you can't even be bothered to spell the name of the involved project/people correctly.
Your work wouldn't exist in this shape without those who came in before you, and all you're doing is discouraging them (at least me) from ever publishing any code or research again.
I admire the entire community behind reverse engineering iPods. I'm active in various community channels, sharing information with them. I wouldn't be an engineer without using the tools and knowledge of those who came before me. The translator (I speak Spanish) changed the text a bit, and some words came out in all caps, but I've already corrected the names.Thanks to everyone for taking this to the next level!
One of the things that gave me a lot of trouble was unlocking the music player. Reverse engineering it was really difficult. I investigated many possible variations, tried searching on https://freemyipod.org for memory register information, but there was nothing for this particular iPod that could help me with the music player. Now I'm trying to unlock Cover Flow, which is something I really liked the first time I saw it on my iPod.
I didn't know that, it's a good fact. When I had my iPod 6G, that album art animation looked amazing.I haven't been able to unlock it because it has many upgrade directions that I haven't been able to decipher
I can imagine some people feel like it's cheating because they did it the hard way. I have much respect for those people and their skillset and I hope AI doesn't discourage them.
Yeah, I'm really pissed at all these car drivers doing marathons in 26 minutes because I've been working on it for years and can't get my time below 4 hrs.
Even though I used AI, it took me months to decipher parts of the emulation. I had to study, and I loved learning things I didn't know. It's also a very beautiful learning path; everything related to technology is magical. Engineers from all over the world are trying to revive the iPod and products that are no longer commercially available.
I think another problem is: vibecoded emulators (like this one seems to be?) are likely to be a stunt, a cool project, but will not be maintained. Upstreaming this to qemu requires at least some human effort, and it is not very likely to happen. So we are left with a cool trick.
Some communities are particular about maintaining cleanroom reverse-engineering (case in point: Portal 64 getting taken down for using Nintendo's leaked N64 SDK and not the OSS libdragon SDK) and are wary of people submitting AI-generated PRs without being able to account for their sources
Some improvements are still needed, but the idea is to run the original Apple firmware without modifications. I'd like to be able to run it on a Raspberry Pi Zero someday... a very thin layer will lift the iPod Classic 6G emulator
I've been developing a QEMU emulator for the iPod Classic 6G (Samsung S5L8702) that boots the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound. There were four different errors, and the last one was my fault in a way that I found amusing enough to write about.
For months I've been trying to emulate the iPod Classic 6G I have in my drawer, without success. After a long time, I finally managed to get it running, although it's still somewhat rough. In QEMU, I managed to boot the original, unmodified Apple retailOS. Navigation, the disc, the screen, and the music library worked for a while, but the music player appeared partially rendered and without sound.
One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download. I have an iPod Classic 6G from 2008. With the help of Claude Code, I was able to create code to extract it using emCORE. I extracted the contents of the flash memory and decrypted the image myself.
and the boot ROM cannot be read from the running device. I confirmed the latter the hard way, and along the way, my iPod restarted several times (pressing the center and menu buttons for 5 seconds to restart it).
There is no datasheet for the SoC. Each model register that allows unlocking some part of the guest is derived from a write operation performed by the guest itself,
Code and notes, including the ~16 hypotheses I had to retract along the way
Great work! I'm the guy that's working on recompiling the iPod games for modern systems (I'm mentioned by the top comment in your Reddit post). Have you tried installing the games in the emulator? If so, this would be a huge step in figuring out the DRM so people can dump their own games. That would lead to more games being supported in siggifly's 5.5G emulator [1] and eventually the games can be brought to more modern platforms.
[1] https://github.com/siggifly/ipod-emulator/ I made the PR that allowed it to run dumped games fwiw
I saw your work and I thought it was excellent; that's another step I want to take: being able to run the games and the cover flow! We're one step away from making the iPod free forever.
Oh nice! There were 2 games I loved playing on my iPod Nano I would love to try again
-Spore, basically the first phase of PC Spore game, was still fun though.
-This one game which was like guitar hero, but used the clickwheel and would automatically generate tracks from your songs.
Do you remember if it was named Musika? [1] If so, that game has actually been decrypted so I could work on a recomp. There's also Phase [2] which seems like the more likely pick. Unfortunately, it was never decrypted. I modeled out the Metadata db structure that the iPod OS exposed to games that represented its iTunesDB so I should be able to support custom songs/albums in a recomp in the future. Long term, I'd love to be able to BYO API key for Spotify and expose your Spotify library to the game as your "iPod's" music. I feel like that would modernize the experience. I'll get there when work calms down and I'm no longer working 60 hour work weeks :(
[1] https://www.youtube.com/watch?v=XfuF_i7N2M4
[2] https://www.youtube.com/watch?v=9scEk1_lQXc
> including the ~16 hypotheses I had to retract along the way
If you're going to paste raw claude output, please at least replace "I" with "Claude".
But that was the single hardest claim in the model register!
Really sounds like: If you’re going to paste raw executable binaries, please at least replace “I” with “the compiler”
More like, don't commit compiled executables to git.
Right, because no one does that.
Hence the equivalence.
I think one of us missed the sarcasm. Lots of people post compiled binaries to git, so you can't really use that as a "you shouldn't forget to mention LLM use because you shouldn't submit compiled binaries" because lots of people do it in order to use it as a distribution channel rather than requiring users to compile it themselves or requiring the author(s) to host the binaries elsewhere.
Lots of people paste LLM output into human discussion forums.
Or "if you're going to submit a comment, credit Tim Berners-Lee".
Hi, I wrote that note by hand; I didn't use Claude. The hypotheses were based on the fact that other emulations used different paths to reach the playback device. For example, I analyzed Rockbox to see how they managed to play music on this chip. I did use Claude and Gemini to investigate and create the emulator code
I, Claudius
> One thing we already know is that the firmware is from Apple and is encrypted, so there's no legal download.
wInd3x can decrypt it.
> and the boot ROM cannot be read from the running device
Yes it can, you just need to turn on the right clock gate.
I'm so tired of AI slop. We've been reverse engineering these SoCs slowly and carefully for years, but this is what ends up getting published and shared.
Careful now. Criticizing the slop machine is a great way to get harassed on this site
Humans doing work is soooo 2021. Only luddites and haters do that. /s
We can all combine our own knowledge, enthusiasm, and AI to do amazing things. It's like using better computers with better processors. For programming, I could perfectly well use a PC from 2001.
I used AI, and I mention it in the post. I'm also an engineer at IBM, and I know a bit about operating systems and embedded systems, which helps me understand and decipher parts of the iPod. I also have a small workshop where I was able to repair an iPod that had been broken for a few years. The community is truly amazing, and it supported me in subsequent research such as freemyipod and https://github.com/devos50/qemu-ios
And with all those credentials, you couldn't even be bothered to write an accurate summary? That makes it look worse, not better.
> FreeiPod and DevoS50/QEMU-iOS reply
It's free_my_ipod and devos50 is not capitalized like (it makes no sense if you knew that it's a derivative of a last name).
You might say all these things but I can't see anything but disrespect if you can't even be bothered to spell the name of the involved project/people correctly.
Your work wouldn't exist in this shape without those who came in before you, and all you're doing is discouraging them (at least me) from ever publishing any code or research again.
I admire the entire community behind reverse engineering iPods. I'm active in various community channels, sharing information with them. I wouldn't be an engineer without using the tools and knowledge of those who came before me. The translator (I speak Spanish) changed the text a bit, and some words came out in all caps, but I've already corrected the names.Thanks to everyone for taking this to the next level!
One of the things that gave me a lot of trouble was unlocking the music player. Reverse engineering it was really difficult. I investigated many possible variations, tried searching on https://freemyipod.org for memory register information, but there was nothing for this particular iPod that could help me with the music player. Now I'm trying to unlock Cover Flow, which is something I really liked the first time I saw it on my iPod.
CoverFlow originally was a 3rd party 'mod' that Apple bought at some point. My memory is hazy...
https://github.com/davidtphung/coverflow-media
https://512pixels.net/2023/10/the-history-of-cover-flow/
I didn't know that, it's a good fact. When I had my iPod 6G, that album art animation looked amazing.I haven't been able to unlock it because it has many upgrade directions that I haven't been able to decipher
It's a rarity to see a comments section in r/emulation that isn't just endless screaming about AI code
Why is it a problem? Sounds to me like emulation is a very good fit for AI.
I can imagine some people feel like it's cheating because they did it the hard way. I have much respect for those people and their skillset and I hope AI doesn't discourage them.
Hopefully as AI coding continues to improve they’ll come to view it like chess players do Stockfish
But playing chess is a game already.
Yeah, I'm really pissed at all these car drivers doing marathons in 26 minutes because I've been working on it for years and can't get my time below 4 hrs.
Even though I used AI, it took me months to decipher parts of the emulation. I had to study, and I loved learning things I didn't know. It's also a very beautiful learning path; everything related to technology is magical. Engineers from all over the world are trying to revive the iPod and products that are no longer commercially available.
They don't normally give a reason. Just picking a few random examples
https://old.reddit.com/r/emulation/comments/1wbapys/zevora_e... https://old.reddit.com/r/emulation/comments/1w8b6rk/ruzu_is_... https://old.reddit.com/r/emulation/comments/1vz9na6/pc_ports...
I think another problem is: vibecoded emulators (like this one seems to be?) are likely to be a stunt, a cool project, but will not be maintained. Upstreaming this to qemu requires at least some human effort, and it is not very likely to happen. So we are left with a cool trick.
Some communities are particular about maintaining cleanroom reverse-engineering (case in point: Portal 64 getting taken down for using Nintendo's leaked N64 SDK and not the OSS libdragon SDK) and are wary of people submitting AI-generated PRs without being able to account for their sources
Here are some details about how I made the iPod Classic 6G emulator and what I encountered along the way: https://x.com/DMonteroCrespo1/status/2095882094455009695
I was deep into customizing iPod firmware almost 20yrs ago in 7th grade or something.
Anyone looking for FW/IPSW https://www.felixbruns.de/iPod/firmware/
felixbruns.de that's a domain I haven't seen in ages (probably also like 20 years)
How close is the emulation to being usable as an actual music player?
Seems to be 100% implemented. Very cool
Some improvements are still needed, but the idea is to run the original Apple firmware without modifications. I'd like to be able to run it on a Raspberry Pi Zero someday... a very thin layer will lift the iPod Classic 6G emulator
An emulator for old iPhones would be even better. There were a ton of great paid games in that era before the app store just became a slop casino.
I think the community is very close to achieving it
https://www.reddit.com/r/programming/comments/1js8gqz/emulat...