HiMDMusicTransferforMac

The transfer-software for HiMD under MacOS-X supports the following MD-Walkman:

MZ- RH1/DH10P/RH10/RH910/RH710

and can be downloaded here:

http://support.sony-europe.com/dna/downloads/downloads.aspx?l=en&f=MT

This software could help developing a Linux-software by analyzing the code of the transfer-program which is only about 1,5 Mbytes in binary. It appears that only the binary "HiMD Music Transfer" itself is necessary to communicate with the HiMD-Walkman, so the code to be analyzed is very few. The additional program "HiMD Monitor" is obviously only necessary to monitor whether a HiMD-Walkman is connected to the Mac and create a shortcut-link on the desktop to the transfer program once the walkman is connected.

The software is a PPC-binary and contains much more functionality in its code than the GUI provides. For example, the code contains functions to format a HiMD or to encode ATRAC3-files, even though the GUI does not provide any functionality for that. Furthermore the code contains all symbols and is not secured against disassembling like the Windows-software SonicStage with its ocm-files. Loading the transfer-program into IDA Pro Advanced (with PPC-support) one gets huge information regarding the functionality of the software. Unfortunately there isn't any NetMD-functionality, which probably comes from the fact that NetMD uses it's own USB-protocol and thus requires also it's own driver.

The code does not use the system supplied USB mass storage driver to access the HiMD device, but uses an internal implementation of the FAT file system. Interestingly, while some SCSI commands are standard, the read(12) and write(12) commands are replaced by the vendor-specific commands C0 (let's call it magic read) and C1 (magic write) for data access. It has not yet been tested whether standard read and magic read return the same data for the same sector.

The software contains a blacklist to allow PCM-upload for specific models only (the MZ-RH10 is blacklisted for example). It has not been verified though whether removing the MZ-RH10 from the blacklist by patching the binary will allow full PCM-upload. A patched binary can be found here: himdtransfermac_patched.gz.

Here a list of the C++-classes of the HiMD-code:

• CHiMDUtilityBase: Base class for CHiMDFileSystem using classes
• CHiMDMedium: Represents a specific HiMD medium. Each medium has a specific Disc ID which is obtained using a proprietary command
• CHiMDIo: Subclass of CSonyScsiIO, contains HiMD specific SCSI commands
• CHiMDFindFile: Represents the state of a search in the CHiMDFileSystem
• CHiMDFileUtil: Class of nice helper functions on the CHiMDFileSystem
• CHiMDFileSystem: Implementation of the FAT system (FAT16, 2k sectors) used on the MD
• CHiMDFile: Represents an open file on the FAT system
• CHiMDDeviceManager
• CHiMDDevice: Represents a HiMD device, which might contain a HiMDMedium. The Medium should have a HiMDFileSystem.

The goal here is to fully understand the C++-code which contains the HiMD-functionality and reimplement the code in C/C++ again. That code would reside inside a library called "libhimd" which then can be used from a simple Qt-based GUI to provide the functionality (and beyond :)) of "HiMD Transfer for Mac" on all platforms which support Qt.

The following will try to explain in detail how the software works (incomplete).

1. Unmount the MiniDisc within MacOSX (the Disk-icon of the MiniDisc vanishes from desktop)
2. Read disk-id and DES-encryption key from disk to generate key for block-encryption
3. Fetch a 16kByte block of the source MP3 and encrypt it with some 3DES-like encryption, write into a 32kByte Buffer
4. Fetch another 16kByte block, encrypt, write to the buffer and flush it
5. Write the buffer to disk using special SCSI write-commands
6. Repeat previous 3 commands until MP3 is written to disk
7. Decode idv3-Tag from MP3 and create track-info and write to disk
8. Once the application is closed, mount the disk in MacOS again (Icon reappars on desktop)

1. Unmount the MiniDisc within MacOSX (the Disk-icon of the MiniDisc vanishes from desktop)
2. Convert input WAV-file to PCM used on HiMD (byte-swap etc)
3. Download track onto disk with probably 16kByte blocks
4. Prompt user to reload medium or disconnect/reconnect Walkman so that the Walkman calculates and writes MAC for new tracks
5. Once the application is closed, mount the disk in MacOS again (Icon reappars on desktop)

Output of himdtest before and after medium reload:

before:

minimac2:MacOS zedv$ ./himdtest /Volumes/NO\ NAME/ tracks verbose 
   1: 3:57 LPCM Unknown artist:Outkast - Hey Ya (Unknown album 0)
       0@03428 .. 254@05992
     Key: 0000000000000000; MAC: 0000000000000000

after:

minimac2:MacOS zedv$ ./himdtest /Volumes/NO\ NAME/ tracks verbose
   1: 3:57 LPCM Unknown artist:Outkast - Hey Ya (Unknown album 0)
       0@03428 .. 254@05992
     Key: 0000000000000000; MAC: 178a45ac2d1978c8

http://forums.minidisc.org/index.php?showtopic=6509&hl=sniff - A report on sniffing USB-I/O of a HiMD-Walkman

[2405910.685270] usb 2-9: new full speed USB device using ohci_hcd and address 5
[2405910.918600] usb 2-9: configuration #1 chosen from 1 choice
[2405910.926599] scsi18 : SCSI emulation for USB Mass Storage devices
[2405910.926599] usb-storage: device found at 5
[2405910.926599] usb-storage: waiting for device to settle before scanning
[2405910.926599] usb 2-9: New USB device found, idVendor=054c, idProduct=021a
[2405910.926599] usb 2-9: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[2405910.926599] usb 2-9: Product: Hi-MD
[2405910.926599] usb 2-9: Manufacturer: Sony
[2405910.926599] usb 2-9: SerialNumber: 02000102A36E
[2405916.130872] usb-storage: device scan complete
[2405916.135091] scsi 18:0:0:0: Direct-Access     SONY     Hi-MD WALKMAN    1000 PQ: 0 ANSI: 0 CCS
[2405916.147196] sd 18:0:0:0: [sdf] 149373 2048-byte hardware sectors (306 MB)
[2405916.154210] sd 18:0:0:0: [sdf] Write Protect is off
[2405916.154216] sd 18:0:0:0: [sdf] Mode Sense: 00 2a 05 00
[2405916.154220] sd 18:0:0:0: [sdf] Assuming drive cache: write through
[2405916.181629] sd 18:0:0:0: [sdf] 149373 2048-byte hardware sectors (306 MB)
[2405916.187352] sd 18:0:0:0: [sdf] Write Protect is off
[2405916.187359] sd 18:0:0:0: [sdf] Mode Sense: 00 2a 05 00
[2405916.187362] sd 18:0:0:0: [sdf] Assuming drive cache: write through
[2405916.187368]  sdf: unknown partition table
[2405916.302773] sd 18:0:0:0: [sdf] Attached SCSI removable disk
[2405916.302773] sd 18:0:0:0: Attached scsi generic sg5 type 0
[2406419.909323] usb 2-9: USB disconnect, address 5