A while ago I wrote about my early experiments with modifying the firmware of the Sony MZ-RH1, mainly driven by one long-standing annoyance: not being able to see track titles on the unit itself during playback. That post demonstrated a proof-of-concept, which was not ready for release.
This time, things are a bit more serious. I’ve now completed the first public release of custom firmware for the MZ-RH1!
The headline feature is exactly what started this whole journey: You can now see track titles directly on the RH1’s OLED displays during playback, without needing the remote.
This works for both standard MD and Hi-MD discs. Seeing titles scroll by on the main unit also feels incredibly right; to me this is how the device was always meant to work.
There are, however, some limitations:
The display controller only supports Latin characters, which is a hardware limitation we can’t bypass in software. Sometimes it is hard to understand Sony…
As a compromise, for MD discs that use half-width Katakana, the firmware will display a romanized version of the track name instead. I know that this is not ideal, but it’s a step up from relying entirely on the remote.
A small quality-of-life improvement: We now have basic track control options in the main unit menu, including things like repeat and shuffle modes - features that were previously only accessible through the remote.
The goal here is to make the RH1 feel more self-contained and less like it’s missing half its brain when the remote isn’t plugged in (again, thanks Sony…).
Getting features working was only half the work. The other half was making sure people can actually install this firmware without turning their RH1 into bricks.
The original Sony firmware does not include any official firmware flashing functionality. To make this possible, I had to reverse engineer the undocumented flash interface of the CXD2687, figure out how to correctly unlock it, erase sectors, and safely rewrite them.
To help people upgrade, I built an easy-to-use WebUSB-based installer (linked on the bottom of this post). The installer performs extensive validation before and after flashing to minimize the risk of corruption. A lot of the development time went into testing edge cases and, yes, nervously experimenting on my own devices first :P
One of the biggest breakthroughs I had during this project helped make custom firmware far less scary.
I’ve identified working JTAG access on the RH1, and even more importantly, discovered a boot ROM mode that can be enabled by bridging two GPIO lines on the mainboard (HSALF / TP8232 / R853 and WDT / SL901) to ground.
Concretely, the boot ROM allows us to take control of the MCU over USB and execute our own flashing code, which means we now have a practical way to recover devices that would otherwise be considered bricked. I was so happy when I discovered this, as it allowed me to recover one of my RH1’s that I bricked during testing, and also be much more risky in my tests. This feature got used quite a lot in my testing, and because of it I was able to make significant progress.
In other words: we have a small safety net.
This release is just a foundation, solving two major issues that I had. There are many more firmware improvements I want to explore - usability tweaks, deeper control, and features that make the RH1 feel even more like the high-end recorder it always deserved to be. Of course, doing this takes time, and as I’m busy with other projects, you might have to wait.
To avoid myself being a bottleneck, I’ve released all my code and work as open source. This enables others to contributed, or even make their own firmware.
It’s been a long road from “wouldn’t it be nice if…” to actually running custom code on this thing, but we’re finally here.
Have a wonderful MD-day,
Jim
Thank you!