To hack or not to hack: Sony MZ-R 700 & MZ-R 900

Sony MZ-R 700, ATRAC 4.5

This is finally it: my last MiniDisc article for the time being. I really have enough units already, I love them dearly. No need to buy more. Anyway, today I´m gonna talk about hacking the firmware of certain MiniDisc recorders. Those devices (and many other) contain a microprocessor that can be programmed to include or exclude certain functions. You can use the same IC for several different units without the need to manufacture two seperate ICs or in other words: the higher the model stands in the line the more functions are enabled. Companies do this to save costs on manufacturing, also do get more revenue. More money equals more features, even if entry levels units would be able to do the same - that would render the flagship models moot of course. Take my Pioneer BDP-140: it shares many features with the higher and more expensive model, the BDP-440. On my entry level player however fewer functions are enabled, it lacks DVD-Audio playback for example. Would you know how to tweak the firmware of the BDP-140 you could in theory add the missing features: my less expensive unit would then have the features of the more expensive unit. This also applies to several MD recorders of mine, by hacking the firmware you can add several features normally reserved for the top-of-the-line models.

Sony MZ-R 900, ATRAC 4.5

The two units you can see above are a Sony MZ-R 700 and two Sony MZ-R 900. The former was a gift to me from one of our mates, he didn´t need it anymore and upon hearing about my passion for MD he decided to give it to me for free. That made me really happy because I love new gadgets to play around with and I also wanted to try hacking its firmware. The MZ-R 700 was released in January 2001 together with the entry level model from the same production line, the MZ-R 500. The flagship MZ-R 900 had been released six months prior and according to many people all over certain boards it wasn´t as technically advanced as the later models. Being the top model it was of course much more feature heavy but it supposedly still lacked the newest ATRAC chip. The MZ-R 700 & MZ-R 500 were equipped with ATRAC 4.5 DSP Type-R configured to use the worse ATRAC 4.5 simply because the top model was using it: the cheaper models weren´t allowed an encoding engine more sophisticated than the one from the top model. Another proof was that the successor of the MZ-R 500 - the MZ-R 501 - was using ATRAC 4.5 DSP Type-R (proudly advertising it) yet both were using the exact same ATRAC IC, the CXD2671-204GA (MZ-R 700: CXD2671-203GA -> same IC, different hardware revision).

ATRAC IC, Sony MZ-R 900

Knowing that fact many people subsequently hacked the MZ-R 500 / 700 into not only having more features but also to use the more advanced ATRAC instructions. This could be done safely since MZ-R 500 / 700 / 501 were basically the same models with different shells and finish. But all the while people left the MZ-R 900 alone, using only the older ATRAC configuration. As it turns out the MZ-R 900 also used the very same ATRAC IC that turned the lower models into such pristine recorders. Look at the picture directly above: it shows the ATRAC IC on the PCB of my silver MZ-R 900 (the fingerprint is not mine and now gone), the CXD2671-204GA. Today I also opened up my blue MZ-R 900 and guess what: I found the same chip again. That means that both of my MZ-R 900 are able to use the more advanced ATRAC DSP Type-R. So I decided to hack their firmware based on this guide here on sharoma.com.

Before we start to hack away a short disclaimer: I´m not responsible for any damage that might happen should you make something wrong. Firmware hacking can be an extremely powerful tool but it can also destroy your recorder completely! If your unit is dead after hacking its firmware don´t blame me, you are doing this on your own responsibility!

According to the Service Manual of the MZ-R 900 a less advanced hardware revision is in use, yet on the PCB itself the 204GA has been printed onto it (on both of my models)

Read this guide at least once before you actually start doing something. I also recommend reading the hints below it and to look at the pictures showing how the display looks. You finished reading? Then let´s start: first of all you have to enter the service mode on your unit. You have to remove any disc, you also have to make sure that it is sufficiently powered. I would add a fully charged battery as well as connecting it to the power supply. I also would unplug the remote as we will apply the hack by using the buttons on the unit itself.

1. To prepare for service mode switch the HOLD mode on.
2. Then hold down the VOL- button (just like the Shift key on your keyboard), then press the following combination quickly: » » « « » « » « then press PAUSE twice. Release the VOL- button. Should you have been successful the display of your recorder is now flashing its firmware version, my two MZ-R 900 were displaying V1.300 00 2.
3. Press VOL+ VOL- VOL- & Keisu 800 should be displayed ("Keisu" on the left, "800" on the right)
4. Press PLAY and then VOL+ five times
5. Press PLAY seven times. On the right you should now see 867 and on the left three rolling numbers and three steady values. Ignore the first.
6. Using the VOL+- keys change the value on the left to S67, then press PAUSE to save.
7. Press PLAY to go to the next register 868 (on the right), change the value on the left to S01, press PAUSE again to save.
8. Exit Service Mode by removing all the power from the unit.

You don´t need to hurry once you have enabled the Service Mode. Take your time, it´ll be much less unnerving. Also, you can always go back to the starting point (where it flashes the firmware) by pressing STOP repeatedly. Remember: pressing PAUSE always stores the value you have just changed. If you don´t press PAUSE nothing will be saved. After changing the values and leaving Service Mode you should enter it again to make sure you really have changed the two values. Should you have done something wrong or if you want to reset the changes here are the original values: for 867 it´s S00, for 868 it´s S20. Shouldn´t you trust my instructions please refer to the site where I took them from: www.sharoma.com/minidisc/hacking.htm.

Step 3 looks like this on the Display

Step 5 & 6 should look like this (the XXX indicates the rolling numbers)

Step 7 should look like this (XXX indicates rolling numbers)

Congratulations! If you have done it correctly you now have enabled ATRAC DSP Type-R on the Sony MZ-R 500, MZ-R 700 and MZ-R 900. I won´t tell you how to add more features to your unit, most of them are pointless anyway in my opinion. I was only interested in changing the ATRAC code... imagine: by hacking a firmware you can have better sound quality. I have not yet found any flaws, my three units still function perfectly. What? You want to know if changing some values really had an effect on ATRAC encoding quality? How lucky you are today, of course I anticipated this and therefore I´m going to present measurments to you (enlarge the pictures and scroll through them, that way you can see differences more easily)!

ATRAC 4.5 Total Harmonic Distortions from MZ-R 900 before hacking

Typical ATRAC 4.5 DSP Typ-R (MZ-N 510): less distortions all around

ATRAC IC of the MZ-R 900 after hacking: DSP Type-R performance!

Naturally all other measurments are the same. The 'attention-shifting' effect I described before also happened here. Are you surprised? I was, I now haven´t got any ATRAC 4.5 device left. I don´t care, naturally I´m gonna use ATRAC 4.5 DSP Type-R exclusively in the future. But one thing is curious: why didn´t Sony activate the most advanced ATRAC codec in the first place if the MZ-R 900 was already equipped with it? When it was released it was the only portable ATRAC 4.5 around (the predecessor probably used ATRAC 4.0) and Sony could have easily skipped an ATRAC generation, going straigt from ATRAC 4.0 to ATRAC 4.5 DSP Type-R. Why they didn´t do so is a mystery to me. Anyway, now I´m going to enjoy some music in pristine quality. Tata!

Sony MZ-R 700: it uses ATRAC DSP Type-R now,...

... as does this one and finally...

... so does this one. Wonderful!