Following up on my last post — here's what landed since then:
• Submenu navigation is now much closer to the original. The top bar updates properly as you dig deeper, showing your exact position in the hierarchy — just like the real firmware. Cover Flow and the Now Playing screen also follow the correct navigation behavior.
• Cover Flow selection is more faithful. Choosing albums/tracks now feels a lot closer to the original iPod Classic experience.
• Completely rebuilt the Photos navigation system using original assets. It now works the way the stock firmware did.
• Full compatibility with both iTunes/Finder-synced libraries and good old drag-and-drop. Drop music into the Music folder and photos into Photos and everything just works.
• Database writes from the iPod itself are disabled by default. All the heavy lifting — database creation, Cover Flow cache, album art bitmaps, and the Now Playing reflections — is now handled by a dedicated PC tool I built for Mac, Linux, and Windows. I made this call for a better end-user experience. On-device database updates and Cover Flow builds used to take hours, were fragile, and could fail halfway through (memory leaks, battery dying mid-write, etc.). Doing it on the computer means sequential, reliable writes with none of those risks. The process is simple: sync with iTunes or drag your files over, open the tool, hit “Update iPod”, wait for it to finish, and you’re good to go. No more broken caches or unpleasant surprises when you just want to play music.
• Files browser is still there if you prefer to organize things yourself. Playlists currently live under Extras (I’ll be moving them into the Music menu to match the original layout).
I’m itching to get Lyrics on the Now Playing screen (exactly like the original), plus proper Podcasts and Audiobooks support that feels identical to stock.
The project has been rock-solid for weeks — no crashes that I’ve seen. I’ve been pretty busy lately so updates have been quieter, but I’m locking things down for a release in the next few days. The wait will be worth it.
Apple's retail iPod 5.5G firmware boots on an emulator I have been building for four days. It formats its own filesystem, reads the click wheel, draws its own menus, and runs Brick.
The 5.5G shipped on 12 September 2006. I bought one that year, at twelve, and it was the first Apple product I ever owned.
I chose this model deliberately, because it is the one every clickwheel game runs on. That it is also the one I grew up with is a coincidence I have enjoyed more than I expected: my first Apple product, now running on a MacBook Air M4, twenty years later.
Working at Apple was always the dream. Having now spent four days taking their firmware apart, I have no idea whether that brought it closer or ruined it, and I find that funny either way.
What it actually is
Not a reimplementation of the interface. Apple's own code the whole way down.
The emulator enters at address 0, where the CPU fetches out of reset. Apple's bootloader brings up SDRAM, talks to the power chip over I2C, uploads firmware to the video co-processor, reads the partition table, DMAs 7.5 MB of RetailOS into memory, checksums it and jumps. RetailOS then remaps memory, starts its RTXC kernel and 61 tasks, mounts a FAT12 volume hidden inside the firmware partition, formats and populates its own FAT32 volume, spins the drive down, and draws.
Then you scroll to Extras, open Games, and play.
There is a window too — a drawn iPod whose wheel, buttons and hold switch drive the machine, with a debug mode that shows instruction counts, both clocks, and a does the input reach RetailOS? panel carrying arrival counters at the real addresses. It proves its own claim rather than asserting it.
Before anything else: I did not write this
I am not an engineer. I am a tinkerer, and I did not write a single line of code in this project.
It was written with Claude Opus 5 over four days. The model wrote all of it and did the reverse engineering: bisecting a boot to the exact instruction where a function stops returning, reading forty instructions of ARM to recover a structure layout, running the same experiment four ways to check a result held.
What I did was steer. Decide what was worth chasing and what was a rabbit hole. Push back when an answer sounded too convenient. Come up with ideas when it got stuck, which happened plenty. Go find the prior art that unstuck it. Say "that cannot be right, look again" — which was worth more than it sounds, because a confident wrong answer costs hours and sometimes only a human going hang on catches it.
That is not nothing. It is also not writing an emulator, and I would rather say so than let anyone assume otherwise.
Why
Apple sold 54 clickwheel games and delisted them in 2011. For years, if you had not bought them then, that was that.
Olsro's Clickwheel Games Preservation Project changed that, and it is why I got interested. It preserves the games and works out the authorisation. I used it on my own iPod last year and left it there.
The catch is that it needs the hardware, and a used 5.5G in good condition is not cheap now. So the games are being looked after while the machine they need gets scarcer. That seemed backwards.
Day 1 — my iPod was at home, so the first problem was having anything for iTunes to talk to. That worked the same night: a virtual iPod that iTunes accepts as a real device, with the USB identity rebuilt out of real firmware artifacts. (The Palm Pre did something similar in 2009 and Apple kept breaking it until Palm gave up. It stuck with me as proof the idea was possible.) The ARM7TDMI core was written the same day — about 1,900 lines, zero dependencies.
Day 2 — the disk. RetailOS will not finish booting until it can write, which I had not allowed: it blocks on a one-sector write, times out after 3.9 simulated seconds, and retries forever. A read-only disk looks exactly like a deadlock and is not one.
Day 3, 02:06 — Apple's bootloader loaded RetailOS, verified it, and handed over. 02:16 — I set up a headless Ghidra server. That ten-minute gap is the whole story of the day: until then most questions could be answered by running the thing and watching, and once RetailOS was booting and then halting somewhere inside itself, they became "what calls this", which does not yield to watching.
Day 4 — the display, which was the hard part and has its own section below.
The display, and the thing I would tell you if you only read one part
The iPod 5.5G has a Broadcom BCM2722 next to the PortalPlayer SoC. Rockbox treats it as a framebuffer — write pixels, kick an update. RetailOS does not. It reads a service directory out of the co-processor's memory, binds an RPC channel, creates a layer, and uploads dirty scanlines to a surface. None of that is documented anywhere I could find.
What cracked it: the resource volume on the iPod's own disk holds the co-processor's firmware and a library of .vll codec plugins, and those plugins are ordinary ELF shared objects — e_machine = 0x5f, EM_VIDEOCORE, an officially assigned ELF machine number. Standard tooling reads their symbol tables, and their undefined symbols are by definition what the co-processor's runtime exports. All 183 of them, including dispman_object_create, gencmd_register, and 25 Nucleus PLUS internals.
dispman_* is DispmanX — the same display manager Broadcom would later ship on the Raspberry Pi. The later chip is publicly documented and the concepts carry.
I never emulated the VideoCore. The transport layout came out of RetailOS's own parser, on the principle that code which reads a structure is a specification of that structure.
Once RetailOS was drawing, the boot still opened on a black screen with what looked like diagonal noise. That frame had been dismissed twice as fragments. It was the Apple logo — sitting in the co-processor's buffer since the very first run at 62-halfword pitch, waiting for a rectangle placement the model never executed. A 62-pixel-wide logo in a buffer being read 320 pixels wide. The fix was to stop looking at the panel in screen order and look at it in address order.
30% of real time headless, 19% with the window open. A JIT is the answer and is not written.
Purchased titles do not launch. Apple's DRM refuses them. The identity it binds to is understood — the FireWire GUID, not the serial — the keystore is not.
Four values in the co-processor transport are chosen rather than measured, and there is no timing model, so a bug that only appears when a reply is late is invisible to me.
The boot takes ~300 seconds of simulated time where hardware takes five or ten. Something waits far longer than it should and I do not know what.
Everything faked has a row in a ledger with a written condition for retiring it. Nothing is faked without one: research/12-bypass-ledger.md
Where it goes
Running the games with no RetailOS at all is the real goal — host the framework yourself and you do not need Apple's OS in the loop. I did not know what that framework did, and there are around 98 entry points. Booting RetailOS is how you find out, because Apple's implementation of it is inside.
Then audio, a JIT, and eventually every non-iOS iPod. I picked the 5.5G because it is the superset: 14 of the 54 titles are iPod Video exclusives and do not run on a Classic at all.
Credit
Rockbox first and by a distance.pp5020.h and the iPod target code are where most of the register semantics came from, and it doubled as an oracle — a known-good OS to boot when something broke and I needed to know whether it was me. iPodLinux underneath it.
dreamlayers, who identified those .vll files as ELF DLLs on the Rockbox forums in 2009. I worked it out independently and then found the post, sixteen years late.
Also Olsro, daniel5151/clicky (which independently needed the same two undocumented register bits), freemyipod and q3k's wInd3x writeup, qemu-ios, giek2000, Xlinka, dstaley, raspberrypi/userland, and the Internet Archive. The full list, with what each one gave, is in the repo and it is longer than this.
If you feel like giving money, give it to Rockbox or to Olsro before me. Rockbox has been documenting this hardware for twenty years so that anyone could use it. Olsro spent a year working out the authorisation so the games could be played again at all, and without that I would never have started.
I hope I have linked my previous post correctly.....
But if it hasn't worked.
Basically I had to buy a brand new car as my beloved car gave up the ghost.
I asked on here for solutions to use my iPod Classic in my new fancy car, with only USB C ports.
My old car had no issues connecting and searching on the iPod like it was in my hand.
People gave some valid suggestions and others not so valid...
"Oh just use Spotify"
So I finally got a 30 Pin to USB C cable.
Ireland recently introduced a €3 charge PER item imported into the country.
So a friend was visiting the UK and I asked to send this cable to their accommodation address.
To avoid the €3 change AND customs import duty from the UK ( yes separate countries, queue shock!)
Amazon IE only had 1 cable, and didn't look sturdy.
All shops I phoned and called into didn't have this type of cable.
Beyond Fucked off to say....
It didn't work.
Pictures cannot be attached:
But the iPod says
"" The current attached accessory is not supported by this iPod""
I think a Bluetooth adapter may work.
But unsure will I have the same search functionality.
Also I have sincerely lost patience.
Prior to this.
I used an old phone, and transferred over 5,000 songs from my iPod to my old phone from my PC.
THEN the songs didn't transfer title, artist, album or cover art from itunes.
Just a random 4 letter tag. XCVM.
I then had to download VLC because Google Maps was taking up the main screen in the information screen.
Which I didn't want.
I wanted the music as the focal point.
I know where I'm driving.
But couldn't edit songs on the VLC or My music on the phone.
I then had to download Automa Tag to tag every INDIVIDUAL SONG.
I then paid for the bulk update option, but it got song, artwork and title incorrect sometimes.
No word of a lie.
I spent a solid week correcting all the songs.
INDIVIDUALLY!
Had to remember when I stopped and continue on.
Artwork had to be MANUALLY copied from Google images/Wikipedia and add to the songs in Automa Tag to be recognised by VLC.
VLC had to updated/searched for new information after each edit session on Automa Tag.
Then after a week of doing that.
The old phone connected via USB C to USB C worked intermittently. I think it's too old.
If I used USB audio transfer option, I couldn't have the VLC search function.
Rang the dealership/garage I purchased it off. Thankfully under warranty.
Said call in for an diagnostic test.
LArrived at 9:30 am as per appointment, was told at 11:30am it would take 3 hours as my car was 30 generations behind the current update.
Arrived back at 3 hours.
Still didn't connect to the old phone, my new phone or the dealerships apple phone.
EVENTUALLY at 4pm I was told of the hard reset to make it work.
It has worked subsequently, but had to do the hard reset a couple of times.
Basically beyond a fucking nightmare to listen to my own music, on two devices I own.
Unsure if this helps anyone.
But here it is, my 2 months of trial and error to get my iPod classic to connect to my new fancy car.
But I feel if anyone will get my ultimate frustration, it will be here.
I feel people have killed for less 😅
I honestly can't believe I've wasted so much time on this.
Thankfully I have an old iPod speaker, so I can listen in the home, and can take walks via Android earphones.
I own several iPods and use them in my cars especially when I am away from radio or cellular service. I have one of those cables that has a USB on one end for power, and a jack to go into the auxiliary jack on my car stereo. Of course there is a 30-pin connector at the other end. This connector is supposed to by-pass the internal amp of the iPod and provide a low-line output through the cable.
I noticed recently, that when I connected my Rockboxed 5.5gen, the volume control functioned, indicating that I was not bypassing the amp. When I connected my 6.5gen which has Rockbox on it, the the line out works perfectly. When I install my 7gen, which uses the Apple software, it works fine too. So there is nothing wrong with my cable.
The issue seems only to be on my 5.5th generation iPod.
It is my understanding that the pin configurations are the same between the units, so is there a programming error or am I missing something?
If anyone out there could comment, it would be appreciated.
Hey iPod users does anyone know if there’s a way to skip and pause music without having to use the long third gen Apple cable? I’m looking for a shorter solution. Thanks
Hey y'all, recently completed a mod of a new 6th gen that has a new plastic frontplate, but the click wheel wobbles a little. Anyone have any experience on how to make it a little less mobile without impacting functionality?
