A while ago I wrote about my early experiments with modifying the firmware of the Sony MZ-RH1, mainly driven by one long-standing annoyance: not being able to see track titles on the unit itself during playback. That post demonstrated a proof-of-concept, which was not ready for release.

This time, things are a bit more serious. I’ve now completed the first public release of custom firmware for the MZ-RH1!

Track titles on the OLEDs

The headline feature is exactly what started this whole journey: You can now see track titles directly on the RH1’s OLED displays during playback, without needing the remote.

This works for both standard MD and Hi-MD discs. Seeing titles scroll by on the main unit for the first time feels incredibly “right” - like this is how the device was always meant to work.

There are, however, some limitations:

The display controller only supports Latin characters, which is a hardware limitation we can’t bypass in software. Sometimes it is hard to understand Sony…

For MD discs that use half-width Katakana, the firmware will display a romanized version of the track name instead.

I know that this is not ideal, but it’s a step up from relying entirely on the remote.

Track control without the remote

Another quality-of-life improvement: We now have basic track control options in the main unit menu, including things like repeat and shuffle modes - features that were previously only accessible through the remote.

The goal here is to make the RH1 feel more self-contained and less like it’s missing half its brain when the remote isn’t plugged in (again, thanks Sony…).

Why this took a while

Getting features working was only half the battle. The other half was making sure people can actually install this firmware without turning their RH1 into a paperweight.

The original Sony firmware does not include any official firmware flashing functionality. To make this possible, I had to reverse engineer the undocumented flash interface of the CXD2687, figure out how to correctly unlock it, erase sectors, and safely rewrite them.

On top of that, I built an as-safe-as-possible WebUSB-based installer. The installer performs extensive validation before and during flashing to minimize the risk of corruption. A lot of the development time went into testing edge cases and, yes, nervously experimenting on my own devices first :P

Recovery

One of the biggest breakthroughs during this project didn’t just make the custom firmware possible - it also made it far less scary.

I’ve identified working JTAG access on the RH1, and even more importantly, discovered a boot ROM mode that can be enabled by bridging two GPIO lines on the mainboard (HSALF / TP8232 / R853 and WDT / SL901) to ground.

Concretely, the boot ROM allows us to take control of the MCU over USB and execute our own flashing code, which means we now have a practical way to recover devices that would otherwise be considered bricked. I was so happy when I discovered this, as it allowed me to recover one of my RH1’s that I bricked during testing, and also be much more risky in my tests. This feature got used quite a lot in my testing, and because of it I was able to make significant progress.

In other words: we now have a small safety net.

What’s next

This release is just a foundation, solving two major issues that I had. There are many more firmware improvements I want to explore - usability tweaks, deeper control, and features that make the RH1 feel even more like the high-end recorder it always deserved to be. Of course, doing this takes time, and as I’m busy with other projects, you might have to wait.

To avoid myself being a bottleneck, I’ve released all my code and work as open source. This enables others to contributed, or even make their own firmware.

It’s been a long road from “wouldn’t it be nice if…” to actually running custom code on this thing, but we’re finally here.

Have a wonderful MD-day,
Jim

Links

• Programming Tool: MZ-RH1 WebUSB Flasher
• Custom Firmware Build: fw_rh1_1.1r3.bin
• Source Code: GitHub

Thank you!