I bought a broken Sonos PLAY:5 from Craigslist.
This site documents the (in-progress) debug of this unit.
Contact: Ben Gelb <ben.gelb@gmail.com>
Status Updates:
12/9 - Unit received
12/15 - Power topology diagram completed and power pins on connector identified. Missing 12V connection to several VRs and connector identified. Bad 2.5V LDO regulator identified.
12/20 - PORESET source identified (On-Semi NCP303 supervisor IC), SRESET and HRESET asserted every ~1.3 seconds (Software Watchdog). NOR Flash part is being accessed after each reboot. No accesses to the NAND flash by CPU (something wrong w/ bootloader in NOR flash?).
12/21 - JTAG hookup works, boundary scan allows toggling of IOs. Bootloader image dumped from NOR flash.
12/23 - NOR flash has a corruption pattern that is perturbed by temperature. Application of cool air to the NOR flash causes the readback to correct itself, and permits the bootloader to execute! Serial console access to bootloader is working. Nothing happens after bootloader attempts to access application image from NAND flash.