Dell Digital Jukebox

[LambdaCalculus]

I may not be much of a real coder yet (I'm still a padawan   ), but I can at least be one hell of an information ferret.

I recently purchased a 1st generation Dell Digital Jukebox from eBay for pocket change. The DJ has a bad hard drive, but I can easily fix it. Anyways, seeing as how the TMS320 and its derivatives seem to be a big topic going around due to the Creative ZEN Vision:M port, I had a notion:

Once one TMS320-based device is up and running, how hard would it be to bring in more devices that use the same family of CPUs?

Despite being branded by (ugh) Dell, the Digital Jukeboxes were rather interesting devices. Basically a rebadged Creative ZEN, the Dell DJs had most of the same features as Creative's early players, but with some cosmetic changes.

I'm currently trying to gather up as much information about the hardware as I can, but I wanted to know if anyone else would be interested in seeing the Dell DJ become a proud new addition to the family.

[JdGordon]

I think the tms320 ports will all be similar to the portalplayer ones, most of the firmware code will be the same with various changes to suit to specific model

[LambdaCalculus]

Very true, I say. Once the core works, we can just build around it.

The only problem I'm having now is that the Dell DJ's drive is toast, but like I said, a friend of mine has a replacement waiting for me which I'll be picking up later this week. And I'm on the verge of banging my head on a brick wall trying to mount the drive on a Windows box; the bloody thing needs a driver from Dell. Only thing is, however, that the driver doesn't do anything.

Once I finish fixing up my laptop, I'm going to see if I can mount it and at least start gathering the partition table for the hard drive... it's the least I can do right now.

[LambdaCalculus]

I just managed to get the Dell DJ back up and running. I'm currently looking for the data sheets for the hardware in the device. I should have a wiki up for it soon enough... and hopefully faster than the Archos AV1XX page.  

Can anyone else help supply a little extra information about the Dell DJ? I am looking for information about the Generation 2 and the DJ Pocket, specifically.

[LambdaCalculus]

First findings on my Dell DJ; sorry for multiple posts in a row, guys.

Hooked the DJ to my Linux laptop and ran lsusb -v on it. Here's the results:

   
Bus 005 Device 003: ID 041e:4111 Creative Technology, Ltd Dell Digital Jukebox
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass       255 Vendor Specific Subclass
  bDeviceProtocol       255 Vendor Specific Protocol
  bMaxPacketSize0        64
  idVendor           0x041e Creative Technology, Ltd
  idProduct          0x4111 Dell Digital Jukebox
  bcdDevice            0.01
  iManufacturer           1 Creative Technology
  iProduct                2 Dell Digital Jukebox
  iSerial                 3 010125511E038C01
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          4 Media
    bmAttributes         0xc0
      Self Powered
    MaxPower              440mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              5 PDE1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass       255 Vendor Specific Subclass
  bDeviceProtocol       255 Vendor Specific Protocol
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)

More to come, including that bloody wiki page...

[Bagder]

Interesting stuff to figure out, apart from the PCB scans etc is the upgrade firmware file format.

Also, for everything DM320-based it is worth checking out the Archopen project since they have code actually running already on (Archos) DM320-based targets. I've seen claims they even have sound going (through the DSP that accesses the DAC).

Oh. and of course there's also Neuros OSD that is open source on DM320 hardware, although of course all the really tasty parts aren't open at all...

There is "leaked" DM320 docs out there.

[LambdaCalculus]

I'm going to download the firmware updates from Dell and post them on the wiki page when it goes up.

I'm also reading up on Archopen, and I did download the source for it. But it may be some time before I can get any real work done because of school and work. I'll keep you guys posted.

(EDIT-2007/09/01): The (very preliminary) wiki page is up and running here:

http://www.rockbox.org/twiki/bin/view/Main/DellDJPort

(EDIT-2007/09/07): I just spent my entire lunch hour opening up the entire Dell DJ. I'm going to try and get some pictures and scans of the components later on this weekend.

[wesmo]

I've been interested in getting a zen xtra port together - if youve looked at the zen touch wiki page (http://www.rockbox.org/twiki/bin/view/Main/CreativeZenTouch) you'll notice that all of the information there is relevant to the dell dj port (considering they are all njb 3 players).
It's possible I could get hold of another Zen Xtra and donote it to rockbox if there are some developers interested??

 Most of the work on the zen vision port (http://forums.rockbox.org/index.php?topic=3320.0) should be relevant too - since the playsforsure firmwares that were available are similar.

[LambdaCalculus]

What I have found is that Creative seems to have kept consistency with their players. When I removed the hard drive from the Dell DJ and plugged it in, it boots into a Rescue Mode, with options to format the hard drive, reload the firmware, check the hard drive for errors (if it's present), or reboot the device. This is very similar to some of the other Creative DAPs.

But it's very hard to navigate the Rescue Mode on the Dell DJ with a bare PCB, because the scroll barrel on the DJ is mounted on the inside of the front case, with small gold contacts that touch five points on the scroll pad. I think it has to maintain a certain amount of contact in order for the barrel to work, but it's hard to hold it down while you've got a bare board. I'll keep trying.

In the meantime, I'll give you the link to the Dell DJ wiki page:

http://www.rockbox.org/twiki/bin/view/Main/DellDJPort

If you have any good info about the DJ, feel free to add it to the page!

[zook]

I've been looking at the firmware of various Zen players and discovered something which holds true for the Dell DJ as well.
The FRESCUE segment of the DellDJ_1_20_03.exe firmware is completely unprotected and I've discovered how the contents is mapped into memory.
The FRESUCE segment starts with a header:

Code: [Select]

struct R_HEADER {
    BYTE  Tag[4]; // "CODE"
    DWORD Size; // Length of segment, excluding header.
};It's followed by a DWORD which I'm not certain what is. It could be an entry point but I haven't remapped my disassembly yet, so I'm not certain.
Then comes an array of section objects:

Code: [Select]

struct R_SECTION {
    DWORD Address;              // The address which Content get's read to.
    DWORD RawSize;             // The size of the data to read.
    DWORD MappedSize;       // Not certain about this one. Sometimes it's larger than RawSize, other's it's less.
                                            // My guess it's used to allocate more memory than is present in Content.
    BYTE      Content[RawSize]; // This is the data that get's copied to Address.
};
It's worth noting that if you're using IDA you need to select TMS320C55x as processor type. However, there's probably half a dozen of instructions which it doesn't recognize. Such as: ec318e0033e8             AMAR *(#033e8h),XAR0

I've also been looking at TI's Code Composer Studio, which is what the firmware is most likely written in.
The entry point function of any given project contains a unique signature which I've been able to locate within the firmware. I'm not certain if posting disassembly is allowed on the board, so I'll just point you towards the function _c_int00. This function is responsible of intiailizing the environment and calling the 'main' function of your project.

[LambdaCalculus]

Excellent!! No protection to hassle with means that we shouldn't have much trouble alternate firmware to work.

zook, can you add this info to the wiki?

[zook]

Excellent!! No protection to hassle with means that we shouldn't have much trouble alternate firmware to work.

zook, can you add this info to the wiki?

Sure. I'll have to think about how to best arrange it. The information applies to select versions of the Dell DJ, Zen Micro, Zen Touch and Zen Xtra. So we'll probably need a shared page with information about the firmware in these models.

I've written a loader plugin for IDA, which handles the FRESCUE address mappings.
And I'm currently working on fixing the TMS320C55 processor plugin. As it turns out it's actually missing 14 instructions out of 393, so there's a bit of work in determining what needs to be added.
Once that is done I'll have a go at producing signatures from the TI libraries, which the firmware uses.
This should give us a good basis for exploring the rescue mode software. I'll add source and binaries to the wiki when I get so far.

Now, I should probably add that I own neither of these models (or any other for that matter). I'm hoping that looking into these will shed some light on what happens in the new versions. Most of the models introduce the NULL signature block, in their later firmware revisions, which is what is holding back progress on the Vision:M. So the entrance into the protected firmware must lie within the unprotected ones. I'll of course share whatever relevant bit's I discover but ultimately my focus is towards the newer models.

[LambdaCalculus]

zook: Here's the Dell DJ wiki page: http://www.rockbox.org/twiki/bin/view/Main/DellDJPort

[mcuelenaere]

Hi zook,
could you share your IDA loader plugin because I'm having trouble identifying the FRESCUE address mappings.
The only things I discovered are the two blocks (CODE & CENC) and a lot of strings.

[zook]

zook: Here's the Dell DJ wiki page: http://www.rockbox.org/twiki/bin/view/Main/DellDJPort

Right. I just got permission's, so I'll have a look at getting the info added.

Hi zook,
could you share your IDA loader plugin because I'm having trouble identifying the FRESCUE address mappings.
The only things I discovered are the two blocks (CODE & CENC) and a lot of strings.

Sure. Here's the source and a binary built for 5.0: http://www.mediafire.com/?ftddmjbxzsn
If you need to build it for another version, you'll have to extract it to the \sdk\ldr\ directory.
It only works for big-endian models right now. There's no point supporting the little-endian's right now, as they're all protected.
The firmware's that I've tested it with so far are:
DellDJ_1_20_03.exe
ZenMicro_PCFW_L4_2_00_12_MTP.exe
ZenTouch_PCFW_L4_1_01_03.exe
ZenXtra_PCFW_LA_1_20_08.exe

There's two things to be aware of once you get a firmware loaded:
1) The following two instructions are not supported by the disassembler (I'm working on that, though):
  10010000 XSSSXDDD          MOV  xsrc, xdst
  11101100 AAAAAAAI XDDD1110 AMAR Smem, XAdst
2) There's an ISR table of 32 entries starting at address 0x200. Each entry consist of 8 bytes. It starts with a status byte(IIRC) then a 24-bit address of the ISR handler, and 4 filler bytes.
The first entry is the reset handler and it points to the function named _c_int00 (in the TI source), this is the starting point of the rescue mode software.