Rockbox Development > New Ports
ZEN V/V Plus
mcuelenaere:
--- Quote from: bughunter2 on August 23, 2008, 05:13:31 AM ---Well, I didn't do much besides the few times you and me chatted about reversing with IDA, but I'm willing to give it another shot ;)
So, after we get the LCD (and some other things?) working we could use parts of the ported Linux kernel?
--- End quote ---
Yes, that's how I should do it: try to get some output going on (most of the times this is the LCD because serial/JTAG is hard to find) and then go on with the rest.
One problem could be that the Zen V uses NAND flash and the structure of it hasn't been figured out yet (perhaps this is the same as the (NOR) flash dump of the ZVM?), but before you'll get there, there's still a long road to go :)
MarcGuay:
An elementary wiki page can now be found here: http://www.rockbox.org/twiki/bin/view/Main/CreativeZenV.
mcuelenaere:
I read this on epiZENter and wondered if there's another way to trigger this HW 'rescue' mode?
Perhaps (similar to the e200v2 models), this mode can be triggered when temporarily short-cutting the NAND flash chip..
If this would be true, this could perhaps make it possible to dump the ROM (if available) or NAND chip directly through USB (if someone could figure out the USB protocol).
Don't get me wrong: it is entirely possible to upload custom code to _all_ Zen players without any problem (see CreativeZVMPort wiki for more info on that), but this could make it possible to dump the NAND flash and/or other stuff.
edit:
@MarcGuay: where did you get that LCD information from?
MarcGuay:
I found a way to get to the STMP3600 hardware recovery mode: remove the battery and connect to USB. Someone wrote a firmware extractor for the 3400/3500 series but I can't find the code for it. In other news, I finally took a peak at the ZenUtils and found a few interesting differences in the Zen V firmware. It looks as though FBOOT has been replaced by a very short file called FBCB which contains the strings "STMP", "BCB2", and "CACA" (either an inside joke or a coincidence). Presumably this is because the Zen V bootloader exists in the STMP ROM and not on flash. Some details of the ROM structure can be found in the Sigmatel Linux docs, I believe.
mcuelenaere:
--- Quote from: MarcGuay on September 23, 2008, 03:53:36 PM ---I found a way to get to the STMP3600 hardware recovery mode: remove the battery and connect to USB. Someone wrote a firmware extractor for the 3400/3500 series but I can't find the code for it. In other news, I finally took a peak at the ZenUtils and found a few interesting differences in the Zen V firmware. It looks as though FBOOT has been replaced by a very short file called FBCB which contains the strings "STMP", "BCB2", and "CACA" (either an inside joke or a coincidence). Presumably this is because the Zen V bootloader exists in the STMP ROM and on flash. Some details of the ROM structure can be found in the Sigmatel Linux docs, I believe.
--- End quote ---
About those strings, those are all common to Creative. I recognize the CACA from the Creative ZVM flash dump/FBOOT block (perhaps BCB2 too, I don't remember that one though).
Probably this bootloader is one of the first code to get runned upon device start-up (as is FBOOT on the ZVM) and it'll load either FRESC or Hjukebox2.jrm (depends whether the specific keys are hold or not).
Navigation
[0] Message Index
[#] Next page
[*] Previous page
Go to full version