Creative Zen Vision:M

[ssjmichael]

Hi, my name is Michael. I'm the admin over at epiZENter.net, a new and very popular Creative fansite. There's been a great deal of interest for rockbox on the Zen Vision:M. I just want to ask directly to all rockbox members whether the Vision:M is really capable of being rockbox'd.

I've read through a few threads and other forums, and the consensus seems to be, that TI doesn't really reveal their documentation, and there are no free compilers available for the TMS320 DSP. Now is this the nail on the coffin, or is there a way around this?

Someone mentioned this and I want to know if it holds any relevance to the free compiler issue:

The TMS320DM320 is a dual core ARM9/DSP chip. The ARM part of it can be targeted by an ARM compiler. The Cowon A2 also uses the TMS320DM320 chipset and has a GPL Linux firmware. You can download the source code from Cowon's website. They don't mention that you need any commercial compilers to build the firmware from the sources... Maybe the RockBox folks should have a look at that source code...

Now we will be gathering money to get a test player, which will be opened up and scanned. What we lack are people with knowlege. We are willing to send the player to someone who is willing to devote their time to helping us, but only if people here feel the Vision:M has any chance of getting cracked.

If you want to help us, please join us in discussion at epiZENter.net. Thank you.

[LinusN]

The problem is not the ARM core, it's the MS320 DSP core, which we will need to program to play audio. If we are lucky, we won't have to write much DSP code, so we may get by writing in assembly language.

Before you waste your money, find out as much as you can about programming this chip.

[Bagder]

The DSP part is clearly the trouble in this beast and it takes more research on how exactly that is needed or even if it is needed for this particular player.

I'd guess that investigating Neuros newest players and their source code would indeed be helpful too.

But yes, I firmly believe this player can be reprogrammed and get Rockboxed, but it will take a serious amount of time and effort by skilled people.

And a last advice: if you want help and assistance from Rockbox developers, you should come here and not try to get us to visist yet another random forum somewhere else.

[ssjmichael]

Thanks. I will be visitng here quite often. That invitation was for other Vision:M owners to read up on our discussion over at epizenter in order to get as much support as possible for our players. Sorry, should've been more specific.

I do wish I knew more about this stuff, or someone over there knew something, but I will try my best to read info over here and look for the neuros source code, etc...

[saratoga]

Do we have any idea what the DSP is used for?  Looking at the doc's on TI's site, it looks to be fairly FPU heavy, something thats not too important for audio.  It may be that they just use it for video, or mostly for video. 

If thats the case, then you could get by with just assembly, since you'd hopefully not need it for anything important. 

I don't suppose anyone has had the courage to try and dissassemble creative's firmware and see what they do?

[Bagder]

The ARM core certainly is powerful enough to drive audio-only codecs fine on its own. The DSP is only really necessary to use for video. Possibly it is good to use for audio too to get the power consumption to a lower level.

But in the Neuros case and with their DM320 chip (I don't know if there even exist different versions, but I can't exclude that risk) the DAC is controlled by the DSP core so there cannot be any sound without at least some basic DSP code that gets PCM data from the ARM. But again, I'm  not sure if that is truly a chip limitation or something they opted to go with.

And yes, reverse engineering will reveal lots of stuff but the DSP code will of course require its own challenge of DSP-specific reverse engineering.

To compare with Neuros again, they intend to have a binary blob of DSP code in the ARM side that the ARM will program the DSP with at boot and if the other TMS320 systems are any similar they too have "binary blobs" in there and if so it might be able to extract them from the firmware and use them as black boxes the same way the original firmware does. But of course, then that DSP code cannot be legally reditributed.

[SumWon]

Michael,

I don't think you need to buy a Vision:M just so that you can see what chips are inside. Based on the pictures I've seen of a disassembled Vision:M and the Vision I disassembled myself, I can tell you what (off the shelf) chips are inside the Vision:M:

TI TMS320DM320 - Dual Core ARM9/C54xx DSP System On Chip
Spansion S29GL032M - 4Mb flash memory
Infineon HYBL256160AF (x2) - 64Mb RAM
Philips ISP1583 - USB 2.0/ATA (IDE) controller

Unfortunately it appears that there are custom logic chips in the Vision and Vision:M. These will be hard to figure out without Creative's design documents and/or reverse-engineering the current firmware.

As other posters in this thread have indicated, the first step in getting any replacement firmware developed is to reverse-engineer the current firmware to see what it does. I've managed to extract the firmware from the firmware updater and had a quick go at running it through an ARM disassembler. It's going to take a lot of work to figure anything out about how it works...

To get the firmware image, you will need to update the firmware on your player. While the updater is running, it extracts the firmware (a file called NK.BIN) to a folder called C:\CTJbFW. If you're quick, you can copy this file before the updater deletes it (which it does when the update is complete).

HTH

[ssjmichael]

Well we'd need some scans too apparently. If you're willing to scan the Vision, that would be helpful. The other reason to have an extra one was for testing purposes so we don't accidently screw up our own players. The plans to buy one have been postponed until we can get some sort of solid footing on whether its even possible to really get this going.

[Bagder]

I don't see why it shouldn't be possible.

There are lots of players around using this TMS320 chip, some of them even distribute chunks of source code and there's always reverse engineering you can resort to, should all else fail.

And since we haven't mentioned this so far in this thread, our "guide" to new Rockbox ports:

http://www.rockbox.org/twiki/bin/view/Main/NewPort

[SumWon]

Michael,

I'm still not seeing what you're hoping to achieve by 'scanning' the inside of the player. Once you have the existing firmware and an awareness of the hardware used, there is not much more you can learn from 'scans' (although I can provide you with hires digital photos of both sides of the Vision's board if you think it will help).

The Vision(:M) like most other hard disk based players, has two firmwares: a flash based bootloader, which shouldn't even be considered for modification unless you have sophisticated equipment to reprogram it when (and not if) things go wrong. And a disk based OS which is loaded by the bootloader. Most players (including the Visions) are able to (use the flash-based firmware to) reprogram the disk based OS through the USB port even if the disk has been completely replaced/zeroed.

As Daniel indicated, there's no particular reason why the firmware couldn't be rewritten on these players. They use (largely) off the shelf chips for which there are open-source firmwares available. The original Nomad Jukebox (6Gb) had an encrypted disk based OS, which meant that either the encryption had to be broken, or the bootloader reprogrammed. Which made modifying or replacing the firmware (practically) impossible. Looking at the Vision's firmware, it does not appear to be encrypted in any way.

However, there is a lot of very skilled reverse-engineering work needed before the firmware can be replaced. This will be the stumbling block (if any). I certainly wouldn't buy a player or get my hopes up until fair progress has been made on disassembling/reverse-engineering the current firmware. I'm certainly no expert in this area, but off the top of my head, I can tell you that the very least you'd need to find out, is how the (disk based) firmware's checksum is calculated and verified, and how to find the entry point...

HTH

[Bagder]

The scans are generally used to identify all chips and circuits, in order to track down exactly what they are and what they are used for.

[ssjmichael]

The scans are generally used to identify all chips and circuits, in order to track down exactly what they are and what they are used for.

Yeah, I'm basing my need for scans off of what Daniel and all the information from this site has said. Scans provide a much bettery idea of every circuit, than a digital picture (from a camera) could do. Like I said, there is no plan at this moment to buy one.

If I can recruit some people who know a great deal about reverse engineering and ways around some of these codes (f there are), and also if they have the time to invest in this, then I'll really get this started.

[ego]

http://forums.rockbox.org/index.php?topic=3320.0

[JazzBone]

If you look for a german speaking forum on rockbox, go here: http://www.rockbox-lounge.com/

[Xenon2434]

Just recently there has been some more discussion about this over at epiZENter.net. Unfortunately, at that website, noone so far has come forth and said they have the skills necessary to make this project happen. However, I believe that if someone with the skills would be willing to do it, that we could get them a player to take apart and work with.


With that said, would anybody with the skills/time like to step up and port Rockbox over to the Zen Vision: M? It would be a free player for you, and would hopefully provide everyone with some amazing firmware. Of course, everyone else would be extremely supportive, but there is only so much some people can do (myself included)

Thank you very much,
Xenon