Creative Zen Vision:M

[bascule]

Lots of off-topic posts removed
Please, only actual development-related posts here.

[mcuelenaere]

OK, just a quick question: which program do you guys recommend me to capture the USB traffic?

For now, I'm going to use HHD Software's USB Monitor...

I'll post my results here in a minute or so...

[iSE]

A kernel debugger such as rr0d will give good results

[HKK]

SHA1 is 160 bit.

There's quite a few 160bit hashes. This site http://whatsmyip.org/hash_generator/ lists sha-1, tiger160, ripemd160 and haval160. I don't know how to work with these but maybe someone here does?

[iSE]

if you read mcuelenaere's post above, he's already tried several 160bit hashes and found them NOT to match

[mcuelenaere]

if you read mcuelenaere's post above, he's already tried several 160bit hashes and found them NOT to match

I've tried SHA-1, TIGER and RIPEMD160. You could try others yourself if you want to, but I'm having the feeling here that not very much people are comprehending what I'm saying. Maybe I'm just wrong, plz correct me if so, but I dunno if someone really understand what I mean if I'm talking about the NULL-block, or other parts of nk.bin's main structure.

Maybe I'll have to take some screens or document everything a bit, so (lazy) people understand what I'm talking about. If I'm totally wrong here, plz say it. Thx

[iSE]

Some of us know what you're talking about . Though I wouldn't say those who don't are lazy, more have not come across this before and just haven't had any experience with it.

[Bagder]

I've tried SHA-1, TIGER and RIPEMD160. You could try others yourself if you want to, but I'm having the feeling here that not very much people are comprehending what I'm saying.

We understand you fine - remember that we have reverse engineered a few other players before this... But I figure there are more than one way to run these hash algorithms on the data (like order of data, range of data, with or without padding etc) so I don't see how any random test-shots can exclude any particular algorithm until more details are discovered.

[mcuelenaere]

We understand you fine - remember that we have reverse engineered a few other players before this... But I figure there are more than one way to run these hash algorithms on the data (like order of data, range of data, with or without padding etc) so I don't see how any random test-shots can exclude any particular algorithm until more details are discovered.

Yes OK, but I wasn't talking about the hash algorithm cracking; I wasn't sure that you(plural) knew what I was talking about when I mention the NULL block and stuff...

And if I insulted anyone, I'm sorry for that; it wasn't my intention to do so...

[jhulst]

We understand you fine - remember that we have reverse engineered a few other players before this... But I figure there are more than one way to run these hash algorithms on the data (like order of data, range of data, with or without padding etc) so I don't see how any random test-shots can exclude any particular algorithm until more details are discovered.

In the past, how did you figure out more details?  Is it best just to keep trying codes and seeing if the match up?  To me, that sounds like a lot of guessing.

[jhulst]

By the way, if no one else figures out a way to get code running on the ZVM, I was going to suggest that someone get a broken player, desolder the flash ROM and then dump it with an EEPROM programmer.  The chip is TSOP with just an 8 bit bus, so it wouldn't be that hard to do.  Hypothetically, would you be willing to do this, or else mail the EEPROM chip to someone with the equipment?

Is there anybody who would be able to dump this for me?  I will mail the flash ROM to you.
jwh

[saratoga]

By the way, if no one else figures out a way to get code running on the ZVM, I was going to suggest that someone get a broken player, desolder the flash ROM and then dump it with an EEPROM programmer.  The chip is TSOP with just an 8 bit bus, so it wouldn't be that hard to do.  Hypothetically, would you be willing to do this, or else mail the EEPROM chip to someone with the equipment?

Is there anybody who would be able to dump this for me?  I will mail the flash ROM to you.
jwh

I can ask around, but it sounds to me like looking at the Windows update program would be the best idea now, since it can likely be used to update the firmware, something we'll need to be able to do regardless.  

[Bagder]

We understand you fine - remember that we have reverse engineered a few other players before this... But I figure there are more than one way to run these hash algorithms on the data (like order of data, range of data, with or without padding etc) so I don't see how any random test-shots can exclude any particular algorithm until more details are discovered.

In the past, how did you figure out more details?  Is it best just to keep trying codes and seeing if the match up?  To me, that sounds like a lot of guessing.

The early targets had "simple" algorithms so they could be "cracked" differently.

For more recent targets (like the sansa), it has involved lots of dissassembly reading.

[mcuelenaere]

I'll post this link here too (dunno if it's useful, most of it has already been said except maybe the last part): http://gim.6te.net/ZVM/zvm.html
(ignore the ads, it's a free hosting so.. )

[mcuelenaere]

So what does the coincidence mentioned suggest? I do not really get it. Sorry.

It means I'm pretty sure that the NULL block contains a 160bit hash of the whole CIFF block