Creative Zen Vision:M

[Sonic]

So, could we just install our firmware directly to the 32MB flash memory, so that there is no need to mess with trying to figure out the hash, since this seems to be the only roadblock(or at least the biggest one)? I'm just a noob at this, so it's just a suggestion, but 32 megs sounds like plenty of space to me.

[Sonic]

Another question: has the firmware (excluding the hash) actually been programmed, or is everything waiting on figuring out the hash?

[EXCiD3]

So, could we just install our firmware directly to the 32MB flash memory, so that there is no need to mess with trying to figure out the hash, since this seems to be the only roadblock(or at least the biggest one)?

The problem is that we dont currently know how to write code that the processor can understand, we need the firmware reverse engineered or documentation on how to do it for us to be able to port rockbox to it.

BTW

I just email Creative contacting them whether we could get information on the hardware for the Zen Xtra and here is what i received:

My email:

On behalf of the Rockbox Community, I would like to know if Creative would consider releasing information on older mp3 players such as the Zen Xtra. If you released information to our community and supported our project, Creative would be seen as one of the best open-source friendly companies. No one would complain about functionality as anyone could add their own ideas to the firmware. Any support would be greatly appreciated. Sincerely, Chris Oliver and the Rockbox Community


Creative's Reply:

Dear Customer,
I'll forward the request.

Be aware that in most cases, Creative is under NDA with parts used in the device, and can not release related information .

But I will forward your email request.
If you still require assistance, please reply to this email with any previous correspondence to ensure the quickest and most accurate service.
Best Regards ,
Phillip (Developer Relations)
Technical Support
Creative Labs Americas

[saratoga]

I haven't bothered to count, but theres someone emailing Creative asking for info every month or so.  From now on don't bother posting about it unless they give you info.

Also, instead of posting "HOW ABOUT WE DO XXXXX", just try it yourself, and post what the results are.  We don't need another 4 pages of people speculating about a port from people who have no intention of actually contributing to one.

[aaronwi]

Tomorrow I'm ordering a 1.8 to 3.5 IDE converter so we can see whats on the hard drive

I attached Microsoft's Visual Studio debugger to the 1.61.01 upgrader
I included the log in this post

It seems odd, it looks like it loaded some Nero and other application dlls.

But what looks important is...
'ZENVisionM_30GB_PCFW_L21_1_61_01.exe': Loaded 'C:\CtJbFW\cttemp\Jboxcrl.crl',
'C:\WINDOWS\system32\xpsp2res.dll',
'C:\WINDOWS\WinSxS\x86_Microsoft.Windows.Common-Controls_6595b64144ccf1df_6.0.2600.2982_x-ww_ac3f9c03\comctl32.dll',
'C:\WINDOWS\WinSxS\x86_Microsoft.Windows.GdiPlus_6595b64144ccf1df_1.0.2600.2180_x-ww_522f9f82\GdiPlus.dll',
'C:\WINDOWS\system32\msscp.dll',
'C:\WINDOWS\system32\winhttp.dll',
'C:\WINDOWS\system32\wininet.dll',
'C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll',

hope this helps somehow

[attachment deleted by admin for age]

[mcuelenaere]

...
'ZENVisionM_30GB_PCFW_L21_1_61_01.exe': Loaded 'C:\CtJbFW\cttemp\Jboxcrl.crl',
...

So could it be that some code is located in Jboxcrl.crl ? Cause I think no-one has looked into it, as it seemed to be non-used..

[saratoga]

toffe82 thought that file was some kind of loader, some people on google have various ideas.

I disassembled it, and its win32 dll (freeware of IDA works great).  Theres a lot of utility functions in there, malloc, string.h stuff, etc.  Also a dozen or so functions IDA doesn't recognize.

[aaronwi]

Yes code is located in that, It looks like it might check the current Zen firmware, if anything, it contains a bunch of possible error messages, here are really the readable chunks, formatted for easiest read.
I notice hex code that shows up twice, I wonder if its a checksum or encryption key? in between each group of 4 digits was 4 0s

fc 56  0e 57  1c 57  2a 57  3e 57  52 57  68 57  76 57  82 57  8c 57  9c 57  aa 57  ba 57  cc 57  dc 57  ea 57  
fc 57  14 58  2a 58  44 58  5e 58  74 58  8c 58  a6 58  ba 58  d4 58  e4 58  f2 58  00 59  0e 59  1a 59  26 59  42 59  5a 59  72 59  7e 59  8a 59  94 59  a0 59  b0 59  be 59  d0 59  e0 59  ec 59  02 5a  12 5a  22 5a  34 5a   46 5a  5e 5a


[attachment deleted by admin for age]

[wantondstrction]

I know it's hardly a useful statement at this point, but if anyone needs a guinea pig I'd be more than happy to help out with that later. I've got a ZenVM 30GB.

I'm not exactly skilled, nor trained for that matter. I fooled around a bit with the MTP porting kit from microsoft. I did a firmware upgrade and an album transfer while running the WPD monitor. I attatched a text readout of what it said.

I'm still figuring out how to use the direct MTP software supplied with the kit  

It does recognize the following in MtpMon:
"Creative Zen Vision:M" "Zen Vision:M" "Flashdrive303B" "Flash Reader"

Again, I'm not particularly skilled, but this seemed like it had some promising pointers to it. Even if it only helps us figure out how to get past the checksum.

[attachment deleted by admin for age]

[wantondstrction]

LOL turns out that was the simplified version. (Told ya I wasn't very skilled)

I have two more text files for you all on what exactly went into the firmware upgrade. One is just what happened when I started the upgrade program. The second is what actually happened during, and a little after the reboot. The WPDmon seems useful, then again, I have little clue what I'm doing  

I'll post just starting in this comment, and then I'll post the full process in another. (Attatchment size limit)

[attachment deleted by admin for age]

[wantondstrction]

here's the full shabang. I had to rar it, it was huge. Well...huge for a text file...when you're only allowed a 128k file

EDIT: Is there any way to possibly use the WinCE emulator to run the nk.bin? I've made a half-assed attempt myself and got the following error

"The internal signature is missing or the section lengths or checksums are incorrect."

Could've been my really half-assed attempt that caused the error, but what are the odds that nk.bin is doing the checksum?

EDIT, again: I answered my question

[justin2net]

the gigabeat s30 also has a nk.bin, and its been labeled as its kernel.
RSA signature encoding a SHA1 hash (nk.bin - eboot.bin - recovery.bin), quoted from the s30 wiki.

[mcuelenaere]

here's the full shabang. I had to rar it, it was huge. Well...huge for a text file...when you're only allowed a 128k file

Could you reupload the text file cause WinRAR says it's a corrupt archive (maybe rapidshare.com or verzend.be ?)

[wantondstrction]

here's the full shabang. I had to rar it, it was huge. Well...huge for a text file...when you're only allowed a 128k file

Could you reupload the text file cause WinRAR says it's a corrupt archive (maybe rapidshare.com or verzend.be ?)

Sorry about that. Here's the rapidshare link

http://rapidshare.com/files/37954246/FULLfirmwareupgrade.txt.html

[disturbedsaint]

Tomorrow I'm ordering a 1.8 to 3.5 IDE converter so we can see whats on the hard drive

Did you already buy a converter and have you already connected it?