Creative Zen Vision:M

[Falafel]

Posted by Aaronwi on Epizenter forum:

Later today, I'm going to try to make another call, the adapter I'm getting was from ebay, but its the wrong kind, it was 1.8" to 3.5" IDE (~$5 USD), where as now after I opened up the zen, it is a ZIF connection, those adapters (ZIF to 2.5" IDE) appear to be ~$40 USD

So...if you do have an IDE connecting hard drive, I could mail you my converter for a reasonable price.

We haven't heard from him yet, but I suppose he doesn't have an adapter he can actually use..

[aaronwi]

sorry, thought I stated above, but, I have a zif hard drive, and the connector I got is for IDE, when I have time, I'll try soldering a cable to an ide connector to read the hard drive,
as for contacting Creative, that site I was using for free out-of-country calls limits calls to only 2 or 3 minutes, not even enough time to get forwarded twice

[wesmo]

How similiar is the firmware of the Zen Vision: M to the NJB3 series - looking at the recovery mode menu of both (Zen Xtra (MTP) and Vision:M) are the same.  I suspect that the vision m uses a more updated/configurable firmware. More infoe about the NJB3 series is can be found on the wiki http://www.rockbox.org/twiki/bin/view/Main/CreativeZenTouch (Click on the NJB3 firmware)

[mcuelenaere]

How similiar is the firmware of the Zen Vision: M to the NJB3 series - looking at the recovery mode menu of both (Zen Xtra (MTP) and Vision:M) are the same.  I suspect that the vision m uses a more updated/configurable firmware. More infoe about the NJB3 series is can be found on the wiki http://www.rockbox.org/twiki/bin/view/Main/CreativeZenTouch (Click on the NJB3 firmware)

Very similiar, its almost the same; except for the fact that there aren't any dictionaries in ZVM and the font files are TTF instead of NFT.
Both firmwares have a CINF header, an encoded part (CENC named in the NJB3, ©TL named in the ZVM), the same firmware structure, ...

[wesmo]

Doesn't that mean njb3 devices would be able to use a derivative of the zen vision m rockbox fw? I'm interested in contacting anyone interested in working on a port to the njb3 - working on both ports at the same time should be easier. I've put more up on the zen touch wiki page related to the ti tms320.

[mitch04]

hey theres a new firmware for creative zen vision m you might be able to crack it i dunno. its version ZENVisionM_30GB_PCFW_L21_1_62_02

[mcuelenaere]

Sorry about that. Here's the rapidshare link

http://rapidshare.com/files/37954246/FULLfirmwareupgrade.txt.html

Hi,

the beginning of the file is clipped off, do you still have that or did you delete it ? Cause it is kinda important and I wanna try to make a proggie that imitates the WPD requests

[metamorph8]

Sorry guys, but i didn't read through the whole thread. I'll delete this post if it's superfluous.

did anyone want a readout of the DeviceInfo.xml file?

[mcuelenaere]

Sorry guys, but i didn't read through the whole thread. I'll delete this post if it's superfluous.

did anyone want a readout of the DeviceInfo.xml file?

No. You can get this file from your ZVM and it is in the firmware; so we already got this one

[wantondstrction]

Sorry about that. Here's the rapidshare link

http://rapidshare.com/files/37954246/FULLfirmwareupgrade.txt.html

Hi,

the beginning of the file is clipped off, do you still have that or did you delete it ? Cause it is kinda important and I wanna try to make a proggie that imitates the WPD requests

That's the only copy I have of the firmware upgrade readout, but I can do another one if you like.

[mcuelenaere]

That's the only copy I have of the firmware upgrade readout, but I can do another one if you like.

That would be nice
Especially the beginning of the process would be of some importance, but if you could do a full readout (and maybe rar/zip it), that would be great!

[wantondstrction]

Well I finally managed to fail a firmware upgrade. It wasn't nearly as devastating as you would think. Interesting enough, after failing the firmware upgrade, it would no longer allow an official upgrade. It would always fail and never give a reason or an error of any sort.

Another interesting point, if you go through the reload firmware process. If you go through windows explorer, it reads the player as a 50mb device with 50mb free. I found this kind of odd.

I managed to figure out how to use the html output function on wpdmon (more like where to find and copy and paste the automatic output into html) Here's a "reload firmware" version of the monitor output.

http://rapidshare.com/files/40174563/WpdMonreloadfirmware.htm.html

PS sorry it's taken me a while to get back to you, I've been having eye problems keeping me from using the computer.

[mcuelenaere]

Well I finally managed to fail a firmware upgrade. It wasn't nearly as devastating as you would think. Interesting enough, after failing the firmware upgrade, it would no longer allow an official upgrade. It would always fail and never give a reason or an error of any sort.

Another interesting point, if you go through the reload firmware process. If you go through windows explorer, it reads the player as a 50mb device with 50mb free. I found this kind of odd.

Interesting...

PS sorry it's taken me a while to get back to you, I've been having eye problems keeping me from using the computer.

Not a problem. I hope you're back allright

[mcuelenaere]

This is rather interesting:

Code: [Select]

Data (from device, 122 bytes) - StorageInfo:
  Storage type      = Fixed RAM (0x3)
  File system type  = Generic Hierarchical (0x2)
  Access capability = Read-Write (0x0)
  Max capacity      = 52428800
  Free space (byte) = 52428800
  Free space (objs) = 4294967295
  Storage desc      = Storage Media

excerpt from WpdMonreloadfirmware.htm
The max capacity indicates 50MiB(exactly), the storage type is Fixed RAM; what could this mean?
Could there be some special partition on the HDD which is 50MiB which hides the OS?

And maybe if the firmware updater can access it, we could too?

edit: made the page a little bit shorter

[mcuelenaere]

I think I get the update progress:

• Firstly, the app checks if there's a device connected.
• The app sends the GetDeviceInfo command and checks if it's the correct device & the correct firmware version

Code: [Select]

 Manufacturer      = Creative Technology Ltd
  Model             = Creative Zen Vision:M
  Device Version    = 1.61.01_0.00.23

• The app uses the GetStorageIDs command and checks with the GetStorageInfo command if the storage is the correct one

Code: [Select]

 Storage type      = Fixed RAM (0x3)
  File system type  = Generic Hierarchical (0x2)
  Access capability = Read-Write (0x0)
  Max capacity      = 52428800
  Free space (byte) = 52428800
  Free space (objs) = 4294967295
  Storage desc      = Storage Media

• The app enumerates through the list of objects until it finds the correct one(I don't know what specific object it's looking for yet)
• The app uses the WPD_COMMAND_CAPABILITIES_GET_SUPPORTED_CONTENT_TYPES command to determine something(?)
• The app creates an object with the WPD_COMMAND_OBJECT_MANAGEMENT_CREATE_OBJECT_WITH_PROPERTIES_AND_DATA command

Code: [Select]

WPD_PROPERTY_OBJECT_MANAGEMENT_CREATION_PROPERTIES           = [VT_UNKNOWN ] IPortableDeviceValues (10 elements)
WPD_OBJECT_PARENT_ID                                         = [VT_LPWSTR  ] s10001
WPD_OBJECT_NAME                                              = [VT_LPWSTR  ] nk.bin
WPD_OBJECT_ORIGINAL_FILE_NAME                                = [VT_LPWSTR  ] nk.bin
WPD_OBJECT_CONTENT_TYPE                                      = [VT_CLSID   ] WPD_CONTENT_TYPE_UNSPECIFIED
WPD_OBJECT_ISHIDDEN                                          = [VT_BOOL    ] FALSE
WPD_OBJECT_ISSYSTEM                                          = [VT_BOOL    ] FALSE
WPD_OBJECT_CAN_DELETE                                        = [VT_BOOL    ] TRUE
WPD_OBJECT_FORMAT                                            = [VT_CLSID   ] {B8020000-AE6C-4804-98BA-C57B46965FE7}
WPD_OBJECT_SIZE                                              = [VT_UI8     ] 0x14C23D0 (Decimal: 21767120)
WPD_API_OPTION_USE_CLEAR_DATA_STREAM                         = [VT_BOOL    ] TRUE

• The app uses the SendObjectInfo/WPD_COMMAND_OBJECT_MANAGEMENT_WRITE_OBJECT_DATA command for writing some data

Code: [Select]

 Format code       = UndefinedFirmware (0xb802)
  Protection status = None (0x0000)
  Compressed size   = 21767120
  File name         = nk.bin

• The app uses several WPD_COMMAND_OBJECT_MANAGEMENT_WRITE_OBJECT_DATA commands to send the firmware
• Finally it sends the WPD_COMMAND_OBJECT_MANAGEMENT_COMMIT_OBJECT command
• The app checks regulary the status of the device with Get Device Status(the ZVM is upgrading his firmware)

Code: [Select]

 Status Length = 4
  Code          = Device Busy (0x2019)

• Finally the device responds

Code: [Select]

Response: OK (0x2001)
  TransactionId: 7

• The device status changes to unknown(the ZVM restarts)
• The app does some not-necessary checking if the device still works

This is kinda the process of doing a firmware update according to WpdMonreloadfirmware.htm and my interpretation;
could someone verify/criticize this?
What do you guys think?