Creative Zen Vision:M

[Bagder]

Shame TI doesn't have the sense to release free tools to work with it.

AFAIK, there is a free assembler for the DSP parts and the CPU part is plain ARM9.

The ArchOpen project has their OS running and playing sound on a TMS320-based player, so a Rockbox port to one of these should indeed be feasable...

[larryzotter]

im willing to help, i've got a zen vision m. See my last post.

[markun]

im willing to help, i've got a zen vision m. See my last post.

Maybe you can decrypt the nk.bin file with the "NKDecrypt" tool

http://www.takingthingsapart.org/index.php?option=com_content&task=view&id=32&Itemid=38

After inspecting the Toshiba Gigabeat S60 we found out there is a partition with 3 .bin files, also nk.bin. It's a Windows CE 5 image.

Good luck

[Bagder]

Allow me to repeat the oft-mentioned wiki page for new ports, but it seems people here haven't looked through it properly:

http://www.rockbox.org/twiki/bin/view/Main/NewPort

Scanning the PCB and figuring out the firmware update file format are two very important steps...

The docs for the DM320 chip are not publicly available, but we know that they have leaked out and they are now possible to find on the internet...

[Otaku]

im willing to help, i've got a zen vision m. See my last post.

Maybe you can decrypt the nk.bin file with the "NKDecrypt" tool

http://www.takingthingsapart.org/index.php?option=com_content&task=view&id=32&Itemid=38

After inspecting the Toshiba Gigabeat S60 we found out there is a partition with 3 .bin files, also nk.bin. It's a Windows CE 5 image.

Good luck

Ah, no : NKDecrypt is only for the Gizmondo - they used a proprietary encryption scheme.
atb
O.

[loekf2]

Allow me to repeat the oft-mentioned wiki page for new ports, but it seems people here haven't looked through it properly:

http://www.rockbox.org/twiki/bin/view/Main/NewPort

Scanning the PCB and figuring out the firmware update file format are two very important steps...

The docs for the DM320 chip are not publicly available, but we know that they have leaked out and they are now possible to find on the internet...

One thing that puzzles me. On its big brother's PCB (Zen Vision) there's a Toshiba gate array doing (most likely) an ATA interface, because the DM320's lacks proper DMA support on its Compact Flash interface.

On the screenshots of the Zen Vision:M PCB i've seen so far this IC is not present. Does this mean that the Zen Vision:M accesses its hard drive via PIO mode ?

[keytotime]

The Datasheet links are all available on the ArchOpen Wiki:
http://www.archopen.org/tiki-index.php?page=AV3xx_Chipset

[Otaku]

Bah.
I've made the offer in pm to a couple of users, now I throw it open to the floor - anyone care to supply an nk.bin I can examine ?
Cheers
O.

[saratoga]

Bah.
I've made the offer in pm to a couple of users, now I throw it open to the floor - anyone care to supply an nk.bin I can examine ?
Cheers
O.

How do I get the file?

[saratoga]

Bah.
I've made the offer in pm to a couple of users, now I throw it open to the floor - anyone care to supply an nk.bin I can examine ?
Cheers
O.

I helpful user noticed this thread and IMed me this link to his nk.bin file:

http://www.epizenter.net/e107_plugins/forum/forum_viewtopic.php?56222.0

Edit:  And yes, it appears to be unencrypted.  Theres large segments that are not ARM, but I'm guessing thats the DSP code and I just don't know how to dissassemble it.

[dan_a]

Theres large segments that are not ARM, but I'm guessing thats the DSP code and I just don't know how to dissassemble it.

I've not looked at the file, but is it possible that it's thumb code?

[saratoga]

I'm not sure.  BX is the switch to thumb op right?  I didn't even think to look at it, as I'm still get used to this windows dissassembler I'm (trying) to use.  If I get a chance this week i'll look into it.

In the meantime, are any developers seriously interested in this platform?  Given that its ARM9 and we can dissassemble the firmware, this probably isn't that difficult of a port, except maybe the audio playback drive.  But I know I don't have the time or the technical ability to do it myself.

[Bagder]

it is a TMS320DM320 based target and the archopen guys have gotten sounds on such a chip so I would guess we should be able as well! ;-)

[ssjmichael]

Someone at epiiZENter.net is making some sort of progress on extracting parts of the firmware. I really don't understand most of the stuff he's mentioning so I'll ask and see if he can post here too.



This is an excerpt from what he last wrote:

I've made a little bit progress on transferring a new firmware to the ZVM. I wanted to this by replacing the nk.bin file in the C:\CtJbFW\cttemp\ folder with the hacked one, by hooking the CreateFile and the WriteFile API.
However, it seems that the upgrade program uses the NtCreateFile API and I do not really know how to hook this one. I managed to block the WriteFile API calls to the nk.bin file, but as the program starts, it does a NtCreateFile call which overwrites the nk.bin file. Now I want to know how to hook this one, so I can block it too. Then I would place the hacked nk.bin file in the folder and hopefully, the program would transfer it to the ZVM.

I used [link=http://www.osix.net/modules/article/?id=728]this[/link] tutorial to hook the WriteFile API calls, but I haven't tried yet with the NtCreateFile, also because this one is in the NTDLL and not in the KERNEL32.

Now, I doubt that anyone has experience with API hooking, but if this is incorrect, plz let me know so that I can finish this hack and we could transfer some hacked firmwares to the ZVM. I will try to hook the NtCreateFile API in the VERNEL32.dll (the hacked KERNEL32, read the tutorial) but I think it won't work. I don't really know an other way, but we could of course copy the USB transfer commands, but I think the API hooking way is faster.

http://www.epizenter.net/e107_plugins/forum/forum_viewtopic.php?69697.30


If anyone here who knows more about this stuff could assist him on the next step it'd be much appreciated!

[mitch04]

hi there making good progress mcuelenaere is nearly there but he said that he needs help  with passing the checksum or signature validation. if anyone can help it would be great