Creative Zen Vision:M

[mcuelenaere]

So I tried extracting nk.bin out of the .exe, but didn't came far..

If you split the .exe into the PE-format (there's a template for 010 Editor here), you get:

• .text
• .rdata
• .data
• .rsrc

sections. The raw ZLIB compressed data is in the .data section; maybe some of the Huffman trees are in the .rdata section, I couldn't extract them cause I don't really know how they look like.

I ran the data from the .data section through WinRAR, PHP's gzinflate() function ( & others) and some universal unpacker program; but they didn't find anything useful.

Now if anyone has some experience with this, could they take a look at it?

[davidb]

This is somewhat unrelated to the Zen Vision M, but you may enjoy reading this. It's a patent from Creative for "controlling distribution of protected content." (see http://www.freepatentsonline.com/20070014403.html) I was looking on google for "creative hash algorithm" and various other searches (who knows, I figured it was worth a try).

[iSE]

This is somewhat unrelated to the Zen Vision M, but you may enjoy reading this. It's a patent from Creative for "controlling distribution of protected content." (see http://www.freepatentsonline.com/20070014403.html) I was looking on google for "creative hash algorithm" and various other searches (who knows, I figured it was worth a try).

Oh no its encrypted and hashed many times by reading that. Best way now it seems is literally to dig through the code of the firmware updater (as it says its encrypted when transferring to the device), and/or the code of the bootloader.

[Falafel]

Here ya go:  http://www.mediafire.com/?93sxbsdgm1r link to first 20MB
And just for good measures:  http://www.mediafire.com/?cv2zd0hcb9n link to First 80mb

[davidb]

Oh no its encrypted and hashed many times by reading that. Best way now it seems is literally to dig through the code of the firmware updater (as it says its encrypted when transferring to the device), and/or the code of the bootloader.

I don't think that patent has anything to do with the Zen Vision M.

[bgdwie]

I think that is in relation to the ability to transfer PFS music to and from the player, not the firmware. Also, from what i have read, you won't be able to get any information from creative or TI without signing an NDA, so there is no way they'd let you put the info in an open source firmware solution...

[aaronwi]

Here ya go:  http://www.mediafire.com/?93sxbsdgm1r link to first 20MB
And just for good measures:  http://www.mediafire.com/?cv2zd0hcb9n link to First 80mb

What is that from? Zen Vision, M, or W?
What program did you use to make the image?
And what firmware version do you have on your player?


looks like system file references don't begin untill 0x00144200
I think anything useful wont be past 0x001882C8, where a song index starts

otherwise, I don't see any matches to the latest ZVM nk.bin file, even simple things like languages and menu words, no matches.

Someone should take a drive from another zen with different firmware version, and see if it works, and if so which version gets used.

[Falafel]

its from a vision (non m or w) firmware version: "ZENVision_PCFW_L16_1_42_01e"
I kopieed directly from the drive using 010 editor.

I'm going to clean out the drive completely and try to install firmware on it..
after that I will knoow for sure that all the bytes in the drive are in fact firmware. after that'll change some and then we will know if the software is checked after installation.

[Transience]

Assuming the vision W and M are the same in terms of firmware upgrades, it seems that any checksumming done by the player is done using code stored on the player's ROM, as the HDD can be changed out on the vision W without any problems. http://onemansblog.com/2007/07/20/tutorial-how-to-upgrade-the-creative-zen-vision-w-hard-drive/

[saratoga]

Assuming the vision W and M are the same in terms of firmware upgrades, it seems that any checksumming done by the player is done using code stored on the player's ROM, as the HDD can be changed out on the vision W without any problems. http://onemansblog.com/2007/07/20/tutorial-how-to-upgrade-the-creative-zen-vision-w-hard-drive/

While I agree that the checksum must be calculated by the firmware in ROM (since doing it from the disk would make absolutely no sense at all), theres nothing specifically in that link to suggest its the case.

[mcuelenaere]

Assuming the vision W and M are the same in terms of firmware upgrades, it seems that any checksumming done by the player is done using code stored on the player's ROM, as the HDD can be changed out on the vision W without any problems. http://onemansblog.com/2007/07/20/tutorial-how-to-upgrade-the-creative-zen-vision-w-hard-drive/

While I agree that the checksum must be calculated by the firmware in ROM (since doing it from the disk would make absolutely no sense at all), theres nothing specifically in that link to suggest its the case.

Yes there is: as the firmware has to be installed on the new HDD, the ZVM must upgrade its firmware and because the HDD is empty, the checksum can't be on it.

Anyway, I was thinking last night: there are several F* (FBOOT, FRESC) blocks and several H* (Hjukebox.grs, Hjukebox2.jrs, ...) blocks; if the F refers to flash and the H to HDD, it would mean everytime an upgrade is performed the boot code is flashed.

To prove my theory: if you look at the rescue menu, you'll see a version number. If you upgrade your firmware, this number changes. But if your HDD becomes corrupt or your ZVM won't boot anymore (you come automatically in Rescue mode), this number is the same (so it doesn't depend on a file on HDD).

So in short, a HDD dump wouldn't give us any real useful information, because (boot) code is stored in ROM/flash.

Also, there are 2 other strange blocks in nk.bin (EXT0 and an encrypted one), maybe one of them could contain DSP code and/or are written to a specific place (as none of them has an H or F in front of their name); but this has nothing to do with the above.

[jermey]

i tell you something guys: put your zen nearby your ears and then swith it on and try somehow watch lcd and you will see that boot sector is on flash and firmware is on hdd

[Transience]

after some searching, i found that the firmware isn't in the first 20-80mb of the HDD. On mine, 010 Editor shows that the firmware images, at least, are located around 2302:2F50h. i was able to modify one of the images on the disk, powercycle the player, and the modification was still there when i opened the drive again in 010. the image i changed was a green check mark, but i'm not sure where that image is used . If anyone knows, please let me know.

[Mardoxx]

there's a checkmark when you change password protected content password
when you use the Custom EQ
ummm I've seen one somewhere before

I'll have a look

[Transience]

back to the problem of the checksum, if the bootloader is checksumming the firmware, creative almost certainly used an existing function, rather than code their own. It seems that they may have coded the bootloader to skip parts of the firmware during the checksum, to save time. since the bootloader would have to be able to check future (not yet coded) firmware updates, it probably skips parts based on the block structure of the firmware (that would be the easiest way, anyway). so perhaps the bootloader is only checksumming certain blocks of the firmware, and skipping others?