Rockbox.org home
Downloads
Release release
Dev builds dev builds
Extras extras
themes themes
Documentation
Manual manual
Wiki wiki
Device Status device status
Support
Forums forums
Mailing lists mailing lists
IRC IRC
Development
Bugs bugs
Patches patches
Dev Guide dev guide
Search



Donate

Rockbox Technical Forums


Login with username, password and session length
Home Help Search Staff List Login Register
News:

Welcome to the Rockbox Technical Forums!

+  Rockbox Technical Forums
|-+  Rockbox Development
| |-+  New Ports
| | |-+  Creative Zen Vision:M
« previous next »
  • Print
Pages: 1 ... 19 20 [21] 22 23 ... 46

Author Topic: Creative Zen Vision:M  (Read 618074 times)

Offline mcuelenaere

  • Developer
  • Member
  • *
  • Posts: 392
Re: Creative Zen Vision:M
« Reply #300 on: July 16, 2007, 09:52:45 AM »
So I tried extracting nk.bin out of the .exe, but didn't came far..

If you split the .exe into the PE-format (there's a template for 010 Editor here), you get:
  • .text
  • .rdata
  • .data
  • .rsrc
sections. The raw ZLIB compressed data is in the .data section; maybe some of the Huffman trees are in the .rdata section, I couldn't extract them cause I don't really know how they look like.

I ran the data from the .data section through WinRAR, PHP's gzinflate() function ( & others) and some universal unpacker program; but they didn't find anything useful.

Now if anyone has some experience with this, could they take a look at it?
Logged

Offline davidb

  • Member
  • *
  • Posts: 5
Re: Creative Zen Vision:M
« Reply #301 on: July 17, 2007, 01:33:46 AM »
This is somewhat unrelated to the Zen Vision M, but you may enjoy reading this. It's a patent from Creative for "controlling distribution of protected content." (see http://www.freepatentsonline.com/20070014403.html) I was looking on google for "creative hash algorithm" and various other searches (who knows, I figured it was worth a try).
Logged

Offline iSE

  • Member
  • *
  • Posts: 37
Re: Creative Zen Vision:M
« Reply #302 on: July 17, 2007, 12:11:53 PM »
Quote from: davidb on July 17, 2007, 01:33:46 AM
This is somewhat unrelated to the Zen Vision M, but you may enjoy reading this. It's a patent from Creative for "controlling distribution of protected content." (see http://www.freepatentsonline.com/20070014403.html) I was looking on google for "creative hash algorithm" and various other searches (who knows, I figured it was worth a try).

Oh no :( its encrypted and hashed many times by reading that. Best way now it seems is literally to dig through the code of the firmware updater (as it says its encrypted when transferring to the device), and/or the code of the bootloader.
Logged

Offline Falafel

  • Member
  • *
  • Posts: 44
Re: Creative Zen Vision:M
« Reply #303 on: July 17, 2007, 12:44:39 PM »
Here ya go:  http://www.mediafire.com/?93sxbsdgm1r link to first 20MB
And just for good measures:  http://www.mediafire.com/?cv2zd0hcb9n link to First 80mb
« Last Edit: July 17, 2007, 12:46:23 PM by Falafel »
Logged

Offline davidb

  • Member
  • *
  • Posts: 5
Re: Creative Zen Vision:M
« Reply #304 on: July 17, 2007, 07:56:54 PM »
Quote from: iSE on July 17, 2007, 12:11:53 PM
Oh no :( its encrypted and hashed many times by reading that. Best way now it seems is literally to dig through the code of the firmware updater (as it says its encrypted when transferring to the device), and/or the code of the bootloader.

I don't think that patent has anything to do with the Zen Vision M.
Logged

Offline bgdwie

  • Member
  • *
  • Posts: 9
Re: Creative Zen Vision:M
« Reply #305 on: July 17, 2007, 09:26:01 PM »
I think that is in relation to the ability to transfer PFS music to and from the player, not the firmware. Also, from what i have read, you won't be able to get any information from creative or TI without signing an NDA, so there is no way they'd let you put the info in an open source firmware solution...
« Last Edit: July 18, 2007, 04:39:00 AM by bgdwie »
Logged

Offline aaronwi

  • Member
  • *
  • Posts: 10
Re: Creative Zen Vision:M
« Reply #306 on: July 18, 2007, 02:30:30 PM »
Quote from: Falafel on July 17, 2007, 12:44:39 PM
Here ya go:  http://www.mediafire.com/?93sxbsdgm1r link to first 20MB
And just for good measures:  http://www.mediafire.com/?cv2zd0hcb9n link to First 80mb


What is that from? Zen Vision, M, or W?
What program did you use to make the image?
And what firmware version do you have on your player?


looks like system file references don't begin untill 0x00144200
I think anything useful wont be past 0x001882C8, where a song index starts

otherwise, I don't see any matches to the latest ZVM nk.bin file, even simple things like languages and menu words, no matches.

Someone should take a drive from another zen with different firmware version, and see if it works, and if so which version gets used.

« Last Edit: July 18, 2007, 03:40:14 PM by aaronwi »
Logged

Offline Falafel

  • Member
  • *
  • Posts: 44
Re: Creative Zen Vision:M
« Reply #307 on: July 18, 2007, 06:05:57 PM »
its from a vision (non m or w) firmware version: "ZENVision_PCFW_L16_1_42_01e"
I kopieed directly from the drive using 010 editor.

I'm going to clean out the drive completely and try to install firmware on it..
after that I will knoow for sure that all the bytes in the drive are in fact firmware. after that'll change some and then we will know if the software is checked after installation.
« Last Edit: July 18, 2007, 06:12:04 PM by Falafel »
Logged

Offline Transience

  • Member
  • *
  • Posts: 15
Re: Creative Zen Vision:M
« Reply #308 on: July 23, 2007, 01:05:15 AM »
Assuming the vision W and M are the same in terms of firmware upgrades, it seems that any checksumming done by the player is done using code stored on the player's ROM, as the HDD can be changed out on the vision W without any problems. http://onemansblog.com/2007/07/20/tutorial-how-to-upgrade-the-creative-zen-vision-w-hard-drive/
« Last Edit: July 23, 2007, 02:31:59 AM by Transience »
Logged

Offline saratoga

  • Developer
  • Member
  • *
  • Posts: 8987
Re: Creative Zen Vision:M
« Reply #309 on: July 23, 2007, 10:42:59 AM »
Quote from: Transience on July 23, 2007, 01:05:15 AM
Assuming the vision W and M are the same in terms of firmware upgrades, it seems that any checksumming done by the player is done using code stored on the player's ROM, as the HDD can be changed out on the vision W without any problems. http://onemansblog.com/2007/07/20/tutorial-how-to-upgrade-the-creative-zen-vision-w-hard-drive/

While I agree that the checksum must be calculated by the firmware in ROM (since doing it from the disk would make absolutely no sense at all), theres nothing specifically in that link to suggest its the case.
Logged

Offline mcuelenaere

  • Developer
  • Member
  • *
  • Posts: 392
Re: Creative Zen Vision:M
« Reply #310 on: July 23, 2007, 01:02:26 PM »
Quote from: saratoga on July 23, 2007, 10:42:59 AM
Quote from: Transience on July 23, 2007, 01:05:15 AM
Assuming the vision W and M are the same in terms of firmware upgrades, it seems that any checksumming done by the player is done using code stored on the player's ROM, as the HDD can be changed out on the vision W without any problems. http://onemansblog.com/2007/07/20/tutorial-how-to-upgrade-the-creative-zen-vision-w-hard-drive/
While I agree that the checksum must be calculated by the firmware in ROM (since doing it from the disk would make absolutely no sense at all), theres nothing specifically in that link to suggest its the case.
Yes there is: as the firmware has to be installed on the new HDD, the ZVM must upgrade its firmware and because the HDD is empty, the checksum can't be on it.

Anyway, I was thinking last night: there are several F* (FBOOT, FRESC) blocks and several H* (Hjukebox.grs, Hjukebox2.jrs, ...) blocks; if the F refers to flash and the H to HDD, it would mean everytime an upgrade is performed the boot code is flashed.

To prove my theory: if you look at the rescue menu, you'll see a version number. If you upgrade your firmware, this number changes. But if your HDD becomes corrupt or your ZVM won't boot anymore (you come automatically in Rescue mode), this number is the same (so it doesn't depend on a file on HDD).

So in short, a HDD dump wouldn't give us any real useful information, because (boot) code is stored in ROM/flash.

Also, there are 2 other strange blocks in nk.bin (EXT0 and an encrypted one), maybe one of them could contain DSP code and/or are written to a specific place (as none of them has an H or F in front of their name); but this has nothing to do with the above.
Logged

Offline jermey

  • Member
  • *
  • Posts: 7
Re: Creative Zen Vision:M
« Reply #311 on: July 26, 2007, 06:16:51 PM »
i tell you something guys: put your zen nearby your ears and then swith it on and try somehow watch lcd and you will see that boot sector is on flash and firmware is on hdd
Logged

Offline Transience

  • Member
  • *
  • Posts: 15
Re: Creative Zen Vision:M
« Reply #312 on: July 27, 2007, 01:09:16 AM »
after some searching, i found that the firmware isn't in the first 20-80mb of the HDD. On mine, 010 Editor shows that the firmware images, at least, are located around 2302:2F50h. i was able to modify one of the images on the disk, powercycle the player, and the modification was still there when i opened the drive again in 010. the image i changed was a green check mark, but i'm not sure where that image is used :(. If anyone knows, please let me know.
Logged

Offline Mardoxx

  • Member
  • *
  • Posts: 2
Re: Creative Zen Vision:M
« Reply #313 on: July 27, 2007, 06:30:23 AM »
there's a checkmark when you change password protected content password
when you use the Custom EQ
ummm I've seen one somewhere before

I'll have a look :)
Logged

Offline Transience

  • Member
  • *
  • Posts: 15
Re: Creative Zen Vision:M
« Reply #314 on: July 29, 2007, 11:41:08 PM »
back to the problem of the checksum, if the bootloader is checksumming the firmware, creative almost certainly used an existing function, rather than code their own. It seems that they may have coded the bootloader to skip parts of the firmware during the checksum, to save time. since the bootloader would have to be able to check future (not yet coded) firmware updates, it probably skips parts based on the block structure of the firmware (that would be the easiest way, anyway). so perhaps the bootloader is only checksumming certain blocks of the firmware, and skipping others?
Logged

  • Print
Pages: 1 ... 19 20 [21] 22 23 ... 46
« previous next »
+  Rockbox Technical Forums
|-+  Rockbox Development
| |-+  New Ports
| | |-+  Creative Zen Vision:M
 

  • SMF 2.0.17 | SMF © 2019, Simple Machines
  • Rockbox Privacy Policy
  • XHTML
  • RSS
  • WAP2

Page created in 0.928 seconds with 22 queries.