Creative Zen Vision:M

[Hoffmann]

Sorry BigBambi, I messed it up, you are right...
Next meeting should be at a date that is easier for europeans and still atendable for americans.

[mcuelenaere]

Hi there,

I saw that you're looking for some older firmwares of the ZVM (+ extracted nk.bin); well there are some at http://epizenter.net/e107_plugins/forum/forum_viewtopic.php?69697.105#post_74257, even some older ones (but without nk.bin extracted) if you look further into the thread...

I've also extracted the separate data blocks of the newest firmware, so the data is more or less separated from the binaries (there are some FBOOT and FRESC blocks; also an encrypted one), but a quick scan with IDA shows me no useful info (although, I'll have to tell, I'm not an assembler/hex expert, I have no experience whatsoever).

I'll post the .rar file with the blocks somewhat later, first I have to upload it  

Edit:

http://rapidshare.com/files/19190349/ZVM.rar.html

[koston]

Ive looked through the firmware updater a several times but i can't find any CRC or other Checksum Check and i don't believe that is decrypted. Ive tried to debug the updating process but Olly doesn't brake when i press the update button and i don't know why.

[Otaku]

Its entirely possible any crc validation/decryption is done on the unit itself. All the PC software would need to be aware of is the return code.
O.

[saratoga]

The check is likely done by the bootloader.  It wouldn't make sense to hand control over to the software unit and then do a checksum.  Though it'd be nice if they did that, since then we wouldn't have to do anything other then delete the original firmware!

[jhulst]

So where are we at?  Anybody making any progress or even actively working on this?

[koston]

I think we should wait until breihanj gets his tool for the HDD.

[toffe]

Hello

If the hard drive has a zif connector, like the zune, the gigabeat S and the ipod, you will not find a cheap interface in the US, the cheapest I found is 120$.
But I found it in France for 60$ delivered in the us, check this site : http://www.pc-look.com/boutik/product_info.php?products_id=7838&referer=PrixMateriel
This interface works for hitachi and toshiba hd, you just have to take care on which way you connect it.

If the hard drive has a standard connector, it is easy to find adaptor in the US but it is different if the hd is a toshiba or a hitachi.

What kind of hd do you have on the zen ? what is the reference ?

[nickqueen]

Hello

If the hard drive has a zif connector, like the zune, the gigabeat S and the ipod, you will not find a cheap interface in the US, the cheapest I found is 120$.
But I found it in France for 60$ delivered in the us, check this site : http://www.pc-look.com/boutik/product_info.php?products_id=7838&referer=PrixMateriel
This interface works for hitachi and toshiba hd, you just have to take care on which way you connect it.

If the hard drive has a standard connector, it is easy to find adaptor in the US but it is different if the hd is a toshiba or a hitachi.

What kind of hd do you have on the zen ? what is the reference ?

On Anything But Ipod it shows a picture of the HDD

It is a Toshiba hdd1442 C.

[mitch04]

this is great people Im willing to help you. hope to speak to you on IRC.
heres another site http://www.epizenter.net/e107_plugins/forum/forum_viewtopic.php?69697.165 thats been trying to crack the firmware as well.

Keep the great work up !

[toffe]

I check the picture on the site , the ref hd1442 c is not the real ref of the hd which is hidden on the picture. the real ref should be mk3006gal.

the connector for this hd is a female connector .

you can find the interface for this drive here :
http://www.addonics.com/products/io/aaedt18IDE25.asp

you can also use an external usb case which support toshiba hd like this one :
http://www.coolerexpress.com/noname.html

The external case should be the easiest to use.

[saratoga]

Did anyone ever bother to post scans?  If so, could we get them on the Wiki please?

[jhulst]

We have a broken player that will be scanned as soon as it is shipped to me, and yes the scans will immediately go on the wiki.

jwh

[saratoga]

We have a broken player that will be scanned as soon as it is shipped to me, and yes the scans will immediately go on the wiki.

jwh

Thats good to hear.  

By the way, if no one else figures out a way to get code running on the ZVM, I was going to suggest that someone get a broken player, desolder the flash ROM and then dump it with an EEPROM programmer.  The chip is TSOP with just an 8 bit bus, so it wouldn't be that hard to do.  Hypothetically, would you be willing to do this, or else mail the EEPROM chip to someone with the equipment?

[mitch04]

We have a broken player that will be scanned as soon as it is shipped to me, and yes the scans will immediately go on the wiki.

jwh

hey are you sure his gonna send you it?