Creative Zen Vision:M

[jhulst]

I am extremely interested in this issue and would very much like to help if I can.

Right now our biggest need is figuring out how to load our own firmware.  Any help is appreciated.

On another note, a test player is being sent to me.  Is there someone who could download the EEPROM contents if I sent it to them?

jwh

[iSE]

I know exactly what you mean mrsubway, theres a fair few things which just niggle at you and serve to ruin an otherwise excellent machine.

jhulst - im assuming that if we can find the file on the harddrive which is the firmware, it would be fairly simple to transfer something else in its place? I'm wondering if it may be worth comparing the firmware update file for two completely different Creative Zen's. The firmware would then be different and the simularities between the files code (using decompilers) would be how the firmware is transferred to the player?

[saratoga]

jhulst - im assuming that if we can find the file on the harddrive which is the firmware, it would be fairly simple to transfer something else in its place?

We've been over this 5 or 6 times in this thread.  I'll summarize it once again, but if you want details, you'll need to read the last 2 pages or so.  We have the firmware already and a way to upload whatever firmware we want to the Vision:M.  Theres a link to it in this thread and info about hows its done.  What we don't have is a way to sign    our own code so that the bootloader on the Vision:M will run it.

I'm wondering if it may be worth comparing the firmware update file for two completely different Creative Zen's.

Yes I've been suggesting this to people.  Its how the Sansa port began.

[iSE]

Sorry, I read the first like 4 pages and the last one, i didnt know you already had a way to upload it. So i'm guessing the bootloader runs a CRC check, using the MD5 checksum? Or is it creative's own cryptochecksum lol.

[saratoga]

Sorry, I read the first like 4 pages and the last one, i didnt know you already had a way to upload it. So i'm guessing the bootloader runs a CRC check, using the MD5 checksum? Or is it creative's own cryptochecksum lol.

I don't think anyone knows.  The extent of the effort so far has been to try and change strings and then upload them to the device.  Since this fails whatever check there is, it doesn't work.  I don't think anyone has made any serious attempt to figure out why.

Edit:  You could be the first.

[iSE]

Well if you can get me the info about the new firmware and how its transferred I will do what I can to figure out a way. And I do have some experience though I can't promise anything lol! You know how it is.

[saratoga]

Actually, having reread the epizenter thread, it looks like the checksum is done by the firmware update utility.  Or at least a checksum is.  So I think I was wrong about having a way to update the firmware.  Theres a possible way, once the checksum is calculated, but I don't think anyone has managed it.  

At least from reading that thread, it sounds like the upgrade progress is failing on the PC side, not the device side.  I could be wrong though.

http://www.epizenter.net/e107_plugins/forum/forum_viewtopic.php?69697.0

[iSE]

Right, so I was wondering, when jhulst is finally able to hook up the harddrive of one to the computer (I would have a go but I'm still waiting for someone to say how to open the damn thing without using a crowbar). But yes, if its possible to explore the file system, lets hope there is a file sitting there called NK.bin. So unless the bootloader performs a CRC check (which I don't see how thats possible with updating the firmware unless the update program changes the bootloader which would be really over the top) then hopefully it will be a simple matter of replacing that file. Next step would be to find out how to replace the file through a USB cable, once we know where the file is. I am hoping once we can work out what filesystem is used, I may be able to get it to work through just the USB cable. (One of the benefits of Linux and the way it mounts things!)

[saratoga]

So unless the bootloader performs a CRC check (which I don't see how thats possible with updating the firmware unless the update program changes the bootloader which would be really over the top) then hopefully it will be a simple matter of replacing that file.

Most players do a check in order to prevent people from hacking their firmware.  Its actually very easy, they just have the bootloader compute a hash, and compare it to the hash written in the binary itself.  Some even take this a step farther and use the hash to encrypt the entire firmware file.  I'm expecting some sort of hash check in the bootloader, but you never know.

[iSE]

A hash by using an algorithm then? I was meaning by using it size and properties to calculate a checksum, by updating the file the checksum would change however. So how to Creative get the firmware to pass then which otherways can't? Would simply replacing the file on the HD cause an abort when switching it on then?

[saratoga]

A hash by using an algorithm then?

A hash is just a number produced by an algorithm, so yes.

I was meaning by using it size and properties to calculate a checksum, by updating the file the checksum would change however.

Generally checksums are computed using the contents of a file, not its size (since size is already just a number, which would make creating a checksum from it pointless), but otherwise, this is also what I meant.

So how to Creative get the firmware to pass then which otherways can't?

The most obvious way is to compute the hash, and then store it in the header of the file.  Then the bootloader or firmware update program can simply read off the expected hash, and then compute the hash over the rest of the file.  If the computed and read hashes match, then you know the file has not been tampered with.  If we knew where the hash was stored, and how it was generated, we could also produce our own firmware updates.  

Now, its not clear to me how this works, but it seems people in the above thread determined that the firmware update utility itself does a hash check.  The bootloader may or may not, but if it does, hopefully its the same one as the update utility.  So one way to proceed would be to look at the update utility and see if theres any clues in it as to how the hash is made.  At least thats my understanding from reading the various stuff posted here ( I don't have a Creative player).

Would simply replacing the file on the HD cause an abort when switching it on then?

On the Sansa and many other players, this is exactly what happens.

[iSE]

So once we have a new firmware we have to convince the player that its legit by getting it to pass the same checksum tests which the legit version would. I don't suppose we could just ring up Creative and ask?

[saratoga]

So once we have a new firmware we have to convince the player that its legit by getting it to pass the same checksum tests which the legit version would. I don't suppose we could just ring up Creative and ask?

Check page 4 or 5 of this thread.

[iSE]

Ok I've read everything now, there seems to be a lot of things starting and very little finishing. If money is a problem, I will be willing to donate some for this cause as I've already spent a fortune on this player, I'd be willing to pay some more to get it to work well!

I have already tried posting in the creative forums, no one seems to help, I'll try emailing and nagging creative until they give me a response worthwhile. If anyone can tell me how I can safely take apart my Zen to gain direct access to the harddrive I will give it a go. In the meanwhile I'm going to do what I can to dissect the update program and continue to try to force mount the zen. If only I knew what filesystem it supported it would be so much easier to gain access to it.

[jhulst]

I have already tried posting in the creative forums, no one seems to help, I'll try emailing and nagging creative until they give me a response worthwhile.

The most worthwhile response I got was where they told me to go buy a different player if I wasn't happy with what I had.

As for the test machine, I got it, took it apart, and am now trying to figure out what kind of an adapter is needed for the harddrive and how it would hook up.  I'll post pictures when I get a chance.  It seems that there are two different hard drives.  A Toshiba and a Hitachi.  The Toshiba seems to have an IDE interface, the Hitachi we think is ZIF but are having a hard time getting the ribbon detached.

jwh