Creative Zen Vision:M

[Couch]

After every firmware update the hash of the firmware image must change, correct?.  So how does the firmware on chip inside the player recognize the changed hash?

I'm thinking the firmware updater software may tell the firmware on chip what the new hash is.  [if so we can just patch the update software with the chksum of hacked image?]

This is just a hypothesis without any disassembly so take it with a grain of salt.

[saratoga]

After every firmware update the hash of the firmware image must change, correct?.  So how does the firmware on chip inside the player recognize the changed hash?

The hash is stored in firmware update and checked when you do the update.

I'm thinking the firmware updater software may tell the firmware on chip what the new hash is.  [if so we can just patch the update software with the chksum of hacked image?]

"Just" doing that is what the last 8 pages of this thread have discussed.  If you're interested, you might want to read the thread.

[Couch]

After every firmware update the hash of the firmware image must change, correct?.  So how does the firmware on chip inside the player recognize the changed hash?

The hash is stored in firmware update and checked when you do the update.

I'm thinking the firmware updater software may tell the firmware on chip what the new hash is.  [if so we can just patch the update software with the chksum of hacked image?]

"Just" doing that is what the last 8 pages of this thread have discussed.  If you're interested, you might want to read the thread.

I apologize for my ignorance.  I only skimmed through a few of the last pages and just felt like presenting my idea.

[saratoga]

I understand that this thread has become somewhat bloated and difficult to find information in.  However, i'm somewhat hesitant to edit it too heavily for fear of deleting relevant information.  Unfortunately, that means people are going to have to dig to find stuff.  It also means I'll probably be deleting offtopic posts without warning.

[iSE]

What about updating the wiki? Keeping all the discussed ideas there so people can first check that?

[Sonic]

What about updating the wiki? Keeping all the discussed ideas there so people can first check that?

I like that idea, 'cause it's a drag to have to sift through the entire thread.

[TheBlackCat]

Some functions I've found in the .exe (named them myself):

FirmwareChk at 00413E10 (big function, has a lot of checks of nk.bin in it)
...
ChkSumInit at 004229B0 (has something to do with the CheckSum; I strongly believe it is SHA1 or RIPEMD160) --> this one uses a lot of SHA1 constants, so I believe the SHA1 hash is generated here

Can you post the text of these, please?

[mcuelenaere]

Can you post the text of these, please?

If you mean the disassembled versions of them, yes:
http://paste-it.net/pf649f3
http://paste-it.net/z5e1fd0

[jhulst]

What about updating the wiki? Keeping all the discussed ideas there so people can first check that?

I like that idea, 'cause it's a drag to have to sift through the entire thread.

Go ahead, it's a wiki, anyone can edit it.

[EXCiD3]

Ok, I just wanted to let you guys know, over at the Nomadness forums, all the work done for the Series 3 devices, such as the Xtra (which i currently own, soon to have a ZVM or ZVW can probably help us work with the ZVM. We have been able to do pretty much about the same as you guys with Series 3 hacking, with the exception of changing text on the firmware. We have gotten a couple of guys to dump the firmware (first 8 megs of the hd) and have modified the text and written it back to the drive. Apparently, the Series 3 devices do NOT have a checksum like the ZVM.

Much of the progress you guys have been making can EASILY be ported to the Series 3 devices. They are using the TMS320 processor also but it is a different variant (DA25x i think). Taken from wikipedia: DA25x is an ARM processor and a C55x core. It has som on-chip peripherals like a USB slave controller and security features. Documentation of this chip is only available after signing a Texas Instruments NDA. These variants are used exclusively in the Creative Zen and Dell Digital Jukebox MP3 players, as the primary CPU and signal processor for all processing of MP3 data streams.

Keep up the good work guys, I am going to begin hacking my Zen Xtra even though much of the progress made was dropped back in 2005 and I still don't quite have the money to shell out for another player.

[jermey]

im noob but this is little bit stupid and you should know something like this exists http://imajr.com/198300734_3_78515

[mcuelenaere]

im noob but this is little bit stupid and you should know something like this exists http://imajr.com/198300734_3_78515

Yes, we know about the recovery mode
It's located in the flash memory; and it's upgradeable, as the FRESC file in the firmware is this one. (FRESC=F(?) RESCue mode)

[Llorean]

F is probalby "Firmware" (not that it matters too much).

[aaronwi]

so has anyone hooked the hard drive up to the computer and read its contents yet?
would it be possible, if the firmware sits on the drive, to just overwrite it with modified firmware, or do one of the chips verify it?

[Couch]

so has anyone hooked the hard drive up to the computer and read its contents yet?
would it be possible, if the firmware sits on the drive, to just overwrite it with modified firmware, or do one of the chips verify it?

I believe the bootloader does sha1 checksums on the firmware.