Creative Zen Vision:M

[wantondstrction]

My best guess would be that once it deletes the firmware it allows direct access to the flash storage (or more likely a hidden partition on the HDD) for reloading the firmware. I think there may be a huge opening here for us.

(which in case anyone hasn't actually done the reload firmware process, it does clearly state on the ZVM that the firmware has been deleted before you even dock the device)

Now my question, is this 50mb the flash memory or is it a hidden partition on the HDD? 50mb seems to be a decent amount of storage space for firmware, wouldn't you say?

I wonder if it would be as easy as copying a ported version of the rockbox firmware to this 50mb storage space. Of course, in order to do that we would probably have to turn rockbox itself into x86 code and use copies of the drivers from the OEM firmware. (Which of course OEM firmware dissection has gone slowly)

I'm still learning, but if any of my questions/theories seem far fetched, please lemme know.

BTW Creative released a new firmware version on June 25th

http://us.creative.com/support/downloads/download2.asp?MainCategory=213&Product=16002&dlcentric=10113&Product_Name=ZEN+Vision%3AM+30GB&filetype=4&OSName=Windows+XP

[samsharp99]

Question: is there a way to transfer whatever file I want into the 50mb storage space after deleting the firmware?

What I am trying to do is put my slightly modified nk.bin (changes a character string in the english localisation) into that 50mb space directly instead of using the update.exe to see if that causes it to load my firmware. We already know from mcuelenaere on epizenter that the nk.bin file is copied directly (raw) from the exe to the zen, maybe this is where it puts it, I was hoping If I can find a way to put the nk.bin file there myself I might be able to make some headway?

Hello everyone by the way! I have a Zen 60Gb and am very interested in helping this project wherever possible, read through this thread and the epizenter one, want to help out with my limited knowledge.

[wantondstrction]

Question: is there a way to transfer whatever file I want into the 50mb storage space after deleting the firmware?

What I am trying to do is put my slightly modified nk.bin (changes a character string in the english localisation) into that 50mb space directly instead of using the update.exe to see if that causes it to load my firmware. We already know from mcuelenaere on epizenter that the nk.bin file is copied directly (raw) from the exe to the zen, maybe this is where it puts it, I was hoping If I can find a way to put the nk.bin file there myself I might be able to make some headway?

Hello everyone by the way! I have a Zen 60Gb and am very interested in helping this project wherever possible, read through this thread and the epizenter one, want to help out with my limited knowledge.

I personally am not sure yet. It clearly exposes the 50mb in windows explorer. Not sure entirely what this means but it seems like an awful big coincidence that it would show itself as a 50mb storage space during that period. I'm also not sure that this defeats any sort of checksum routine. I'm just thinking that this is an opening. In other words not necessarily an unlocked door, but may have found the door itself.

EDIT: Well I tried to straight up copy the nk.bin file over to the 50mb and it gave me the generic error message of this player does not support this kind of file. I even tried renaming it to another extension to just get it on there and it was still wise to it.

Also, the nk.bin from the new firmware revision is 616 bytes larger than the old one.

[samsharp99]

yeah, that's what I was trying to do. It did also format my player's drive so I dont suggest doing it unless you have everything backed up.

It seems weird that it would show up as a storage volume but to make it impossible to transfer any files.

Does anyone have the zen vision m's own software installed, maybe the creative software for transferring files will allow it?

The only other thought I had was whether or not it is possible to replicate the USB transfer (since that makes it possible to transfer the file to this volume)?

[mcuelenaere]

Maybe, if you directly copy the file using WinExplorer or whatever; the internal WPD/MTP commands/properties are different as from the ones used during the firmware updating progress.
As you can see in my earlier post, I included some excerpts from the WPDMon HTML file in which there are some details of the creation of the nk.bin file, it could be that this exact command with exactly the same properties has to be executed in order to upload the nk.bin file.
I'll take a look at the WPD SDK (if there exists one) and try to program a little app for uploading the (altered) file.

But still, it appears that the checksum is checked on the ZVM itself, so we aren't any closer as of the beginning..

[samsharp99]

No you can't I tried that but windows explorer (under vista) won't allow it, do we know what the file-system is?

[mcuelenaere]

No you can't I tried that but windows explorer (under vista) won't allow it, do we know what the file-system is?

MTP serves it as Generic Hierarchical (0x2), but what the underlying FS is nobody knows atm (excluding Creative);
we should have a HDD-dump to know this.

[samsharp99]

Surely the vista drivers for it know the file system, as I can copy and paste my music onto the device hard disk with no problem using just windows explorer? Or is this again controlled by the firmware?

[saratoga]

Surely the vista drivers for it know the file system, as I can copy and paste my music onto the device hard disk with no problem using just windows explorer? Or is this again controlled by the firmware?

I don't think Vista can see the filesystem of an MTP device.  I think it just asks the device for a list of files, asks it to read a file, etc.  Its more like FTP then mounting a disk AFAIK.

[mcuelenaere]

Surely the vista drivers for it know the file system, as I can copy and paste my music onto the device hard disk with no problem using just windows explorer? Or is this again controlled by the firmware?

I don't think Vista can see the filesystem of an MTP device.  I think it just asks the device for a list of files, asks it to read a file, etc.  Its more like FTP then mounting a disk AFAIK.

Indeed, saratoga is right. Windows uses MTP/WPD to communicate with the ZVM, and this one accesses his HDD directly so it can decide which it want to be visible to the "outside".

[samsharp99]

I think that's as far as my contribution can go :S

I dont really know if there's anything more I can help with

[aaronwi]

I did a firmware "update" from 1.61.01 to 1.61.01 on my ZVM while running "Device Monitoring Studio 5.1",  and got this output, I don't believe anyone else used this program before; it gives a lot of info,  files included are the packet view, and the URB data, in basic format. (the program says URB data is the raw usb packets decoded)
Here's the data

http://www.fileden.com/files/2007/7/3/1236670/urb%20basic%20and%20packet%20view.rar
contains the basic output from the URB data window, and the regular packet view data, both RARed..less then a megabyte

http://www.fileden.com/files/2007/7/3/1236670/URB%20view%20html%20format%20%20complete.rar
the full version of the URB data...about 191 MB, and RARed to 30 MB, (contains hex views of each packet)

[aaronwi]

more goodies!!!

I couldn't get much from WpdMon, so I decided to try MtpMon, and here is the output
http://www.fileden.com/files/2007/7/3/1236670/verbose%20output%201.61.01%20to%201.61.01.rtf
I labeled each part of the log with #'s



http://www.fileden.com/files/2007/7/3/1236670/WPDmon%201.61.01%20to%201.61.01.rtf
was all I got from WpdMon, anyone know why It wouldn't log the initial upload?

I have XP sp2 and WMP11, by the way


also, in the installer, is the firmware nk.bin compressed/encrypted or anything, or can I directly modify it,
or is it possible to modify nk.bin when its in the temp folder, I tried before, but I believe its just overwritten just before the update process.

[samsharp99]

maybe if you were quick enough?!?!

[wantondstrction]

more goodies!!!

I couldn't get much from WpdMon, so I decided to try MtpMon, and here is the output
http://www.fileden.com/files/2007/7/3/1236670/verbose%20output%201.61.01%20to%201.61.01.rtf
I labeled each part of the log with #'s



http://www.fileden.com/files/2007/7/3/1236670/WPDmon%201.61.01%20to%201.61.01.rtf
was all I got from WpdMon, anyone know why It wouldn't log the initial upload?

I have XP sp2 and WMP11, by the way


also, in the installer, is the firmware nk.bin compressed/encrypted or anything, or can I directly modify it,
or is it possible to modify nk.bin when its in the temp folder, I tried before, but I believe its just overwritten just before the update process.

Did you make sure to turn on all the monitors in WPDmon? If not, try going to the Monitor tab in wpdmon.exe and turn all of them on. Also, if you delete wpdmon.htm that's in the exe folder, it'll give you an html readout that doesn't do stupid stuff like cut off parts. If you ever wanna clear it out, just delete it and it'll make a new one.