Creative Zen Vision:M

[wantondstrction]

I'm starting to get somewhere on transferring firmware.

To sum it up, I managed to use directmtp to transfer OFFICIAL firmware onto the device. I don't have an altered nk.bin. (Nor the skill to create one that is stable.) If someone would upload one they feel is stable I'll attempt to upload it to my player. I managed to get the sendobjectinfo and sendobject commands down fairly well. Once the firmware is transfered onto the ZVM it more or less takes it from there by itself.

If someone can manage to alter nk.bin to where it has some sort of noticeable difference. (maybe a different version number?) I would be greatly appreciative.

If anyone wants directmtp, let me know what OS you're using and windows media player version. It only comes in vista or xp format but is a pretty powerful tool.

[samsharp99]

yes please, im using vista x64 if you wouldn't mind, I have an altered nk.bin for my 60gb zen. on WMP 11.

[wantondstrction]

yes please, im using vista x64 if you wouldn't mind, I have an altered nk.bin for my 60gb zen. on WMP 11.

Vista version. Fairly certain this will work with x64 edition. I'm using the vista version on 32 bit and can tell you it works.

http://rapidshare.com/files/41255138/DirectMTP_Vista.zip.html

Here's the Vista directions. XP is a little different...

1. Verify that target MTP device is installed, connected and turned on.

2. Make sure there are no scanners, cameras or web-cams connected to the PC aside from the target MTP device.

3. Replace the WPD MTP driver for the device with the test driver

3a. Access the Device Manager (type “Device Manager” in the Start menu)

3b. Right click on your MTP device in Device Manager and choose “Update Driver Software”

3c. Choose “Browse my computer for driver software”

3d. Enter the path of your DirectMTP directory and click Next.

3e. Please choose “Install this driver software anyway”

3f. Your device should be installed correctly.

4. Run "mtpinfup.exe" from an elevated command line to finish configuration for DirectMTP.

5. Start DirectMTP and click Open Device.

6. If device is opened successfully, you will be able to proceed with execution of MTP commands.  Results of operations are displayed in the right pane.

7. To return the device to normal operation, run "mtpinfup.exe post" from an elevated command line.  This will restore the original WPD MTP driver settings for that device.


Now for transferring firmware. This is what worked for me on the 30 gig, not sure if the commands are exactly the same on the 60, or even on somebody else's player. Anyway.

Open Device

Open Session (I just used Session ID 1)

Send Object Info

  Destination Storage ID = 0x10001 (65537)
  Destination Folder Handle = 0xFFFFFFFF (-1)
 
  Format code       = 0xb802 (UNDEFINEDFIRMWARE)
  Protection status = 0x0000 (No Protection)
  Compressed size   = (use the size of the nk.bin you're transferring)
  Thumbnail format  = 0x3000 (FORMATCODE_UNDEFINED)
  Thumbnail size    = 0
  Thumbnail width   = 0
  Thumbnail height  = 0
  Image width       = 0
  Image height      = 0
  Image bit depth   = 0
  Parent obj handle = 0x00000000
  Association type  = 0x0000 (not association)
  Association desc  = 0x0000 (unused)
  Sequence number   = 0
  File name         = nk.bin
  Capture date      = (leave blank)
  Modification date = (leave blank)
  Keywords          = (leave blank)

Click OK, wait for a positive response from your player

From there hit send object and select your nk.bin.

I would recommend using wpdmon to see what your 60GB zvm is transferring during an official firmware upgrade to see if it's using the same protocol for everything. Particularly, the format code. It SHOULD be fine, however I take no responsibility for your player bricking, burning your house down, or global warming. lol

[saratoga]

If someone can manage to alter nk.bin to where it has some sort of noticeable difference. (maybe a different version number?) I would be greatly appreciative.

If anyone wants directmtp, let me know what OS you're using and windows media player version. It only comes in vista or xp format but is a pretty powerful tool.

Can you just open the file, search for a string that you know is displays, and change a letter from lower to upper case or something equally simple?

[samsharp99]

that's what im trying to do. changed some of the english language text

however I take no responsibility for your player bricking, burning your house down, or global warming. lol

hahahaha....we've been having some funny weather here recently *glares*

oh, and in case anyone wants to know how to edit their nk.bin to modify it, when you run the official firmware upgrader it saves the nk.bin to c:\CtJbFW\cttemp so you can copy it to your drive (it deletes it afterwards im pretty sure) you can then open it with a hex editor like 010 Editor, and if you scroll down the lines to about... 34:0A00h (for the 60gb firmware) you get the english language section.

will update this post if i am successful.

UPDATE: can't get wpdmon to log anything. ran the .cmd as administrator, connected my zen, ran wpdmon, started monitoring, nothing. am i missing something?

[mcuelenaere]

nice nice

I would test it myself, but am having trouble my PC recognizing my ZVM :s

If you just change the checksum, nothing is changed in the firmware itself but you could see if the transfer would succeed with an altered checksum.

Here is such a file:
http://www.verzend.be/v/114342/ZENVisionM_30GB_PCFW_L21_1_62_02_nk_altered.rar.html

[gitrdone300ex]

Hey everybody I'm new to the forum but would love to have rockbox on my zen and will help in anyway i can.

Has anyone gotten DirectMTP.exe to run in vista x64? evertime I try it crashes. I got the test driver installed fine but I just get an error everytime I try to run DirectMTP.

[samsharp99]

Not tried it yet as I need the wpdmon output before I try and do it as im using the 60gb zen so need to see if it's different.

[aaronwi]

Did you make sure to turn on all the monitors in WPDmon? If not, try going to the Monitor tab in wpdmon.exe and turn all of them on. Also, if you delete wpdmon.htm that's in the exe folder, it'll give you an html readout that doesn't do stupid stuff like cut off parts. If you ever wanna clear it out, just delete it and it'll make a new one.

Yes, I did all of that, and still nothing, only thing logged is the connection and disconnection of the usb to zvm cable

I would test it myself, but am having trouble my PC recognizing my ZVM :s

try http://www.fileden.com/files/2007/7/3/1236670/mtp%20driver%20fix.rar
Found it on another forum, fixed the problem with my zen not showing up/being usable

[aaronwi]

just curious, did anyone find my log dumps useful?

also, anyone know whats going on here?...
"  
Item 10 of 60:
    Object handle   = 0x65
    Property code   = PersistentUniqueObjectIdentifier (0xDC41)
    Data type       = UINT128 (0xA)
    Value           = Array (4 elements) = {0x65, 0x0, 0x0, 0x0}
"

I notice 0x65 is in a list of addresses I got from the MTPmon log
Other Items also show up using different addresses
And, an array of 4 elements? What can all of those be for?

"
Data (from device, 52 bytes) - 0x59 Unknown, 0x0 NotUsed, 0x65 Unknown, 0x0 NotUsed, 0x5d Unknown, 0x0 NotUsed, 0x61 Unknown, 0x0 NotUsed, 0x79 Unknown, 0x0 NotUsed, 0x69 Unknown, 0x0 NotUsed
"

[Hitman2k7]

If you just change the checksum, nothing is changed in the firmware itself but you could see if the transfer would succeed with an altered checksum.

Can you tell me how i can change the checksum?

[mcuelenaere]

Can you tell me how i can change the checksum?

The easy way: download http://www.verzend.be/v/114342/ZENVisionM_30GB_PCFW_L21_1_62_02_nk_altered.rar.html
(its checksum has been changed)

The DIY way: use a hex editor and go to the last 20 bytes: these contain the checksum, change them to whatever you want, it makes the checksum incorrect.

[mcuelenaere]

Damnit, the player checks the checksum

First, I tried upping a modfied file, which gave me:
SendObject: Operation failed, response = MTP_RESPONSECODE_ACCESSDENIED

Then I upped the correct one, which gave me:
SendObject: sent 21767736 bytes, response = MTP_RESPONSECODE_OK

A small comment I noticed, my ZVM gave that responsecode pretty fast; so it must be computing the checksum while it is receiving the firmware, cause computing the SHA-1 checksum even on a 1,0Ghz comp takes 10 to 15sec ...

P.S.: XP users trying to use DirectMTP: http://www.verzend.be/v/6860021/DirectMTP.rar.html

[Hitman2k7]

Right, checksum check is made by the player.
I modified the updater to transfer a different nk.bin than the one which comes with the updater.
It gives an Update failed error after transfering the file  

[wantondstrction]

Well, alas, I can't get an altered nk.bin onto the player by those means. I can still get the official nk.bins on there that way though. Every time I try I get an Access Denied error. I'm gonna keep plugging along.

I knew it was too good to be true, but it seemed positive when the official one worked.

I even tried formatting my player to limit the amount of objecthandles that popped up, but none of the objecthandles given matched firmware remotely.


At this point, I'll state some of the obvious.

1. The player itself does the checksum

2. The official firmware loader is relatively pointless. (It's more or less just a long command line to interact with the player doing the directMTP functions.)

3. Mcuelenaere, you're right. I tested that theory out by altering different parts of the code on a few different nk.bins and some failed noticeably quicker than others.

Has anyone tried removing the last 20 bytes of an nk.bin altogether?

Edit: Oddly, I managed to get an altered nk.bin onto the player. I had a program crash and it quit watching what file formats were being copied onto the player. It hasn't done anything and hasn't upgraded the firmware or done anything with it. It's just there. All I did was copy and paste during a huge transfer after a program crash. (reloading my music after formatting)

It's chilling next to devlogo.fil and so on. It's not that this means much of anything, but it's further than I've managed to get to date. I'm looking into isolating exactly what happened.

(I realize this doesn't help with the checksum)