ZEN V/V Plus

[mcuelenaere]

Well, I didn't do much besides the few times you and me chatted about reversing with IDA, but I'm willing to give it another shot

So, after we get the LCD (and some other things?) working we could use parts of the ported Linux kernel?

Yes, that's how I should do it: try to get some output going on (most of the times this is the LCD because serial/JTAG is hard to find) and then go on with the rest.

One problem could be that the Zen V uses NAND flash and the structure of it hasn't been figured out yet (perhaps this is the same as the (NOR) flash dump of the ZVM?), but before you'll get there, there's still a long road to go

[MarcGuay]

An elementary wiki page can now be found here: http://www.rockbox.org/twiki/bin/view/Main/CreativeZenV.

[mcuelenaere]

I read this on epiZENter and wondered if there's another way to trigger this HW 'rescue' mode?

Perhaps (similar to the e200v2 models), this mode can be triggered when temporarily short-cutting the NAND flash chip..

If this would be true, this could perhaps make it possible to dump the ROM (if available) or NAND chip directly through USB (if someone could figure out the USB protocol).

Don't get me wrong: it is entirely possible to upload custom code to _all_ Zen players without any problem (see CreativeZVMPort wiki for more info on that), but this could make it possible to dump the NAND flash and/or other stuff.

edit:
@MarcGuay: where did you get that LCD information from?

[MarcGuay]

I found a way to get to the STMP3600 hardware recovery mode:  remove the battery and connect to USB.  Someone wrote a firmware extractor for the 3400/3500 series but I can't find the code for it.  In other news, I finally took a peak at the ZenUtils and found a few interesting differences in the Zen V firmware.  It looks as though FBOOT has been replaced by a very short file called FBCB which contains the strings "STMP", "BCB2", and "CACA" (either an inside joke or a coincidence).  Presumably this is because the Zen V bootloader exists in the STMP ROM and not on flash.  Some details of the ROM structure can be found in the Sigmatel Linux docs, I believe.

[mcuelenaere]

I found a way to get to the STMP3600 hardware recovery mode:  remove the battery and connect to USB.  Someone wrote a firmware extractor for the 3400/3500 series but I can't find the code for it.  In other news, I finally took a peak at the ZenUtils and found a few interesting differences in the Zen V firmware.  It looks as though FBOOT has been replaced by a very short file called FBCB which contains the strings "STMP", "BCB2", and "CACA" (either an inside joke or a coincidence).  Presumably this is because the Zen V bootloader exists in the STMP ROM and on flash.  Some details of the ROM structure can be found in the Sigmatel Linux docs, I believe.

About those strings, those are all common to Creative. I recognize the CACA from the Creative ZVM flash dump/FBOOT block (perhaps BCB2 too, I don't remember that one though).

Probably this bootloader is one of the first code to get runned upon device start-up (as is FBOOT on the ZVM) and it'll load either FRESC or Hjukebox2.jrm (depends whether the specific keys are hold or not).

[JohnDoeJr]

I need the Zen V Plus actually
Well, it only works if you have one; then download the firmware upgrader and when upgrading your  firmware, go to C:\CtJbFW\cttemp\, there will be a nk.bin file: copy it and send it to me.

I'd like RockBox firmware for my Zen V Plus because I want bookmarking that also remembers playlists.

mcuelenaere - do you still want a copy of the nk.bin file? If so, I'll reflash the latest v1.32.01 firmware to get it for you.

[mcuelenaere]

I'd like RockBox firmware for my Zen V Plus because I want bookmarking that also remembers playlists.

mcuelenaere - do you still want a copy of the nk.bin file? If so, I'll reflash the latest v1.32.01 firmware to get it for you.

There's already an easier way to get it: using ZenUtils.

And as I don't own the device, don't count on me porting Rockbox to it; you're better of doing it yourself.

[creativesansa333]

You can remove the firmware to upload your own by holding the play button down while turning the player on, which will display a recovery mode where one of the options is to completely remove the firmware, if that's any help to someone. I would also like to help port rockbox to the zen v plus but don't know how to go about it.

[StsIkel]

UK based 1GB Zen V plus free for anyone that wants to help develop rockbox on it....

[creativesansa333]

Well, my zen v plus 2GB's battery just died. I took it apart so I can help if you need any insight on a dissassembled zen. Unless, that is, I find a battery to replace the one that died.