Zune

[Llorean]

Basically, the Zune in theory has both some strong points (in regards to porting Rockbox) and very weak ones.

The bad: Until someone figures out a way to bypass the encryption so unsigned code can be run, there's really nothing much that can be done.

The good: Due to its similarities with the Gigabeat S, should the encryption be cracked or bypassed, in theory it will be a less onerous task than an entirely from-scratch port (though obviously, only in theory).

[Bagder]

Regarding wiki page, you need to register and get write permission and then creating or editing pages is easy.

Since the Zune runs some kind of Win CE, I figure it could be a good idea to scan the net for known buffer overflows in that or in one of the components the Zune uses to see if that could be an entry point to running custom code.

[JonathanHull]

I've been seeing a lot of cheap zunes online recently (as low as $80 once). I'm not much of a coder, but would it be helpful to the effort if I bought one and donated it to one of the devs?

[ecow7]

Yeah, I am hoping that all the cheap zunes on woot will spark some interest from the community.

I'm doing my research now, as I know almost nothing about running unsigned code or breaking encryptions or windows ce.

One thing I noticed, though, is that there is a GigabeatS option for the configure file in subversion.  Does this mean that they got past the encryption/signing issue?  Or is that just an early start of writing the drivers in case they ever do get that far?

[saratoga]

One thing I noticed, though, is that there is a GigabeatS option for the configure file in subversion.  Does this mean that they got past the encryption/signing issue?  

They did.  I believe it was done by someone working on the Zune actually, however the trick they used does not work on the Zune.

[svet-am]

this probably sounds pretty dumb, but have people tried exploiting the way that Zunes are "hard reset?"  According to the MS docs (MSKB 927001) during the hard reset the Zune first formats itself and then re-copies the firmware from the host PC to the player.  Now, this assumes that the bootloader is smart enough to handle these low level transaction and will probably be looking for properly signed code.  But, I thought I'd throw it out there just to stimulate discussion about this.

I picked up a zune for $85 from w00t and I really like the player.  But, I'd like to have Rockbox and/or Linux on it to make it work better with my Linux desktops.

[tweezer]

The Guy from http://www.streamcentric.com/zune find JTAG and SERIAL connectors on clean side of PCB:

Serial:
Rx - 4
Tx - 5

JTAG:
TRST - 8
TDI - 9
TMS - 10
TCK - 11
TDO - 13

Power:
+3.3 - 6
GND - 17,18,19,20

You may want to be careful here. Give this a read...
http://www.freescale.com/files/32bit/doc/white_paper/IMX31SECURITYWP.pdf
Section 5 (Hardware Security) refers to security faults causing the Red Ram to be zeroed and yer device being pooched. One of those security faults potentially being any JTAG manipulation. The person who posted that on their site said they "sacrificed" their Zune. Soooo... maybe Microsoft uses that security feature.

[zivan56]

I used Windows and modified the proper registry key to make it show up in My Computer, but that did not allow files to be copied to it.  Instead, I had to run the Zune software and end the process while it was converting a movie in order to have read/write/delete access to it.
Long story short, it will read ANY jpeg and ANY wmv video, no matter the size.  It will display them without issue (except for being very slow) even if you didn't use the Zune software to send it.

Are there any recent wmv/jpeg exploits that could be tried on the device?  It would have to inject ARM code...a long shot but it may work.  Any thoughts?

[tipok]

Are there any recent wmv/jpeg exploits that could be tried on the device?  It would have to inject ARM code...a long shot but it may work.  Any thoughts?

I found that zune (v1.1 fw) reboots after playing VLC-encoded files.
Maybe media player inside zune (windows media player mobile) have leak while playing asf files with WMV2+MP3 You can try to encode some file to asf and play it on zune. You will see result.

[zivan56]

What is now needed is for someone to go through the firmware and find an exploit.  The DLL files for the OS are easily extracted and do not appear to be encrypted.  Forcing people to downgrade is not really an option until rockbox fully works on the player (especially USB host).  The Gigabeat S port is progressing, so most of the base level stuff should work on the Zune.

[zivan56]

Is anybody interested in the hard drive contents?  I could perhaps find the right ZIF <-> ATA adapter and post it.  Perhaps someone could then find an exploit of sorts and I could write it to the disk to test it.  I also found a bunch of datasheets for this player, but they all say "confidential" (like the FM tuner for example), yet they are available of many sites.

[LambdaCalculus]

Although not strictly related, the contents of a Gigabeat S hard drive were read by dropping the drive into an iPod video and using the iPod's emergency disk mode to read the contents. This was mentioned on the Gigabeat S wiki page.

If you can get a cheap iPod video, you can read the drive that way. Seeing the contents of a Zune 30 (as the old Zunes are called now) would be useful, but it's going to be the encryption on the firmware that we have to worry about.

[Chronon]

You can also get USB enclosures for 1.8" ZIF drives for pretty cheap at online auction sites these days.  

[zivan56]

Ok, I got a ZIF to IDE adapter and could not get it to show up on 2 different computers.  I could hear/feel the disk spin up and down, but it was not identified in the BIOS of either computer.  I guess I will order a USB one just in case.

[bipton]

It may be like the xbox drives.... they are locked, you read them by booting the xbox and hotswapping the cable from the box to your pc. This may be possible to do IF you can supply voltage to the drive by another means than the zune itself, so you had room to remove the cable after it is unlocked and plug it into whatever interface your trying to use to access it.