Rockbox Technical Forums

Rockbox Development => New Ports => Topic started by: LambdaCalculus on July 02, 2007, 08:17:25 PM

Title: Dell Digital Jukebox
Post by: LambdaCalculus on July 02, 2007, 08:17:25 PM
I may not be much of a real coder yet (I'm still a padawan  ;) ), but I can at least be one hell of an information ferret.

I recently purchased a 1st generation Dell Digital Jukebox from eBay for pocket change. The DJ has a bad hard drive, but I can easily fix it. Anyways, seeing as how the TMS320 and its derivatives seem to be a big topic going around due to the Creative ZEN Vision:M port, I had a notion:

Once one TMS320-based device is up and running, how hard would it be to bring in more devices that use the same family of CPUs?

Despite being branded by (ugh) Dell, the Digital Jukeboxes were rather interesting devices. Basically a rebadged Creative ZEN, the Dell DJs had most of the same features as Creative's early players, but with some cosmetic changes.

I'm currently trying to gather up as much information about the hardware as I can, but I wanted to know if anyone else would be interested in seeing the Dell DJ become a proud new addition to the family.
Title: Re: Dell Digital Jukebox
Post by: JdGordon on July 02, 2007, 09:27:48 PM
I think the tms320 ports will all be similar to the portalplayer ones, most of the firmware code will be the same with various changes to suit to specific model
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on July 02, 2007, 09:37:59 PM
Very true, I say. Once the core works, we can just build around it.

The only problem I'm having now is that the Dell DJ's drive is toast, but like I said, a friend of mine has a replacement waiting for me which I'll be picking up later this week. And I'm on the verge of banging my head on a brick wall trying to mount the drive on a Windows box; the bloody thing needs a driver from Dell. Only thing is, however, that the driver doesn't do anything.

Once I finish fixing up my laptop, I'm going to see if I can mount it and at least start gathering the partition table for the hard drive... it's the least I can do right now.
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on July 06, 2007, 08:58:14 AM
I just managed to get the Dell DJ back up and running. I'm currently looking for the data sheets for the hardware in the device. I should have a wiki up for it soon enough... and hopefully faster than the Archos AV1XX page.  :P

Can anyone else help supply a little extra information about the Dell DJ? I am looking for information about the Generation 2 and the DJ Pocket, specifically.
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on August 30, 2007, 08:09:52 PM
First findings on my Dell DJ; sorry for multiple posts in a row, guys.

Hooked the DJ to my Linux laptop and ran lsusb -v on it. Here's the results:

Quote
   
Bus 005 Device 003: ID 041e:4111 Creative Technology, Ltd Dell Digital Jukebox
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass       255 Vendor Specific Subclass
  bDeviceProtocol       255 Vendor Specific Protocol
  bMaxPacketSize0        64
  idVendor           0x041e Creative Technology, Ltd
  idProduct          0x4111 Dell Digital Jukebox
  bcdDevice            0.01
  iManufacturer           1 Creative Technology
  iProduct                2 Dell Digital Jukebox
  iSerial                 3 010125511E038C01
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          4 Media
    bmAttributes         0xc0
      Self Powered
    MaxPower              440mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass    255 Vendor Specific Subclass
      bInterfaceProtocol    255 Vendor Specific Protocol
      iInterface              5 PDE1
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0200  1x 512 bytes
        bInterval               0
Device Qualifier (for other device speed):
  bLength                10
  bDescriptorType         6
  bcdUSB               2.00
  bDeviceClass          255 Vendor Specific Class
  bDeviceSubClass       255 Vendor Specific Subclass
  bDeviceProtocol       255 Vendor Specific Protocol
  bMaxPacketSize0        64
  bNumConfigurations      1
Device Status:     0x0000
  (Bus Powered)

More to come, including that bloody wiki page... :P
Title: Re: Dell Digital Jukebox
Post by: Bagder on August 31, 2007, 03:08:35 AM
Interesting stuff to figure out, apart from the PCB scans etc is the upgrade firmware file format.

Also, for everything DM320-based it is worth checking out the Archopen project since they have code actually running already on (Archos) DM320-based targets. I've seen claims they even have sound going (through the DSP that accesses the DAC).

Oh. and of course there's also Neuros OSD that is open source on DM320 hardware, although of course all the really tasty parts aren't open at all...

There is "leaked" DM320 docs out there.
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on August 31, 2007, 07:32:52 AM
I'm going to download the firmware updates from Dell and post them on the wiki page when it goes up.

I'm also reading up on Archopen, and I did download the source for it. But it may be some time before I can get any real work done because of school and work. I'll keep you guys posted.

(EDIT-2007/09/01): The (very preliminary) wiki page is up and running here:

http://www.rockbox.org/twiki/bin/view/Main/DellDJPort

(EDIT-2007/09/07): I just spent my entire lunch hour opening up the entire Dell DJ. I'm going to try and get some pictures and scans of the components later on this weekend.
Title: Re: Dell Digital Jukebox
Post by: wesmo on September 18, 2007, 06:45:42 PM
I've been interested in getting a zen xtra port together - if youve looked at the zen touch wiki page (http://www.rockbox.org/twiki/bin/view/Main/CreativeZenTouch) you'll notice that all of the information there is relevant to the dell dj port (considering they are all njb 3 players).
It's possible I could get hold of another Zen Xtra and donote it to rockbox if there are some developers interested?? :)

 Most of the work on the zen vision port (http://forums.rockbox.org/index.php?topic=3320.0) should be relevant too - since the playsforsure firmwares that were available are similar.
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on September 19, 2007, 06:31:57 AM
What I have found is that Creative seems to have kept consistency with their players. When I removed the hard drive from the Dell DJ and plugged it in, it boots into a Rescue Mode, with options to format the hard drive, reload the firmware, check the hard drive for errors (if it's present), or reboot the device. This is very similar to some of the other Creative DAPs.

But it's very hard to navigate the Rescue Mode on the Dell DJ with a bare PCB, because the scroll barrel on the DJ is mounted on the inside of the front case, with small gold contacts that touch five points on the scroll pad. I think it has to maintain a certain amount of contact in order for the barrel to work, but it's hard to hold it down while you've got a bare board. I'll keep trying.

In the meantime, I'll give you the link to the Dell DJ wiki page:

http://www.rockbox.org/twiki/bin/view/Main/DellDJPort

If you have any good info about the DJ, feel free to add it to the page!
Title: Re: Dell Digital Jukebox
Post by: zook on September 20, 2007, 10:57:13 AM
I've been looking at the firmware of various Zen players and discovered something which holds true for the Dell DJ as well.
The FRESCUE segment of the DellDJ_1_20_03.exe firmware is completely unprotected and I've discovered how the contents is mapped into memory.
The FRESUCE segment starts with a header:
Code: [Select]
struct R_HEADER {
    BYTE  Tag[4]; // "CODE"
    DWORD Size; // Length of segment, excluding header.
};
It's followed by a DWORD which I'm not certain what is. It could be an entry point but I haven't remapped my disassembly yet, so I'm not certain.
Then comes an array of section objects:
Code: [Select]
struct R_SECTION {
    DWORD Address;              // The address which Content get's read to.
    DWORD RawSize;             // The size of the data to read.
    DWORD MappedSize;       // Not certain about this one. Sometimes it's larger than RawSize, other's it's less.
                                            // My guess it's used to allocate more memory than is present in Content.
    BYTE      Content[RawSize]; // This is the data that get's copied to Address.
};

It's worth noting that if you're using IDA you need to select TMS320C55x as processor type. However, there's probably half a dozen of instructions which it doesn't recognize. Such as: ec318e0033e8             AMAR *(#033e8h),XAR0

I've also been looking at TI's Code Composer Studio, which is what the firmware is most likely written in.
The entry point function of any given project contains a unique signature which I've been able to locate within the firmware. I'm not certain if posting disassembly is allowed on the board, so I'll just point you towards the function _c_int00. This function is responsible of intiailizing the environment and calling the 'main' function of your project.
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on September 20, 2007, 11:12:49 AM
Excellent!! No protection to hassle with means that we shouldn't have much trouble alternate firmware to work.

zook, can you add this info to the wiki?
Title: Re: Dell Digital Jukebox
Post by: zook on September 21, 2007, 01:49:55 PM
Excellent!! No protection to hassle with means that we shouldn't have much trouble alternate firmware to work.

zook, can you add this info to the wiki?
Sure. I'll have to think about how to best arrange it. The information applies to select versions of the Dell DJ, Zen Micro, Zen Touch and Zen Xtra. So we'll probably need a shared page with information about the firmware in these models.

I've written a loader plugin for IDA, which handles the FRESCUE address mappings.
And I'm currently working on fixing the TMS320C55 processor plugin. As it turns out it's actually missing 14 instructions out of 393, so there's a bit of work in determining what needs to be added.
Once that is done I'll have a go at producing signatures from the TI libraries, which the firmware uses.
This should give us a good basis for exploring the rescue mode software. I'll add source and binaries to the wiki when I get so far.

Now, I should probably add that I own neither of these models (or any other for that matter). I'm hoping that looking into these will shed some light on what happens in the new versions. Most of the models introduce the NULL signature block, in their later firmware revisions, which is what is holding back progress on the Vision:M. So the entrance into the protected firmware must lie within the unprotected ones. I'll of course share whatever relevant bit's I discover but ultimately my focus is towards the newer models.
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on September 21, 2007, 03:13:01 PM
zook: Here's the Dell DJ wiki page: http://www.rockbox.org/twiki/bin/view/Main/DellDJPort
Title: Re: Dell Digital Jukebox
Post by: mcuelenaere on September 22, 2007, 09:48:03 AM
Hi zook,
could you share your IDA loader plugin because I'm having trouble identifying the FRESCUE address mappings.
The only things I discovered are the two blocks (CODE & CENC) and a lot of strings.
Title: Re: Dell Digital Jukebox
Post by: zook on September 22, 2007, 10:35:55 AM
zook: Here's the Dell DJ wiki page: http://www.rockbox.org/twiki/bin/view/Main/DellDJPort
Right. I just got permission's, so I'll have a look at getting the info added.

Hi zook,
could you share your IDA loader plugin because I'm having trouble identifying the FRESCUE address mappings.
The only things I discovered are the two blocks (CODE & CENC) and a lot of strings.
Sure. Here's the source and a binary built for 5.0: http://www.mediafire.com/?ftddmjbxzsn
If you need to build it for another version, you'll have to extract it to the \sdk\ldr\ directory.
It only works for big-endian models right now. There's no point supporting the little-endian's right now, as they're all protected.
The firmware's that I've tested it with so far are:
DellDJ_1_20_03.exe
ZenMicro_PCFW_L4_2_00_12_MTP.exe
ZenTouch_PCFW_L4_1_01_03.exe
ZenXtra_PCFW_LA_1_20_08.exe

There's two things to be aware of once you get a firmware loaded:
1) The following two instructions are not supported by the disassembler (I'm working on that, though):
  10010000 XSSSXDDD          MOV  xsrc, xdst
  11101100 AAAAAAAI XDDD1110 AMAR Smem, XAdst
2) There's an ISR table of 32 entries starting at address 0x200. Each entry consist of 8 bytes. It starts with a status byte(IIRC) then a 24-bit address of the ISR handler, and 4 filler bytes.
The first entry is the reset handler and it points to the function named _c_int00 (in the TI source), this is the starting point of the rescue mode software.
Title: Re: Dell Digital Jukebox
Post by: zook on September 22, 2007, 12:53:02 PM
Okey. I've just added a new section to the Dell DJ wiki page.
I've tried to include everything that I could think of, pertaining to the firmware.
I'll add the program I've been using to extract the firmware, once I've updated it to handle big-endian files.
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on September 22, 2007, 12:57:19 PM
Thanks, zook. I'm going to keep experimenting with this to see what else I can find.

I'm going to be a little busy in the next few weeks with some personal stuff I have to take care of, but I'll try to keep working on this when I get some time.
Title: Re: Dell Digital Jukebox
Post by: zook on September 22, 2007, 01:03:02 PM
Thanks, zook. I'm going to keep experimenting with this to see what else I can find.

I'm going to be a little busy in the next few weeks with some personal stuff I have to take care of, but I'll try to keep working on this when I get some time.
No problem, I'm used to being on my own, anyway :)
Title: Re: Dell Digital Jukebox
Post by: zook on September 24, 2007, 03:03:37 PM
Right, so I figured I'd post an update on things.
I've managed to get a disassembly of FRESCUE, it leaves a lot to be desired but it's useable.
The rescue mode software is located in the section of code which get's loaded at 0x840000.
I've found the main loop of the rescue menu and the functions which handles menu choices. I haven't fully investigated the ReloadFirmware code path, but there doesn't seem to be anything interesting there.
I've also found a function which parses the firmware archive format, from what appears to be a local file named upgrade.jrm.
The CINF block get's matched to a hardcoded device name string, as expected.
The CENC or TL block get's written to the local file jukebox2.jrm.
The DATA blocks, as assumed, get's written either to flash ram(F*) or the harddisk(H*).
The EXT0 block get's written to an internal device, either mcu0 or ide0. The P prefix to the device name does not appear to be checked.
The version I'm looking at checks for two extra block names: CODE and _PIC. CODE is related to CENC/TL and _PIC is related to mcu0, I haven't checked them indepth.
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on September 24, 2007, 03:10:05 PM
zook, do you go to the IRC channel often? Maybe we can speak with the other devs about this as well.
Title: Re: Dell Digital Jukebox
Post by: zook on September 24, 2007, 03:22:16 PM
zook, do you go to the IRC channel often? Maybe we can speak with the other devs about this as well.
I've tried using the web interface a few times but it lags and ends up disconnecting me every 5 minute or so.
Title: Re: Dell Digital Jukebox
Post by: mcuelenaere on September 24, 2007, 03:23:53 PM
Could mcu0 stand for microcontroller unit?
Title: Re: Dell Digital Jukebox
Post by: zook on September 24, 2007, 03:29:36 PM
Could mcu0 stand for Memory Control Unit?
I suppose. Could also be Micro Controller Unit.
The devices are implemented in a polymorphic manner, which I haven't been able to track down at first glance. What I'm missing is the point where they're registered.
Title: Re: Dell Digital Jukebox
Post by: zook on September 27, 2007, 10:17:36 AM
I've added zenfirm.rar (http://www.rockbox.org/twiki/bin/viewfile/Main/DellDJPort?rev=1;filename=zenfirm.rar) to the wiki page. It has 3 functions, extracting the firmware from the updater, displaying information about the firmware and splitting the firmware into seperate files. It includes heuristics for locating the firmware offset and key.
I've tested it with models from the NOMAD Jukebox 3 up to the Zen Vision: M. However, let me know if you run into problems with it.

The NOMAD Jukebox 3 uses the _PIC block which I mentioned earlier. The block data looks like the kind of ascii format you'd use to program an EEprom. I haven't checked which exact format it is, but it would definitely be interesting to see what the decoded code looks like.
My guess is that it contains the on-chip boot-loading code. Further more, I believe that EXT0 in the newer models fulfills the same purpose, with the main difference being that the EXT0 data is encrypted.

I've also discovered that the CENC/TL block get's read, validated and decoded/decrypted by the FRESC block code. I believe I've also found the code which displays the splash screen. To me this suggests that FRESC provides the base OS.

Now, that just leaves FBOOT unaccounted for. In some of the documentation I've read there's a mechanism refered to as a secondary bootloader. The reasoning behind this construct is that the on-chip boot loader is limited to reading a fixed amount of data into a fixed location. To work around this limitation, you'd create a secondary bootloader which is small enough to fit, and capable of doing the full boot. My guess is that FBOOT is such a device.

So if all my assumptions hold up, that leaves an execution sequence like this:
_PIC/EXT0 -> FBOOT -> FRESC -> Jukebox2.jrm (CENC/TL)

I'm currently trying to work out the encryption/encoding of Jukebox2.jrm. That'll mostlikely open up the door to examining FBOOT too, as they both contain similar artifacts.
If anyone feels like working on the ascii encoding used in the _PIC block used in the NOMAD Jukebox 3 firmware, that would be a great help. We need to understand the roles of the above mentioned components, as that'll be our only way into the fully protected firmware versions.
Title: Re: Dell Digital Jukebox
Post by: mcuelenaere on September 29, 2007, 06:59:06 PM
For people who are too lazy to extract the _PIC themselves: http://www.verzend.be/v/2031877/JB3Upgrade_1_20_0_r_PIC.bin.html

@zook: I tried running it through IDA, but didn't came with something usefull. Which processor/architecture do you think it is running ? C55x ?
Title: Re: Dell Digital Jukebox
Post by: zook on September 30, 2007, 10:12:38 AM
For people who are too lazy to extract the _PIC themselves: http://www.verzend.be/v/2031877/JB3Upgrade_1_20_0_r_PIC.bin.html
I believe the ascii encoding is what the 010 editor calls Intel 32-bit Hex Code (see the Copy As menu).

@zook: I tried running it through IDA, but didn't came with something usefull. Which processor/architecture do you think it is running ? C55x ?
The TMS320DSC24 manual (http://www.archopen.org/tiki-download_file.php?fileId=6), which should be similar enough, states that the ARM core is booted first and that it's responsible of resetting the DSP core.
The ARM core is a Micro Controller Unit, so it would make sense that _PIC/EXT0 contains the ARM boot code.
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on September 30, 2007, 12:44:17 PM
The ARM core is a Micro Controller Unit, so it would make sense that _PIC/EXT0 contains the ARM boot code.

I believe you're right, zook. Why would it be any other way?
Title: Re: Dell Digital Jukebox
Post by: zook on October 07, 2007, 08:12:43 AM
It's been a busy week for me, so I haven't had all that much time to look at this.
However, I'm just one function short of having codified the CENC decoding.
The algorithm is a run length encoding variant. The first 32-bit word of the CENC block is the decoded size, then follows the sequences of encodings. The two most significant bit's of the first 8-bit word determines which type of encoding the sequence is. 0x80 and 0xC0 are repeated character block types (effectively memset's), with different length encodings. 0x00 and 0x40 is the type which I'm missing, I haven't traced it enough to describe it, but it's much more elaborate. My guess is that it's used to decode repeated patterns, but it goes hay-wire in the simulator so I can't say for sure.
Anyway, if any of this sounds familiar to anyone, then please chip in. I've had a feeling of deja vu since I first glanced at the code, but I still can't place where I've seen it before.

As an aside I've looked at the flash related code a bit and it seems like it provides these name mappings: TSIG, BOOT, CONF, TOC0, PFM1 and RESC. I was hoping to find code to decode/decrypt the BOOT block but so far I haven't found any. I'll need to fix the processor module though, there's too many important things missing currently.
I've also found the lowlevel functions which are used to erase or program the flash, so that should make an excellent starting point for working out how flash entries are processed during a firmware upgrade.
The flash functions in the Zen Micro firmware (the latest unprotected version) indentifies and accept 3 different types of SST flash chips. ID: 0xBF and 0x2780/0x2781/0x2782. I haven't cross-checked with the Dell DJ, but my guess is that it's the same. Why else would they accept different types?
Title: Re: Dell Digital Jukebox
Post by: mcuelenaere on October 11, 2007, 04:13:56 PM
In segment003 of FRESC of DellDJ_1_20_03_rk.bin there are a lot of BE EF and FE EB; also some FF FF FF ..
These remind me of the minifs/cfs filesystem described on nomadness;
could this be a (mini-)implementation of this filesystem (e.g. for emergency purposes)?

I tried finding those docs where this is described, but can't find them anymore...
But in the HDD-dumps posted on epiZENter you can also find some BE EF and FE EB's (these are probably boundary markers).
Title: Re: Dell Digital Jukebox
Post by: zook on October 11, 2007, 06:43:28 PM
In segment003 of FRESC of DellDJ_1_20_03_rk.bin there are a lot of BE EF and FE EB; also some FF FF FF ..
These remind me of the minifs/cfs filesystem described on nomadness;
could this be a (mini-)implementation of this filesystem (e.g. for emergency purposes)?

I tried finding those docs where this is described, but can't find them anymore...
But in the HDD-dumps posted on epiZENter you can also find some BE EF and FE EB's (these are probably boundary markers).
Ohh, FRESC does contain a filesystem implementation. I'm not sure the BE EF and FE EB blocks are referenced anywhere, though.
I've gathered a list of the most important functions that I've named in my disassembly:
Code: [Select]
00849EB4 RescueModeMenu // Handles the rescue menu.
00849B60  ReloadFirmware
00849C38  FormatAll
00849DAC  CleanUp

0084BA08 Bootup // Is responsible of intializing everything.
0084D65C  System_Init
00800000   Chip_Init
00801A64    Lcd_Init // Device construction and registration.
00804084    Adc_Init // --||--
0080421C    Iic_Init // --||--
00802064    Rtc_Init // --||--
00804734    Mcu_Init // --||--
00809750   Flash_Init // --||--
00848480   Usb_Init // --||--
00808EB0  Ide_Init // --||--
0084D100  ReadJukeAndSplash // Loads the player software and the splash bitmap.
0084C130   cenc_decode // Decompresses the player software.

0084A5BC ProgressUpgrade // Handles the firmware archive, which is stored locally as upgrade.jrm.
0084C1AC  ParseCIFF // Parses the firmware archive, validates it and stores each entry according to their type.

00800164 Device_Register // Is used to register a device class instance.
008004AC Device_Open // Is used to access a device class instance.

00806804 Object_Init // Based on how these functions are used, I'm guessing that they're synchronization primitives. But I could be wrong.
00806854 Object_Lock
00806880 Object_Unlock

0080304C _fopen // Provides access to the filesystem.
00803610 _fread
00803BE5 _fwrite

Im including the IDA plugin that I've been using, it's far from perfect but it's a step in the right direction: http://www.mediafire.com/?1mt2xznax33
Once again, the source is included along with a pre-compiled binary for IDA 5.0.
Once you've copied it to the plugins directory and loaded your FRESC file, you need activate the plugin by selecting Edit->Plugins->TMS320C55 processor extender.
It will extend the processor module to handle the two previously mentioned instructions, but it doesn't output the instruction text properly, so sometimes parts of or the whole instruction line is missing.
There's two more instructions which aren't handled at this point, because I haven't been able to find any documentation on them.
I plan to fix as many of the issues as I can once I've gotten the player software fully decoded.


Regarding the CENC encoding. I've gotten my code to the point where it produces the same output as the simulator in single case use. However, there's some logic or indexing error(s) in the code, which derails the decoding. So there's still some work left.
Title: Re: Dell Digital Jukebox
Post by: mcuelenaere on October 27, 2007, 12:04:34 PM
Zook, could you post your program regarding the CENC decryption (binary/source) so others could look into it?
Title: Re: Dell Digital Jukebox
Post by: zook on October 27, 2007, 06:08:56 PM
Zook, could you post your program regarding the CENC decryption (binary/source) so others could look into it?
Sure, I was meaning to add some other stuff to it first but I haven't had the time. I've updated the file on the wiki.
This obviously paves the way for running dsp code on any zen based devices using the CENC encoding.
The player software (CENC/jukebox2.jrm block) uses the same fileformat as the rescue mode software (FRESC block), which is described on the wiki.
The player software also contains a copy of the TI DSP/BIOS RTOS, located at address 0x39800, which means that the player software replaces the rescue mode software in memory.

Here's a few suggested next-steps for the Dell DJ port:
- Write a CENC encoder/compressor. (Just invert decode_pattern in cenc.cpp and split the file into 64K encoded blocks)
- Write a firmware updater patcher. (It would be safest to add a new section to the exectuable, to host the new firmware archive and then redirect references to the existing firmware archive)
- Modify the player software, encode it, repackage the firmware archive, patch the archive into the corresponding updater and run it. (this should be safe, given that the player software is stored on the harddisk and can be recovered from the rescue mode software).
- Write a utility to convert from the TI COFF file format (used by the Code Composer Studio tools) to the FRESC file format.
- Optionally write a utility to convert from FRESC file format to TI COFF file format, this will allow us to make use of the simulator included in CCS.
- Improve zenext. (Handle the missing instructions; Handle extended instructions properly, ie. add cross references and print instructions manually)
- Reverse engineer the LCD code and write code to interface the LCD.

Once each step is completed, we'll have a development platform to explore from.
I'll be working my way through the list whenever I 've got time, however, if anyone want's to sign up for an item or two, it would save some time.
Title: Re: Dell Digital Jukebox
Post by: LambdaCalculus on January 04, 2008, 08:09:29 AM
It's been a while since we last reported in, hasn't it? ;)

My Dell DJ is down to the mainboard now, but I still can't quite remove the LCD from the board (it's attached to some kind of plate). I think the CPU is underneath it, but I can't be so sure until I can remove it to get some scans.
Title: Re: Dell Digital Jukebox
Post by: Gradius on January 06, 2010, 08:14:09 AM
What's up?  It seems everyone give up on project ?

The IC behind LCD is:
NEC D720122GC

More infos here:
http://www.anythingbutipod.com/forum/showthread.php?t=41542

I'm still dreaming about FLAC support on my Zen Xtra, is all I miss on this player!