Creative ZEN

[mcuelenaere]

Once Creative's firmware encryption is cracked, the ZEN could also be ported to Rockbox (as its functions are almost identical to the ZVM and I believe its internals are too), so I opened this thread for gathering information of the Creative ZEN.

[mcuelenaere]

According to http://xxmycreativexx.blogspot.com/2007/09/creative-zen-uses-sigmatel-latest.html the ZEN uses a SigmaTel 3700 SoC (so no TI TMS320DM320) which means the processor+DSP combination is quite different, although their firmware format is the same. (open up an firmware update of the ZEN with ZenFirm.exe from zook and you'll see)

[skaos]

The Sigmatel STMP3600 and STMP3700 belongs to the same ARM-family (I think), and Sigmatel have published some Linux work on the 3600. I would guess that you could get some hardware info by looking at the Linux code: http://linux.sigmatel.com/

[mcuelenaere]

I have a 8gb Zen so i wouldn't mind trying to help. I'm new to this so..
but i know somethings about electronics

As stated in the posts above: first read the CreativeZVMPort wiki page which contains a lot of information which is also valid for the Creative ZEN (firmware structure etc).
Then I advice you to download CreativeWizard (see CreativeZVMPort page or epiZENter.net), extract (C)TL from a nk.bin file and decrypt it (using zook's zenutils).
Then you'll be able to disassemble it et cetera..

[Karl_210]

how do you take it apart i've taken apart my sansa e250 before.
do you pull off the top?

[mcuelenaere]

how do you take it apart i've taken apart my sansa e250 before.
do you pull off the top?

epiZENter topic about opening up Creative ZEN

edit:
Battery info:
CREATIVE
3.6V Lithium Ion Polymer Battery 0.55AH
Creative PN: BAC0603R79925

KKBJGHJB
[then down the bottom]
Model No: LPC6333445

edit2:

link 2

[Zeroth]

I have a Creative ZEN 8GB model. It has a different chip, but likely very similar firmware. I have opened it, and the chips I could see, are as follows:

CPU:
Sigmatel STMP3760
BBE-TA4
UO4211
072956

Memory:
Samsung 734
K9HBG08U1M

(Two of these)

According to Sigmatel's materials, the STMP3700 class chip uses an ARM 926 as the core(300MHZ), with built in USB, DC conversion, headphone and microphone amplification. It as well, contains support for WiFi, and Bluetooth, however the Creative ZEN does not have this hardware...(yet). If you need more information/pictures, let me know! I will be happy to provide.

-Zeroth

[mcuelenaere]

...
I have opened it, and the chips I could see, are as follows:
...
If you need more information/pictures, let me know! I will be happy to provide.
...

Could you take some pictures and/or use a (flatbed) scanner to take some hi-res scans of the main board?

[Zeroth]

Be glad to. Opened it while I was at work, I'll post pictures tonight. I have also extracted the firmware for the ZEN out, it looks similar to the ZVM firmware, however, I don't know how to use zenutils zen_crypt on it. What do I need to do, to decrypt the firmware?

EDIT: I just found this: http://linux.sigmatel.com/, which contains a modified version of linux and the requisite toolchain for the 36xx series chips, and likely contacts for the 37xx series chips. Hardware programming in this case is likely quite easy.

UPDATE: I have the scan... its very highly detailed(1200 dpi... so quite large...)  Anyway, here is the link: ZEN chip scan Any other help I can provide, please let me know. I am familiar with C, a bit of hardware/software programming, and assembly(unfortunately, MIPS not ARM)

[mcuelenaere]

I made a wiki page with all the information I could find.

Since it's a wiki I would say: go ahead and edit it!

[Zeroth]

Okay, I've found the actual firmware, using zen_utils. Most of the information to do so came from the ZVMport wiki page, thanks guys. I can confirm that it does indeed follow the same format as the firmware for other players in the creative line. I even found the same strings that were found in the ZVM firmware. I'll do some more work, after work.

-Zeroth

EDIT: Okay, so, I have identified the function of the files, they are quite similar to what is found in the ZVM project. However, only problem, I made one, very very tiny modification: I altered a few strings in jukebox2.jrs, and compiled a new firmware, using zenutils. I then tried to replace the firmware of my player with the new, very slightly altered firmware, and it did not accept it. As an experiment, I also tried using the old firmware, still using sendfirm in rockbox/utils/MTP, and that update worked.

Therefore, theres still a step I'm missing in the compiling of a new firmware. I have made no modifications to the actual firmware code, just to the strings in an associated file.

UPDATE: April 23rd, 2008
Still working on getting the player to accept a firmware archive.

UPDATE: April 25th, 2008
The player accepts signed firmware now, courtesy of Maurus. Yay Maurus! I've also taken the firmware, and disassembled it. Now to be reading the very very long firmware. 

[ctaf]

some more info on the LCD to put on the wiki, it's a lms250gf03:
http://www.lcdsolar.com/EmpGoog/SAMSUNG/2.5/LMS250GF03.html

the usb of the device vid and pid:
041e:4157

[mcuelenaere]

some more info on the LCD to put on the wiki, it's a lms250gf03:
http://www.lcdsolar.com/EmpGoog/SAMSUNG/2.5/LMS250GF03.html

the usb of the device vid and pid:
041e:4157

Thanks, I've added it to the wiki.

BTW, I've read the IRC logs and if you have some questions about porting, PM me

[saratoga]

Just to update this thread, the Zen uses the STMP3760 which is very similar to the STMP3780 (I think just different amounts of SRAM and some onboard peripherals) used in the now supported Fuze+.  Most likely a large amount of that work could be reused on the Zen if someone feels like working on this port again.

[pamaury]

Hello,
I am the developer who did the Fuze+ and X-Fi 2/3 ports. The Creative ZEN uses a SoC very similar to the imx233 which can be found in the Fuze+, ZEN X-Fi2/3. Also if I'm correct, the Creative ZEN is very very similar to the ZEN X-Fi (read: basically the same). I have begun some work on the ZEN X-Fi. I think the amount of work to port to the ZEN is very moderate once the ZEN X-Fi is done, it could amount to only change a few settings/pins here and there. Both ports could even be done at the same time.

Depending on how much you want to get involved, you can try to run code on the device and play with it or even do some reverse engineering. I advise that you come on IRC in any case, I can give you many tools to avoid starting from scratch.