Creative

Current status

Watch the ZVM Port Thread for current progress

"The short-term goal is to get a build tool chain up and running." - tools/rockboxdev.sh (and select arm)

"Once that's ready, the actual porting process can begin. Which I think entails writing a bootloader, working out (reversing/reading specs) how the various devices work and writing the code to integrate them into the rockbox source."

"The bootloading of the player software is split into 3 phases: 1) The built-in boot loading, which loads a limited sized secondary boot loader from a fixed location in flash memory, to a fixed address. 2) The secondary boot loader (named FBOOT in the firmware) which decrypts and loads the Rescue Mode software (FRESC) also from flash memory. 3) The Rescue Mode software decrypts, decompresses and loads the actual player software (CENC/TL) from a file named Jukebox2.jrm on the HDD. If the validation checks fail, it'll load a Resuce Mode menu, which allows you to "reload" the firmware amongst other things."

"I've described the file formats, hashing, compression and encryptions algorithms involved in the process."

zook from the forum thread

Information:

• Zen Xtra/NJB3/Touch

• ZVM

• Dell DJ

• Zen Nano Plus/Non-Plus

The chipset implemented in this device (SigmaTel 3520) is similar to that of the Ipod Shuffle, and is the same as in the iAudio I5/G2/U2, as well as the MobiBLU DAH-1500i. A free complier for the chip does not exist. The Plus models have an FM tuner on-board, the TEA5767. Hi-Res photos of the internals found here.

Original Firmware

Firmware Info

• NJB Firmware info page - outdated

The firmware used by Creative is Nucleus RTOS. They use Nucleus PLUS and the ARM925 TI v. 1.14 toolchain to compile it according to strings found in FBOOT. This is based on MicroWindows^? (Nano-X), as several assert messages are found pointing to (open source) source code. (even NeurosTechnology uses Nano-X)

Other strings of companies working on the firmware:

• Copyright MGC 2004 - Nucleus PLUS - ARM925 TI v. 1.14
• Accelerated Technology Internal Use Only - Serial Number: NP0000
• Copyright(c) Founder Corporation.2005

Modifying the firmware

Uploading a firmware

Firmware Boot

1. The built-in boot loading(EXT0?), which loads a limited sized secondary boot loader from a fixed location in flash memory, to a fixed address.
2. The secondary boot loader (named FBOOT in the firmware) which decrypts and loads the Rescue Mode software (FRESC) also from flash memory.
3. The Rescue Mode software decrypts, decompresses and loads the actual player software (CENC/TL) from a file named Jukebox2.jrm on the HDD. If the validation checks fail or switch is hold to ON/OFF, it'll load a Rescue Mode menu, which allows you to "reload" the firmware amongst other things.

Firmware Format

Description

A firmware always starts with the string FFIC (=CIFF). Followed by the total size of the file minus the last (NULL) block and possible some padding bytes.

After this header comes a block structure, always started with a 4-byte string header (e.g. FNIC, ATAD, LLUN, CNEC, 0TXE or LT©). Then comes (again) the size of this block.

Then you have, based on the type of block: a) a data block with size of Size b) a 32-byte Unicode name(=filename) and the data block of (Size-32).

Overview table

Normal files to be found in an official firmware

CINF block

NULL block

©TL block

FRESCUE Structure

  struct R_HEADER {
    DWORD Tag;
    DWORD Length;
    BYTE Data[Length];
  };

  struct R_SECTION {
    DWORD Address;
    DWORD Length;
    DWORD Unknown;
    BYTE Data[Length];
  };

  struct TMS320C55x_ISR {
    BYTE  Flags;
    DWORD ISR : 24;
    BYTE  Filler[4];
  };

Other Creative players' firmware information

Remark: Because the TWiki markup sees '|' as a table marker, all '|' are replaced by '$'

Miscellaneous Links

• Transcript of initial IRC meeting
• TMS320DSC24 Manual (pdf) Same DSP, similar Arm core as what is in the ZVM
• Dock Pinout
• Video Adapter Pinout
• Free C54x compiler from TI
• ARM/DSP bridge
• ZVMFirmwareLoader - Conversation where the hard drive was removed and the ZVM was booted up. Looks like the majority of the firmware comes off of the hardrive and the recovery console is booted from the flash memory.
• TexasInstrumentsTMS320

Attachment	Action	Size	Date	Who	Comment
idc_utils.zip	manage	9.8 K	20 Dec 2007 - 02:59	WessamBaghdadi	idc utils