---+!! Creative Zen X-Fi Port %TOC% --- ---+ Overview This is the page for the Creative Zen X-Fi port. See CreativeZENXFi for more information about the device. ---+ Firmware The firmware structure is similar to the one of the older Creative players. See CreativeZVMPort for more info. The biggest difference is that the rescue firmware (aka FRESC) uses the SbFileFormat. Unfortunately the firmware is encrypted and the key is not known but using on-device crypto, I have been able to decrypt it. --+ Extracting the firmware You can use the zenutils from the SVN (in utils/zenutils). First use update_extract to extract the archive from the updater executable and then firmware_extract to extract the files from the archive. Note that the main firmware (in the ŠTL block) is using the TL encryption mode. --+ Sending the firmware You can rewrite the firmare of the device by booting in recovery mode (shut off, hold play, power on). Then erase the old firmware using the "reloading the firmware" entry and send a new one with the senfirm tool available in the SVN (in utils/MTP). Not that the device is using MTP mode and that writing a new firmware is merely a question of sending "nk.bin" file with type firmware (and with the correct format). Fortunately the device accept firmware images consisting only in CIFF, ŠTL and NULL blocks. --+ Decrypting FRESC The FRESC file is the rescue firmware (that you DONT want to overwrite). It uses an unknown public key but because of the way the SbFileFormat is designed and because I have been able to decrypting it on device, it is still possible the *extract* it using the sbtools in the SVN (in utils/MTP) this way: =SB_REAL_KEY="78B092EB8370D4C3BC13B3BF42C8EBB6" sbtoelf -zf FRESC= This has been tested with the =ZENXFI_PCFW_L22_1_04_08e.exe= updater only.
ore topic actions
r2 - 01 Jul 2012 - 01:08:38 -
Copyright Š by the contributing authors.