release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Search | Go
Wiki > Main > DellDJPort

Rockbox port to the Dell Digital Jukebox (Dell DJ) Series

About the Dell Digital Jukebox

The Dell Digital Jukebox (Dell DJ) is a DAP released by Dell Computer, using technology OEMed from Creative Labs. The internals are mostly taken from Creative's NOMAD/ZEN line of DAPs, which minor internal changes and features such as FM radio removed.

The Dell DJ uses the MTP protocol for communicating with a PC. Linux users may have to download libmtp in order to access the device. Gnomad (http://www.gnomad2.sourceforge.net) supports the Dell DJ.

Current Status

No work has been done yet on this port, as it is currently in a state of research. I am looking for information about the hardware used inside the system, and work is being done to see how the firmware is structured and stored on this device.

I only own a Generation 1 Dell DJ. If anyone has information regarding the Pocket DJ or Generation 2 (or any yummy tidbits of information!), feel free to contact me (RobertMenes), or add it to this wiki page. Please note that the DJ Ditty may not be a feasible port, and I am not considering it at this time.

There's a forum topic thread here: http://forums.rockbox.org/index.php?topic=11368.0

Hardware Summary

This list is still incomplete at this moment. More info will be added as I find it. The main components are as follows:

  • Texas Instruments TMS320DA255? CPU (ARM and C55x core, unknown clock speed) (According to MaurusCuelenaere the ARM and DSP are on the same chip; see below)
  • NEC D720122GC? 0336E3019 USB Generic Device Controller
  • Monochrome (?) LCD, 160x104x1 (?)
  • "Powered by SKC" 3.7v Li-Ion Polymer Battery (SMMJCAJJB CP:BA20603R79901) (1)
  • Touchpad labeled "0039 SO-DMD004C / Model PD0500A? (Socketed onto the main board; Creative logo appears underneath it)
  • Creative CA206-IAG 4A-39AF9WX sound processor (This chip may be the TMS320 ARM and DSP SoC)
  • Samsung K4S281632E?-TC75 chip; 128Mbit/16MByte SDRAM
  • SST 39VF400A Flash ROM
  • Fairchild Semiconductor FST16211 24-bit Bus Switch

The Dell DJ uses 1.8" Hitachi TravelStar hard drives for storage. The Generation 1 models used both 15GB and 20GB drives.

  • The 15GB Gen 1 uses a Model HTC424015F7AT00? drive. (4200 RPM; 44-pin IDE connector)
  • The 20GB Gen 1 uses a Model HTC424020F7AT00? drive. (4200 RPM; 44-pin IDE connector) (NOTE: Turns out the iriver H10 20GB model uses this hard drive as well.)

Firmware Updates

Dell offers firmware updates for the DJ on their site. We need to examine how the firmware upgrade process is performed. The updates are only for Windows 2000/XP.

Firmware Reversing

The term firmware is often used to refer to the entire package of software and data, which is collectively stored in a single file (nk.bin or rk.bin) contained in the firmware updater application. However, to avoid confusion I suggest using firmware when talking about the software only and firmware archive when talking about the entire collection.
Note: All the information in the following sub-sections applies to certain versions of the Zen Micro, Zen Touch and Zen Xtra as well.

Extracting the Firmware Archive from the Updater

As mentioned, the firmware archive is stored within the firmware updater application and extracted during updating. The firmware archive is compressed using zlib and xored with a permuted ascii key. The chunk of data is prefixed with a 32-bit word, which holds the length of the chunk. To extract the archive manually, you first need to obtain the ascii key, then permute it as follows:
  for (int i = 0; i < strlen(key); i++)
    key[i] = (key[i] - 1) | 0x80;
then you need to xor the chunk with the permuted key and finally inflate it using zlib.

The attached zenfirm.rar is a utility for extracting the firmware archive automatically. It comes pre-compiled, with the source code included.

Firmware Archive Structure

The archive is split into entries consisting of a 32-bit word name and 32-bit word size, followed by the entry data:
  struct FW_ENTRY {
    DWORD Name;
    DWORD Length;
    BYTE Data[Length];
  };
The first FW_ENTRY in the archive is the root entry, called CIFF, which embodies all other entries. The first child node of CIFF is CINF which contains a unicode model name string.
The next entry type is called DATA and is used to designate where to store the file it contains. The first 32 bytes of it is a file name which is either prefixed with F (for flash) or H (for harddisk).
There are two DATA entries prefixed with F: FBOOT and FRESCUE. FBOOT is assumed to be a secondary bootloader and FRESCUE is the rescue mode software (more on this later).
There are three DATA entries prefixed with H: Hjukebox2.jrs, Hsplash.jbm and Hunicjkl.nft. Hjukebox2.jrs is a string table containing localized strings used by the player.
Hsplash.jbm is the splash screen of the player, in a proprietary bitmap format. Hunicjkl.nft contains the fonts used by the player.
In addition there are two more types of entries: CENC (presumably the player software) which shares structual similarities to FBOOT (probably ISR arrays). And EXT0 whose purpose is unknown.

FRESCUE Structure

The FRESCUE file starts off with a header consisting of two 32-bits words, a tag and a size, followed by the data:
  struct R_HEADER {
    DWORD Tag;
    DWORD Length;
    BYTE Data[Length];
  };
The Tag is always CODE. The Data starts off with one 32-bit word whose purpose is unknown at this point. Following is an array of section objects, which specifies where in memory to read the contained section data:
  struct R_SECTION {
    DWORD Address;
    DWORD Length;
    DWORD Checksum;
    BYTE Data[Length];
  };
The Address specifies the physical address which the data will be written to. This array continues till the end of the file.
I've attached zenldr.rar, an IDA loader plugin which handles the FRESCUE format. The pre-compiled file zenldr.ldw is compiled for IDA 5.0.

Once mapped into memory, address 0x200 will contain an array of 32 8-byte ISR entries. The ISR entry format is as follows:
  struct TMS320C55x_ISR {
    BYTE  Flags;
    DWORD ISR : 24;
    BYTE  Filler[4];
  };
The Flags controls the operating behaviour when performing an interrupt. The ISR is a 24-bit address of the ISR handler.
The first ISR entry is the RESET vector, which points to a function named _c_int00, in the TI RTOS/BIOS source code.

Rescue Mode

I came across this when I first got my Dell DJ. If the hard drive has failed or is not connected, the DJ will enter "Rescue Mode", where you can attempt to either format the drive, or perform a firmware update. This Rescue Mode was carried across almost all of the Creative devices, most of which have a similar mode on the devices.

Images

(Scans of the PCB and components to come.)

ArchOpen

ArchOpen (http://www.archopen.org) has code running on the TMS320 family of CPUs, and may prove useful in research.

Links

Footnotes

(1) I'd like to get a voltage readout so we can have a precise number of the mAh measurement.
I Attachment Action Size Date Who Comment
DellDJ-mainboard-scan.jpgjpg DellDJ-mainboard-scan.jpg manage 1392.2 K 15 Jan 2008 - 02:36 RobertMenes Dell DJ Gen 1 Mainboard Scan
FST16211.pdfpdf FST16211.pdf manage 296.4 K 11 Sep 2007 - 00:56 RobertMenes Datasheet for Fairchild Semiconductor FST16211 Bus Switch
R76038.EXEEXE R76038.EXE manage 918.5 K 01 Sep 2007 - 23:32 RobertMenes Dell DJ Firmware Upgrade (Windows only; hopefully good for research)
S16685EJ3V0DS00.pdfpdf S16685EJ3V0DS00.pdf manage 664.7 K 15 Jan 2008 - 02:44 RobertMenes Datasheet for the NEC D720122GC? USB Controller Chip
SST-Flash-1301.pdfpdf SST-Flash-1301.pdf manage 59.9 K 10 Sep 2007 - 18:32 RobertMenes Datasheet for the SST 39VF400A Flash ROM chip
delldj-connectinfo.txttxt delldj-connectinfo.txt manage 2.4 K 01 Sep 2007 - 23:27 RobertMenes The results of lsusb -v under Linux; taken from my Dell DJ
k4s281632e-tc75.pdfpdf k4s281632e-tc75.pdf manage 146.6 K 10 Sep 2007 - 18:10 NilsWallmenius Datasheet for the k4s281632e-tc75 128Mbit sdaram chip
zenfirm.rarrar zenfirm.rar manage 33.6 K 27 Oct 2007 - 21:09 RasmusRy Zen Firmware utility
zenldr.rarrar zenldr.rar manage 30.1 K 22 Sep 2007 - 16:49 RasmusRy IDA loader plugin for the FRESCUE format
r22 - 14 Oct 2008 - 19:23:00 - RobertMenes
Copyright by the contributing authors.