NJB3Firmware < Main

Downloads
release
dev builds
extras
themes
Documentation
manual
wiki
device status
Support
forums
mailing lists
IRC
Development
bugs
patches
dev guide
Donate
Wiki > Main > CreativeZenTouch > NJB3Firmware
---+!! NJB3 Firmware details

---++ Fimware details

[[http://downloads.sourceforge.net/libnjb/libnjb-win32-2.2.4.zip?modtime=1129123719&big_mirror=0][Libnjb windows]]

The majority of this information is from [[http://libnjb.cvs.sourceforge.net/libnjb/libnjb/HACKING?revision=HEAD][Linus Wallej's Introduction to libnjb hacking guide]]. Linus works on libMTP and libnjb. 

---+++Database format

It looks like everything on here is in UTF-16, so that explains the null bytes in between every other significant byte - [[http://www.nomadness.net/modules.php?name=Forums&file=viewtopic&t=13781&highlight=tms320][Nomadness.net:Changing Zen Xtra Firmware Text]] 

Additional info can be found on [[http://www.nomadness.net/modules.php?name=Forums&file=viewtopic&t=18515&postdays=0&postorder=asc&start=0][Nomadness.net:NJB3 File system]]

The internal format of the database(s) used to store tracks,
files and playlists on the series 3 devices is actually known: 
when listing the files on the device, an odd file with a 16-byte 
serial number appears in the directory. This file actually 
contains the file database so it can be examined. (We don't know 
why it's there, perhaps for debugging?)

A typical beginning of the file will look like this:

|*Address*|*Hex*|*ASCii??*|
|0000:| 0100 0100 0000 0000 0000 0e00 0000 0600|  ................|
|0010:| 000c 001c 620f 0600 000e 0928 0000 0600|  ....b......(....|
|0020:| 0016 78ca 7441 0600 0018 2000 0000 2000|  ..x.tA.... ... .|
|0030:| 0007 7200 6500 6700 6c00 6500 6d00 6500|  ..r.e.g.l.e.m.e.|
|0040:| 6e00 7400 6500 7400 2e00 7000 6400 6600|  n.t.e.t...p.d.f.|
|0050:| 1400 000d 5c00 4600 6f00 6f00 5c00 6200|  ....\.F.o.o.\.b.|
|0060:| 6100 7200 5c00 0000 0600 000c 001c 6218|  a.r.\.........b.|

*Meaning:*

|0x0100 0x0100 0x0000 0x0000 0x0000|unknown header|
|0e00 0000|number of metadata entries (little-endian in this case 14 entries)|
|0x0600|size of next element (little-endian)|
|0x000c|metadata post ID (big-endian)|
|0x001c620f|post ID|
|0x0600|size of next element (little-endian)|
|0x000e|metadata filesize (big-endian)|
|0x0928 0000|filesize (little-endian)|
|0x0600|size of next element (little-endian)|
|0x0016|metadata file timestamp (big-endian)|
|0x78ca 7441|timestamp (big-endian?)|
|0x0600|size of next element (little-endian)|
|0x0018|metadata file attributes (big-endian)|
|0x2000 0000|Windows file attributes (big-endian)|
|0x2000|size of next element (little-endian)|
|0x0007|metdata file name (big-endian)|
|0x72 0x00 .. |a string (little-endian)|

We see that the database use a mixture of little- and  big-endian values, whereas the bytes delivered over the USB 
bus are actually all big-endian. Thus we can conclude that the processor is little-endian and will use little-endian
words internally for it's databases, whereas the outside communication is defined to be big-endian only. The 
metadata retrieved with the USB commands is very close to the internal database format, in fact the only real 
modification is that it corrects all the endianness-troubles.

The database is finally terminated with two consecutive 0x0000 0x0000 words. These are also returned when reading
out the database.

Further, people who dumped out the harddisk of a Zen Xtra player see a file allocation table (in something called 
"minifs", a miniature file system) on the disk, containing  these eight files (with some variations):

|*NJB File allocation table*|
|attrs.db|
|jukebox2.jrm|
|jukebox2.jrs|
|unicjkl.nft|
|kanji.dct|
|fhandle.db|
|btree.db|
|pm.cfg|

It's a rough guess that "attrs.db" contain the metadata for all tracks, "fhandle.db" contains the metadata for files, and
"btree.db" contain the playlists. The following is a dump of the firmware index for a Zen Xtra (done using the fwupgrade
program that comes with libnjb with no jukebox connected):

*Firmware CIFF image, 001e5c0c bytes:*

   |*Offset*|*Type*|*Size*|
   |00000008|CINF|00000060 bytes "NOMAD Jukebox Zen Xtra"|
   |00000070|DATA|00003b94 bytes "FBOOT"|
   |00003c0c|DATA|00035082 bytes "FRESC"|
   |00038c96|CENC|00099c6c bytes|
   |000d290a|DATA|0002895c bytes "Hjukebox2.jrs"|
   |000fb26e|DATA|000dc3f8 bytes "Hunicjkl.nft"|
   |001d766e|DATA|0000e59e bytes "Hkanji.dct"|

We can see that the jukebox2.jrs, unicjkl.nft and kanji.dct files are actually part of the firmware. The "H" prefixing them
in the firmware most likely tell that this is a file that shall be stored in the file system, not programmed to the flash memory
or stored in the program area of the hard disk.

The .nft files are probably fonts, the .dct files "dictionaries", given the obvious chinese terms "kanji" (writing system) and "cjk" 
(chinese glyphs).

A recent MTP firmware extracted from a Zen Touch FW 2.10.05 have these files:

|*MTP File allocation table*|
|attrs.db|
|jukebox2.jrm|
|jukebox.jrs|
|unicjkl.nft|
|splash.jbm|
|devicon.ico|
|devlogo.png|
|btree.db|
|plist.db|
|musicait.db|
|musicstr0.db|
|musicstr1.db|
|musicstr2.db|
|archvait.db|
|archvstr0.db|
|archvstr1.db|
|archvstr2.db|
|vdirait.db|
|vdirstr0.db|
|vdirstr1.db|
|vdirstr2.db|
|plistait.db|
|pliststr0.db|
|pliststr1.db|
|pliststr2.db|
|fsdirtree.db|
|fhandle.db|
|pm.cfg|
|pm.cbk|
|list.qm|

It seems the operating system has been quite rewritten and the database split (normalized?) in the recent MTP firmwares.

*.jbm* is a proprietary bitmap format used by at least the Zen Xtra and Touch, if not all Creative players. A valid BMP header will start at the 2nd byte.
r3 - 02 Jan 2008 - 11:35:29 - MaurusCuelenaere
Parents: CreativeZenTouch