release
dev builds
extras
themes manual
wiki
device status forums
mailing lists
IRC bugs
patches
dev guide



Search | Go
Wiki > Main > CreativeZenTouch > NJB3Firmware (r2)

NJB3 Firmware details

Fimware details

Libnjb windows

The majority of this information is from Linus Wallej's Introduction to libnjb hacking guide. Linus works on libMTP and libnjb.

Database format

It looks like everything on here is in UTF-16, so that explains the null bytes in between every other significant byte - Nomadness.net:Changing Zen Xtra Firmware Text

Additional info can be found on Nomadness.net:NJB3 File system

The internal format of the database(s) used to store tracks, files and playlists on the series 3 devices is actually known: when listing the files on the device, an odd file with a 16-byte serial number appears in the directory. This file actually contains the file database so it can be examined. (We don't know why it's there, perhaps for debugging?)

A typical beginning of the file will look like this:

Address Hex ASCii??
0000: 0100 0100 0000 0000 0000 0e00 0000 0600 ................
0010: 000c 001c 620f 0600 000e 0928 0000 0600 ....b......(....
0020: 0016 78ca 7441 0600 0018 2000 0000 2000 ..x.tA.... ... .
0030: 0007 7200 6500 6700 6c00 6500 6d00 6500 ..r.e.g.l.e.m.e.
0040: 6e00 7400 6500 7400 2e00 7000 6400 6600 n.t.e.t...p.d.f.
0050: 1400 000d 5c00 4600 6f00 6f00 5c00 6200 ....\.F.o.o.\.b.
0060: 6100 7200 5c00 0000 0600 000c 001c 6218 a.r.\.........b.

Meaning:

0x0100 0x0100 0x0000 0x0000 0x0000 unknown header
0e00 0000 number of metadata entries (little-endian in this case 14 entries)
0x0600 size of next element (little-endian)
0x000c metadata post ID (big-endian)
0x001c620f post ID
0x0600 size of next element (little-endian)
0x000e metadata filesize (big-endian)
0x0928 0000 filesize (little-endian)
0x0600 size of next element (little-endian)
0x0016 metadata file timestamp (big-endian)
0x78ca 7441 timestamp (big-endian?)
0x0600 size of next element (little-endian)
0x0018 metadata file attributes (big-endian)
0x2000 0000 Windows file attributes (big-endian)
0x2000 size of next element (little-endian)
0x0007 metdata file name (big-endian)
0x72 0x00 .. a string (little-endian)

We see that the database use a mixture of little- and big-endian values, whereas the bytes delivered over the USB bus are actually all big-endian. Thus we can conclude that the processor is little-endian and will use little-endian words internally for it's databases, whereas the outside communication is defined to be big-endian only. The metadata retrieved with the USB commands is very close to the internal database format, in fact the only real modification is that it corrects all the endianness-troubles.

The database is finally terminated with two consecutive 0x0000 0x0000 words. These are also returned when reading out the database.

Further, people who dumped out the harddisk of a Zen Xtra player see a file allocation table (in something called "minifs", a miniature file system) on the disk, containing these eight files (with some variations):

NJB File allocation table
attrs.db
jukebox2.jrm
jukebox2.jrs
unicjkl.nft
kanji.dct
fhandle.db
btree.db
pm.cfg

It's a rough guess that "attrs.db" contain the metadata for all tracks, "fhandle.db" contains the metadata for files, and "btree.db" contain the playlists. The following is a dump of the firmware index for a Zen Xtra (done using the fwupgrade program that comes with libnjb with no jukebox connected):

Firmware CIFF image, 001e5c0c bytes:

Offset Type Size
00000008 CINF 00000060 bytes "NOMAD Jukebox Zen Xtra"
00000070 DATA 00003b94 bytes "FBOOT"
00003c0c DATA 00035082 bytes "FRESC"
00038c96 CENC 00099c6c bytes
000d290a DATA 0002895c bytes "Hjukebox2.jrs"
000fb26e DATA 000dc3f8 bytes "Hunicjkl.nft"
001d766e DATA 0000e59e bytes "Hkanji.dct"

We can see that the jukebox2.jrs, unicjkl.nft and kanji.dct files are actually part of the firmware. The "H" prefixing them in the firmware most likely tell that this is a file that shall be stored in the file system, not programmed to the flash memory or stored in the program area of the hard disk.

The .nft files are probably fonts, the .dct files "dictionaries", given the obvious chinese terms "kanji" (writing system) and "cjk" (chinese glyphs).

A recent MTP firmware extracted from a Zen Touch FW 2.10.05 have these files:

MTP File allocation table
attrs.db
jukebox2.jrm
jukebox.jrs
unicjkl.nft
splash.jbm
devicon.ico
devlogo.png
btree.db
plist.db
musicait.db
musicstr0.db
musicstr1.db
musicstr2.db
archvait.db
archvstr0.db
archvstr1.db
archvstr2.db
vdirait.db
vdirstr0.db
vdirstr1.db
vdirstr2.db
plistait.db
pliststr0.db
pliststr1.db
pliststr2.db
fsdirtree.db
fhandle.db
pm.cfg
pm.cbk
list.qm

It seems the operating system has been quite rewritten and the database split (normalized?) in the recent MTP firmwares.

.jbm is a proprietary bitmap format used by at least the Zen Xtra and Touch, if not all Creative players. A valid BMP header will start at the 2nd byte.
Edit | Attach | Print version | History: r3 < r2 < r1 | Backlinks | View wiki text | More topic actions...
r2 - 24 Jun 2007 - 11:37:21 - WessamBaghdadi
Copyright by the contributing authors.