Wiki > Main > CreativeZENXFiPort (compare)
Difference: CreativeZENXFiPort (r2 vs. r1)
This is the page for the Creative Zen X-Fi port. See CreativeZENXFi for more information about the device.
The firmware structure is similar to the one of the older Creative players. See CreativeZVMPort for more info. The biggest difference is that the rescue firmware (aka FRESC) uses the SbFileFormat. Unfortunately the firmware is encrypted and the key is not known but using on-device crypto, I have been able to decrypt it.
--+ Extracting the firmware
You can use the zenutils from the SVN (in utils/zenutils). First use update_extract to extract the archive from the updater executable and then firmware_extract to extract the files from the archive. Note that the main firmware (in the ©TL block) is using the TL encryption mode.
--+ Sending the firmware
You can rewrite the firmare of the device by booting in recovery mode (shut off, hold play, power on). Then erase the old firmware using the "reloading the firmware" entry and send a new one with the senfirm tool available in the SVN (in utils/MTP). Not that the device is using MTP mode and that writing a new firmware is merely a question of sending "nk.bin" file with type firmware (and with the correct format). Fortunately the device accept firmware images consisting only in CIFF, ©TL and NULL blocks.
--+ Decrypting FRESC
The FRESC file is the rescue firmware (that you DONT want to overwrite). It uses an unknown public key but because of the way the SbFileFormat is designed and because I have been able to decrypting it on device, it is still possible the extract it using the sbtools in the SVN (in utils/MTP) this way:
This has been tested with the
r4 - 12 Nov 2013 - 17:54:53 - AmauryPoulyRevision r2 - 01 Jul 2012 - 01:08 - AmauryPouly
Revision r1 - 30 Jun 2012 - 23:58 - AmauryPouly
Copyright © by the contributing authors.