NJB3 Firmware details

Fimware details

The majority of this information is from Linus Wallej's Introduction to libnjb hacking guide. Linus works on libMTP and libnjb.

Database format

It looks like everything on here is in UTF-16, so that explains the null bytes in between every other significant byte - Nomadness.net:Changing Zen Xtra Firmware Text

Additional info can be found on Nomadness.net:NJB3 File system

The internal format of the database(s) used to store tracks, files and playlists on the series 3 devices is actually known: when listing the files on the device, an odd file with a 16-byte serial number appears in the directory. This file actually contains the file database so it can be examined. (We don't know why it's there, perhaps for debugging?)

A typical beginning of the file will look like this:

Address	Hex	ASCii??
0000:	0100 0100 0000 0000 0000 0e00 0000 0600	................
0010:	000c 001c 620f 0600 000e 0928 0000 0600	....b......(....
0020:	0016 78ca 7441 0600 0018 2000 0000 2000	..x.tA.... ... .
0030:	0007 7200 6500 6700 6c00 6500 6d00 6500	..r.e.g.l.e.m.e.
0040:	6e00 7400 6500 7400 2e00 7000 6400 6600	n.t.e.t...p.d.f.
0050:	1400 000d 5c00 4600 6f00 6f00 5c00 6200	....\.F.o.o.\.b.
0060:	6100 7200 5c00 0000 0600 000c 001c 6218	a.r.\.........b.

Meaning:

0x0100 0x0100 0x0000 0x0000 0x0000	unknown header
0e00 0000	number of metadata entries (little-endian in this case 14 entries)
0x0600	size of next element (little-endian)
0x000c	metadata post ID (big-endian)
0x001c620f	post ID
0x0600	size of next element (little-endian)
0x000e	metadata filesize (big-endian)
0x0928 0000	filesize (little-endian)
0x0600	size of next element (little-endian)
0x0016	metadata file timestamp (big-endian)
0x78ca 7441	timestamp (big-endian?)
0x0600	size of next element (little-endian)
0x0018	metadata file attributes (big-endian)
0x2000 0000	Windows file attributes (big-endian)
0x2000	size of next element (little-endian)
0x0007	metdata file name (big-endian)
0x72 0x00 ..	a string (little-endian)

We see that the database use a mixture of little- and big-endian values, whereas the bytes delivered over the USB bus are actually all big-endian. Thus we can conclude that the processor is little-endian and will use little-endian words internally for it's databases, whereas the outside communication is defined to be big-endian only. The metadata retrieved with the USB commands is very close to the internal database format, in fact the only real modification is that it corrects all the endianness-troubles.

The database is finally terminated with two consecutive 0x0000 0x0000 words. These are also returned when reading out the database.

Further, people who dumped out the harddisk of a Zen Xtra player see a file allocation table (in something called "minifs", a miniature file system) on the disk, containing these eight files (with some variations):

NJB File allocation table
attrs.db
jukebox2.jrm
jukebox2.jrs
unicjkl.nft
kanji.dct
fhandle.db
btree.db
pm.cfg

It's a rough guess that "attrs.db" contain the metadata for all tracks, "fhandle.db" contains the metadata for files, and "btree.db" contain the playlists. The following is a dump of the firmware index for a Zen Xtra (done using the fwupgrade program that comes with libnjb with no jukebox connected):

Firmware CIFF image, 001e5c0c bytes:

Offset	Type	Size
00000008	CINF	00000060 bytes "NOMAD Jukebox Zen Xtra"
00000070	DATA	00003b94 bytes "FBOOT"
00003c0c	DATA	00035082 bytes "FRESC"
00038c96	CENC	00099c6c bytes
000d290a	DATA	0002895c bytes "Hjukebox2.jrs"
000fb26e	DATA	000dc3f8 bytes "Hunicjkl.nft"
001d766e	DATA	0000e59e bytes "Hkanji.dct"

We can see that the jukebox2.jrs, unicjkl.nft and kanji.dct files are actually part of the firmware. The "H" prefixing them in the firmware most likely tell that this is a file that shall be stored in the file system, not programmed to the flash memory or stored in the program area of the hard disk.

The .nft files are probably fonts, the .dct files "dictionaries", given the obvious chinese terms "kanji" (writing system) and "cjk" (chinese glyphs).

A recent MTP firmware extracted from a Zen Touch FW 2.10.05 have these files:

MTP File allocation table
attrs.db
jukebox2.jrm
jukebox.jrs
unicjkl.nft
splash.jbm
devicon.ico
devlogo.png
btree.db
plist.db
musicait.db
musicstr0.db
musicstr1.db
musicstr2.db
archvait.db
archvstr0.db
archvstr1.db
archvstr2.db
vdirait.db
vdirstr0.db
vdirstr1.db
vdirstr2.db
plistait.db
pliststr0.db
pliststr1.db
pliststr2.db
fsdirtree.db
fhandle.db
pm.cfg
pm.cbk
list.qm

It seems the operating system has been quite rewritten and the database split (normalized?) in the recent MTP firmwares.

.jbm is a proprietary bitmap format used by at least the Zen Xtra and Touch, if not all Creative players. A valid BMP header will start at the 2nd byte.