dev builds
themes manual
device status forums
mailing lists
IRC bugs
dev guide

Search | Go
Wiki > Main > CreativeZenV

Creative Zen V (Plus) Port


Small flash based player from Creative. The V Plus models have a radio and can play video.

Firmware Format

The firmware format is very similar to the one described here, but with some minor differences.

Normal files to be found in an official firmware

Block Type File Name Information File Format
FINC N/A player string  
ATAD FBCB flash bootloader? Mentions 'STMP'  
ATAD FRESC flash rescue mode (key is 'Copyright (C) CTL. - zN0MAD iz v~p0wderful!')  
LT© N/A firmware file  
ATAD Hjukebox2.jrs multilingual strings  
ATAD Hunicjkl.nft Unicode font?  
ATAD Hunicjapkl.nft Unicode font?  
ATAD Hdevicon.ico icon used in MTP mode  
ATAD Hdevlogo.png picture of 'CreAtive'  
ATAD Hdeviceinfo.xml MTP description  
LLUN N/A firmware checksum  

Creative's Software Recovery Mode

  • Detach your player from the PC if it is connected, and turn off the player. (If the player stops responding, you can reset the player. To reset the player, gently insert a thin object into the Reset hole located below the power switch.)
  • Press and hold the Play button while powering on your player.
  • When the player displays the Creative logo, release the Play button.

It will display the following options

  • Clean Up: Scans the player and removes invalid links from its music library. Does not affect music files themselves.
  • Format (All): Caution! Erases all content! Save a copy of your player's content before formatting.
  • Reload OS/ Firmware: Caution! Erases your player's firmware. DO NOT select the Reload Firmware option unless you have access to a PC and you have downloaded the necessary firmware to install.
  • Reboot: Reboots the device.

SigmaTel's Hardware Recovery Mode

Like the other STMP3xxx players, the Zen V has a built-in hardware recovery mode which presents itself as a Player Recovery Device Class with the proper drivers installed. Normally this mode can be accessed by holding a button while connecting to USB, but I tried many different combinations and couldn't find one. Then, after reading a ton of forum posts about the recovery mode showing itself after people screwed up their batteries, I thought I'd try simply removing it and it did indeed connect in recovery mode. Perhaps there is another way, and in the meantime we have no use for this, but now we know how to get to it if required.


ZenV_SOC.png Creative CA0209-HA6 - Re-branded STMP3600
ZenV_Flash2.png Samsung K9L8G08U0M - NAND - Datasheet
Philips TEA5767 - FM Radio - Data sheet
Phison PS3002T - CompactMedia Controller - Data sheet
Infineon HYB25L25616AF - 256MBit Mobile-RAM - Data sheet
SSD1338U2 - LCD IC - This similar LCD used to use the same controller.
This guy wrote a device driver for SigmaTel.
This could prove handy.


Here is a list of all the pins used by the OF. Pins are of form BxPyy where x is the bank and yy the number within the bank. Direction only applies to GPIO.
Pin Use/GPIO Dir Comment
B0P{00-15} gpmi_d{0-15}  
B0P16 gpmi_irq  
B0P17 gpmi_rdn  
B0P18 gpmi_rdy  
B0P20 gpmi_rdy2  
B0P21 gpmi_wrn  
B0P22 gpmi_a0  
B0P23 gpmi_a1  
B0P24 gpmi_a2  
B0P27 OUT lcd power (only if B3P16=0)
B1P00 IN lcd kind
B1P{00-15} lcd_d{0-15}  
B1P16 lcd_reset  
B1P17 lcd_rs  
B1P18 lcd_wr  
B1P19 lcd_cs  
B1P20 gpmi_reset  
B1P22 OUT usb/charger/lradc related
B3P00 gpmi_ce0n  
B3P01 gpmi_ce1n  
B3P11 pwm1 button light
B3P16 IN lcd power kind
B3P17 i2c_scl  
B3P18 i2c_sda  

lsusb Output on Hardware Recovery Mode

Bus 001 Device 005: ID 066f:3600 SigmaTel, Inc. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x066f SigmaTel, Inc.
  idProduct          0x3600 
  bcdDevice            0.01
  iManufacturer           1 Sigmatel, Inc.
  iProduct                2 STMP3600
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          3 USB Boot Class-c
    bmAttributes         0xc0
      Self Powered
    MaxPower              100mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass      0 
      bInterfaceProtocol    255 
      iInterface              4 USB Boot Class-i
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0

Useful Links

r15 - 02 Apr 2021 - 20:46:06 - UnknownUser

Copyright © by the contributing authors.