Creative Zen V (Plus) Port

---

Intro

Small flash based player from Creative. The V Plus models have a radio and can play video.

---

Firmware Format

The firmware format is very similar to the one described here, but with some minor differences.

Normal files to be found in an official firmware

Block Type	File Name	Information	File Format
FINC	N/A	player string
ATAD	FBCB	flash bootloader? Mentions 'STMP'
ATAD	FRESC	flash rescue mode (key is 'Copyright (C) CTL. - zN0MAD iz v~p0wderful!')
LT©	N/A	firmware file
ATAD	Hjukebox2.jrs	multilingual strings
ATAD	Hunicjkl.nft	Unicode font?
ATAD	Hunicjapkl.nft	Unicode font?
ATAD	Hdevicon.ico	icon used in MTP mode
ATAD	Hdevlogo.png	picture of 'CreAtive'
ATAD	Hdeviceinfo.xml	MTP description
LLUN	N/A	firmware checksum

---

Creative's Software Recovery Mode

• Detach your player from the PC if it is connected, and turn off the player. (If the player stops responding, you can reset the player. To reset the player, gently insert a thin object into the Reset hole located below the power switch.)
• Press and hold the Play button while powering on your player.
• When the player displays the Creative logo, release the Play button.

It will display the following options

• Clean Up: Scans the player and removes invalid links from its music library. Does not affect music files themselves.
• Format (All): Caution! Erases all content! Save a copy of your player's content before formatting.
• Reload OS/ Firmware: Caution! Erases your player's firmware. DO NOT select the Reload Firmware option unless you have access to a PC and you have downloaded the necessary firmware to install.
• Reboot: Reboots the device.

---

SigmaTel's Hardware Recovery Mode

Like the other STMP3xxx players, the Zen V has a built-in hardware recovery mode which presents itself as a Player Recovery Device Class with the proper drivers installed. Normally this mode can be accessed by holding a button while connecting to USB, but I tried many different combinations and couldn't find one. Then, after reading a ton of forum posts about the recovery mode showing itself after people screwed up their batteries, I thought I'd try simply removing it and it did indeed connect in recovery mode. Perhaps there is another way, and in the meantime we have no use for this, but now we know how to get to it if required.

---

Hardware

	Creative CA0209-HA6 - Re-branded STMP3600
	Samsung K9L8G08U0M - NAND - Datasheet
	Philips TEA5767 - FM Radio - Data sheet
	Phison PS3002T - CompactMedia Controller - Data sheet
	Infineon HYB25L25616AF - 256MBit Mobile-RAM - Data sheet
	SSD1338U2 - LCD IC - This similar LCD used to use the same controller. This guy wrote a device driver for SigmaTel. This could prove handy. http://www.solomon-systech.com/pdf/OLED%20into%20mobile%20main%20display.pdf

---

Pins

Here is a list of all the pins used by the OF. Pins are of form BxPyy where x is the bank and yy the number within the bank. Direction only applies to GPIO.

Pin	Use/GPIO Dir	Comment
B0P{00-15}	gpmi_d{0-15}
B0P16	gpmi_irq
B0P17	gpmi_rdn
B0P18	gpmi_rdy
B0P20	gpmi_rdy2
B0P21	gpmi_wrn
B0P22	gpmi_a0
B0P23	gpmi_a1
B0P24	gpmi_a2
B0P27	OUT	lcd power (only if B3P16=0)
B1P00	IN	lcd kind
B1P{00-15}	lcd_d{0-15}
B1P16	lcd_reset
B1P17	lcd_rs
B1P18	lcd_wr
B1P19	lcd_cs
B1P20	gpmi_reset
B1P22	OUT	usb/charger/lradc related
B3P00	gpmi_ce0n
B3P01	gpmi_ce1n
B3P11	pwm1	button light
B3P16	IN	lcd power kind
B3P17	i2c_scl
B3P18	i2c_sda

---

lsusb Output on Hardware Recovery Mode

Bus 001 Device 005: ID 066f:3600 SigmaTel, Inc. 
Device Descriptor:
  bLength                18
  bDescriptorType         1
  bcdUSB               2.00
  bDeviceClass            0 (Defined at Interface level)
  bDeviceSubClass         0 
  bDeviceProtocol         0 
  bMaxPacketSize0        64
  idVendor           0x066f SigmaTel, Inc.
  idProduct          0x3600 
  bcdDevice            0.01
  iManufacturer           1 Sigmatel, Inc.
  iProduct                2 STMP3600
  iSerial                 0 
  bNumConfigurations      1
  Configuration Descriptor:
    bLength                 9
    bDescriptorType         2
    wTotalLength           32
    bNumInterfaces          1
    bConfigurationValue     1
    iConfiguration          3 USB Boot Class-c
    bmAttributes         0xc0
      Self Powered
    MaxPower              100mA
    Interface Descriptor:
      bLength                 9
      bDescriptorType         4
      bInterfaceNumber        0
      bAlternateSetting       0
      bNumEndpoints           2
      bInterfaceClass       255 Vendor Specific Class
      bInterfaceSubClass      0 
      bInterfaceProtocol    255 
      iInterface              4 USB Boot Class-i
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x01  EP 1 OUT
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0
      Endpoint Descriptor:
        bLength                 7
        bDescriptorType         5
        bEndpointAddress     0x82  EP 2 IN
        bmAttributes            2
          Transfer Type            Bulk
          Synch Type               None
          Usage Type               Data
        wMaxPacketSize     0x0040  1x 64 bytes
        bInterval               0

---

Useful Links

• STMP36xx Linux BSP
• Forum thread
• CreativeZVMPort contains info about the firmware structure.
• Pictures from Lost_prophet
• SansaExpress - Uses a similar chipset.
• SigmaTelSTMP3xxx - General chip info

---