Zunerama logo   
News: Register to join Zunerama forums!
 
*
Welcome, Guest. Please login or register. October 28, 2012, 06:59:30 PM


Login with username, password and session length


Pages: [1]   Go Down
  Print  
Author Topic: ZuneFact - True Hard Disk Contents - 2 partitions  (Read 17380 times)
ZunePet
lil zuner
**
Posts: 13


View Profile Email
ZuneFact - True Hard Disk Contents - 2 partitions
« on: December 11, 2006, 10:59:11 AM »

(ZuneFact - part of a series listing Zune technical facts, not the bulls#!t that is floating around many other boards)

The so-called "Zune Hard Drive Hack" that everyone is talking about does *NOT* give you direct access to the hard drive !!!!

In reality the true hard drive looks a lot different than what you see in Windows Explorer. What you are seeing in Windows Explorer is a filtered (fake) view.
For most casual Zune owners, the difference doesn't matter. For people seriously trying to access/hack the Zune, it is very significant.

---
If you want direct access to your Zune hard drive, you need to take out the Zune hard drive and connected it to other hardware like an iPod or special adapter
Then it will appear as TWO different partitions. The system partition (~150MB) which contains the real NK.BIN firmware and other stuff, and the data partition.
The data partition contains the media content.
The actual media info and data is stored in a database on the Zune hard drive (Microsoft SQL Mobile) and in other non-obviously named files.

"\Hard Disk\" (152MB partition, only 9% of space used)
Code:
02/03/2003  10:21 PM           262,315 eboot.bin
02/03/2003  10:21 PM        11,154,839 nk.bin
02/03/2003  10:22 PM                80 pmcver.dat
02/03/2003  10:22 PM         1,373,735 recovery.bin
[current date/time]             57,344 pmcstore.edb

The 3 BIN files are exactly the same as the ones on your computer. Typically "C:\Program Files\Zune\Firmware\Zune01010322.cab". Don't trust the dates in the listings (2003?)
The pmcver.dat file is a short file. The pmcstore.edb is a little database ("EDB" SQL mobile format). This stores user specific settings (many string values like "SyncPartner" and "EnableWifi").

-----
The media partion, "\Hard Disk2\" contains raw media data, with fake names and a big database. It is a little under 30GB in size.

Code:
[------------------]    <DIR>          Content
02/03/2003  10:23 PM             5,656 devcert.dat
[current date/time ]         1,347,584 drmstore.dat
[current date/time ]               160 MediaItems.dat
[current date/time ]       167,772,160 MediaLibrary.edb
[current date/time ]           131,072 MediaLibrary_thumbs.edb

Under 'Content' are the media files with synthetic names you aren't supposed to see, examples:
Code:
\Content\0100\00\0b.wma
\Content\0100\00\c3.wma
...
\Content\0600\00\0f.jpg
\Content\0600\00\12.jpg


Files sizes and layout under Content will be different on your Zune.
The Windows Explorer (using the MTP) formats the file names into a more user friendly format (eg: "\Storage\Music\blahblahblah) using info in the database. As mentioned, this is fake filtered view.
Logged
aaron00lee
zune rockstar
*******
Gender: Male
Posts: 1037


Zune, School and Fun...my life in a nutshell

aaron00lee
View Profile
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #1 on: January 10, 2007, 08:27:23 AM »

very interesting
Logged

Gowking
zune dog
***
Posts: 27


View Profile
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #2 on: January 10, 2007, 11:09:32 PM »

So what would happen if you were to connect the Zune HD to a PC via adapter and resize the data partition and then add a third partition?
Logged
rj1790
zune trooper
*****
Gender: Male
Posts: 219



View Profile
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #3 on: January 10, 2007, 11:17:14 PM »

Umm... Does Zune have ability to run eboots?
Logged
aaron00lee
zune rockstar
*******
Gender: Male
Posts: 1037


Zune, School and Fun...my life in a nutshell

aaron00lee
View Profile
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #4 on: January 11, 2007, 10:20:40 AM »

Thats Confusing...
Logged

zunemediaplayer
lil zuner
**
Posts: 16


View Profile WWW
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #5 on: January 11, 2007, 02:22:07 PM »

Excellent post, I have placed you on my blog for everyone to follow up on.

Thanks!
Logged

http://zunemediaplayer.blogspot.com/
zune-online.com
zune n00bie
*
Posts: 6


Zune-Online.com


View Profile WWW
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #6 on: January 11, 2007, 05:30:29 PM »

Thanks ZunePet for going that deep into the Zune filesystem, I've also posted it on my site.
I believe this (and you) can be helpful in projects like RockBox for Zune or Linux for Zune. Check the following:

RockBox Forum Zune Thread
Linux on Zune

EDIT: it would be interesting to check if the firmware / bootloader is digitally signed by Microsoft. If not installing an alternative firmware would be trivial. (There is a linux port for the Zune's processor already)
« Last Edit: January 11, 2007, 06:05:46 PM by zune-online.com » Logged

-- Zune-Online.com Share your Zune Experience!
rj1790
zune trooper
*****
Gender: Male
Posts: 219



View Profile
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #7 on: January 12, 2007, 12:38:59 AM »

u mean custom firmware? That would be incredible!
Logged
ZunePet
lil zuner
**
Posts: 13


View Profile Email
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #8 on: January 12, 2007, 10:08:57 AM »

> So what would happen if you were to connect the Zune HD to a PC via adapter and resize the data partition and then add a third partition?
It does a sanity check on boot, and if the hard drive is really messed up it will reformat/repartition it and get the NK.BIN firmware from your PC.
My guess is a 3rd partition would be an acceptable variation (they handle 80GB drives). If true it would work normally (essentially shrinking the available space on your 2nd data partition). No reason to do it since none of the existing software will access the 3rd partition.

> I believe this (and you) can be helpful in projects like RockBox for Zune or Linux for Zune. ...
I'm still looking for an exploit (the Zune engineers have done a great job locking it down, they even fixed an exploit in the GigaBeat "S")
Thinking about maybe a contest to get people to work on this.

> ...Linux on Zune...
Please don't propagate that link. I think everyone by now realizes it was a hoax/fake.
(ie. people do want Linux, but we can't run the most basic homebrew yet)

> it would be interesting to check if the firmware / bootloader is digitally signed by Microsoft.
It is digitally signed, otherwise all this would be running already
 (discussed on other threads and BBSs, including: http://www.zuney.net/zune-hacks-mods/258-bad-news-firmware-hacking.html#post2382 )
Logged
rj1790
zune trooper
*****
Gender: Male
Posts: 219



View Profile
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #9 on: January 12, 2007, 01:47:41 PM »

Quote
> it would be interesting to check if the firmware / bootloader is digitally signed by Microsoft.
It is digitally signed, otherwise all this would be running already
 (discussed on other threads and BBSs, including: http://www.zuney.net/zune-hacks-mods/258-bad-news-firmware-hacking.html#post2382 )
Looks like some bad news
Logged
zune-online.com
zune n00bie
*
Posts: 6


Zune-Online.com


View Profile WWW
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #10 on: January 12, 2007, 04:42:05 PM »

I've been told the freescale processor of Zune checks this digital signature. So can't trick it using firmware/bootloader modification.

Of course all these are speculations. Do you know on what level the digital signature is checked ? For example if the bootloader checks it, a modified one could be instructed not to check it. But if this is done on a hardware level...
Logged

-- Zune-Online.com Share your Zune Experience!
rj1790
zune trooper
*****
Gender: Male
Posts: 219



View Profile
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #11 on: January 12, 2007, 07:13:33 PM »

I'll ask my fellow psp developers if they can help.
Logged
ZunePet
lil zuner
**
Posts: 13


View Profile Email
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #12 on: January 15, 2007, 10:29:47 AM »

> I've been told the freescale processor of Zune checks this digital signature.
Don't know if that feature is used or not (they don't have to, see below)
If they did use the lower level processor protection, specific to the Freescale chip, it could protect the Zune from a lower level hardware chip mod (IMHO: not a viable solution for the Zune)
The regular EBoot check is already very anal and blocks a software-only update (unless digitally signed by Microsoft). This can be done with generic ARM code (not specific to the Freescale chip)

> Do you know on what level the digital signature is checked ?
Check that other thread for more detailed discussion. Short version:
All the obvious ways of tricking the system are protected. Uses a 20 byte SHA1 of almost every byte in the image, and checks it against the signature signed with Microsoft private key. They've done their homework.

> For example if the bootloader checks it, a modified one could be instructed not to check it....
It checks the NK.BIN loaded from the hard drive before running it. It also checks any new/modified EBOOT.BIN before writting it to Flash ROM and using it. So a homebrew patch of the EBOOT boot loader won't work either.

---
Note: this is hacker protection, not DRM. Defeating hacker protection is a legal activity. Defeating DRM on music/videos is not a legal activity (in most countries).
See recent discussion on iPhone too (apparently Apple wants to be in total control of the software it will run, just like Microsoft does on the Zune and Sony tries to do on the PSP).
Logged
tazaleth
zune n00bie
*
Posts: 1


View Profile Email
Re: ZuneFact - True Hard Disk Contents - 2 partitions
« Reply #13 on: September 09, 2010, 04:13:11 PM »

Is is possible to downgrade the zune firmware manually by overwriting the boot files on the zune hard drive directly?
( by removing the hard drive, wiring up as said )

If so, that would be extremely helpful. I have a new zunehd; and as it is, it is useless to me. I don't want the new version of the
firmware, because I refuse to run the new version of the software. I want to enable the old zune hard drive hack so I can at
least start using my zune to listen to music.

Plus; for development; the only way we are ever going to get the system to have anything akin to a custom firmware is
by taking advantage of glitches in the old firmware versions.
Logged
LuisTWatson
zune n00bie
*
Gender: Male
Posts: 1


luistwatson@yahoo.com LuisTWatson LuisTWatson
View Profile WWW Email
« Reply #14 on: February 09, 2011, 07:28:08 AM »

I am very interested for this post. Its really give me lots of pleasure. I choose this article very much. So lots of thanks for this post.
Logged

LuisT Watson
Pages: [1]   Go Up
  Print  
 
Jump to:  


Got a Kindle? Join our Kindle forum.

Zunerama is an independent website and is not affiliated with Microsoft. Zune, Zune Marketplace, and Zune Social are trademarks of Microsoft Corporation.
(c) 2006 - 2008 Zunerama. All Rights Reserved.
Top Zune Sites Microsoft Zune Player Top Site List
Powered by MySQL Powered by PHP Powered by SMF 1.1.15 | SMF © 2011, Simple Machines

Valid XHTML 1.0! Valid CSS! Dilber MC Theme by HarzeM
Page created in 0.05 seconds with 18 queries.