ZuneFact - True Hard Disk Contents - 2 partitions

[ZunePet]

(ZuneFact - part of a series listing Zune technical facts, not the bulls#!t that is floating around many other boards)

The so-called "Zune Hard Drive Hack" that everyone is talking about does *NOT* give you direct access to the hard drive !!!!

In reality the true hard drive looks a lot different than what you see in Windows Explorer. What you are seeing in Windows Explorer is a filtered (fake) view.
For most casual Zune owners, the difference doesn't matter. For people seriously trying to access/hack the Zune, it is very significant.

---
If you want direct access to your Zune hard drive, you need to take out the Zune hard drive and connected it to other hardware like an iPod or special adapter
Then it will appear as TWO different partitions. The system partition (~150MB) which contains the real NK.BIN firmware and other stuff, and the data partition.
The data partition contains the media content.
The actual media info and data is stored in a database on the Zune hard drive (Microsoft SQL Mobile) and in other non-obviously named files.

"\Hard Disk\" (152MB partition, only 9% of space used)

Code:

02/03/2003  10:21 PM           262,315 eboot.bin
02/03/2003  10:21 PM        11,154,839 nk.bin
02/03/2003  10:22 PM                80 pmcver.dat
02/03/2003  10:22 PM         1,373,735 recovery.bin
[current date/time]             57,344 pmcstore.edb

The 3 BIN files are exactly the same as the ones on your computer. Typically "C:\Program Files\Zune\Firmware\Zune01010322.cab". Don't trust the dates in the listings (2003?)
The pmcver.dat file is a short file. The pmcstore.edb is a little database ("EDB" SQL mobile format). This stores user specific settings (many string values like "SyncPartner" and "EnableWifi").

-----
The media partion, "\Hard Disk2\" contains raw media data, with fake names and a big database. It is a little under 30GB in size.

Code:

[------------------]    <DIR>          Content
02/03/2003  10:23 PM             5,656 devcert.dat
[current date/time ]         1,347,584 drmstore.dat
[current date/time ]               160 MediaItems.dat
[current date/time ]       167,772,160 MediaLibrary.edb
[current date/time ]           131,072 MediaLibrary_thumbs.edb

Under 'Content' are the media files with synthetic names you aren't supposed to see, examples:

Code:

\Content\0100\00\0b.wma
\Content\0100\00\c3.wma
...
\Content\0600\00\0f.jpg
\Content\0600\00\12.jpg

Files sizes and layout under Content will be different on your Zune.
The Windows Explorer (using the MTP) formats the file names into a more user friendly format (eg: "\Storage\Music\blahblahblah) using info in the database. As mentioned, this is fake filtered view.

[aaron00lee]

very interesting

[Gowking]

So what would happen if you were to connect the Zune HD to a PC via adapter and resize the data partition and then add a third partition?

[rj1790]

Umm... Does Zune have ability to run eboots?

[aaron00lee]

Thats Confusing...

[zunemediaplayer]

Excellent post, I have placed you on my blog for everyone to follow up on.

Thanks!

[zune-online.com]

Thanks ZunePet for going that deep into the Zune filesystem, I've also posted it on my site.
I believe this (and you) can be helpful in projects like RockBox for Zune or Linux for Zune. Check the following:

RockBox Forum Zune Thread
Linux on Zune

EDIT: it would be interesting to check if the firmware / bootloader is digitally signed by Microsoft. If not installing an alternative firmware would be trivial. (There is a linux port for the Zune's processor already)

[rj1790]

u mean custom firmware? That would be incredible!

[ZunePet]

> So what would happen if you were to connect the Zune HD to a PC via adapter and resize the data partition and then add a third partition?
It does a sanity check on boot, and if the hard drive is really messed up it will reformat/repartition it and get the NK.BIN firmware from your PC.
My guess is a 3rd partition would be an acceptable variation (they handle 80GB drives). If true it would work normally (essentially shrinking the available space on your 2nd data partition). No reason to do it since none of the existing software will access the 3rd partition.

> I believe this (and you) can be helpful in projects like RockBox for Zune or Linux for Zune. ...
I'm still looking for an exploit (the Zune engineers have done a great job locking it down, they even fixed an exploit in the GigaBeat "S")
Thinking about maybe a contest to get people to work on this.

> ...Linux on Zune...
Please don't propagate that link. I think everyone by now realizes it was a hoax/fake.
(ie. people do want Linux, but we can't run the most basic homebrew yet)

> it would be interesting to check if the firmware / bootloader is digitally signed by Microsoft.
It is digitally signed, otherwise all this would be running already
 (discussed on other threads and BBSs, including: http://www.zuney.net/zune-hacks-mods/258-bad-news-firmware-hacking.html#post2382 )

[rj1790]

> it would be interesting to check if the firmware / bootloader is digitally signed by Microsoft.
It is digitally signed, otherwise all this would be running already
 (discussed on other threads and BBSs, including: http://www.zuney.net/zune-hacks-mods/258-bad-news-firmware-hacking.html#post2382 )

Looks like some bad news

[zune-online.com]

I've been told the freescale processor of Zune checks this digital signature. So can't trick it using firmware/bootloader modification.

Of course all these are speculations. Do you know on what level the digital signature is checked ? For example if the bootloader checks it, a modified one could be instructed not to check it. But if this is done on a hardware level...

[rj1790]

I'll ask my fellow psp developers if they can help.

[ZunePet]

> I've been told the freescale processor of Zune checks this digital signature.
Don't know if that feature is used or not (they don't have to, see below)
If they did use the lower level processor protection, specific to the Freescale chip, it could protect the Zune from a lower level hardware chip mod (IMHO: not a viable solution for the Zune)
The regular EBoot check is already very anal and blocks a software-only update (unless digitally signed by Microsoft). This can be done with generic ARM code (not specific to the Freescale chip)

> Do you know on what level the digital signature is checked ?
Check that other thread for more detailed discussion. Short version:
All the obvious ways of tricking the system are protected. Uses a 20 byte SHA1 of almost every byte in the image, and checks it against the signature signed with Microsoft private key. They've done their homework.

> For example if the bootloader checks it, a modified one could be instructed not to check it....
It checks the NK.BIN loaded from the hard drive before running it. It also checks any new/modified EBOOT.BIN before writting it to Flash ROM and using it. So a homebrew patch of the EBOOT boot loader won't work either.

---
Note: this is hacker protection, not DRM. Defeating hacker protection is a legal activity. Defeating DRM on music/videos is not a legal activity (in most countries).
See recent discussion on iPhone too (apparently Apple wants to be in total control of the software it will run, just like Microsoft does on the Zune and Sony tries to do on the PSP).