Zune HD ROM Dump

Da_G · Sep 25, 2009

Here we go!

3 Relevant partitions on the Zune HD:

ZBoot
NK
EXT

(there's actually a 4th partition, but it's a recovery partition for NK to facilitate fail-safe updating)

Enjoy

(a note: some files appear to be damaged, its my first time dumping a CE 7/Zune HD ROM

)
(another note: thanks to nd4spd for getting the rom update to me, i don't have a zune hd

)

fards · Sep 25, 2009

wow I'll take a look.

Anything usable?

Da_G · Sep 25, 2009

These executables are designed for CE 7 and more than likely will not work at all on CE 5 (although things coded for .NET might)

Really, you tell me, though, I haven't actually tried

bedoig · Sep 25, 2009

Awesome! Subscribed...

fb401 · Sep 25, 2009

Wait...so you're telling me it might be possible to create custom roms on the zune hd?!?! i need them to come out with a 128 gb model asap then...

votum · Sep 25, 2009

WOW....they were trying to dump a zune rom for years.... so this means the protection on the zune HD is not nearly as strong as the regular zune...this is good news indeed...Mine is on backorder still =x

votum · Sep 25, 2009

Another quick Q, did you dump that yourself or find it somewhere?

setix · Sep 26, 2009

been trying to find this for a few weeks

looking forward to see what can be done!

are the keyboard files in a format that we can use on windows mobile phones?

ND4SPD · Sep 26, 2009

votum said:
Another quick Q, did you dump that yourself or find it somewhere?

Actually, all I did was reset my Zune HD in recovery mode and plugged it in. When the Zune Software detected it, it downloaded the ROM from MS. When I was defragging my computer a few days earlier, I happened to find the folder where it saved all of the Firmware Updates. So I just looked in that folder and found the FirmwareUpdate.cab that had the .bin files in it.

setix · Sep 26, 2009

after messing around with it, looks like nothing can really be recmoded to make dll files. it may need another way to rec mod than in the vk.

Blackwheel · Sep 26, 2009

So does this mean that the Zune HD will be unlocked shortly?!

benko286 · Sep 26, 2009

Blackwheel said:
So does this mean that the Zune HD will be unlocked shortly?!

and does this mean that we will have Zune GUI on winmo devices

?

setix · Sep 26, 2009

benko286 said:
and does this mean that we will have Zune GUI on winmo devices ?

That could take some time, but once we are able to read the files, i will try to work on a keyboard

Blackwheel · Sep 26, 2009

setix said:
That could take some time, but once we are able to read the files, i will try to work on a keyboard

How about unlocking the Zune HD? Or is that a completely different animal?

Somebody please sticky this thread immediately. This can only lead to great things!

butterdori · Sep 27, 2009

Blackwheel said:
How about unlocking the Zune HD? Or is that a completely different animal?

Somebody please sticky this thread immediately. This can only lead to great things!

Err.. forgive my ignorance.. but is Zune HD locked?

In what way?

koikaze · Sep 27, 2009

I think what he means by unlocking is to unlock for ROM modification and development.

hairchrm · Sep 29, 2009

ND4SPD said:
When I was defragging my computer a few days earlier, I happened to find the folder where it saved all of the Firmware Updates. So I just looked in that folder and found the FirmwareUpdate.cab that had the .bin files in it.

The ROM is saved in a .cab file to %HOMEPATH%\AppData\Local\Microsoft\Zune\Firmware Updates

7-Zip or another unzipping software can extract it out into the 4 .bin files, ext.bin, nk.bin, recovery.bin, and zboot.bin.

I have not yet succeeded to breaking it down into DLLs, it seems like there are multiple DLLs compiled into one .bin file.

Interestingly enough, some of the plaintext I saw in the recovery file was associated with camera/photography code (do a ctrl-f for "autofocus" or "lens" in the recovery.bin file in wordpad). However, I'm guessing it is the remnants of WinCE code, not for the Zune HD (or a successor?). It still begs the question of why it would be included in the recovery code though...

Hope that someone can use this for something...

ND4SPD · Sep 29, 2009

hairchrm said:
The ROM is saved in a .cab file to %HOMEPATH%\AppData\Local\Microsoft\Zune\Firmware Updates

7-Zip or another unzipping software can extract it out into the 4 .bin files, ext.bin, nk.bin, recovery.bin, and zboot.bin.

I have not yet succeeded to breaking it down into DLLs, it seems like there are multiple DLLs compiled into one .bin file.

Interestingly enough, some of the plaintext I saw in the recovery file was associated with camera/photography code (do a ctrl-f for "autofocus" or "lens" in the recovery.bin file in wordpad). However, I'm guessing it is the remnants of WinCE code, not for the Zune HD (or a successor?). It still begs the question of why it would be included in the recovery code though...

Hope that someone can use this for something...

To break it down, you need to use cvrtbin.exe to convert it to the .nb0 format. Once you have that, as Da_G pointed out to me, you can use Xipport.exe's dump xip function to dump whichever converted file. Unfortunately, xipport has an error on the last file, so I'm going to try to fix that this evening.

You can also view the files in Da_G's first post

hairchrm · Sep 29, 2009

ND4SPD said:
To break it down, you need to use cvrtbin.exe to convert it to the .nb0 format. Once you have that, as Da_G pointed out to me, you can use Xipport.exe's dump xip function to dump whichever converted file. Unfortunately, xipport has an error on the last file, so I'm going to try to fix that this evening.

You can also view the files in Da_G's first post

Ahh... haha, I thought he linked to the raw .bin files and I figured that it would be easier to grab them from your own computer than download them. Whoooops!

pidsw · Sep 29, 2009

I am curious, has anyone disected the Zune HD Hardware? I wonder what extra hardware got left behind that is not currently activated (and possilby not licensed). The core chipset can handle all of the common peripherals that you might find in a WM7 class phone chasis.
At the very least you should be able to see the sort of antenna and amps in there.

the Imageupdate system clearly works, so one approach to updating it (unlocking and or removing security) is to use the imageupdate system (on device or from your desktop, or possibly OTA). Although you would need to know a good bit about the NK and zloader for wm7. WM7 is a more streamlined, efficifient design, but - unfortunatey - there is a lot more in the kernel which makes updating individual bits more difficult without a full link.
It is a little bit more like the X360 design in this sense.
I believe that imageupdate is only known the to the end users as the engine for Windows Phone Update or -previously - FOTA (firmware over the air)

As Da_g mentioned, this is the first commercial device (to my knowledge) to use WCE7/WM7 (in general, WM is just a big OAK on WCE)

What certs are in the full CAB?

Zune HD ROM Dump

Inactive Senior RD / Moderator Emeritus

Inactive Recognized Developer

Inactive Senior RD / Moderator Emeritus

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Senior Member

Member

Retired Forum Moderator

Senior Member

Member

Senior Member

Senior Member

hairchrm

Guest

Senior Member

hairchrm

Guest

Senior Member

Similar threads