Zvue Development

Analyzing the Zvue Media Player

Introduction
The Zvue is a new $99 media player with a 2.5" color screen capable of playing audio and video from MMC or SD memory cards.

There is also a $150 version that has the same hardware, but includes MP4 encoding and decoding software. I'm actually a little puzzled with that version -- that seems like a lot to pay for the extra software (update: actually you get extra hardware, including a USB cable, 32 MB card, and batteries). I wonder if a good part of that is to make up for the fewer zcards they expect to sell the owners of the MP4-enabled version. The MP4 upgrade will come on a card is seems to be just a flash upgrade -- I wonder what's to prevent someone from reselling their card on ebay after they've upgraded (update: maybe the data on the upgrade card get changed).

The screen is a 2.5" is specially optimized for displaying pictures. Although it is physically wider than tall, it measures 160 pixels wide by 240 pixels tall because the pixels have a 2:1 aspect ratio. To improve quality further, the color stripe order is different on every other row -- the result is more natural looking pictures with less artifacts, but at the expense of color fringes on plain text (which makes it suitable for general-purpose computer screens). The Zvue's stripe order isn't necessarily correct in this diagram, but it'll suffice:

r	g	b	r	g	b
r	g	b	g	b	r
r	g	b	r	g	b

regular zvue

Since the screen is physically different, it's not reproducable on a normal computer screen. This picture has the same resolution, but it will look much better on an actual Zvue.

Hardware
I've got an analysis of interesting parts used in the device and some disassembly pictures. The device has a JTAG port and I've managed to use it to examine memory and registers.

Software
A large variety of operating systems are available for the i.MXL processor, including Linux, Windows CE, Palm, and Symbian. Rolling their own operating system wouldn't be too difficult -- the most complicated part would be the implementation of a read-only FAT filesystem (not too hard). The fact that they didn't support FAT32 in their earlier releases tells me this is probably what they did.

One clue comes from the 563420-byte firmware upload file: http://tope.findpage.com/zvue/zvue_update040105.prg

The file seems to be a special 8-byte header followed by the beginning of a standard ELF object file:

00000000:  48 48 65 50 ba 6e f2 0b  7f 45 4c 46 01 01
01
00  |HHeP.n...ELF....|

Running the UNIX utility file on a stripped version of the update reports "ELF 32-bit LSB executable, ARM, version 1 (SYSV), statically linked, stripped" - exactly what I'd expect. Unfortunately, strings and objdump (built for ARM processors) didn't yield any more information. The utility gzip manages to compress it 15% -- strong crypto and already-compressed data should be essentially incompressible, while typical object code compresses 50%. Two things could be happening: Either the ROM is using a form of weak encryption or scrambling, or it contains a mixture of some uncompressed data and some compressed (such as the startup video).

The file size is interesting: 563420 bytes may be 512kB of uncompressed FLASH memory image + 39132 bytes of overhead and loader -- bit since the device has 4MB of FLASH memory, it clearly isn't filled and therefore we wouldn't expect the file to be an even power of 2. (although it may be a power of 64KB since this is the Flash's natural block size).

Disassembling the first few bytes of what looks like real data (the header is a bit different than standard ELF format even after stripping the first 8 bytes) results in what looks like garbage:

	32-bit ARM instruction set		16-bit Thumb instruction set
	54: 2bdcafab blcs ff72bf08 <_binary_t_size+0xff6a2633> 58: d2eb92a9 rscle r9, fp, #-1879048182 ; 0x9000000a 5c: 83c3709a bichi r7, r3, #154 ; 0x9a 60: 29735a57 ldmcsdb r3!, {r0, r1, r2, r4, r6, r9, fp, ip, lr}^ 64: 43e347bb mvnmi r4, #49020928 ; 0x2ec0000 68: 83b4ccb9 movhis ip, #47360 ; 0xb900 6c: 479fbb9c undefined 70: e8bf2c75 ldmia pc!, {r0, r2, r4, r5, r6, sl, fp, sp} 74: 54167778 ldrpl r7, [r6], -#1912 78: 918f62ed orrls r6, pc, sp, ror #5 7c: 9e354d30 mrcls 13, 1, r4, cr5, cr0, {1} 80: 4496db7c ldrmi sp, [r6], #2940 84: ca8c556e bgt fe315644 <_binary_t_size+0xfe28bd6f> 88: 8f15fa11 swihi 0x0015fa11		`54: afab addr 7, sp, #684 56: 2bdc cmp r3, #220 58: 92a9 str r2, [sp, #676] 5a: d2eb bcs 34 <_binary_t_start+0x34> 5c: 709a strb r2, [r3, #2] 5e: 83c3 strh r3, [r0, #30] 60: 5a57 ldrh r7, [r2, r1] 62: 2973 cmp r1, #115 64: 47bb undefined instruction 0x47bb 66: 43e3 mvn r3, r4 68: ccb9 ldmia r4!,{r0, r3, r4, r5, r7} 6a: 83b4 strh r4, [r6, #28] 6c: bb9c undefined instruction 0xbb9c 6e: 479f undefined instruction 0x479f`

Update: a new firmware version is available and the old version has been pulled. The new one is slightly larger and shares many of the same bytes in the beginning.

Resources
http://www.zvue.com - the official HandHeld entertainment (HHe) website.
An incredible site with all sorts of info on the zvue.
Zvue zine with gratuitous almost-nudity when I last checked (uh, why?)
http://zvue.blogspot.com is an informative news blog and its affiliated discussion board (it used to be here). Although this is run by Zvue marketing, it seems fair and lets users speak openly.
Motorola i.MXL Documentation is the authoritative source on the Zvue's processor.
A place that sells the Zvue and offers some tech specs. Supposedly the Discovery Store will offer these at a brick-and-mortar outlet.
Firmware version 040105 is available for download from HHe.
Recent Slashdot article on the Zvue. If you read closely, the Zvue developer posted to it, but moderators didn't notice.

Similar: It looks like there is a great development system for the Game Boy Advance.

contact me: my email address is my first name (john) at my last name (maushammer) dot com.

other systems I've played with
visit my homepage