mirror of https://github.com/project-dorado/dorado-hd.git synced 2026-10-11 21:10:01 +00:00

Files

T

John Smith b8403621da feat(re): kernel module reconstruction and ZCSTFS/keyvault findings

- Add scripts/reconstruct_nk_modules.py to rebuild the kernel-only modules
  (zcstfs.dll, keyvault.dll, DwXfer.dll, zcblock.dll, zpartstream.dll) from
  NK.bin into the external corpus.
- Update the module inventory and API reference: 114/114 modules, 67,399
  functions decompiled, 4,236 exports.
- Correct the ZCP inventory and asset notes: the payload is a ZCSTFS volume
  (plaintext for the runtime), and marketplace keys are per-package AES keys
  unwrapped from an RSA-2048 blob by a device-provisioned keypack.

2026-09-11 03:26:21 -04:00

2.9 KiB

Raw Permalink Blame History

Zune HD firmware asset inventory (disassembly corpus)

Non-module files extracted from PavoBaseline.Cab (ROM file table) into the out-of-tree zune-hd-disassembly/assets/. Raw assets are provisioned by the device firmware and are never committed; this document is the synthesized inventory only.

Fonts (`assets/fonts/`, 28 files)

Authentic Zegoe UI (Microsoft): ZegoeUI.ttf, _B, _Blk, _L, _SB, _SL — the device UI typeface. Dorado-HD ships metric-compatible Selawik (OFL) instead; users may supply Zegoe locally.
CJK: MalgunForZune.ttf (Korean), MeiryoForZune.ttf (Japanese).
Core CE/desktop set: Arial, Courier New, Georgia, Impact, Times New Roman, Trebuchet MS, Verdana, Webdings, Wingdings (Web/CE rendering fallbacks).

Multimedia / codec firmware

File	Role
`nvmm_h264dec.axf`, `nvmm_mpeg4dec.axf`, `nvmm_adtsdec.axf`, `nvmm_jpegdec.axf`, `nvmm_jpegenc.axf`	Tegra APX 2600 codec firmware images (H.264, MPEG-4, AAC-ADTS, JPEG decode/encode).
`nvddk_audiomixer_core.axf`, `nvrm_avp.axf`	Audio-mixer core and the Tegra AVP (audio/video processor) firmware.
`msadpcm.dll`	Microsoft ADPCM codec (WinCE).
`runtimeZune.v3.1.zcp`	The XNA Game Studio 3.1 runtime package (4.3 MB). NX format version 1: a plaintext ZCSTFS volume holding ten runtime assemblies. It parses and extracts with no keys (`dorado-emu` M1.5).
`TVOut.exe`	Small Windows CE ARM PE (TV-out helper).

Networking / radio firmware

File	Role
`Acs_045E_081C_3_90_ClutchFW.hex`, `Acs_045E_091A_4_26_ConcertoFW.hex`	Intel-HEX touch-controller firmware (`045E` = Microsoft VID): "Clutch" and "Concerto" controllers.
`athwlan2_0.bin.z77`, `data.patch.hw2_0.bin`	Atheros Wi-Fi firmware (LZ77 "z77" compressed) + patch.
`calData_sd21-055-d0513.bin`	Wi-Fi calibration data.

Identity / provisioning

File	Role
`sysroots.p7b`, `zuneca.p7b`	PKCS#7 certificate bundles (trust roots / CA chain).
`zuneroots.p7b`	PGP-encrypted root key material.
`zbinfs_EXT.hash`	Filesystem (binfs) hash table for the EXT partition.
`hdrfirmware.bin`	Discrete HD-radio (HD-Radio) firmware blob.

UI chrome / OS resources

File	Role
`stdsm.bmp`, `viewsm.bmp`, `stdsm.2bp`, `viewsm.2bp`, `close.2bp`, `ok.2bp`	Boot / status bitmaps and `.2bp` mask pairs.
`DefaultAd.png`, `Dismiss.png` / `DismissESP.png` / `DismissFRA.png`, `devicon.ico`	Marketplace/notification chrome.
`Dictionary.dat`	Custom `ZDCT` (Zune Dictionary) data file, 1.28 MB — spelling/dictionary resource.

What this pass did not recover

Device-provisioned keypacks (the RSA-2048 private key that unwraps marketplace .zcp content keys); not present in the firmware cab or PC installer.
zuneroots.p7b (PGP-encrypted).
Field semantics of the XuiTouchSettings struct (see zune-hd-touch-settings.md §4 — no PDB/symbol data exists in the corpus).

2.9 KiB Raw Permalink Blame History