Sync Signal

[PityOnU]

What we really need for the harddrive hack is some way to mimic the signal sent to the Zune when the Zune software starts up (duh!)

What I did (I know I'm not the first) was track what was going back and forth between the computer and the Zune with a USB Sniffer (starting when I plugged it in and through a sync). I got lots of useful data out of it, but I don't know how to use any of it, and I certainly don't know how to write a program to mimic it. I am posting it here in hopes that someone who knows what they're doing with this kind of thing will take this information and use it to write a totally kick-ass Zune Syncing (but not really) program. I am attaching the info in the form of a .jpg. Once you download it, change the file extension to .usblog. Then, open it up using a USB Sniffing program like Snoopy Pro (http://sourceforge.net/projects/usbsnoop/).

I think it is the 4th "down" when the computer sends the Zune the signal to sync... but as I said, I'm no expert. Could someone please have a look at this and figure out if it can be used in a mimicing program?

[Mistafied]

First your Log Image isnt working...

Secound I would suggest doing a search for "USB Design by Example". Maybe in a torrent near you. This will help start your beginnings of USB and what some of that information is doing.

[PityOnU]

Originally Posted by Mistafied

First your Log Image isnt working...

Secound I would suggest doing a search for "USB Design by Example". Maybe in a torrent near you. This will help start your beginnings of USB and what some of that information is doing.

Fine.

[lpxxfaintxx]

I couldn't get USB snoop to work. :P

[PityOnU]

Really?

DId you download USBSnoop or USBSnoopSrc? I'm not sure what the "Src" one is, but it's just files, no executable.

If you can't figure out how to get the thing to run, you have to right click on "Vid_045e&Pid_0710" and select "Install and Restart" with the Zune program running and the Zune connected. It took me 2 tries, but I got it.

[collingall2005]

Originally Posted by PityOnU

Really?

DId you download USBSnoop or USBSnoopSrc? I'm not sure what the "Src" one is, but it's just files, no executable.

If you can't figure out how to get the thing to run, you have to right click on "Vid_045e&Pid_0710" and select "Install and Restart" with the Zune program running and the Zune connected. It took me 2 tries, but I got it.

Src means source, its the source files so that you can freely (under certain restrictions) modify the program to your liking. :

[PityOnU]

Originally Posted by collingall2005

Src means source, its the source files so that you can freely (under certain restrictions) modify the program to your liking. :

Ooooohhhhhhh... Well, I won't be doing any of that, that's for sure ;D

[Mistafied]

Thanks got it to work.. It seems only to log data on the connect.. It seems to be monitoring still, but when I try a Manual sync it doesnt log anymore data.. and two dumps give me the same amount of code..

But here are my dumps in word and the log file the program created.

[PityOnU]

Originally Posted by Mistafied

Thanks got it to work.. It seems only to log data on the connect.. It seems to be monitoring still, but when I try a Manual sync it doesnt log anymore data.. and two dumps give me the same amount of code..

But here are my dumps in word and the log file the program created.

Looks like yours are the same as mine... it prompts the Zune for ID 3 times, and then sends the starting signal.

o.O You put them in Word! How'd you do that?

[SauliusM]

This has all been done on Zuney with a better USB Monitoring Program (Well actually 2, started out with 1 and then found the other).Also ive got many file/program monitoring programs that ive used on it.

Ive found with it quite a lot of stuff, Because with the programs ive used it gives me hexes, and ascii, of what its transferring/receiving. Go check it out on Zuney.

Heres a little taste of one of my file monitoring programs.

<?xmlversion="1.0"?>
<LICENSEversion="2.0.0.0">
<LICENSORINFO>
<DATA>
<LID>
{160F39D6-8052-4AF3-AB48-881BE2BCC80A}
</LID>
<KID>
EZ5kdFj9uEqWb0k8GqiOYg==
</KID>
<ISSUEDATE>
#2006122700:31:15Z#
</ISSUEDATE>
<PRIORITY>
0
</PRIORITY>
<RevocationList>
B0crP6asP4HweCIxjMppECCDi34a*rf6n0ks
JguQyGyMR!oBum18IwIAAADAAAAABgAAA
AAAAAAoAAAANsoG8h076HTyFMMZjG1vHXe
ZmFeFES14zclivEcB3FgtMrxadnl2aQAAAAAoA
AAAkT8hU9tuYui*2dyuJ8!6VtLNWnr7z7GY7MG
D8johDA1aGt2taWZlOwAAAAAoAAAAEEHRFb
XHQQGkpQhOQnuMj4KgSSCfy!ogHo08y!ZTAQ
oQPsKkUXSQfQAAAAAoAAAASSBW8Brm2QMF
mXjMc0fsJoZC910j03VkHoAP70Up8ehGlx*idNilgg==
</RevocationList>
<CONTENTPUBKEY>
3miavHkcRDNnRR9bQD5RMFxV1GNl6IFerpdyJ!YN026mqf1pbK 5XNQ==
</CONTENTPUBKEY>
<META>
<EncryptorID>
152144
</EncryptorID>
</META>
<ONACTION type="Restore">
<CONDITION>
<![CDATA[1]]>
</CONDITION>
</ONACTION>
<ONACTION type="Backup">
<CONDITION>
<![CDATA[1]]>
</CONDITION>
</ONACTION>
<ONACTION type="CREATE_PM_LICENSE">
<CONDITION>
<![CDATA[pmlicense.rights=3;pmlicense.appseclevel=1000;1]]>
</CONDITION>
</ONACTION>
<ONACTION type="Play">
<CONDITION>
<![CDATA[1]]>
</CONDITION>
</ONACTION>
<ONSELECT>
<CONDITION>
<![CDATA[(!exists(secstate.deleted)&&(app.minseclevel>=1000 ?1secstate.drmreason=3;0)))]]>
</CONDITION>
</ONSELECT>
<ONSTORE>
<ACTION>
<![CDATA[!exists(secstate.MinAppSecLevel)?secstate.MinAppSe cLevel=1000:0]]>
</ACTION>
</ONSTORE>
<ENABLINGBITS>
<ALGORITHM type="MSDRM">
</ALGORITHM>
<PUBKEYtype="machine">
28IXqkL0n6gQIWKIQufhIduHphMJ5SgOa
Np5eczlEFtS4cze3Um8JA==
</PUBKEY>
<VALUE>
9WZLyAh!AB9MU4Et1qtjvwKnpDfaCJ*Fx
G28EkdC2DGx5ztYpS9WgvlZJIaT4naE6b
8*g7Cz!pF*kxkXqyijwZTb5aIb9iFA!7VVu3kyCB8=
</VALUE>
<SIGNATURE>
01RXFw9lucdWIM!gn2cxXalShmQiKxLqg
0AcC0K99P54K8xmpWGteg==
</SIGNATURE>
</ENABLINGBITS>
</DATA>
<SIGNATURE>
<HASHALGORITHM type="SHA">
</HASHALGORITHM>
<SIGNALGORITHM type="MSDRM">
</SIGNALGORITHM>
<VALUE>
gozrKEA0kx*M2*t2CTaZuNmvd3TszLB4d
VnrGWj3E9fNKCRzObWYVg==
</VALUE>
</SIGNATURE>
<CERTIFICATECHAIN type="MSDRM">
<CERTIFICATE>
AAEAADgAAACXxr7XlfjvIXHhFnDyYzNfUQ
VDPy1Ii!xhem!VxM8n*yBqyWnq2lRM8aL8
A3aNRiqdpucCapuaEu2sow5oNjSuG6KN49
470s53bn*XIUhCeB4ADB8AAABlAAAAAQAAAAE=
</CERTIFICATE>
<CERTIFICATE>
AAEAADgAAADAT4rf8nsAeecQKY8jVT8T0N
DMT3P0Wu!9j0RcshFwnhoO5ZJnY8sxXN6d8
6SYySqJoKnskPUAu6jg84ETjgK8u1x7NLxsjL
28W4*sOJ0WAhQNAQEAAlJQAAAAZQAAAGU=
</CERTIFICATE>
</CERTIFICATECHAIN>
</LICENSORINFO>
</LICENSE>

[shailigum]

its ok saulius theres no point in telling them, they already know. They steal most of these posts from zuney and other sites anyway.

[Mitch]

shailigum..look at this

http://www.zuney.net/zune-hacks-mods...une-patch.html

they are doing a real good job coming up with there own stuff there....

2nd i did search on zuney.net for the words "usb snoop" and "snoopy" and there was nothing on the forums about either

3rd after looking through the hacking section there, they seem to have no real advances. i mean cmon look at this post

http://www.zuney.net/zune-hacks-mods/573-hmm-idea.html

wtf does psp and ds have to do with hackin a zune...

[PityOnU]

Originally Posted by Mitch

shailigum..look at this

http://www.zuney.net/zune-hacks-mods...une-patch.html

they are doing a real good job coming up with there own stuff there....

2nd i did search on zuney.net for the words "usb snoop" and "snoopy" and there was nothing on the forums about either

3rd after looking through the hacking section there, they seem to have no real advances. i mean cmon look at this post

http://www.zuney.net/zune-hacks-mods/573-hmm-idea.html

wtf does psp and ds have to do with hackin a zune...

Thanks for backing me up, man. +rep for you ;D

As I said in my first post, I know USB Sniffing the Zune is nothing new, I hadn't heard of anyone actually trying to do anything with them yet. Also, I do not use or go to Zuney.net or any other sites. ZuneBoards is the only site that actually comes up with their own stuff. Plus, it definitely has all of the coolest people :P

Anyway, what people are saying on here is that the program I am using is basically only allowing me limited access to what is actually going on Does anyone know of a free program that will allow me to see everything?

[Mistafied]

Originally Posted by shailigum

its ok saulius theres no point in telling them, they already know. They steal most of these posts from zuney and other sites anyway.

As you are reading every post there is.. Second I know that people have done dumps.. That is not what we are going for. In order to find hole and bugs you need to compare ****.
But I forget, humans are perfect and they build everything the same and never fail.

Second I read zuneys post for there help. Not to steal information.. If you dont want it to get out, Then dont write it. You give up that right once you publish to the public and you take that risk.

[Mistafied]

Anyway, what people are saying on here is that the program I am using is basically only allowing me limited access to what is actually going on Does anyone know of a free program that will allow me to see everything?

I am starting to think it is going to take a good USB hardware analyzer device.

I did find a program on sourceforge to play back the log files created by sniffer.. I am going to try to play with that and see what I can do.. But I dont thing it will step it thru.

[SauliusM]

Originally Posted by Mitch

shailigum..look at this

http://www.zuney.net/zune-hacks-mods...une-patch.html

But as you can see its at least mentioned that its from zuneboards

Originally Posted by Mistafied

As you are reading every post there is.. Second I know that people have done dumps.. That is not what we are going for. In order to find hole and bugs you need to compare ****.

True they are just dumps, and ive tried to look for programs to send back packets, but found only 1 and it still screwed up all my zune drivers (which i had to repair) and the program was way to confusing (I even think it had nothing to do with sending back packets). Other than that i didnt find anymore programs that send packets. Otherwise i would have already gotten the zune in sync mode without the program because i have the packet(s) which opens it. No matter, no need in fighting about everything. Everyone needs to start working together (giving credit to whoever finds info) otherwise its going to take a long time for the zune to get hacked.

[PityOnU]

Originally Posted by Mistafied

I am starting to think it is going to take a good USB hardware analyzer device.

I did find a program on sourceforge to play back the log files created by sniffer.. I am going to try to play with that and see what I can do.. But I dont thing it will step it thru.

Good luck, man.

[Napoleon Iven Quinnly]

This is something I found in zuneloc.dll with resource hacker it looks very interesting:

else if ( g_StartSection == OOBE_SYNCWIZARD )// start sync wizard
{
setTimeout( "CheckForDevice()", 100 );
bottomPanel.style.visibility = "visible";
SetNavButton(1, "Cancel", false, false);
SetNavButton(3, "hidden", false, false);
}
else if ( g_StartSection == OOBE_FIRMWAREUPDATE ) // start firmwareupdate
{
try
{

bottomPanel.style.visibility = "visible";
SetNavButton(1, "Cancel", false, false);
SetNavButton(2, "hidden", false, false);
SetNavButton(3, "hidden", false, false);
g_CurrentState = stateUpdateDevice;
DoNavigate(htmlUpdateDevice, "");
setTimeout( "CheckForDevice()", 1000 );

by itself it probably nothing but lookin at the stuff around it......(other stuff was too big and a pain to read so if you think its important tell me and ill try and brave it )

[AlbinoTux]

I had begun looking in to doing this with the conceptual "zunlock" by trying to reproduce what the Zune software does. Microsoft has tools to log and view the transactions that occur between the Zune and the your computer. "WPDMon.exe" http://msdn2.microsoft.com/en-us/library/aa973614.aspx . If come in one of the Windows SDK.

However, there are certain commands where keys are sent between the computer and I couldn't tell what the "data" was. You can verify that the "command" was successful as it returns an HRESULT.

Anywho, I'll try and be more informative. Try looking at zUnlock.zip for my source. I'll see if I can't find the log file I have and post it.

[Trogdor]

ZuneBoards is the only site that actually comes up with their own stuff. Plus, it definitely has all of the coolest people :P

Agreed.
On this forum your sitting at the cool kid table.