Post Your Progress on Your Attempt at Hacking the Zune

lpxxfaintxx · 11-14-2006, 06:14 PM

That's right, keep us updated! We'll be glad to help, however we can.

Post your progress, what are you trying to do? Where are you? How far into the project are you? etc.

11-14-2006, 07:08 PM

I would, but I need someone who has one to let me have a Virtual Connection to their computer.

DUI_ · 11-14-2006, 10:52 PM

videl, go buy a Zune now! No more remote zune access talk! Lmao!

Zuneologist · 11-15-2006, 01:06 AM

Quote:

Originally Posted by DUI

videl, go buy a Zune now! No more remote zune access talk! Lmao!

lol yeah.

Videl in 2010

I would, but I need someone who has one to let me have a Virtual Connection to their computer.

:icon_eyes:

thehollywood · 11-15-2006, 05:35 AM

Just got my zune. I love the thing but I can't wait for people to get started on mods. :10:

thefinalprophecy · 11-15-2006, 10:47 AM

I hope someone makes a program to replace the Zune software soon. I can't stand using it. There needs to be a program that works for the Zune like Anapod Explorer works for the ipod.

Phaleux · 11-22-2006, 11:39 PM

I have enabled mine to be accessible like a hard drive on my computer and I have pulled the preloaded content off.

PhunkMaster · 11-22-2006, 11:42 PM

w00t. You know what time it is? Walk through time!!!! lol. Just e-mail me the specifics and I will create the walkthrough if that is ok for everyone.

Sculay · 11-23-2006, 01:13 PM

fyi if someone wants to remote desktop someone get REALVNC install the server and viewer tell videl or who eva ur ip by going to www.whatismyip.com and fyi messing with the firmware leads to bricking e.g. psp firmware bricking lol

11-23-2006, 01:19 PM

I made my own VPN to connect with. Who the hell uses a program to make a VPN?

PhunkMaster · 11-23-2006, 01:52 PM

Not I. I use windows built in mstsc.

tmdriscoll · 11-25-2006, 06:12 PM

Hi all! First attempt at trying to get the Zune to work with the Mac is here: http://www.oreillynet.com/mac/blog/2...r_zune_on.html

jwscuba · 11-28-2006, 04:24 PM

Quote:

Originally Posted by Sculay

fyi if someone wants to remote desktop someone get REALVNC install the server and viewer tell videl or who eva ur ip by going to www.whatismyip.com and fyi messing with the firmware leads to bricking e.g. psp firmware bricking lol

Child?

Quote:

Originally Posted by Erica

Hi all! First attempt at trying to get the Zune to work with the Mac is here: http://www.oreillynet.com/mac/blog/2...r_zune_on.html

What a great resource and addition to Zuneboards you will be!

11-28-2006, 04:34 PM

Quote:

Originally Posted by Erica

Hi all! First attempt at trying to get the Zune to work with the Mac is here: http://www.oreillynet.com/mac/blog/2...r_zune_on.html

I like your writing style.

Your glasses are super sexy. ;-)

Quote:

Originally Posted by GEN3RIC

What a great resource and addition to Zuneboards you will be!

Umm, hello...I totally mentioned this earlier
It's alright, I know I'm not a valuable resource. Just ask putis616, he'll tell you.
I know when I'm not loved. ;-)

11-28-2006, 04:40 PM

I love you RYS. So no worries. I finally have my Zune

. Thanks to the member Tacoma here at Zune Boards.

putis · 11-28-2006, 04:43 PM

Quote:

Originally Posted by RYS

Umm, hello...I totally mentioned this earlier
It's alright, I know I'm not a valuable resource. Just ask putis616, he'll tell you.
I know when I'm not loved. ;-)

It's true, I do love you.

11-28-2006, 04:47 PM

Aww...Sharin' da love.
I feel special. :pat:

Quote:

Originally Posted by Mys Videl

I love you RYS. So no worries. I finally have my Zune

. Thanks to the member Tacoma here at Zune Boards.

Just thought I'd bold those words...:-D
Thats good to here! I was gonna offer you access to mine, but now that you have one of your own...The possibilities are endless!
Yays!

When you're ready for a tester, let me know! ;-)

Phlag · 12-11-2006, 10:18 PM

My "attempt at hacking the Zune" is basically limited to analyzing a little bit of the Zune's Community broadcast wifi traffic. There's no breakthroughs or anything, but I haven't seen this information available anywhere before (except for another Zune board I posted it to), so I might as well share it.

I messed around with Wifi sniffing with a friend, and we found out a couple basic things. Song and picture transfers are done with WPA encryption, so we weren't able to analyze that traffic - and no one probably will be able to until someone modifies the Zune's firmware to not do file transfers with WPA, or until the WPA key is figured out. And, assuming that Microsoft is using a complex key (which they surely are), cracking it is probably unfeasible. But all Zunes must be using the same key, and maybe it's possible to analyze the contents of the harddrive or firmware to derive it. Either way, it's not going to be easy.

We were able to capture and edit packets that the Zune broadcasts to populate the "Community list", and re-send them from our computers. So, I captured the packet he was sending, edited both his user name and the song he was listening to, turned off his Zune, and sent the modified packet to my Zune. And, easy as that that, apparently the user "Bill Gates" was listening to "Abcdefghijlkmnop."

Here's a break-down of the Zune broadcast packet.
0x0000 50 00 A2 00 00 17 FA 00-2E EF 00 17 FA 03 B2 CF P.¢...ú..ï..ú.²Ï
0x0010 AA 08 A1 C6 87 B4 30 02-DE 1F BF 00 00 00 00 00 ª.¡Æ´0.Þ.¿.....
0x0020 64 00 32 00 00 00 01 08-82 84 8B 96 8C 98 B0 12 d.2.....°.
0x0030 03 01 0B 2A 01 02 32 04-24 48 60 6C 06 02 0A 00 ...*..2.$H`l....
0x0040 DD 9E 00 50 F2 06 25 12-53 F5 02 00 00 00 70 01 Ý.Pò.%.Sõ....p.
0x0050 92 00 70 64 68 61 72 74-00 00 00 00 00 00 00 00 .pdhart........
0x0060 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x0070 00 00 11 05 00 02 B2 CF-03 0A 00 17 FA 03 B2 CF ......²Ï....ú.²Ï
0x0080 39 31 2E 37 00 65 65 64-20 59 6F 75 20 42 6C 61 91.7.eed You Bla
0x0090 63 6B 20 45 6D 70 65 72-6F 72 21 20 27 30 39 2D ck Emperor! '09-
0x00A0 31 35 2D 30 30 20 28 50-61 72 74 20 4F 6E 65 29 15-00 (Part One)
0x00B0 27 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 '...............
0x00C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................
0x00D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................

0x0000 05-10 is the destination MAC
0x0000 11-16 is the source MAC address
0x0050 03-
0x0070 -02 is the Zune name (31 characters). A hex value of 00 signals the end of the name and ignores any remaining data within this range.
0x0070 06 is the status flag (00: simple, 01: song, 02: radio, 03: video, 04

ictures, 05: basic, 06: busy, 07+: offline) *
0x0070 11-16 is a repeat of the source MAC address. As far as I can tell, it doesn't really matter and can be any value.
0x0080 01-
0x00D0 -16 is the title. A hex value of 00 signals the end of the title and ignores any remaining data.

* These flags determine what is shown to nearby Zune users in the 'Community.' When set to 00, it just shows [title]. When set to 01, 'listening to [title]'. When set to 02, 'listening to radio [title] FM'. When set to 03, 'watching [title]'. When set to 04, 'Viewing Pictures'. When set to 05, it just says 'Online' for when online status is set to basic. When set to 06, 'Busy'. When set to 07 or above, 'Offline'.

In the above example, a Zune with the MAC address 00:17:FA:00:2E:EF is receiving the packet sent by a Zune with MAC address 00:17:FA:03:B2:CF. The Zune name for the sender is 'pdhart' and the receiving Zune displays pdhart's status as 'listening to radio 91.7 FM'. The "eed You Black Emperor..." is left over from what song pdhart was listening to before. New titles are inserted over the old ones. Because it is preceeded by the hex value 00, "eed You Black Emperor..." is ignored.

The really interesting information that could potentially come from all this is in analyzing the file transfers. But, like I said, it's WPA encrypted, so it's a mystery for now.

Agaryulnaer · 12-11-2006, 11:35 PM

Can't you get the key through capturing packets, building up a large packet file and decrypting it? Or am I totally off the page here? I think I remember reading somewhere this is how wifi hacks get into locked networks by capturing packets and getting the WPA key or something of the sort.

Phlag · 12-12-2006, 06:43 AM

That's how WEP cracking is done, but not WPA. From my understanding (which is pretty limited, so more knowledgeable people please be sure to correct me), the only way WPA can be cracked is through brute-force.
Here's a depressing little quote (source)

Quote:

"WPA-PSK may be vulnerable to a brute force attack but, with the choice of the right password, it becomes unfeasible.

Assuming a decent utility is used, a 31 character long password of random upper- and lowercase letters and numbers results in 62^31, or 3.7x10^55 possible combinations.

If we assume 60 attempts per second, it will take more that 1.3x10^36 times the age of the universe (15 billion years) to attempt every possible combination. The average time would be half that, or 6.5x10^35 times the age of the universe.

Even if someone were to come up with a scheme that reduced the bruteforce time to 1 trillionth of what would be required otherwise, it would still take 6.5x10^23 times the age of the universe. And so on..."

11-14-2006, 06:14 PM	#1 (permalink)
lpxxfaintxx Administrator Ultimate Zuner Join Date: Jul 2006 Location: Irvine, CA Posts: 5,719 Reputation: 177 $zB: 1775 Donate	Post Your Progress on Your Attempt at Hacking the Zune That's right, keep us updated! We'll be glad to help, however we can. Post your progress, what are you trying to do? Where are you? How far into the project are you? etc. __________________ To view links or images in signatures your post count must be 0 or greater. You currently have 0 posts. To view links or images in signatures your post count must be 0 or greater. You currently have 0 posts.

11-14-2006, 07:08 PM	#2 (permalink)
Mys Videl Posts: n/a $zB: Donate	RE: Post Your Progress on Your Attempt at Hacking the Zune I would, but I need someone who has one to let me have a Virtual Connection to their computer.

11-14-2006, 10:52 PM	#3 (permalink)
DUI_ Retired Staff Jr. Member Join Date: Nov 2006 Posts: 486 Reputation: 10 $zB: 0 Donate	RE: Post Your Progress on Your Attempt at Hacking the Zune videl, go buy a Zune now! No more remote zune access talk! Lmao! __________________ To view links or images in signatures your post count must be 0 or greater. You currently have 0 posts.

11-15-2006, 05:35 AM	#5 (permalink)
thehollywood Zuner Join Date: Nov 2006 Posts: 57 Reputation: 10 $zB: 6 Donate	RE: Post Your Progress on Your Attempt at Hacking the Zune Just got my zune. I love the thing but I can't wait for people to get started on mods. :10:

11-15-2006, 10:47 AM	#6 (permalink)
thefinalprophecy Experienced Zuner Join Date: Nov 2006 Posts: 159 Reputation: 10 $zB: 0 Donate	RE: Post Your Progress on Your Attempt at Hacking the Zune I hope someone makes a program to replace the Zune software soon. I can't stand using it. There needs to be a program that works for the Zune like Anapod Explorer works for the ipod. __________________ To view links or images in signatures your post count must be 0 or greater. You currently have 0 posts.

Remove Advertisements Sponsored Links
Zune Boards Advertisement

11-22-2006, 11:39 PM	#7 (permalink)
Phaleux Squirt Join Date: Nov 2006 Posts: 15 Reputation: 10 $zB: 0 Donate	RE: Post Your Progress on Your Attempt at Hacking the Zune I have enabled mine to be accessible like a hard drive on my computer and I have pulled the preloaded content off.

11-23-2006, 01:13 PM	#9 (permalink)
Sculay Zewbie Join Date: Nov 2006 Posts: 9 Reputation: 10 $zB: 0 Donate	RE: Post Your Progress on Your Attempt at Hacking the Zune fyi if someone wants to remote desktop someone get REALVNC install the server and viewer tell videl or who eva ur ip by going to www.whatismyip.com and fyi messing with the firmware leads to bricking e.g. psp firmware bricking lol

11-23-2006, 01:19 PM	#10 (permalink)
Mys Videl Posts: n/a $zB: Donate	RE: Post Your Progress on Your Attempt at Hacking the Zune I made my own VPN to connect with. Who the hell uses a program to make a VPN?

11-25-2006, 06:12 PM	#12 (permalink)
tmdriscoll Zewbie Join Date: Nov 2006 Posts: 1 Reputation: 10 $zB: 0 Donate	RE: Post Your Progress on Your Attempt at Hacking the Zune Hi all! First attempt at trying to get the Zune to work with the Mac is here: http://www.oreillynet.com/mac/blog/2...r_zune_on.html

11-28-2006, 04:40 PM	#15 (permalink)
Mys Videl Posts: n/a $zB: Donate	RE: Post Your Progress on Your Attempt at Hacking the Zune I love you RYS. So no worries. I finally have my Zune . Thanks to the member Tacoma here at Zune Boards.

12-11-2006, 10:18 PM	#18 (permalink)
Phlag Posting Disabled Squirt Join Date: Dec 2006 Posts: 13 Reputation: 10 $zB: 0 Donate	Re: Post Your Progress on Your Attempt at Hacking the Zune My "attempt at hacking the Zune" is basically limited to analyzing a little bit of the Zune's Community broadcast wifi traffic. There's no breakthroughs or anything, but I haven't seen this information available anywhere before (except for another Zune board I posted it to), so I might as well share it. I messed around with Wifi sniffing with a friend, and we found out a couple basic things. Song and picture transfers are done with WPA encryption, so we weren't able to analyze that traffic - and no one probably will be able to until someone modifies the Zune's firmware to not do file transfers with WPA, or until the WPA key is figured out. And, assuming that Microsoft is using a complex key (which they surely are), cracking it is probably unfeasible. But all Zunes must be using the same key, and maybe it's possible to analyze the contents of the harddrive or firmware to derive it. Either way, it's not going to be easy. We were able to capture and edit packets that the Zune broadcasts to populate the "Community list", and re-send them from our computers. So, I captured the packet he was sending, edited both his user name and the song he was listening to, turned off his Zune, and sent the modified packet to my Zune. And, easy as that that, apparently the user "Bill Gates" was listening to "Abcdefghijlkmnop." Here's a break-down of the Zune broadcast packet. 0x0000 50 00 A2 00 00 17 FA 00-2E EF 00 17 FA 03 B2 CF P.¢...ú..ï..ú.²Ï 0x0010 AA 08 A1 C6 87 B4 30 02-DE 1F BF 00 00 00 00 00 ª.¡Æ´0.Þ.¿..... 0x0020 64 00 32 00 00 00 01 08-82 84 8B 96 8C 98 B0 12 d.2.....°. 0x0030 03 01 0B 2A 01 02 32 04-24 48 60 6C 06 02 0A 00 .....2.$H`l.... 0x0040 DD 9E 00 50 F2 06 25 12-53 F5 02 00 00 00 70 01 Ý.Pò.%.Sõ....p. 0x0050 92 00 70 64 68 61 72 74-00 00 00 00 00 00 00 00 .pdhart........ 0x0060 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0x0070 00 00 11 05 00 02 B2 CF-03 0A 00 17 FA 03 B2 CF ......²Ï....ú.²Ï 0x0080 39 31 2E 37 00 65 65 64-20 59 6F 75 20 42 6C 61 91.7.eed You Bla 0x0090 63 6B 20 45 6D 70 65 72-6F 72 21 20 27 30 39 2D ck Emperor! '09- 0x00A0 31 35 2D 30 30 20 28 50-61 72 74 20 4F 6E 65 29 15-00 (Part One) 0x00B0 27 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 '............... 0x00C0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0x00D0 00 00 00 00 00 00 00 00-00 00 00 00 00 00 00 00 ................ 0x0000 05-10 is the destination MAC 0x0000 11-16 is the source MAC address 0x0050 03- 0x0070 -02 is the Zune name (31 characters). A hex value of 00 signals the end of the name and ignores any remaining data within this range. 0x0070 06 is the status flag (00: simple, 01: song, 02: radio, 03: video, 04ictures, 05: basic, 06: busy, 07+: offline) 0x0070 11-16 is a repeat of the source MAC address. As far as I can tell, it doesn't really matter and can be any value. 0x0080 01- 0x00D0 -16 is the title. A hex value of 00 signals the end of the title and ignores any remaining data. * These flags determine what is shown to nearby Zune users in the 'Community.' When set to 00, it just shows [title]. When set to 01, 'listening to [title]'. When set to 02, 'listening to radio [title] FM'. When set to 03, 'watching [title]'. When set to 04, 'Viewing Pictures'. When set to 05, it just says 'Online' for when online status is set to basic. When set to 06, 'Busy'. When set to 07 or above, 'Offline'. In the above example, a Zune with the MAC address 00:17:FA:00:2E:EF is receiving the packet sent by a Zune with MAC address 00:17:FA:03:B2:CF. The Zune name for the sender is 'pdhart' and the receiving Zune displays pdhart's status as 'listening to radio 91.7 FM'. The "eed You Black Emperor..." is left over from what song pdhart was listening to before. New titles are inserted over the old ones. Because it is preceeded by the hex value 00, "eed You Black Emperor..." is ignored. The really interesting information that could potentially come from all this is in analyzing the file transfers. But, like I said, it's WPA encrypted, so it's a mystery for now.

12-11-2006, 11:35 PM	#19 (permalink)
Agaryulnaer Jr. Zuner Join Date: Dec 2006 Posts: 31 Reputation: 10 $zB: 0 Donate	Re: Post Your Progress on Your Attempt at Hacking the Zune Can't you get the key through capturing packets, building up a large packet file and decrypting it? Or am I totally off the page here? I think I remember reading somewhere this is how wifi hacks get into locked networks by capturing packets and getting the WPA key or something of the sort. __________________ To view links or images in signatures your post count must be 0 or greater. You currently have 0 posts.

Sponsors