bunnie’s blog » Blog Archive

« My Virtual Chumby

Site Down »

Zune Guts

“Would you like the extended warranty on that, sir?”

“No”, I say breaking a wry smile. What is so darn funny about that question? She seems to be thinking.

Anyways, long story short, I have a Zune. I have it apart. I can’t really say why right now, but I thought it was neat enough to share a few shots of its guts.

You can click the above for a much higher resolution version. The images below are just screen-res photos to save on band

[edit: by request, a macro shot of the Wi-Fi module; note there is normally a metal shield over it, I have removed it to see what is underneath, and simultaneously marred part of a component in the upper right hand corner, although it still seems to work. Info on it here and here]

Back up regularly!

Note that it uses the Freescale iMX31L processor at its core…

…I’m just sayin’ ;-).

This entry was posted on Tuesday, November 14th, 2006 at 5:35 pm and is filed under Hacking. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.

47 Responses to “Zune Guts”

Nate Says:
November 14th, 2006 at 6:17 pm
Guh, what is with all the discrete components? And the daughterboard? Is this just a prototype or they havent got around to cost reduction yet?
Jose Says:
November 14th, 2006 at 9:30 pm
Discrete components… well now we know why the battery life sucks.
Grumma Says:
November 15th, 2006 at 12:32 am
Hi
great pics
can you photo that module in the left - bottom corner
its seems like the RF module so if you can do a macro photo it will be great
og Says:
November 15th, 2006 at 12:45 am
On the bottom left of the first photo is what looks like the wifi antena
Adam Says:
November 15th, 2006 at 12:51 am
Great photos. You might want to think about hosting the hires photos on Flickr or tarring them up and making them available through BitTorrent. The reason I recommend this is because this dissection *will* end up on Slashdot or some other such site and you’re going to end up getting pounded.
Alex Says:
November 15th, 2006 at 1:23 am
It is now on hack a day ;)
Views on life at zunes.com » What do the guts of the Zune look like? Says:
November 15th, 2006 at 1:24 am
[…] I was expecting it to take a little longer, but, you can now see what the inside of your Zune looks like (without voiding your warranty) thanks to bunnie: www.bunniestudios.com/wordpress/?p=131 […]
Aaron Says:
November 15th, 2006 at 1:36 am
Less then 24 hours and the thing is gutted… NICE!
Tom Parker Says:
November 15th, 2006 at 1:59 am
I’ll post the next obvious link

www.freescale.com/webapp/sps/site/prod_summary.jsp?code=MC13783&nodeId=01J4Fs4881
Tom Parker Says:
November 15th, 2006 at 2:06 am
[merged per poster request]
I’ll post the next obvious link

www.freescale.com/webapp/sps/site/prod_summary.jsp?code=MC13783&nodeId=01J4Fs4881

Is it just me or does the assembly of this remind you of transistor radios from the 70s. It is loaded with dry joints and joints with too much solder. I’d almost suggest it was hand assembled, doesn’t look consistent enough assembly for a machine. This is version 1.0 hardware for sure. That wireless antenna looks really shoddy too, given this is a portable device is really needs better anchoring to the PCB. Here’s another link for you all

www.focussemi.com/products/fs455.html

looks like 16M ram

K4M51323LE-L - 4M x 32Bit x 4 Banks Mobi

(sorry can’t edit my posts, Bunnie, perhaps combine them? Loved your xbox book BTW).

[more info to share…]
```
K4M51323PC-DG75	        64 Mbytes x32 Mobile SDR DRAM / 133 MHz / 90 mA
PH28F160C3TD	        1Mx16 Boot block NOR flash, 3.3V
FS456LF	                PC to TV video scan converter (Macrovision 7)
CN211/SN74CBTLV16211C	24-bit FET bus switch
WM8978G	                Stereo CODEC with speaker driver / 0.9W power out
P003 / 620A5	        8-bit bus transciever/driver for ATA standard
                        (hypothesized, more info appreciated...)
MC13783	                Power manager
ISP1504	                USB2.0 PHY
CL245/SN74CBTLV3245A	Low voltage octal FET bus switch
KS3021/KS7010	        RF/BB/MAC 802.11g WiFi (KeyStream) module
```
Eric Says:
November 15th, 2006 at 2:25 am
Would it be a M$ product if the first release was not beta quality?
bunnie Says:
November 15th, 2006 at 2:27 am
I wish I could comment more…I actually have a purpose for taking this apart but I probably should not say. There are a couple of *very* interesting facts and…er…facts about the device.
Jeremy Grosser Says:
November 15th, 2006 at 2:35 am
I hope it has something to do with the Chumby. I like it when my toys can play well together.
bunnie Says:
November 15th, 2006 at 3:36 am
Also, if they did it right, they will have enabled the built-in security features of the MX31 so you can’t/it is very difficult to hijack the boot–but it is still vulnerable to buffer overruns, etc. as far as I can tell. Haven’t bothered to test it either way, but the High Assurance Boot (HAB) feature is worthy of caution if you are thinking about trying something.
amd Says:
November 15th, 2006 at 3:56 am
Also, you can see that all the solder points of the main chips have been made hacking-proof with this black-epoxy like compound. :( I also couldn’t spot obvious JTAG contacts.
bunnie Says:
November 15th, 2006 at 4:24 am
The black-epoxy like compound I believe is not there for hack-proofing. It’s an underfill that is used to improve the reliability of the high-stress but very fragile BGA solder connections in the face of repeated shock and thermal cycling. It does have the additional benefit of making it more difficult to work with.

Can anybody find the FM radio tuner on this board? I can’t seem to unequivocally identify that chip. Also curious if anybody knows for sure what the P003 / 620A5 chips are that are lined up near the ATA connecter. I’m guessing they are level translators or buffers to the hard drive based on their location and connectivity, but I couldn’t get a positive ID on the part number.
bunnie Says:
November 15th, 2006 at 4:31 am
Nevermind, I just figured out which one is the radio tuner. It’s the chip in the upper left hand corner near the WM8978G, labelled 4701A15, for the Silicon Labs Si4701 single-chip radio tuner.

Still wondering about the P003 / 620A5 chips, 4 of them in a row, near the hard drive connector on the left–actually, on the hi-res image they look grey because the part number is illegible due to a lack of contrast from light reflecting off of the package.

For the record, these questions are to satisfy my curiosity. I’m always afraid these days to post tear-downs of high-profile stuff…life was much simpler a few years ago.
changocool Says:
November 15th, 2006 at 5:17 am
hey i want some linux on it!! i want to access the 30gb hd!! i want real wifi!! i will only buy one if i know i can boot it into linux
Nick Charlton Says:
November 15th, 2006 at 8:41 am
You will have to wait a while for Linux, but I bet people are forming groups already….

Nick
goudabob Says:
November 15th, 2006 at 8:50 am
just a thought, i wonder if you could replace the hard drive with a bigger drive. toshiba makes an identical 40gb drive.
goudabob Says:
November 15th, 2006 at 9:59 am
btw, they also make a 60gb and an 80gb drive but they are 3mm thicker according to the documentation
DCFluX Says:
November 15th, 2006 at 10:45 am
If I was going to design something like this, I would think about software defined radio as an IF decoder, but that would mean you still need a front end, mixer and local oscillator.

I saw a chip close to the MC13783 that was a Philips, and I think it said 504A. I am not sure what that is but SA604A is an FM IF decoder IC. Although it would be smarter to use the SA605A which is basicly a FM receiver on a chip, combining a SA602 mixer/vco with a SA604 in one package.

Walkman style devices love to use the head phone leads as an FM antenna, It may be worth checking if the ground is left floating and there should be a AC coupling cap to get RF down the ground leads, that should lead to the first stage at least.
ejonesss Says:
November 15th, 2006 at 12:43 pm
looks like it may use an ipod hard drive or ipod compatible because toshiba drives are used in the ipod.

now me having said zunes and zune parts are probably going to be sold at high prices on ebay
daqq Says:
November 15th, 2006 at 1:48 pm
poor little zune…
iPod looks much cooler from the inside than this thingie.

pc.watch.impress.co.jp/docs/2005/0908/nano.htm

Fewer components, less discrete components etc. Fully tinned board and more simpatic.
Cathedrow Says:
November 15th, 2006 at 2:59 pm
There seem to be an awful lot of SMDs around the processor. Far too dense for decoupling caps. Bus termination resistors?

I’m guessing the designers weren’t aware just how vulnerable the naked hypertransport bus made the Xbox. Maybe they’re about to find out.

Very kind of Microsoft to put them all in a nice neat row. Still got that FPGA dev kit lying around?

And as for those P003 / 620A5 chips. I’d guess they were for bus voltage conversion. That processor is probably on 1.8 or 2.5V I/O, but the drive will be expecting 3.3V.
A.A. Says:
November 15th, 2006 at 3:33 pm
Looks like one of the audio chips is from Wolfson-also seen in many iPods.
bunnie Says:
November 16th, 2006 at 11:12 am
Site went down; web hoster firewalled the IP because it crashed the server. Should be back up now.
toffe Says:
November 16th, 2006 at 12:05 pm
Can you make a hires picture of the backplane, I think there is a jtag connector or something like this.
It seems to be the row of solder point in the top center of the backplane.
Zune insides laid bare - Zuney.net - Your ultimate ZUNE resource! Says:
November 16th, 2006 at 2:15 pm
[…] working link…. Here’s a link to someone that took his apart, which is also the same person that helped put together the specs that allowed the original Xbox to be modded: bunnie’s blog Blog Archive Zune Guts […]
Ward Says:
November 16th, 2006 at 2:34 pm
As for the mystery ICs, they’re 24-QFN (or MLF), and the eight series termination resistors on the left and top sides of the top two ICs would seem to indicate that they’re octal. The 74*620A is an octal bus transceiver, so that would seem to fit with the “620A5″ on the package. It also looks like there’s a bypass cap above and below each package…might that point to two supplies as one would expect in a level translator? It would be interesting to know the voltage across each of those caps.
A Gentlemans Provision » Playing a different…Zune? Says:
November 16th, 2006 at 7:23 pm
[…] Lot’s of excitement in the gadget world lately. Microsoft has released their new music player, The Zune. It touts Wi-Fi between Zune units, and a radio receiver. However, beamed songs are only good for three days and you can’t send them to anyone else. Kind of a bummer. Is it the Ipod killer MS claims it to be. Better yet, is it worth the money? Well, CNN doesn’t think so. However, if the Wi-Fi file sharing catches on I’m sure Apple will be quick to follow in later Ipods. While you’re at it, check out it’s dissection! […]
TheRandomDude Says:
November 16th, 2006 at 8:51 pm
I’ve lately been extremely interested in what’s called tempest attacks, and many voting machines have been hacked in this form. Could you conceivably sniff the circuits in a zune or xbox by studying the circuits’ electromagnetic resonance?
Dotnix Says:
November 16th, 2006 at 9:18 pm
Man, terrible!!!
Low quallity thought…..look at those soldering point all over the pcb main….TERRIBLEEEEE….
Well, its MS….y ohhh y am i surprised? lol
A verdadeira face do Zune Says:
November 16th, 2006 at 9:32 pm
[…] Tava demorando! Zune escancarado. […]
John Miles KE5FX Says:
November 16th, 2006 at 10:13 pm
“Is it just me or does the assembly of this remind you of transistor radios from the 70s. It is loaded with dry joints and joints with too much solder.”

Remember that due to RoHS regulations in the EU, most consumer electronics products (even those destined for the US) no longer use lead-based solder. It’s normal for lead-free solder joints to look “dry” or “cold” compared to what you’re used to seeing from good old 60-40 Kester.

The soldering work looks fine to me. That said, wow, yeah, that’s a whole lotta discrete components.
vk Says:
November 17th, 2006 at 12:15 am
you do mean passive, right? there’s a (big) difference between passive and discrete; passive = resistors, capacitors, while discrete = transistors.

the fact that there are so many resistors doesn’t mean at all that it gobbles up more power. the transistors i spotted don’t necessarily mean that it uses a lot of power. Having this many chips compared to using SOCs probably does increase the power drain, though.

However, it does seem like whoever designed this board (microsoft or someone else) isn’t very experienced at miniaturization. I’m sure that if they actually looked for nicer ICs which didn’t need so many passive components, or got their hands on some SOCs rather than relying on so many chips, they could CONSIDERABLY reduce the size of this monster. If you’ve been reading all the cellphone ICs they advertise these days on EDN, you know this is quite possible.

Well, it [i]is[/i] microsoft’s first miniature hardware thingamabob.

though i have this suspicion they actually left the job to some inexperienced chinese firm to do it. . .
Beaker Says:
November 17th, 2006 at 12:18 am
DCFluX: The 504A is the Philips ISP1504A, a ULPI transceiver. This is needed for the USB 2.0 OTG controller on the i.MX31L.

John Miles KE5FX: The soldering work looks fine to me as well. No way that anything like this is hand assembled for production. The i.MX31L and MC13873 are both 0.5mm pitch parts. A nightmare to deal with when prototyping.

Cathedrow says: “There seem to be an awful lot of SMDs around the processor. Far too dense for decoupling caps. Bus termination resistors?”

Exactly. The i.MX31 reference designs use 10ohm series bus termination resistors for the DDR bus. Not sure that they are absolutely necessary, but this is a fast bus (up to 266Mhz for DDR). And you are right about the I/O voltage conversion needed for the ATA. The MC13783 provides 2.775V for the I/O supply of the i.MX31L. I’m finishing an i.MX31 design right now, and I didn’t use the MC13783, instead using a Linear Tech LTC3440 @ 3.05V for the I/O supply so that I don’t need conversion for my peripherals that will only operate down to 3.0V.
Beaker Says:
November 17th, 2006 at 12:29 am
vk Says: “a bunch of stuff”

I was with you through the first two paragraphs, but the comments about miniaturization are…well….for want of a better word…uninformed. Have you designed something like this before? I mean right now with the state of the art, as it applies to the specific requirements of a PMP?
Coyote Says:
November 17th, 2006 at 6:36 am
“though i have this suspicion they actually left the job to some inexperienced chinese firm to do it. . .”

Didn’t Toshiba design the Zune?

www.reghardware.co.uk/2006/08/25/toshiba_ms_zune_details/
eConectados » Archivo del blog » Zune y Vista incompatibles Says:
November 17th, 2006 at 10:21 am
[…] Actualización 2 Atención a la jugada, ya se sabe que el micro del Zune puede correr Linux, en concreto Linux BSP. ¿Seguro que es imbatible el iPod? […]
kurtdiver Says:
November 17th, 2006 at 11:01 am
Can we get close up shot of the backside of the PCB? I’d like to figure out who manufactured the PCB….
sweetjustice Says:
November 17th, 2006 at 11:39 am
for those that are curious about the i.MX31

www.logicpd.com/eps/som/freescale/i.MX31/
Mike Arnold Says:
November 17th, 2006 at 11:55 am
At ipodmods.com, we now offer to upgrades to the Zune. First is the battery upgrade that installs a new Li-Io battery into your unit whihc also has a 30 % longer life than the stock battery. You can also hold onto it until the original battery dies. The battery we have also comes with a self installation kit/tools.

The second, more impressive one is the hard drive upgrade. We take the standard 30 gig drive and replace it with a 40 gig drive (Don’t worry, we tested it and the unit still works great). We offer free installation and a 90 Day warranty.

If your interested in either upgrade, you can read more about them at:

www.ipodmods.com/shop/microsoft-zune-parts.html

Mike Arnold
www.ipodmods.com
marnold@ipodmods.com
————————–

iPod LCD screens fixes Zune Hard Drives
iPod Harddrive repairs Zune Batteries
iPod Battery Replacement Zune repairs
iPod mods Zune Mods
iVue Crystal Clear Front Panel
iPod Repairs
La canción repetida de Zune at Cactus Digital Says:
November 17th, 2006 at 12:00 pm
[…] Fotos del Zune por dentro [vía bunnie’s blog] linux, tech, win32 […]
RogerBacon Says:
November 17th, 2006 at 8:01 pm
Hi, before trying to hack the Zune read this : www.freescale.com/files/32bit/doc/white_paper/IMX31SECURITYWP.pdf
Samo malo » Blog Archive » Zune iznutra Says:
November 18th, 2006 at 12:26 pm
[…] I sam sebi postajem dosadam ovim plejerom ali neko se potrudio da ga otvori i otkrije šta se krije unutra. Pogledajte ovde! […]
Tek-Guru Says:
November 18th, 2006 at 5:22 pm
[…] Check out more pictures over at Bunnie’s Blog. […]

Name (required)

Mail (will not be published) (required)

Website

Zune Guts

47 Responses to “Zune Guts”

Leave a Reply