Skip to content

Project Lyra

A reverse-engineering and modding platform for Zune devices.

Project Lyra documents how Zune devices work at the level of addresses, struct layouts, and protocols, and builds on that a system for creating, publishing, and running community mods on hardware Microsoft stopped supporting in 2010.

The project itself has two halves. This wiki covers both.

Reverse engineering

The foundation is a verified account of how these devices operate: their SoCs, firmware, UI runtime, media pipeline, networking, and boot process.

The wiki is intended to provide reference material and procedures for how the information was obtained. Memory maps, API shapes, protocol formats, and working patterns, validated on real hardware. Findings that have not been proven on-device are marked as such.

Zune hardware falls into two families. They share substantial software heritage (all are Windows CE devices with related Microsoft UI and media stacks), but firmware-specific details do not transfer: addresses, struct offsets, and module layouts are per-device.

  • Zune HD (Tegra "Pavo", firmware v4.5). The primary target. Its UI is the XUI engine (xuidll) driving the gemstone shell.
  • Zune Classic. The pre-HD line, sharing a common firmware base with hardware differences (drivers and support code) between models: the Zune 30 (Keel), the second-generation HDD Zune 80/120 (Draco), and the second-generation flash Zune 4/8/16 (Scorpius). Only the Zune 30 (firmware 3.30) has been analyzed in depth so far; the others are expected to share roughly the same firmware architecture, and no address in this family is shared with the HD.

The modkit

The modkit is a framework and management system for creating, publishing, installing, and running mods that coexist rather than contend for the same patches.

A mod can:

  • add scenes and interfaces built from the device's own UI engine,
  • share menus, components, and navigation so multiple mods compose into one interface,
  • extend existing device features and capabilities, and
  • be installed, enabled, and managed from a single on-device system.

Install mechanics are layered: custom scenes, menu entries, C++ class registration, and boot-time persistence, driven by an on-device runtime that reads each mod's manifest and applies its capabilities. A reference "Mods" tab ships on-device today, managing installed mods with per-mod enable state that survives reboots.

The intended endpoint is a Marketplace-style hub for browsing, downloading, installing, and managing mods from the device.

Why Lyra?

Zune hardware carried codenames from constellations rooted in Greek mythology: Pavo the peacock, Draco the dragon, Scorpius the scorpion, and Keel for Carina, the keel of the ship Argo.

The constellation Lyra represents the lyre of the bard Orpheus. When his wife Eurydice died, he carried it down into the underworld and played before Hades and Persephone. They were so moved by his song that they relented and agreed to let her go, under the condition that he not look back.

Project Lyra intends to be the instrument by which Zunes can have a second chance at life. And unlike Orpheus, we're not looking back.

Organization

Pages are reference documents: stable, verified, scoped to one subsystem or mechanism. They describe what is true, not how it was found.

Content is published one page at a time as it is finalized. A topic absent from the navigation has not yet been reviewed.