Zune

This is the reverse-engineering record. Process and module layout, memory model, the UI engine and shell, the media, storage, USB, Wi-Fi and input stacks, and the constants that pin them down.

Zune HD (Pavo, firmware 4.5)

The primary target and the bulk of this reference. An NVIDIA Tegra APX 2600 running Windows CE 6, with the UI drawn through a Direct3D-Mobile-style path on the Tegra GPU and audio and video decoded on the AVP coprocessor. Coverage here is device-verified against a live unit: kernel read and write, arbitrary function calls, breakpoints, and memory snapshots back most of what is stated.

Planned pages cover the platform overview (SoC, OS, process and module map, memory model), boot and process bring-up, the XUI engine, the gemstone shell scenes, the media pipeline, the storage, USB, Wi-Fi, input and display stacks, and the service brokers between the shell and its background services.

Zune Classic (Keel and the 3.x line)

The pre-HD devices: the Zune 30 (Keel), the second-generation HDD Zune (Draco), and the second-generation flash Zune (Scorpius). These run the same gemstone and xuidll lineage as a distinct Windows CE 5 build, drawn through DirectDraw over an image processing unit rather than a 3D GPU, and with no web browser. Only the Zune 30 has been examined in any depth, mostly through static analysis of its firmware image. Findings here are marked accordingly.

Reference tables

Consolidated lookup material: the gemstone v4.5 address list, the strings.gem label index, the byte-exact USB descriptor baseline, the registered system fonts, and the Zune MTP operation codes.

Verification convention used throughout: a plain statement is device-verified; [static] marks a finding from static analysis only; [unverified] marks something open or hypothesised.