Tinkering with Zune 4.0, enabling the unfinished “Radio”
Back on the 17th, I posted a quick registry hack for those that wanted to force certain Zune software features on or off. One of my readers inquired, however, about Radio features that seemed to exist but were disabled. Double-checking my previous research, there was nothing available to enable anything related to Radio, so I had to dig deeper.
Before you see Zune’s cute UI, the software has to jump through a number of hoops beforehand. Some of these hoops involve asking the Zune Gods (pictured to the right) if certain features are enabled or disabled. This inquiry is made by calling a special function called IsFeatureEnabled, implemented by a special object returned from Zune’s native (as opposed to managed) library. (This function is one of many that are described by an interface called IFeatureEnablement.)
Why is this important?
While it is true that most of the Zune features were implemented with a “ignore the Gods” override, this isn’t true for the unfinished Radio feature. This feature was marked as permanently disabled, hiding unfinished/unstable code from the public.
Re-enabling this feature isn’t exactly easy.
At first, I was inclined to simply disassemble all the managed code into IL, edit, and re-assemble. This turned into a nightmare involving digital signatures, Steven Sinofsky, and embedded native code (which cannot be disassembled properly). My second idea involving writing a loader that patched the relevant code at runtime fell flat too, due to my inexperience with the whole managed/native mish mash environment. Growing tired, I simply resorted to old school patching-on-disk of the Zune native library.
First, I wrote a utility to identify what I need to patch. Static analysis is fun, but not that fun. The Zune Function Locator utility (pictured above) may have a corny name but it does its job. (I plan on further expanding the tool’s capabilities, hence the generic name.) It will locate, within Zune’s native library (ZuneNativeLib.dll), where the IsFeatureEnabled function starts.
Err… why do we care?
Well, as I mentioned before, this function asks the Zune Gods if a feature is enabled or disabled. It returns the “answer” to the Zune software, controlling whether or not the user sees the feature. We’ll need to rewrite this function’s logic to always return “can haz”.
Second, I opened the library in a disassembler to provide a machine code listing of what’s going on here. The contents weren’t really relevant – I was going to rewrite it.
Third, I opened the library in trusty ol’ XVI32, jumped to the offset my tool spat out earlier, moved a few bytes in and… mashed the keyboard, inputting a bunch of random characters.
No, not really.
I typed in the hexadecimal characters for several assembly opcodes that ensured the feature was always considered enabled. The actual x64 code for this is below:
xor rax, rax inc rax mov [r8], al dec rax pop rdi retn
(The x86 code is very similar, therefore I won’t spend two hours trying to format it properly in Windows Live Writer.)
Fourth, I saved everything and fired up Zune. Crossing my fingers, the UI appeared and lo’ and behold the Radio feature appeared.
As mentioned earlier, the Radio feature is very unpolished and unstable. The baked in stations don’t play or display station graphics, but I’m willing to bet the folks at Zunerama will have it tamed in a few days.
All the resources I used are available for download from either here or the internet. Enjoy your private tinkering, but remember: I’m not responsible if your entire Zune music collection is replaced with Katy Perry albums. Also keep in mind the patched library may inhibit proper servicing (i.e. updating) by Microsoft. YMMV.
Download: Zune Function Locator 0.1 [x86/x64] // Raw patching instructions
This may be a very very stupid question, but where exactly do we place your utility? I tried chucking it in the Program Files/Zune, and it does nothing….
@Mattisdada If you run it in the cmd command promt, you will see the result.
I copied the file into my Zune folder.
All on Vista Home Premium x86:
By following the instructions the Radio option under Collection indeed appeared.
When starting the software it first played the intro video, I skipped it.
A week or two ago I did do the register edit to get the hidden locked features, they worked fine for me. Never had an issue.
Upon starting the software updated my library with the new content I added to my folders a day earlier, no error. The software started in the Quickplay screen, before it started on the Collection screen.
I went to the Radio tab, it showed me the default three stations. Since I am from Europe(The Netherlands) these are useless to me. I clicked on one of them, the software instantaneously stopped working, a windows error box came up. I tried debugging, but VS2008 wouldn’t let me.
The real test is of course to go to the Radio tab again and actually click something.
I tried right clicking on one of the default radio station.
The software stopped – I was thrown out again.
Since I am in Europe, there is no use of this feature I guess. It’s no big deal.
I won’t touch it for now, and revert back to the original library if it turns out problematic.
Thanks Rafael!
I started the software again, this time it stopped working as soon as I made my first click(again I was on Quickplay, clicked on Collection) it stopped, the same Windows box(to stop or debug) came up.
While I am typing this the software has been running in the background all the time, I haven’t touched anything. I did see that it started downloading new podcasts without a problem. The quickplay screen also shows newly added content as updated before. [as I type I will now try using the software again]
No fault of any kind so far, I can manage my content, even on the Radio tab it won’t throw me out. Playback of media works.
I connected my Zune(brown 1st gen 30GB), it syncs fine.
The software seems to hog a bit more resources that I can remember from before: zune.exe uses 150MB memory and 10% processor power. ZuneEnc.exe uses 60MB to 65-70%.(I have a core2duo E8200 with 3.2GB memory – 2×2GB in x86). This might also have to do with syncing of a vidcast in mp4 format.
Add-on: I looked up ZuneEnc, it indeed is an encoder module. So it must have had to do with the mp4 vidcasts.
Having issues with 64 bit patch
1. I put zfl_x64.exe at C:\Program Files\Zune
2. Open Command Prompt
3. Did command: cd C:\Program Files\Zune
3. command: zfl_x64.exe
4. It show: ::IsFeatureEnabled function file offset: 0×5D4270
What do I do next? Radio is not showing up yet.
OK, from the above, I edited 48 83 EC XX in ZuneNativeLib.dll with 48 33 C0 48 FF C0 41 88 00 48 33 C0 5F C3
but got Zune is not responding error.
I found the 48 33 C0 48 FF C0 41 88 00 48 33 C0 5F C3, but what do I override the value with?
@Mark the result the ZFL gives you can look up in the hex editor, in your case 5D4270.
From that point look for the entry 48 83 EC XX.
Overwrite, starting with 48, with the string Rafael has given: 48 33 C0 48 FF C0 41 88 00 48 33 C0 5F C3.
NOTE: This is all for a 64-bit system, but I assume you know this since you read this blog;)
ALSO: make a back-up of the files you edit:)
@Niek Yeah i tried that, it says about the IsEnabled Offset thing… But it still does nothing….. It doesnt launch Zune Media Player, nor does it patch the file…. It does nothing…..
The utility simply identifies the location that you must patch yourself. See the instructions linked at the bottom of the article.
Do you think I ought to help them out?
I use Windows Server 2008 as a workstation and would love to run Zune 4.0 on it. The installer doesn’t allow this even if you set the compatibility mode for the installer. Any tips for getting the installer to run on Windows Server?