bass_rock

Something else that is interesting to note is that for the bluetooth audio cross-upgrade issue, I was able to use some of the new test mode features to get bluetooth audio to work in the test mode, bluetooth line test area by changing the Audio Codec to Digital, however these changes do not persist after exit and a reboot.

Ok added a good amount of all data discussed on the forum here: https://github.com/bassrock/AVIC-NEX Please create any pull requests with modifications!

Also another note, I am wondering if Bluetooth Audio is not working in the cross update due to the Bootloader file not being in the update. As the x100 are on 1.0000 boot loader and the x000 are on .02000. Not sure at what point the boot loader helps with android as it seems to be different than the boot image.

Ok I just tried to run the copy script function but it would not run. I also attached the contents of my usb at the time. Is Copy Script the correct function in the Write Programs Forcibly Menu? shell.zip

Ok creating a repo and wiki here: https://github.com/bassrock/AVIC-NEX Will fill it out tonight.

Ah ok. Never mind then, do you have a good spot for a wiki for this useful information then? Ok that sounds really awesome. I will start small tonight and give it a shot. (Of course after I threw my deck back in my car right after we cracked the test mode keys.) So for the script though, Does it look like I have to put the script on the device and run it from the TestMode, or do I use a test mode key with the command to run it?

@AdamOutler thanks! I will get it to trying that tonight. Also @AdamOutler since you are big on XDA, is it possible to get an admin to open a forum there, or do you have a good place to wiki dump this knowledge so we don't have to go digging through 30+ forum pages?

Yep thats probably correct, although I am not sure if any of the current test mode strings we have ever it the +76. I did a strings terminal command on the libTestMode.so and that stuck out to me as it was next to SERVICE, PRODUCT and more, and that thread that talks about the TestMode keys mentioned those so I tried it. If you can provide me with a script that dumps out what we need I can run it on my device later today.

Ok found some more modes that are available with the TESTMODE_A.key and the contents: XXTECHNICALXX - Starts up into a mode very much like the Service mode above, except it has a lot more debugging options. 013XXTECHNICALXX003ALL00833333333013XXTECHNICALXX0082013010100820201230000 PRODUCT - Starts up like the Service mode, seems to have a combination of Service and Technical. 007PRODUCT003ALL00833333333007PRODUCT0082013010100820201230000 AUTO - Starts up like the Service mode, says Production in the top right, couldn't tell the difference 004AUTO003ALL00833333333004AUTO

Ok I have modified the script and created an encode script. Now we just need to know the available commands! Decoder: #!/usr/bin/perl # usage perl decode.pl TEST.KEY my $filename = (shift); open(my $fh, $filename) or die $!; binmode($fh); my $cnt = 0; my $encodeString = ""; my $otherString = ""; while (read($fh, my $byte, 1)) { if ($cnt % 2 == 1) { $byte = ord($byte) - 0x14; $encodeString = $encodeString.chr($byte); } else { $byte = ord($byte) - 0x14; $otherString = chr($byte).$otherString; } $cnt++; } print $encodeString.$otherString; print "\n"; close $fh; Enco

Ok sweet. The TESTMODE_A that I have that works has the contents of: 007SERVICE003ALL00833333333007S After decode which makes sense now.

Also, @AdamOutler based on the above that would explain why the n_1 is not working, since it is not doing it from the norflash.

Can you post your version of the script?

Also thinking about it, my 8000 did not work well with the 5000 sd card image (The screen would not tilt or think it could tilt) as it seemed to have something on the EXTDATA partition (the one partition that the updates don't touch). I wonder if the Bluetooth audio for Android Auto and the system is looking for some key or piece of information on this EXTDATA partition, that the x000's do not have. But, again it comes down to figuring out the TestMode Keys, enabling debuging and ADB with them, then browsing the filesystem, seeing the logs and comparing the EXTDATA partitions.

It really comes down to figuring out the method to the data in the testmode_n files as those do specific functions and n_2 and n_3 are the same up until the change from flag 8 to flag 12. So if we can figure out the bit setting or encryption (if they use encryption on those files) We allow ourselves to flip the bits in the bsp without needing a jtag.

@whatisbypass. Can you dump the strings for that as I assume it's a bit different on our models.

So been looking around. The test mode looks like it may be the same as http://avic411.com/index.php?/topic/35253-advanced-puzzles-testmodekey-scriptexecini/ I have tried the script on the n_2 and the n_3 and get the following Daniels-MacBook-Pro:~ daniel$ perl test.pl /Users/daniel/Desktop/testmode_n_3/TESTMODE_N.KEY 002008000120ENHE Daniels-MacBook-Pro:~ daniel$ perl test.pl /Users/daniel/Desktop/testmode_n_2/TESTMODE_N.KEY 002008000120EIEY It now comes down to really figuring out the test mode files as they open us up to easier modifications and the ability to recover witho

@rojc any help or insight you have to the Testmode keys would help us a lot on this forum: http://avic411.com/index.php?/topic/80945-upgrading-nex4000-to-nex4100-work-in-progress/page-28

I have key 1 working, It just only seems to work though on a booted device following the steps I outlined, I have no clue why. Do you need it sent to you? As for each image removing the header. You just need to comment out 1 line from my script and it will save the .img out for you.

I think have not figured out what TestKey 3 does or how to do the boot sub modes or secondary flags. If we can figure that out I can get adb and change the usb modes. Something else you can try is dd'd the expanded images from the update files of the 8100 to the respective partitions on the 5000 sd card. That should at least get something bootable to force NOR into recovery mode.

Ok thats the screen from the test_mode_n.key under the testmode_n_2 folder. Use the one from the testmode_n_1 folder as that boots the recovery mode. (That was my 2 am mistake in typing) Sorry It was about 2 in the morning when I wrote the steps, so it made sense at the time. Remove Broken Internal SdCard. Insert the sd card with the AVIC5000 SD Card Image Boot With the AVIC5000 SD Card Image Insert the testmode_n_1, TEST_MODE_N.key, which will make the unit boot to recovery Power off unit. Remove internal AVIC5000 SD Card Boot Again with the test mode n 1 key Receive System Error. Le

I tried TestMode s with the value 6 inside it and it seems to have turned off warp (boot takes much longer). the test mode a you proved me with does not do anything but I have a different one from @rojc that boots into the testmode.apk. testmode_s with a value of 6 or 5 seems to just say the word Test Mode in yellow on the screen, otherwise the device behaves normally. If someone has more experience with the test mode files and knows how to get read them and get different modes to boot, more than willing to try!

Yes my restored sd card is locked. The steps I used to restore my card is as follows: Remove Internal SdCard. Boot With the AVIC5000 SD Card Image Insert the testmode_n_2, TEST_MODE_N.key Boot To recovery mode power off unit. Remove internal sd card Boot Again with the test mode n 2 key Receive System Error. Let it sit here for about 30 seconds to be sure. (this seems to trigger the NOR Flash, not the sd card, to always boot in recovery until you write a file using recovery) Put original SD Card back in. Boot with the last OS update you used (i.e. if you used 5100 update last, put t

We are currently working on this and much more over at this thread: http://avic411.com/index.php?/topic/80945-upgrading-nex4000-to-nex4100-work-in-progress/page-27

Thanks to the kind support of @whatisbypass my original sd card now works again. I was able to use one of the TESTMODE Keys to put my device in recovery mode with the 5000 SD Card image installed. Once it booted into recovery mode each time, I put back in my original sd card, put the update on a usb drive and used the recovery mode options to write all the partitions. I now have my deck back to what is was. This also confirms whatisbypass and AdamOutlers thoughts on DRM and custom data on the EXTDATA partition that does not get updated in a system update. Other than that partition (which