e0x70i

have been exploring the 8100 /system partition extracted from the PRG using the methods in AVIC.sh. 

It looks like the av.apk debug mode  indeed has a ton more stuff than that of the x000 series av.apk. Also in both x000 and x100 series the debug menu makes system changes by calling methods in framework/framework2.jar's DebugModeServiceProxy class. These methods are just wrappers for native JNI functions, however.  

Unfortunately, we can't just drop the x100 series av.apk in since it at the very least relies on the DebugModeServiceProxy functionality in framework/framework2.jar. We will have to transplant both the app and framework folders into the x000 series. 

Has anyone already tried  replacing the x000 app and framework folders with the x100 app and framework folders? 

Found the DebugModeServiceProxy class . It is in framework/framwork2.jar, along with a lot of interesting pioneer classes.

The setting the usb device mode change method calls a native JNI function though, so have to do some more digging to find out exactly what that JNI is doing when setting usb to device mode

    private native int SetUsbPortMode(final int p0);

Also have been exploring the 8100 /system partition extracted from the PRG using the methods in AVIC.sh. 

It looks like the av.apk debug mode  indeed has a ton more stuff than that of the x000 series av.apk. Unfortunately, we can't just drop the x100 series av.apk in since it at the very least relies on new functionality in framework/framework2.jar. We will have to transplant both the app and framework folders into the x000 series. 

Has anyone already tried  replacing the x000 app and framwork folders with the x100 app and framework folders? 

Just checked on my unit, 8000nex 1.10, I don't have the ADB options. 

Let us know if adb works! Maybe it will be possible to to just swap out the 8000 av.apk with the 8100 av.apk.

Hmmm this looks promising: http://android.stackexchange.com/questions/55674/how-can-i-enable-adbd-during-boot-on-cyanogenmod

We can disable adb auth requirements and make it so when mtp is enabled, adb also gets enabled. 

I don't have access to my internal sd card till this weekend when I can pull the thing out of my car so just throwing suggestions in the air for now. 

I have not tried that method yet as I thought it just gets overwritten. 

Sorry, im a noob at this, not sure what the best way to change these android system properties are. I'll do some more research on this and how the init scripts work. 

I want to take a closer look at the debug proxy class as that may have some hints on how to enable adb just through the av debug menu, which is much more ideal

Have you found which apk or jar the  jp.pioneer.ceam.widget.DebugModeServiceProxy.* package is in? 

Actually, what about changing the sys.usb.config to adb?

# adb only USB configuration
# This should only be used during device bringup
# and as a fallback if the USB manager fails to set a standard configuration
on property:sys.usb.config=adb
    write /sys/class/android_usb/android0/enable 0
    write /sys/class/android_usb/android0/idVendor 18d1
    write /sys/class/android_usb/android0/idProduct D002
    write /sys/class/android_usb/android0/functions ${sys.usb.config}
    write /sys/class/android_usb/android0/enable 1
    start adbd
    setprop sys.usb.state ${sys.usb.config}

Can we change this in default.prop?

#
# ADDITIONAL_DEFAULT_PROPERTIES
#
ro.secure=1
ro.allow.mock.location=0
ro.debuggable=0
persist.sys.usb.config=mtp

Nice!!

also, noticed adb daemon in the sbin folder on the /boot partition.

Has anyone tried having this run in rc.local or something? Maybe combo of enabling USB OTG and running the daemon? 

/wordlists/nex/boot/ramdisk/sbin# ls
adbd  andsnap  snapshot  ueventd  watchdogd

https://github.com/bassrock/AVIC-NEX#update-file-modification

Advice is specific to update files so you probably don't need to edit . But if we want to create a custom rom and package it up for people to update, could modifying boot.img still be an issue? 

You can modify the boot partition by dd'ing it to a separate image and then running mkboot on it. That will create a folder where you can edit the boot init scripts and such. Then run mkboot again to create a new image that you just dd back.

 

 

As far as modifying and packaging the images. We can repackage images, and create updates for them, we just haven't created any nifty tools to do it. But if you have scripting knowledge, you can see the script here: https://github.com/bassrock/AVIC-NEX

 

That unpacks an update file, allows for you to make changes and then repacks it into a PRG. The only issue is the SNAPSHOT, but new post shortly on a new menu we found that recreates the snapshot.

I took a look at your script earlier, awesome stuff! Was going to mess with it later tonight to try and pull a 8100 image from the update file. 

The main question I had was related to this comment 

 

 

Any modifications made to the BOOT.img kernel/prg cause the deck to not boot. There is a checksum that we have not yet figured out on the Boot partiton.

Is modifying boot still a hurdle? have you guys modified boot on the sdcard directly without issue? 

Oh nice! Ok I'll take a look at those scripts

 

Partitions with size 10MB and 30MB is two sides (side A and side of normal boot and two sides (A/B) of recovery boot. This partitions is starting with "ANDROID!" and can be extracted with special software too. Normal boot partition is almost empty, recovery boot partition contains testmode files.

 

Also, mtd2 nor flash backup contains fifth boot partition with EasyRecovery boot. This EasyRecovery is called then system cannot boot properly from SD Card.

Ah, thanks! So it looks just like normal android /boot and /recovery partitions.

Any gotchas with checksums on /boot when I modify the partition on the SD card directly? Or is that a problem only when updating from the PRG file? Either way, I'll avoid making changes to boot since it looks like no-one has found out a way to package modifications to boot.img in a PRG update file yet. 

Found some interesting stuff digging through the 1.10 backup image from my 8000nex.

Looks like carplay is called "DIO" internally. Smoking gun are dio_demo.jpg files that are screenshots or ads for carplay. Additionally the functionality of the classes referencing DIO look like they are working with carplay.

 There are a handful of classes so far relating to DIO. The jp.pioneer.ceam.mode.modescreen.DIO.SCR_DIO_Base class, which is found in the mode.apk,  has most of the basic functionality in it. This includes the display of the caution screen. First thing I am going to try is disabling the caution screen by editing the smali for this class. 

There are more references to DIO in other classes, mostly classes that manage the state of the UI/audio services. 

There are also many references to AAM. The base class for AAM in mode.apk looks MUCH more complicated than the carplay classes. I think this is appradio, but am not sure. I will take a look at the 8100nex image and compare to see if AAM is possibly android auto.

Attached the carplay DIO image file below. 

AV.apk -> /res/drawable-mdpi/dio_nex_demo_image.jpg

Thanks, 

Sorry just made a ton of edits to my first post!

Just tried out kpartx with your flags, nifty. 

It didn't automatically mount the drives it set up for me, but I just had to mount manually and it worked fine:

mount /dev/mapper/loop3p7 /mnt/avic7

kpartx -l AVIC.img gives me no output.

fdisk -l   AVIC.img gives me 

              Device Boot      Start         End      Blocks   Id  System
/wordlists/AVIC.img1         1050624     1071103       10240   83  Linux
/wordlists/AVIC.img2         1071104     1091583       10240   83  Linux
/wordlists/AVIC.img3         1091584     3573759     1241088    5  Extended
/wordlists/AVIC.img4         3573760    30197759    13312000   83  Linux
/wordlists/AVIC.img5         1091585     1153023       30719+  83  Linux
/wordlists/AVIC.img6         1153025     1214463       30719+  83  Linux
/wordlists/AVIC.img7         1214465     2263039      524287+  83  Linux
/wordlists/AVIC.img8         2263041     2525183      131071+  83  Linux
/wordlists/AVIC.img9         2525185     3573759      524287+  83  Linux

and partedx  AVIC.img gives me

# 1:   1050624-  1071103 (    20480 sectors,     10 MB)
# 2:   1071104-  1091583 (    20480 sectors,     10 MB)
# 3:   1091584-  3573759 (  2482176 sectors,   1270 MB)
# 4:   3573760- 30197759 ( 26624000 sectors,  13631 MB)
# 5:   1091585-  1153023 (    61439 sectors,     31 MB)
# 6:   1153025-  1214463 (    61439 sectors,     31 MB)
# 7:   1214465-  2263039 (  1048575 sectors,    536 MB)
# 8:   2263041-  2525183 (   262143 sectors,    134 MB)
# 9:   2525185-  3573759 (  1048575 sectors,    536 MB)

The only partition I can mount is # 4,  with 

Logical partiations of 3 seem to mount fine from the ones I have tried

mount -o loop,offset=1829765120  AVIC.img /mnt/avic4

the rest of them error out.  just 1-3 error out  For example trying to mount #3 I get:

mount -o loop,offset=558891008 -t ext4 AVIC.img /mnt/avic3
mount: wrong fs type, bad option, bad superblock on /dev/loop1,
       missing codepage or helper program, or other error
       In some cases useful info is found in syslog - try       dmesg | tail  or so 

Are you able to mount the other partitions? Or is 4 the only valid one. 

Having WARP disabled makes the unit boot about 30 seconds before you can listen to music. It is even worse startup times with the Original SD Card Pioneer ships with. If you are going to disable WARP and are opening your unit, you should replace the SD Card with the fastest SD Card you can find to help speed it up.

Thanks,

I completed the NOR and SD card backups and posted details in the backup thread. Won't be able to flash the BSP and put in the new sd card until this weekend. 

In the meantime, I'll start looking at the image itself, play around with the PRG conversion script you guys wrote, and explore interesting APKs. 

NOR Backup and SD Card backup worked. NOR backup completed instantly to USB1.

Backing up to /sdcard/ for the SDcard backup took about 30 minutes. Pressed the volume minus button a handful of times. 

After putting the SD Card back into my computer, however, windows gave the error  "found errors on this drive. to prevent data loss, repair this drive now." After scanning the drive, it said no errors were found. Maybe I ejected it wrong from my machine initially, or the linux NTFS drivers on the next are causing weirdness. 

I copied the avic.img over . Despite the windows error message, the file looks fine. it is 16,130,244,608 bytes (15.0 GB). I may try one more time and see if I still get that error. 

lol a douchebag with 5 posts trolls me with a 2 year old meme.  Nice.

 

Welcome to AVIC411. You will fit in just fine

 I hope I will

But for real, give whatis a break. He did some great work and probably has valid reasons for removing his posts. Besides his posts aren't part of an open source project or under any license so he can do what he wants with them. 

Two pages of comments like "Great work guys" and "he is bad man". Is anyone tried at least to backup his device? 100% safe operation. Or clone device? Tried somebody do something?

Give it some time. There's going to be more lead time on testing out something that requires ripping a radio out of a car vs. just plugging in a phone. 

I am going to be testing this out this weekend. Also, anyone daily driving with warp disabled? Is it still fast enough to not be terribly annoying? 

EDIT: Is everyone doing this from firmware 1.10? I am on an older version currently. 

Amazing work guys.

Still not happy that WhatIs deleted all of his posts.  You are hiding code of an open source project.

wow very hide,  much scare

I measured the sound with my iPhone. It shows a spike at 12-15 KHz and also 20 Khz. I know I can't hear 20 Khz, so I doubt that's it.

 

Then I did a web search for 12 KHz sound, and found the link below. It sounds very similar to the sound being made by the 8000NEX. It's also behaves the same, in that it's much louder when I turn my head at certain angles.

 

Nice detective work! 12 Khz is pretty low, I'll try to remember to do the measurement tonight on mine and see if it is the same. 

Another possible explanation: I have seen (or, rather, heard) this happen on an embedded device which used a switching mode power converter to supply power to a daughterboard assembly. If we powered up the device without that daughterboard plugged in, the power supply would make that high-pitched whine because the power load was too low.

Oh interesting, that one sounds a bit harder to fix than gluing a capacitor 

Or you can't hear it. I can't , but that doesn't mean it's not there. As we get older, we lose the ability to hear tones in the high kHz range. (above 15 kHz). I'm going to get my SLM out and see if I can see the frequency and dB level of the noise.

Yeah its very high pitched, you would have to be  sensitive to the noise and relatively young. I am 24 and really have to listen closely and have my head in the right position to hear it. 

Would be interesting to see what the results are of that test! I have an iphone app that measures frequency, I'll try that too, but im doubting the iPhone mic can pick something up that high in the frequency range 

I had the exact same issue you are describing. Display whine, high pitched, and only when some sort of dimming is enabled. 

I went to the shop I got the unit from and checked out some of their other 8000nexs, they all had the exact same issue. I think every 8000 has this issue, just most people aren't sensitive enough to the noise to notice it. I don't notice it when the engine is on so I have just accepted it. Opening a support ticket with pioneer may get you a new one but it is probably going to have the same issue.

This is a common issue on crappy screens with cheap components, it is probably a whiny capacitor that starts vibrating when dimming is enabled. If you open up the unit and find the offending capacitor you could glue it to make it stop, though this will obviously void your warranty. 

Personally I stopped caring once I found that all other 8000s (that i have seen) have the issue . Need to tell pioneer to use some better components in their LCDs.