AdamOutler

The question is how do we get into the U-Boot console http://forum.xda-developers.com/showthread.php?t=1423009 Maybe I should look into this, since console seems to be confirmed. I will probe around this weekend.

I thought SDCard was the flash on this device. There is a second storage?

On the SDCard image. please check these locations "0x250000 (and 0x260000)". When opened with a Hex Editor, you should see " a bunch of zeroes … and a 16-byte ASCIIstring hiding there. This is our password." https://fail0verflow.com/blog/2014/enhancing-the-avic-5000nex.html

Very good work. that's the entire android system, there. We just need a fool-proof way to recover devices. If you can figure out how to deodex your SYSTEM.img (/system/framework and /system/app), and test it to verify your device boots up properly, I can rewrite the code to remove the warning screen. I ordered this SDCard. it's on back order. I requested that it come without encryption/sdcard lock in the special requests field. They obviously need to make new ones anyway, maybe they could just not lock the SDCard before sending it. I'd hope I don't have to send my device out for

I can't get my device working without an 8100 SDCard and it's just not proper to RMA the device. I'm really hoping an employee with access to the raw SD Image is reading this and can help. I can keep things anonymous. I'm also exploring JTAG but I've really screwed with the firmware on my unit so JTAGing a broken firmware will only get us so far and won't allow me to restore my device. If it comes to JTAG, does someone have an x1xx unit or SDCard I can use to pull a pristine 8gb image?

Just needs more time and effort. I spent all weekend analyzing firmware and trying to get my bricked deck working. Once I'm able to get my device working again, custom firmwares should be simple.

use tab auto-complete, be outside of the ramdisk dir, make sure all tools are chmodded +x (executable), and specify full paths. /path/to/mkbootimg_tools/mkboot /path/to/original_boot.img /path/to/root/of/unpacked/ramdisk_folder/ /path/to/new_boot.img

Got VirtualBox, or MacPorts? Either one should be able to do it. VirtualBox would be preferable to run Ubuntu in a VM and you can share a folder between the computer and the VM. I won't ever be able to get x0xx logs on my device. This weekend I'm going to make a full SD from the x0xx upgraded to x1xx. I hope to restore my bricked device back to operations.

The kernel is the layer where the drivers are initialized. Try changing the boot.img as well. If that doesn't work we will need to get debugging info. After decompressing the ramdisk, in the init.rc, somewhere late in the boot, place this.. sleep 60 && dmesg>> /storage/sdcard0/log.txt & Which will cause the system to wait 60 seconds on a background process, then write the kernel log to the external sd. You can paste it on http://code.casual-dev.com You will have to recompress the kernel using the same tool, then sign it and flash it.

btw... external SD is /storage/sdcard0

Here's how to extract the boogimg.cfg, the zImage and the initrd.img#remove headers and create standard boot.img files dd if=AVICE5100NEX/BOOT/PJ150BOT.PRG skip=1 of=/home/adamoutler/Desktop/boot.img dd if=AVICE5100NEX/RECOVERY/PJ150REC.PRG skip=1 of=/home/adamoutler/Desktop/recovery.img cd /home/adamoutler/Desktop abootimg -x boot.imgfirst things first, in the bootimg.cfg, make "bootsize = 0x416800" blank so it should be "bootsize =" then save the file. Now lets get into the image. You'll need the mkbootimg tools from here https://builds.casual-dev.com/index.php?dir=random%2FAVIC%2F ada

Use the old kernel and the old BT partitions. They would need to be resigned. If you can resign a kernel, I can work on some things that will allow us to log to the SDCard. After you remove the header from the kernel you can use a tool to separate the kernel, ramdisk, and kernel parameters. Then the ramdisk can be mounted and we can see what's going on. I'd like to add in a "dmesg>/extsdcard/log.txt or something to the /init.rc file . I don't know what the partitions look like just yet but we could get a better idea from the recovery's /etc/recovery.fstab, or the normal fstab on the

I just picked up 10 sdcards so I would be able to make 10 different custom ROMs. I need the original unencrypted SDCard image.

Something we are missing here is a map.. I'm using a 150version (x1xx series) firmware. I will ignore the version. I'm trying to create the start of a scatter chart here. Add more information as it is discovered... Actual partition names, locations in /dev/block, EMMC layouts.. that sort of thing. Eventually we will blow this thing wide open for modification, but we have to start by mapping it out. common name - associated ver file - location in update boot.img - BOT.VER - BOOT/BOT.PRG bootloader - BTL.VER - n/a UNKNOWN - BT.VER GPS/GPS.PRG userdata - DAT.VER - USERDATA/D

OK. I really need that SD now. I've bricked my device. After deodex, for some reason it said it was upgrading to a different version. Now it just sits at pioneer loading screen.

Thanks. I tried downloading that torrent in the hopes I could rebuild with the update. No luck. It can't even find a single source for download. Any chance you could upload it somewhere? I could set up an ftp at adamoutler.com or casual-dev.com if you'd like. Currently I'm deodexing the system/app and system/framework. I will then package it all back up, test and upload somewhere. The deodexing is important because it combines the .odex and the .apk to make a full app. If you don't deodex, you end up with only part of the app when you decompile the apk. Apparently people o

Thank you ever so much. I need an AVIC-8100NEX image though. Any chance you know of one for the x1xxNEX series?

I got around to testing. I took the stock update and ran the above script with /AVIC.sh /home/adamoutler/Downloads/15MY_FW-Update_v1.03_16G_20150318\ \(2\).zip 5100 150 I then copied the resulting AVIC5100NEX folder to an SDCard and popped it into the radio. The update took just fine. I was not able to connect Android Auto (which depends on bluetooth) after the update and multiple restarts of the phone and head unit. I held the pin-hole reset button for 5-seconds, the HU rebooted and Android Auto connected. Now I'm going to work on the stinkin' start up screen. Verified: he

Hey guys, I'm Adam Outler. I'm new here. I'm pretty well known on the XDA-Developers forums and I'm interested in working on this platform. I own two AVIC-8100NEX units. One is on my bench and the other is in my car. I posted quite a bit of information the other day before I found this post. I'm very saddened by the lack of communication on this forum. People are making progress independently without sharing any changes or methodologies. I'd like to (without overstepping my bounds) encourage people to post cool new hacking techniques in the relevant forums. You see, without shar

I mucked around for about 16 hours this weekend playing with the AVIC 8100 NEX, firmware update, source code, and SD card. I have never worked with Freescale or EasyRecovery so I'm not sure which features to attribute to which manufacturer, or how they work. I'm hoping to start a conversation about this here and maybe pioneer a custom Pioneer Android ROM, which would add some serious value to our devices. First off, does anyone know the SD CMD42 password for the SDCard? Overall: This generation runs Android. The UI is entirely Android. The partitions in the update are standard Andro