Jump to content


  • Content count

  • Joined

  • Last visited


About Shtirlitz

  • Rank

  1. AVIC-MRZ99 Custom Firmware / Testmode

    Hi @Mwassaru Just use sources: https://github.com/Shtirlitz/RZ09 Cut 0x200 header of PRG-file - you'll get the .NB0 firmware. Extract initDB.dat from .NB0 file, use my tools to make the translation. Replace translated initDB.dat in the .NB0 and use makever.c to create updated FW files. Here is step-by-step manual (2 posts): http://4pda.ru/forum/index.php?showtopic=847671&st=20#entry90149444 It's in Russian but I think it's easy to translate to English. Good luck! Alex
  2. AVIC-MRZ99 Custom Firmware / Testmode

    Hi, OK, here is the step-by-step manual: Step 1: Take out the FW, see here Step 2: Get the file named "PS140PLT.PRG". For RZ09 it is in folder NAVIVUP\AVICRZ09\PLATFORM\ Cut out 0x200 bytes from the start of the file: its header. I used the SFK-tool: sfk195x64.exe partcopy PS140PLT.PRG -allfrom 0x200 output.nb0 -yes When you need to extract file output.nb0 by the dumpromx.exe tool (easy to find it on this forum): mkdir DUMP dumpromx.exe -d DUMP -v -5 output.nb0 >output.txt As a result, you'll get a lot of FW files, and initDB.dat of course Step 3: Patch initDB.dat file. Use my sources, take translate.c and translation.txt, and see the code: const long OFFSET = 0x18C8D0L; // RZ09 1.04 0x18C8D0L; RZ77 2.07 = 0x1EA87CL const long BLOCK_LEN = 0xAF00BL; // RZ09 1.04 0xAF00BL; RZ77 2.07 = 0xB5CDFL These constants define the start and length-1 of the data block inside of the initDB.dat, correct it according to your header. Address stores in the little-endian bytes sequence: Go to the start of this data block offset: You can see the start of the Japanese strings data, its in UCS-2 LE codepage. The end of the data block at the end of the initDB.dat file: The address of the last data byte is 0x23B8DB. Use the calc for calculating the length-1 and insert it to translate.c source, and compile it. While running, the translate.exe search for initDB.dat and translation.txt in the current folder. After finishing the output file initDB_out.dat will be created. Step 4: Assemble the updated FW. Get makever.c and compile it. You can change the version if you need it, the current FW version in the PS140PLT.VER file. Replace initDB.dat in the FW by commands: copy /Y initDB_out.dat initDB.dat dumpromx.exe -a initDB.dat fw_104_src.nb0 You need to get the correct output, like this: img 00000000 : hdr=8d908c88 base=88471000 commandlineoffset=88471000 ERROR: could not find pointer for ofs 00000000 Successful file initDB.dat inserting initDB.dat.nb saved successfully If it OK, run the makever.exe by commands: del /Q fw_104.nb0 ren initDB.dat.nb fw_104.nb0 makever.exe mkdir NAVIVUP\AVICRZ09\PLATFORM copy /Y PS140PLT.PRG NAVIVUP\AVICRZ09\PLATFORM\PS140PLT.PRG copy /Y PS140PLT.VER NAVIVUP\AVICRZ09\PS140PLT.VER It creates the folders (NAVIVUP) and files for the AVIC's FW update. Step 5: Just place folder NAVIVUP on the SD and try to update your AVIC in a test mode. Use "Program forced write" menu and "Platform write" command, SD as a source. On Internal SD stayed the original Japanese FW if you want back to it. And be careful, do not power off the AVIC during updating, it can be bricked (or boot looped)!!! Good luck)
  3. AVIC-MRZ99 Custom Firmware / Testmode

    Hi! For RZ05 translation you need to take out the FW, and use my GitHub project to prepare modified FW: https://github.com/Shtirlitz/RZ09 Good luck)
  4. AVIC-MRZ99 Custom Firmware / Testmode

    Hi @Mwassaru, This set of setting (DSP & sound settings) I have translated already, but some interfaces (Navi for example) is still in Japanese. The screenshots are not up to date on GitHub, see translation.txt commits for last updates. Alex
  5. AVIC-MRZ99 Custom Firmware / Testmode

    Hi everyone, I have finished the translation of my AVIC-RZ09 to English (with string length limits of initDB.dat file). Here are updated sources and examples: https://github.com/Shtirlitz/RZ09 Alex
  6. AVIC-MRZ99 Custom Firmware / Testmode

    Hi Sadhri, Easiest way to do it, just install FM converter device between AV and antenna. It moves FQ range and you will be able to tune radio stations in your region.
  7. AVIC-MRZ99 Custom Firmware / Testmode

    Hi @DriveNSK, I could not upload images here (I got an error), but I uploaded it on GitHub: https://github.com/Shtirlitz/RZ09/tree/master/RZ09_photos Alex
  8. AVIC-MRZ99 Custom Firmware / Testmode

    Hi everyone, I have partially translated my AVIC-RZ09 to English, but it looks not so good as I wanted because of string length limits of initDB.dat file. I didn't find any markup records in initDB.dat file. I try to investigate some other files of the AVIC-RZ09 firmware but no results for now. Maybe someone knows where are stored the Strings length and field's markup of the AVIC UI? Here are sources and examples: https://github.com/Shtirlitz/RZ09 Alex
  9. AVIC-MRZ99 Custom Firmware / Testmode

    I've downloaded it, thanks! It's funny)) Folder inside of the "NAVIVUP" named as "AVICRZ09" on your RZ77 device Pioneer's engineers place same compiled Testmode.EXE on all devices and don't mind it))
  10. AVIC-MRZ99 Custom Firmware / Testmode

    Hi DriveNSK, You are welcome) Can you share your FW with me (upload it to Google Drive for example)? I try to find tips and tricks of new WM-based AVICs firmwares. Thanx!
  11. AVIC-MRZ99 Custom Firmware / Testmode

    Hi All! FW backup instruction for AVIC-RZ09 (and similar devices - AVIC-RL09, AVIC-RW09, AVIC-RZ09, AVIC-RZ07, AVIC-RZ06, AVIC-RL05, AVIC-RZ05, AVIC-RW03, AVIC-RZ03): 1. Get SD card, FAT32-formatted. Probably the USB disk will work too, but I didn't check back up on USB. 2. Make the empty folder named "NAVIVUP" on SD card. 3. Power on the AVIC and place the SD card into AVIC device slot. 4. Go to in the Testmode (press and hold "NAVI" button, press each once right-left-right-left-right-left, release "NAVI" button - device restarted in test mode). 5. On the first screen - select menu "10. Program forced write", go to the next screen of this submenu (2 of 3) and select "3. Take out program". 6. Select destination "SD" or "USB" and press "MENU" for start downloading. 7. Wait for about minute while FW downloaded to SD/USD disk - with full-screen messages "!!NOW COPYING!!", while "HIT ANY KEY" message didn't appear. Profit) You can see the full-FW files on your SD/USB disk in the NAVIVUP folder. P.S.: Sorry guys but I cannot upload the screen-shots here, I see just "There was a problem uploading the file." message displayed. Alex
  12. AVIC-MRZ99 Custom Firmware / Testmode

    Hi DriveNSK, I didn't find any correct TESTMODE.KEY for now: a have tried a lot of variants from this site and others but every time saw an error message "TESTMODE.KEY is incorrect". But I can see the Test modes keywords inside of the file "Testmode.exe". I'm not sure what the correct TESTMODE.KEY will open the "Copy" and "Paste" commands, further, the device file manager didn't access to files which contains the strings for translation - all of them inside of the main FW file PS140PLT.PRG. WM6.x - yes, the device is Windows Mobile 6.x based, and I found tools to get/repack files of the FW (dumpromx for extract/replace files, fdf2reg and reg2fdf for registry "default.fdf" file changing). "Take out program" is one of the menu items on the second or third screen of the TestMode menu on my RZ-09. I can make a screenshot for you tomorrow. My device cannot connect to PC, for navigation updates synchronization uses the SD card (you need to prepare it on the device first and after it uses the Smartloop SW - it in Japanese only). Alex
  13. AVIC-MRZ99 Custom Firmware / Testmode

    Hi DriveNSK! I have AVIC RZ-09 and it looks very similar to RZ-77. I've spent about 2 weeks on investigations and for today I found: no easy way to make the device translation to English, but I think it possible by modding FW files I cannot find any similar model on the European market you can make the FW copy form the device easy - just use "Take out program" menu in test mode while SD-card inserted (FAT32 formatted, FW size about 500Mb) The folders structure looks like: NAVIVUP - AVICRZ09 -- APL -- DTV -- DTVDATA -- PALTFORM The FW and other internal data stored on the internal SD card. It is cyphered, I cannot make a copy under Win10 (I'll try to do it in *nix soon) The FW can be repacked using WM6.x tools and I'm trying to make the first patch to change time zone (Moscow std time instead of Japanese) Now I try to make repacked FW, but it is not too easy because for the payload of the main .PRG file (for RZ09 - PS140PLT.PRG) consists of unknown CRC checksum algorithm (for other FW files used plain CRC32B). May be DZO knows this secret Alex