Jump to content


  • Content Count

  • Joined

  • Last visited

Posts posted by FourG

  1. As a side note, if you have a QNX Foundry27 account you can download the Centrality Titan evaluation board BSP for QNX to get a lot of insight into the way the eval board Pioneer based the Navi board off of works (mem map, I/O, NAND flash, CPLD, etc). If you launch Test Mode on the AVIC-F the system info under the control panel even calls out the Centrality Titan EVB as their BSP, so I'm willing to wager once we have the uBoot/ROM programming routines figured out a QNX/Linux/alternative OS is that much closer (or even a home-rolled BSP package for WinCE 5 to use/enhance LeetLauncher3 or MioPocket).


    MioPocket 2.0 does a pretty good job of restoring many of the missing WinCE DLLs to the whole system, and has the option to run off the SD card (it does install some entries into the registry though).


    Wondering if we should start a hardware section under the AVIC Wiki sometime to collect this sort of stuff...?

  2. Before I put the unit in the car, I think I'm going to take a peek inside it to see if I can find any alternate I/O access points for the unit. However, I have a feeling that everything is going to be a proprietary stripped down bare bones design that has been custom tailored for Pioneer.


    Not sure how much it will apply to the F700BT, but the F90BT/F900BT Service Manual has a lot of information about the AV board and its connections to the Navi unit. It doesn't have the schematic for the Navi itself, but it does show some interesting places where you can tap off the I/O to trace what's going on when switching sources, adjusting volume, etc. It also has most of the reset flow, from power on to the uCOM releasing reset to the Navi board... :D


    Looks like most of the audio work is handled by the System uCOM IC, which the Titan ARM CPU talks to using UART #2. The uCOM talks to the audio/video switch control (AV Selector, I4171) using I2C. The AV Selector selects between the R/L audio channels of AV1, AV2, DVD. It also controls which of the two Aux video inputs is shipped off to the Navi's second composite video input for use as a video source (the Navi can also select the rear camera input as the other source).


    All volume being fed to the Amp is handled by the E-Vol IC (IC4271), also controlled by the uCOM via some sort of 3 wire protocol (Clock, Data and Strobe). E-Vol selects between the output of the AV Selector, the FM/AM Tuner, the uCOM IC (probably handles IP Bus audio), the stereo ouput of the Navi (music) and the mono output of the Navi (Guidance).


    As for the IP Bus, the uCOM IC handles communication with those devices. For more info on the pinout of the IP Bus, check out this page or this page. I can't imagine why Pioneer claims they can't get button labels going on the HD Radio, since I'd guess they control the I/C and are reading at least frequency numbers (if not ASCII strings) across the UART from the uCOM when it talks to the GEX-P10HD over IP Bus. Watching both the UART and the IP Bus +/- data would probably be very informative, if someone has an O-scope or logic analyzer at their disposal. :twisted:


    So I guess it all boils down to figuring out the UART commands the individual .exes execute to tell the uCOM to do their bidding as a first step to really getting control of things.


    I'm still pretty interested in MioPocket 2.0/LeetLauncher3 as a pretty good baseline of a full WinCE environment that's somewhat removable without too much "harm" to the main flash. Seems like MortScript would give us lots of control over the initialization of the whole thing (which it looks like Leetcoder chose for LeetLauncher 3.0). MioPocket 2 runs pretty well on my iPaq 310, which is basically the same environment as the AVIC Navi board sans the TMC/MSN and AV inputs. Sadly the AVIC apps (ezrider, SytemSettings, AV, etc) nuke on the iPaq since the relevant AV board hardware isn't there, making it less than useful for in-house testing (i.e. load it on iPaq first to check it out, then copy to SD card and take 'er for a spin on the AVIC). So it looks like emulation is the only way to go, short of buying another unit to hack on on your desk with the bench supply.

  3. If the cmh autoload method doesn't work, some WinCE PNAs have a way to get into engineering mode by pressing and holding a button (scrollwheel in on my iPaq 310, for example), pressing reset and then holding the button for around 10 seconds or so until the screen displays the Engineering Mode menu. Probably doesn't work for AVIC Fs (otherwise, wouldn't someone have already found it?) but figured it's worth mentioning if the flash is gone.


    Good luck!

  4. Just a heads up that some of the buttons in the navigatemap.ui are missing their USESEPARATEDSAFETYMODE=0 statements (specifically, the announcer mute button when a route is active). Some of us haven't done the HW bypass yet, so they're unavailable without the separated safey mode in the declaration...



  5. Hey guys... In the file data.zip/ui_pioneer/common/ui/navigatemap.ui, there is a code snippet that caught my eye:

    The sc_SkipMessageBox script's code is:


    I haven't been able to track down the code for vActionNotConfirmed or sc_HideMessageBox yet, but has anyone tried messing with this code to see if commenting it out skips the safety message? It seems like it's something run-once and disable...


    Also noticed some messages that the init is sending to MainMenu and AV:

    	EXEC "other.pioneer.postmessage" "MainMenu" "WM_APP_AV_IGOMAP" 1
    	EXEC "other.pioneer.postmessage" "MainMenu" "WM_APP_MAINMENU_CLONING" 5






    Has anyone managed to set some breakpoints in the simulator and catch these message events?

  6. Sweet! I noticed that some of the code samples in the software mods sections are in blockquotes, but the line breaks aren't being turned into "

    "s in the browser. This might break cut-and-paste, since it looks like one long line... I added some

     tags to the "Tap Compass to Cancel Route" page as a suggested way to post code, since the  WikiMedia tags didn't seem to work for the page for some reason.  Just something for the mod owners to keep in mind when you're updating a page with your code.
  7. since we got our MLS team figured i might share a couple i put together for the Seattle Sounders!

    i actually nabbed the backgrounds from earlier posts in this thread and tweeked the 'metal' one with some color.


    first post BTW - WooHoo!


    And you wasted it with Flounders propaganda? :lol: Just kidding man. You've shamed me into making a Timbers/Section 107 screen now.



  8. Short answer is no, there isn't a menu option in the AVIC settings/sys.txt, etc to fix this. It's probably hard-coded in AV.exe.


    Looking at the service manual (thread with link) the wired remote goes to an IC on the AV board that converts the level to a command for the Nav unit. So it's theoretically possible to alter the software on the Nav side of things for command substitution, but we probably won't be able to easily expand the command set coming in from the wired remote to add the missing Preset commands to the IC and still keep the track/scan buttons.


    Also notice there's an I2C connection going from the Nav to this IC, so if someone has an Aardvark or similar I2C bus analyzer we could probably observe commands being sent/received over the bus for various events (tuning, wired remote press, etc)...

  9. In the meantime, one option is to apply the sys.txt workaround that used to be in the iGo FAQ, then use test mode to set the timezone and time from within the WinCE control panel.


    In sys.txt:




    Assuming that the WinCE 5.0 image already has the DST issue patched you can boot into test mode, update sys.txt, apply your timezone and correct time via Control Panel, remove SD card and then cycle ACC. I think a reset would likely clear the setting...

  10. There was a known issue with iGo 8, as far as the timezones getting set incorrectly when the automatic timezone setting was selected. It was supposed to be fixed in the R1 patch Nav N Go released in August. Nav N Go also released R1 patch 2 in December, hopefully Pioneer includes this one in their 3.0 release (if it really is coming). Not sure if patch 2 also included timezone fixes.


    XDA dev post on the topic


    EDIT: Just checked my iPaq 310 (same iGo version, 2007.7 maps, same Titan CPU), it has the same issue with timezones. So Pioneer and other integrators probably used a common SDK with the same bug.

  11. Yeah, there were a lot of hotfixes available for WinCE/WinMo devices after 2007 to apply the DST fix (Google search get a lot of hits). Seems Pioneer forgot to apply MS' patch to the WinCE 5 image they gave us.


    Let's see now: unit goes on sale in '08, but is missing an '07 patch and the iGo 8 fix for correct timezone location for some of us (No, Pioneer, I DON'T live in Boise)... Seems they did all their testing in a single geographic location outside the US to me. :roll:


    God I wish their engineering department had an external Bugzilla so we could submit bugs for tracking.

  12. Does anyone have an editor that can read the .bpnd files in the .res files correctly? I thought I saw Guga mention they were .xml files or something of that nature, but opening them in a non-hex editor gives you some extra ASCII characters (kind of like F|O|N|T...). Also made sure it wasn't a SQLite DB that just happened to store strings as Unicode or something like that.


    Anyway, there's a .bpnd file in one of the .res files (I think it was AVRes.res or something like that) that looks to be related to a warning message. Just couldn't read it out correctly to correlate which .exe calls it or how to kill it.


    EDIT: Correction. It's in MainRes.Res under MainRes\NSWinsOpening\UIN_WIN_PLCaution.win.pnd.bpnd. Killing off some of the NULs didn't result in any strings matching the warning message, so... Losts of Font and Text Content IDs though, so it still might be in MainMenu.exe if it was indeed built with NSBasic (gotta love eVB/NSBasic forms).

  13. Pretty sure it would require modifying av.exe or an associated .res file. It's not driven by iGo 8, so there isn't a .ui in the data.zip we can change for this.


    It's been #1 on my must-fix items for a while now, since the steering wheel controls can't change presets up/down. Next ideal would have been knob up/down allowing preset changes, but with iGo claiming those for zoom control that just leaves the AV menu... :?

  14. I had a similar problem with mine, ended up sending it back to Crutchfield. Still haven't installed its replacement, without presets etc it just seemed like a waste of time unless I was going to have the dash open for something else.


    Tried soft-resetting the system, re-seating the IP-bus cable (and yes, the colors of the cable ends were in the right locations, non-reversed) made sure the powered antenna control was set to Power and not Radio under Settings, removed the antenna Y-splitter from the equation and took the antenna directly into the box, verfied 12V to the box (before and after the fuse) and chassis ground. Just seems like mine gave out.


    If the rumoured 3.0 firmware finally adds preset labels, I may actually try re-installing the thing. Until then, it's sitting unopened on a shelf waiting for a bench setup (anyone have a F-series with a borked audio out they want to part with on the cheap?)...

  15. Just a heads up in case you're not using the grounded mute wire hack, the data.zip's ui_pioneer/800_480/ui/navigatemap_800_480.ui is missing a few "USE_SEPARATED_SAFETY_MODE=0" in the buttons. This means they work fine when you're parked but stop working in motion.


    Buttons: Compass/delete route, nav voice mute/unmute, street numbers, street name.


    Check lines: 6, 18, 19, 35, 36, 90 (I think the last one had USE_SEPARATED_SAFETY_MODE=0 but forgot a space between it and a ' )


    My copy attached for reference/diffing.


  16. So the HP iPaq 310 has the same CPU (SiRf Titan, ARM instruction set), OS (Win CE 5.0), Navi software (NavNGo 8.0) and screen resolution (800x480) as our AVIC Fs. I picked one up refurb from eBay for a decent price (~$120 US after Live cashback). The iPaq's OS image seems to have more of the system DLLs than the AVIC so apps that work on it may not work on the F series. That being said, the iPaq has been pretty educational to hack on.


    In my opinion HP's NavNGo interface implementation is much better, I plan to study their .ui files for porting ideas. Also trying to get HaRET (handheld reverse engineering tool) working on it to gather info about the Titan/OS/memory map/interrupts, etc which is the first step towards booting something other than Win CE. Like leetcoder's pointed out though, we'd need to reverse engineer a lot of the interface DLLs that talk to the radio, iPod, HD/Sirius/Xm if we ever wanted to try to get Linux going on the AVIC.

  17. Wishlist:

    1. Ability to store station name/callsign with HD Preset. I'm in no rush to put the HD tuner back in my car until then.

    2. Increase the height of the soft buttons for presets, etc by at least 2x so it provides a better target for fingers. I can't take my eyes off the road to hit the touchscreen just right, so often times the wrong button gets selected.

    3. Add RDS to the standard FM tuner screen if possible

    4. Add preset up/down support for the remote

    5. Add the iGo 8 Timezone fix for auto time setting, so my HU doesn't think it's in Idaho instead of Oregon when using the GPS to set timezone.

  • Create New...