Jump to content


  • Content Count

  • Joined

  • Last visited

Posts posted by FourG

  1. I'm keen on reading the speed signal (wired, not GPS) through a custom app.


    I'm guessings its just a serial port or something, but any advice hould be helpful rather than trial & error

    The schematic for the AV board in the F900/90BT repair manual has the speed sensor signal going through a margining network and then over to the Navi board into a Xilinx CPLD used for timing control. The schematic doesn't call out how the CPLD connects to the Titan CPU, it may be a GPIO/interrupt pin or a two-wire interface. Might still be trial-and-error territory.

  2. If it was possible, someone would have don't it by now.

    Heh, not necessarily. Thanks to the service manual, we know that the Wired Remote goes to the uCom chip on the AV board, which I'm willing to wager notifies the Navi about the button press (or press and hold) via the UART (COM2). This is probably done by one of the programs in APL (MainMenu, AV or NEventWatcher, perhaps) which sends a message to the application that is currently running in the foreground. We'd probably need to do some hacking on the event dispatcher to do the remapping, the knowledge required is held by a few members here (carver most likely, I'm still working on getting my ROM image cooking skills at the moment).

  3. lucaspeedy,


    You need to copy some files from Testmode 2.3's testmode folder into LeetLauncher 3.0's testmode folder for it to wok with the latest releases of the AVIC firmware. Copy all the 0-length files without an extension (they are named like "45487613469745412354668745684665", etc) from Testmode 2.3's "testmode" folder into the LeetLauncher 3.0's "testmode" folder and it should boot. These files are like keys the firmware looks for before it will let you enter testmode.

  4. Thanks, I tried the download but unfortunately the rar file seems to be corrupt (when I attempt to extract is came up with a crc error).


    Huh, so it is. Luckily my copy is still OK, I'll attach it to this reply.


    My F900BT is a new unit only purchased this month. Is it possible that the latest units from Pioneer have had the testmode hack blocked by pioneer?


    If it's a more recent version, perhaps. What firmware version do you have (I think it can be found under Settings->System Settings->Service Information). Mine's 3.020100 (UC) and Testmode 2.3 works fine for it.


  5. Sounds like the AU testmode was based upon an old Testmode release. Make sure you use Testmode_2.3.rar (download/file.php?id=8932). It has a single folder called "testmode" that you put in the root of the SD card. That folder has some 0-length files with names like "164C549550B84211BA8C4B84AC5C0081". These files are the "keys" the firmware looks for to know you're allowed to boot into test mode. When a new version of the firmware comes out, one usually needs to determine what the new key file's name is an add it to the test mode folder.


    EDIT 2010-01-18: Uploaded my copy of Testmode 2.3 which didn't have the CRC errors on CEcmd.exe, updated the links above.

  6. Any luck getting this going? I've been trying to reverse-engineer carver's instructions on how to carve up the WINCEIMG.BIN into toc.bin, eboot.nb0, chain.bin and wince.nb0 files so I can use 3.0 in the emulator. I think I've got the four files created right but the emulator doesn't like wince.nb0. Also tried the same process on a 2.06 WINCEIMG.BIN (following carver's instructions in viewtopic.php?f=34&t=25385) but the emulator didn't like that one either.


    Has anyone successfully extracted nk.bin out of a WINCEIMG.BIN?

  7. Not hi-jack this thread, but did you try adding this to sys.txt:






    This will be my last post in this thread regarding this. Sorry Alex

    Not yet, but in Alex's defense: I just put the F90BT on my desk back to stock versions (data.zip, sys.txt, etc) and deleted all user save data. Rebooted, and the AV.exe clock went an hour ahead even with my timezone set manually in iGo's (didn't do this w/ 2.006). Looks like it's a bug w/ the way iGo 8.3 sets the date/timezone when it gets a GPS lock to me... Especially since I can go do this:


    • [*:1reesinh]Start in Settings->Navi Settings->GPS & Time Settings
      [*:1reesinh]Set to Auto timezone (and swear under breath that the damn thing thinks I'm in Idaho now)
      [*:1reesinh]Back out one screen to Navi Settings
      [*:1reesinh]Go back into GPS & Time Settings and reset to timezone to Manual
      [*:1reesinh]Go back out to map, see right time
      [*:1reesinh]Go to AV screen and now the time is correct!


    /me points finger at NavNGo and Pioneer.

  8. Regarding the times not matching the IGO screens as opposed to the AV (win ce) screens, try booting in safe mode, go to control panel and change the time zone there. See what happens. I seem to recall something similar about a year ago with other users.


    Just a note that I've got the same behavior, and I already tried setting the OS timezone through a different process (this is w/ Diaftia's 10/10 release). I used a mod I made to Diaftia's Settings->Navi Settings->Run menu to launch Explorer without needing to boot into test mode. Brought up the Date/Time control panel, there was no time zone selected (drop-down was blank) and the time was an hour ahead of what it should be. Fixed the timezone to Pacific time which automatically set the clock correctly in the taskbar and in the APL\ apps (AV.exe, etc) when I hit Apply. I have to manually select my timezone in iGo already (I've got the "Oregon means you're in Mountain Time!" bug) so not sure if there's something in the startup flow of the data.zip or not.

  9. On my Blackjack II, I think I had to pair the phone first and make sure the Serial Port service was selected under the Windows Mobile Bluetooth connection settings for the Pioneer Navi. So first go through the process of adding the Pioneer Navi to your phone. Under the Advanced settings, make sure the "Serial Port" service has been checked too.


    Steps to transfer the phonebook:

    1) Select "Phone Book Transfer" from the Phone menu

    2) Select OK on the first dialog box (some info or warning, I forget)

    3) Select OK on the "Send Business Card" dialog box, don't bother sending a business card over Bluetooth

    4) Wait at the "Now loading data..." dialog. It will take a while to copy the data, but it's copying over your phonebook at this point.

    5) Once you see the "Completed dataloading!!" dialog, your phonebook should be transferred.


    Now you can use the phonebook editing software mentioned on the other thread (or SQLite3 directly) to remove entries you don't want in the unit.

  10. Hmmm, if you have a way to remove the link, then you must have an idea where the UI for the AV/MAIN menu is. Can you tell me where to find it, as I have spent countless hours going through files trying to find the ui for both the AV screen and the Main screen

    More than likely the AV UI is in the APL\AV.exe and APL\AVRes.Res files and Main Menu UI is in APL\MainMenu.exe and APL\MainRes.Res, with both pulling image data from APL\Image.Res. Both are independent executables from APL2\iGo\ezrider.exe and APL2\iGo\data.zip. ezrider just posts messages to both via commands in the scripts like this one:

    ;send message to mainmenu
    	EXEC "other.pioneer.postmessage" "MainMenu" "WM_APP_AV_IGOMAP" 0


    If that command wasn't captured right by MainMenu, then that's when you end up with the "System Startup In Progress" message stuck on the screen (I think it's drawn by MainMenu) over the top of the other apps. In a similar fashoion, AV.exe draws the Now Playing/Source Icon over the top of the iGo map when you're navigating. So if IDT had found the right messages to post to AV.exe to make it hide, then it won't draw on top of the map. But it also sounds like it won't expect to listen for the button press to indicate Voice Rec is active (notice how VR only works when certain Pioneer APL\ apps are running and on-screen? Probably the same reason...).

  11. So we cant just use the windows CE 5.0 version of the driver then?

    Haven't tested it yet but I'm pretty sure we can use their driver. The "install" process has to be redone every time we reboot the system though. This is due to the fact that the DLL, .ini and registry entries are not part of Pioneer's WINCE.BIN image, so it's not in \Windows after the reboot and must be copied off the flash drive as part of a scripted startup process.


    Vag-Com is not on windows CE, They have never ported it so we are stuffed there.

    For now, anyway.


    How about running a virtual machine on CE, Or am i pissing into the wind here.... :lol:

    Hmmm, not aware of any virtual machine monitors designed for CE since the ARM/OMAP cores CE runs on might be a tad underpowered for the task. Now if VAG-COM was a .Net app, maybe using the .Net micro framework on the AVIC would let you run it.

  12. You'll likely need to use MortScript to help copy the FTDI driver DLL and .ini to \Windows and install the registry entries they outline in the "INF Files/registry settings.txt" file inside the driver. You should be able to call this script when the system starts up each time so driver.exe knows how to bind the driver to the USB device when detected. Once that's done and the FTDI chip's virtual COM port is available, it's a matter of getting the VAG-COM software working in the WinCE environment. I'm not sure if Ross-Tech ported the software to WinCE or not, I've only ever seen it on a Windows XP box. I've got a OBD-Link (next gen ElmScan dongle) that uses an FTDI chip too, been looking at the source for Scantool.Net to see if it would be relatively easy to port to WinCE...

  13. At this point no one has found a way to change major features/layout of the "skins" of any of the Pioneer applications (tel.exe, av.exe, mainmenu.exe or settings.exe, i.e. the ones in the APL folder). Only a few hex edits to the .exe/.dlls to disable messages or enable features and modifying the contents of image.res to change icons/colors have worked so far.

  14. I'd be shocked if they didn't have some way to inject the GPS coordinate data into iGo via emulation, maybe they can collect some location and hysteresis data from one of our units and replay on a development unit or emulator... Interesting thing to note is that running TomTom and Garmin under Testmode, I had no trouble with the unit setting its timezone correctly. Still think this is pointing at problems with their iGo implementation (either a bug in ezrider.exe, the data.zip's multi-timezone support or the map data they used).

  15. azux's answer: R3 (iGo 8.3) maps will only work with 3.0 firmware + hacked ezrider.exe + license. 2.009 only has iGo 8.0 (R1) support, there is no way to use R3 maps with 2.x series firmware.

  16. These files should be 0-length, the file names act as a "key" for your version of firmware to OK entry into testmode (usually one key per release version, but they're all here so the release works with multiple firmware releases). When Pioneer releases a new version of the firmware, usually a new one of these files is required before we can enter test mode again:










    These files are under the testmode folder:

    CopyTool.exe     Really a renamed copy of MortScript.exe, called by NNtestmode.exe, runs
                    CopyTool.mscr script 
    CopyTool.mscr    Script that executes commands to create icons on the desktop for programs in
                    testmode\Util folder
    MortScript.exe   Scripting engine
    NNtestmode.exe   Command executed by the AVIC when entering testmode


    These files are under the testmode\Utils folder:

    AYGSHELL.DLL    Support DLL
    cecmd.exe       Midnight Commander file manager
    commctrl.dll    Support DLL
    coredll.dll     Support DLL
    DiskRW.exe      Tool that allows one to backup and restore the SDMLC and flash disk,
                   search for carver's posts on the topic.
    ResInfo.exe     Resource information program, shows processes, memory, etc.
    Restart.exe     Reboots the system
    TRE.exe         Registry editor

  17. What might be happening is without the .exe that initializes communication with the uCOM on the AV board (due to empty flash disk) the reset watchdog's timer expires and it resets the Navi because it thinks it's stuck.


    If you don't have enough time to copy the APL folder from your My Flash Disk backup back over to the flash drive before reset, there might be another option. If you've got Testmode 2.3, there is a file in the "testmode" folder called CopyTool.mscr. It's a script that gets executed by the CopyTool.exe (really Mortscript.exe that's been renamed so the AVIC executes it to enter testmode). You can edit CopyTool.mscr to add instructions to copy at least the APL folder over to your flash disk so that the uCOM init (I think it's called "initucom.exe") command gets executed which will reset the watchdog timer and thus keep you in testmode until reset. Use the XCopy command in your CopyTool.mscr file:


    XCopy( source files, target directory [, overwrite?[, subdirs? ] ] )


    So I think the command will be (assuming there's an APL folder in the root of your SD card:


    XCopy( "\Storage Card\APL", "\My Flash Disk\APL", TRUE, TRUE )


    Good luck.

  • Create New...