bushing

This screen? This means the internal SD card can't be read:

Come on, if we're going by how much this stuff is worth doing now ...

Hi guys! I already have the apk / odex files disassembled to .smali, I can share them if anyone else wants to look at them Sofakng, yes, I have some background in EE, glad you like the blog posts! I have a crafted "update" that you can apply using one of the test modes that can patch the PLCaution nag screen out. It also offers a couple different ways of backing up your internal SD card to external USB or SD; you can use a built-in EasyRecovery mode to re-image the internal SD without opening up the case (or you can use the image to restore the internal card manually if that doesn't w

Yes, I did try going back from the "SET ON" message. Someone with more practice reversing Android apps could probably find this in five minutes, let me know if anyone wants the APK / ODEX ... But if I'm doing it on my own, here's what the layout for the AV "Off" screen is (when you're in the AV screen, but all sources are off) -- http://pastie.org/private/z0brsx08glku0erwteuvg After staring at that for a while, I boil that down to <CTL_Control_ViewGroupBase layout_width=fill_parent layout_height=fill_parent> <CTL_Control_ImageViewBase width=267 height=144 marginLeft=63

Yeah, the SD card password just isn't useful for most people because it's pretty difficult to use -- and I'm not even sure it's the same for all units! More useful would be a dump of the SD card, because any(?) system will boot an unlocked card; I can't release my image, but hopefully I've provided enough information for someone else to reproduce this and post an image. No need to "root" the thing, it's pre-rooted, if you can manage to turn on ADB or find the correct serial port and enable it (I believe that both of these are possible by pressing hidden buttons in the display, much like t

Possibly; there's a lot of parts missing on my 5000NEX compared to the most expensive models (e.g. HDMI input, internal (visible SD slot), CAN bus interface of some sort? What specific features would you like to try "upgrade"? Thanks for the kind words! Sometimes you just need to find a project that annoys you enough to make it worth the time. This counts, for me. In principle, there's nothing keeping us from rooting these boxes, though more research is necessary to figure out how to e.g. enable ADB. (There seems to be a hidden debug menu that will allow this, but I haven't

I'm doing a bit of reversing of my AVIC-5000NEX with the goal of eventually making my own update that disables the nag screen. I'm still quite a ways away from that, but I wrote up a blog post that some of you might find interesting.

I have a lot of fun plans for this one --- plans made significantly easier by finding schematic and service info for the NEX series. Hell, I found the Avic-D1 manual several places, and with a bit of digging I found complete schematics and partial source code for the AppRadios on GoogleCode (wtf?!?) Any suggestions?

I also tried replacing struct_0 with struct_0 ... and same result (freeze).

Great! Time to pick this back up, then. I put some updated files (disassembly, etc) here: http://people.freedesktop.org/~bbyer/av ... 07.lst.bz2 I'd like to draw your attention to this table of function pointers: 08C27B40 unktable: struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 There are two other similar tables (0x8c2804c, 0x8b4eda0), but I can't find references to the first two, only to the latter (TaskTable). I experimented bef

Sorry, i've been busy, but I've had a number of requests for this, so here ya go -- from memory. Getting into the Service mode on AVIC-D1 (and D2?) 1. Turn car on, AVIC unit should power on. 2. Hold down OPEN button so that the panel flips down all of the way (as if you were going to replace the Map DVD 3. Using a paperclip (etc), press the Reset button on the LCD panel -- this is inside a small hole next to the directional (joystick) control. Hold down the button. 4. While holding down the reset button, press the DVD drive Eject button (the lower of the two eject buttons, it says "RO

Okay, I'm pretty much stuck here, so I'm posting what I have so far in the hopes that someone else might be able to get further. The "Application" code is contained on the DVD as EU050APL.PRG, and it references strings in the file UC050DAT.USA. http://people.freedesktop.org/~bbyer/avic/eu050apl.prg http://people.freedesktop.org/~bbyer/avic/UC050DAT.USA A parsed version of the strings file is here: http://people.freedesktop.org/~bbyer/avic/UC050DAT.USA.txt That was produced with this program: http://people.freedesktop.org/~bbyer/avic/parse-dat.c In order to modify either

Thanks If you scroll back up to http://avic411.com/forum/viewtopic.php?p=25112#25112, that's one of the strings in UC050DAT.USA; the "hard" part was finally figuring out the checksum so that it would actually let me reflash that file using the service menu. (If you don't fix the checksum, it will try to reflash, but it will tell you it failed, and it will refuse to boot until you insert a DVD with a valid copy of that file, which it will then reflash.) I'll post the checksum program in a bit, but what I'm really trying to do is patch the code (in EU050APL.PRG) to skip the screen entirel

I've still been working on this, off and on for the past few months. I wrote a V830 disassembler plugin for IDA Pro. While it's not perfect, it works well enough to disassemble most of UC050SYS. I believe the code that verifies the checksums is in there, but I haven't been able to figure out where. Does anyone here read assembly? I'd be happy to email my partial disassembly...

All I get is garbage at 0x1000 -- 0x1200 looks more promising. (we're talking about UC050SYS.USA, right?) BTW, I'm not sure if there's a difference in the instruction sets, but the chip in the AVIC-D1 is a "UPD705103GM-180S1". I can't find a datasheet for that anywhere, but I did find one for the UPD705102GM (aka NEC V832), which at least has an identical pinout to the one in the unit. http://www.necel.com/cgi-bin/nesdis/o006_e.cgi?article=UPD705102

It looks like they're 0603 LEDs (so the same size as the Nokia) ones, and there are 21 green ones and 4 blue ones. Maybe someday when I'm feeling stupid I'll try to swap out the green ones for red. (I, too, used to mod Nokia phones ) -b

I'm starting to see "pre-release" CNDV-70MT discs on eBay. Anyone know if these are legit? Anyone wanna go in on a copy to be seeded? -b

Probably not until someone figures out the checksum. Ok, you're right -- there is a checksum. I tried editing UC050DAT.USA and reburning it, then used the service mode menu to force-update the application flash. It worked, but when the unit restarted, it said "beginning program update", tried to reflash (again) off the same DVD, said that the update was corrupt, and then rebooted -- I had to eject the DVD to get it out of a loop. (Maybe this isn't news, but) I think the checksum is the last 16 bits of the file. Here's what I make of the header: 0000000: a55a 5aa5 7300 0002 55

What would you recommend for a bit? This is the best picture I could find: My car is like that, but without the horizontal piece that the yellow arrow is pointing to. Behind it, you can see a black vertical plastic piece that it hooks into, with an oval-shaped cutout at the top. I need to cut a notch out of the side of it toward the bottom. I have a cutoff wheel for my Dremel, but I don't think that will work -- I need something that will cut from the front.

Enjoy! AVIC-D1.pdf Mirror:http://www.eserviceinfo.com/downloadsm/28034/Pioneer_AVIC-D1.html

Any hints? I see the plastic piece that needs to ... not be there, and I have an idea of how much needs to be removed. I was thinking of taking an X-Acto blade to it, but the plastic is a little thick. It'd be preferable to take the plastic piece out to work on it, but that requires disassembling the entire dash.

Probably not until someone figures out the checksum. Is there a checksum? (It looks like the last 16 bits of the file *could* be one.)

Nothing too crazy yet -- but I did find the text for the warning message in UC050DAT.USA. String 1424 (offset=4a88): 'CAUTION: This Navi product is intended solely as a driving aid. Review instruction manual and select route before driving. Navi is not a substitute for your attentiveness, judgment, and care while driving or moving your vehicle. Always observe safe driving rules and driving laws, and follow road signs even if they contradict Navi's instructions. By pressing OK key, you accept the license agreement in the instruction manual.' I'm attaching a parsed list of the

I just spent 3 hours swearing at this thing, maybe someone here can help: I'm trying to install an AVIC-D1 into a 2004 Jetta, in place of the existing Monsoon double-din HU. I've read here that it is a tight fit... the best I can do still leaves about 1 cm protruding from the metal cage. After some experimentation, I discovered that it fits perfectly if I remove the IP-Bus cable from the back of the HU -- the one that's plugged into my GEX-P10XMT. Anyone ever get this to work in this car, or have any suggestions? The connector seems to be hitting against a plastic support piece.