bushing

...I seem to be the only person interested in doing this.

 

nope.

 

The OS loader starts around 0x1000. I can disassemble there no problem. Another chunk starts at 0x1200. It's using the NEC RX OS. I'll attach some of the documentation I've found so far and the disassembler I'm using.

Thanks for posting the instruction set documentation -- I'm going to try to write a V830 processor module plugin for IDA Pro, and will be happy to share my results. (There was talk on a thread on another board (http://cl.acurazine.com/forums/showthread.php?t=169301) that mentioned using IDA Pro, but as far as I can tell it was in error -- the latest version does NOT have support for this chip.)

FWIW, the service manual for the D1 breaks the files out as follows:

UC050BOT.USA: Bootloader

UC050SYS.USA: System Software / OS

UC050GPS.PRG: GPS firmware

EU050APL.PRG: Application code (loaded into SDRAM)

UC050DAT.USA: Language data

Any one know where we can find that bootloader, and does anyone know where the nag message is stored? (as a bitmap, as text?)

-b

Nope, it's a pdf you can download. The AVIC-D1 manual is 33mb, 276 pages, very interesting.

For example, it turns out that the pin we ground to bypass the lockout is identified as "KMODE", and there's a note that says 'K mode is for develop [sic] use. K mode status must be "OFF" for normal operation.'