RonS

I have posted in the Z series Hacks & Mods a Nag Screen Removal hack that should work for the F series 2017 (v7.0) firmware.

Do not do this hack before installing the 2017 firmware on your Nav unit.

http://avic411.com/index.php?/topic/83542-2017-v70-nag-screen-removal-z-x-and-f-series/&do=findComment&comment=345037

For those who have installed the 2017 release (v7.0), here is the Nag Screen Removal hack. Requires  supertestmode.zip (unzip it; copy TESTMODE.KEY to your FAT32 SD). 

This should work for Z110, Z120, Z130, Z140, X920, X930, X940. It should also work for F-series comparable models and likely others that have v7.0 firmware.
 
This is dangerous - especially for noobies. Make a backup of any files you change - in fact making a backup of all files under \USER is a good idea. Keep the original file(s) until you are sure everything is working correctly. It is very easy to accidentally delete files or whole directories in TestMode. Copying and Pasting files is a real PITA and is very error prone. I recommend watching the YouTube video by JasonH on using TestMode (even though he calls it HackMode for historical reasons). Do not install Hackmode!
 
Note: Install the 2017 map update before installing this hack. Do not change the file on the 2017 installation SD. If you do, the installation will fail. You will get the dreaded "Wrong SD" error.
 
Note: I have no way ATT to verify that the F series NAVI.EXE is the same binary, so it would be helpful if someone could verify the bytes below are correct at that location. If not, more research will be necessary.

1. Patching the NAVI.EXE file

Make a copy of the NAVI.EXE file on the 2017 update SD (in \UPDATE\USER\PRG\APL) to patch.
 
Then using a hex editor (such as HxD):
  at offset 0xBEC18  
  change 05 00 00 0A   to   00 00 A0 E1
and save the file.  HxD also has a binary file comparison that can  be used to make sure that only the above 4 bytes were changed.

2. Installing the Patched NAVI.exe 
Use an SD with TESTMODE.KEY and the patched NAVI.EXE on it. With your headunit turned on, insert the above SD. It will boot into TestMode.
 
Go into File Maintenance.
 
First, you need to identify the "active" set of files. There are two \USER\PRGx directories on your HU. The active one is indicated by the presence or absence of a file named \USER\PRG.FLG  If this file is not present, the active application files are in \USER\PRG0\APL. Otherwise, the active files are in \USER\PRG1\APL. From now on I'll just call it the Active directory.
 
The goal is to replace the Active NAVI.EXE with the patched one using File Maintenance. Since TestMode will not allow you to overwrite an existing file, you need to delete the one already there.
 
Using TestMode, go to the Active directory and delete NAVI.EXE. Then go to the SD and select the patched NAVI.EXE and select Copy. Then go back into the Active directory and select Paste. It might take a minute to complete.
 
Then remove the SD and reboot your head unit. The app should start and allow you to see the map without presenting the annoying Nag Screen.

On 8/19/2017 at 4:50 AM, ric90 said:

Hello guys but this update is also good for the F-series?

This isn't an update. It is a hack to existings files on your unit to bypass Pioneer password verification during the update installation.  It should also work for many F series. I believe it was actually developed for the F series. At least WinCE based units since around 2009.

Thank you very much RonS but I do not find a recent update. I have a pioneer f840bt. Can you tell me where to find a recent update? Thanks again

I don't follow the F series but I see where the 2017 maps will soon be posted by godzilla.

I downloaded this update and I got the car locked at the end of the update asking me to insert the correct sd. Please help me?

Once in testmode:

-go into file maintenance

-Delete the file USER\SYSTEM\Download\StartKnd.log

This will kick the unit out of upgrade mode, and should restart into regular mode on next power up (remember to remove the TestMode SD).

Next time don't install 4 yr old software when an important file is missing.

This is how to hack the update once the new maps are here.  While not as easy as the pionara hack to VERINFO.DAT, this hack works for the EU 2017 maps. Map Update Hack using ShortFuse method - Z110-Z140;X920-X940 allows installing without registration on Pioneer's web-site. 

This is a hack to prepare your unit to install a map/firmware update. Confirmed to allow firmware updates for all Z110, Z120, Z130, Z140, X920, X930, X940 - and probably their corresponding rest-of-the-world units. I can't say whether it will work with the very old units, and it won't work with the model numbers ending in 50 or greater,  or Nex units. 
 

This should work with the following F series models:

F10BT, F20BT, F30BT, F40BT, F840BT, F8430BT, F920BT, F930BT, F940BT, F9210BT, F9220BT, F9310BT

Abstract:
This was an early method used to hack map update releases. I believe it was published many years ago by member ShortFuse. Use this hack to allow installation of new update releases without requiring a unique password from Pioneer (which binds the update's unique media serial number to a specific headunit's serial number). It involves patching a DLL on the headunit prior to installing the update.

UPDATE: See  Easy method  for an automated installation of a pre-hacked file. No Testmode or hex file editing needed. I'll leave the rest of this original post here for educational purposes. If you use the script method, steps 1 - 4 below can be skipped. But read 5 & 6.
 
I only recommend this hack for those experienced with modifying/hacking their AVIC units. It requires familiarity with use of TestMode to copy/paste/delete files on your headunit. TestMode's user interface is not intuitive and very frustrating and error prone. I recommend watching JasonH's youtube tutorial - but do not install Condi's Hackmode. Just  download supertestmode.zip; unzip it; copy TESTMODE.KEY to your SD; insert in your headunit. I also recommend making a backup of all the files/folders on your headunit in the USER folder before trying anything. Put that SD away and keep it. If you brick your headunit with no backup, I won't be helping you. Let me be clear here. The danger isn't that this hack will damage your unit. The danger is that you will inadvertently delete something important using TestMode. If you use care it is perfectly safe.
 
1. First Boot into TestMode.
 You'll need to identify the "active" set of files. There are two \USER\PRGx directories on your HU. The active one is indicated by the presence or absence of a file named \USER\PRG.FLG  If this file is not present, the active application files are in \USER\PRG0\APL. Otherwise, the active files are in \USER\PRG1\APL.  Upon further research I see most people using this hack say to use the USER\PRG0\APL file. From now on I'll just call it the APL_Directory.
 
2. Get a copy of APL_Directory/RenewallFlib.dll.  If you still have the files from the last map update installation, you can also get it from there. Actually I don't know if it matters where you get the file. Copy it to an SD and then move it to your computer.
 
3. Using a hex file editor (like HxD.exe) apply these changes to your copy of RenewallFlib.dll. Using HxD.exe - when using Find or Replace make sure you set to it to Hex Values. It defaults to String data type. Also, put spaces between the hex bytes (a byte in hex has two numbers....03 50 A0 E3).  (Note: if the expected values are not found at that offset location, do not continue - your firmware is not compatible). See Alternate Patch Method below.

• Offset 000019F0:  0350A0E3 replace with 0050A0E3
• Offset 00001A10:  0350A0E3 replace with 0050A0E3
• Offset 00001A3C:  0350A0E3 replace with 0050A0E3
• Offset 00001AD8:  0350A0E3 replace with 0050A0E3
• Offset 00001C1C:  0250A0E3 replace with 0050A0E3
• Offset 00001C24:  0150A0E3 replace with 0050A0E3

IMPORTANT - do not modify the file on your new map/firmware installation SD -  this will cause the installation to fail. Use a different SD with Testmode.key and the patched file.
 
4. Copy the file back to your HU into the same APL_Directory. Hint: you must delete the old one before you can "Paste" the file back. TestMode silently ignores overwrites. 
It is a very good idea to keep a copy of the original file. This DLL (library) only gets used during firmware updates. 
Edit: It wouldn't hurt (and might help) if you copied the modified file into both APL folders (\USER\PRG0\APL and \USER\PRG1\APL). This way you are sure the hacked DLL will be used.
 
5. Install the unmodified map update. (see separate thread for map updates and instructions)
When you are ready to install a map update for your supported AVIC model, just restart your head unit and insert the map update SD.  With the "ShortFuse" hack installed on your head unit, the update will work as described in the release documentation. When prompted for the password from Pioneer, the password you enter will not be validated in the normal manner. I suspect you could enter anything that is 16 characters long but I recommend entering PASSWORDPASSWORD just because I know that works. If the update software rejects that password, you did something wrong.
 
6. If the map update fails to complete and you are stuck with a wrong or incorrect SD message:

• boot into testmode. 
• go into file maintenance
• remove the file USER\SYSTEM\Download\StartKnd.log

This will kick the unit out of upgrade mode, and it should restart into regular mode on next power up (remember to remove the TestMode SD). You should still be running with your previous firmware and maps.
 

Enjoy!
 
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// 
Alternate Patch Method.
There are multiple version of the RenewalIFLib.dll file. For some the offsets of this patch could be slightly different. In that case, try using this method.
 
Using HxD (hex editor), load up the RenewalIFLib.dll file you copied from PRG0\APL
Enter the Search/Replace dialogue and make sure Datatype is Hex-values[/size]
Search For: 03 50 A0 E3  Replace with:  00 50 A0 E3
In Search Direction select All
Then click Replace All
You should see a dialog box saying Replaced 4 occurrences of "03 50 A0 E0". Press OK.
 
Now, the fuzzy part. Search at or nearby these addresses and replace:

• At or near Offset 00001C1C: find 0250A0E3 replace with 0050A0E3
• At or near Offset 00001C24: find 0150A0E3 replace with 0050A0E3

If the above worked, save the file and continue at step 4 above. If not, something is wrong. Do not save the file.

Thought I'd post the Installation/operation manuals and info on the two 2017 updates (v7.0 firmware). I recommend that everyone review them before installing. Also note the specific instructions for upgrading BT from older( < 3.10) versions to v3.32. And as before, it doesn't seem possible to add iPhone Lightning connector support(patches 4.6 or 5.1) after the fact. It must be installed before installing firmware 6.0 and higher. IDK if there is a workaround.

Only Compatible With: 

• AVIC-Z110BT, AVIC-Z120BT, AVIC-X920BT         CDR5009A.pdf
• AVIC-Z130BT, AVIC-X930BT, AVIC-X9310BT, AVIC-Z140BH, AVIC-X940BT    CRD5006A.pdf      

As with other updates, either product can be made to install on any of the above units when used with the proper CARDINFO file.  See post #26 for the update files and see Shortfuse Hack for how to hack you unit prior to installing those files.

Any ideas?

When this is happening try going to Settings/Navi Settings/Connection Status. If the wired parking brake bypass it working, it should always say On.

If not, sounds like a loose wire somewhere. Sometimes moved pins in the harness aren't fully locked in place. Or a bad ground or pinched wire. Lots of possibilities.

But before tearing everything apart, try a hard reboot by disconnecting the battery for a couple minutes.

I just bought the maps. I need to find a z/x series unit to read them though. I only have a NEX unit now

I'm curious why you are doing this? You have no vested interest in getting it working. Do you get contributions to more than offset your out-of-pocket expenses? For these older units, it may take a long time to break even. There doesn't seem to be much interest.

Did they post the details on how the last one was cracked? Is it just the verify file? Can you pull these files through the USB cord like the x850 seireS?

I heard somewhere that the F-series 2017 updates are still using a plain old FAT32 formatted micro-SD. So no trouble copying it using a PC.   I guess the firmware on the older units precluded them from using something fancy.  Not like the 2016 z150/x850/x950 update which apparently used a non-standard format. Off topic but I wonder if that was a linux format like ext2/3/4. Might explain why a PC couldn't read it.

So it should just need a hacked VERINFO.DAT.  I have no idea what pionara did to hack it last time. Maybe comparing an original and hacked version might give a clue. 

I am using Windows 10, i managed to get updatemrz99.zip  but not mrz09.zip and from dzo's post i think i will be able to change language on the mrz09. i want to change background image to something darker as i have eye issues but am not able to open image.img image to change the original background image before i patch the system. Any idea on what software i can use, or should i get a mac computer to open the image?

No. Mac's have been known to have problems with some Zip files. That is why I asked.

I can't help with what  you're trying to do - just telling you there's nothing wrong with that mrz09.zip file.

need a new map 2017 for x940bt if anyone has please upload.

Or you could buy it and upload it. BTW, there's already a pinned thread on this - I'm merging them.

Hi guys

 

I have been trying to download the zip for MRZ09 but cant, its giving me an error and when it downloads the zip wont open i think its corrupted. Could somebody repost the zip please.

Hmm  . . . And I was just thinking yesterday I should list my 120BT on CL and buy the NEX 8000. Maybe I'll wait a little bit longer. I bought a new cell LGv20 and when I connect it to the unit over BT the music plays through the phone but I can still go to the next song using the unit. BT firmware says 3.32. If I unpair the phone then register it again it works like it should. It's a pain in my ace.

 

   That is the reason I was checkin out avic411, to see if the 120BT was getting any more map/bt updates.

This release still comes with BT 3.32. And the documentation doesn't seem to indicate any functional differences from the 2015 v6 firmware. So I wouldn't expect it to solve your problem. Still, new maps might make the unit more salable on CL. AFA your specific issue, lets not get sidetracked from the topic of this thread.

I've had the Z120BT installed in my truck for 4 years, and a month ago I had my dashboard replaced due to cracks.  When I got the truck back, the time was behind by 10 minutes.  I can't seem to find any way to adjust the time, and not just the time-zones.  I tried disconnecting the battery to see if that would do the trick but nothing.  Has anyone seen this?

Since we can only set the time offset in hours  and whether we use DST, I think it gets its time from the GPS satellite signal. Does your GPS still work - or maybe you haven't been in line-of-sight of any satellites long enough to get a "fix"?  Just wondering if the GPS antenna got disconnected when the dash was removed.

Im going to buy the update and share like i did for the x series. Hopefully we can inject the same maps but just swap the .cif file like on the 2015 updates. PM me your contact info if you want to partner on this. I dont have an X or Z model anymore so I need to find a doner one, or one on ebay for cheap to read the files

Well, it would still need to be cracked. We're assuming that they didn't change the installation process (which was easily hacked in prior years).  I doubt if the hacked VERINFO.DAT file from 2015 will work here. It is version-specific. So someone with knowledge of that file will need to modify it (bypasses the installation password checking).  

We'll also need a Cardinfo.cif that works on all models, or get one for Z110,Z120,X920 and one for Z130,Z140, X930, X940.

Heads-up!
I saw the following message on http://www.navigation.com for the Z130BT, Z140BH, X930BT, X940BT only.

"PLEASE NOTE: This product is currently out of stock. The new 2017 product will be available for purchase on July 26th. Thank you!"

Nothing shown for the earlier models (Z110bt,Z120BT,X920BT). I have a feeling we are being abandoned by them.
 
Note: I posted the same message in the Z series forum.  No info yet on hacks to bypass the installation password or any other mods.  The F series guys usually are ahead of us on finding hacks, so keep an eye over there.
 
Please post all discussion Here to consolidate both X and Z series issues.

Heads-up!

The Navigation.com website now has the new 2017 maps for Z130BT, Z140BH, X930BT, X940BT and for earlier models Z110bt, Z120BT & X920BT. http://www.navigation.com

I suggest reading the installation instructions found on the above website before installing. 

Note: I posted the same message in the X series forum and requested that they post any discussion on this update here.  The F series guys (which use the same firmware but EU maps) usually are ahead of us on finding hacks, so keep an eye over there.

Didn't know there was 2015 maps or where to get the patch. And I've been trying to figure out how to zoom. I looked in the manual but all I saw was something about turning on the option to automatically zoom out.

They call it "map scale" in the manual.  See image below.  Setting to .1 mile will give the most detail but may be too close-in for you. Try pressing '-' to gradually zoom out enough for your needs.

There's threads on the 2015 US/Can map update in both the Z and X series forums. The same update works for both. They are long threads and much obsolete info is at the beginning. You might want to start at the end and work backwards.

Let me start by say hi, first post etcetera etcetera. Recently bought this unit off craigslist since I just got a new car and am too poor to few a new one. I've been into car audio since the 90s, my last car had an 80prs in it running active, but this is my first touchscreen nav setup.

 

Anyway I used the how toos on here to update the thing with 5.00 and the 2013 maps. My issue is the only roads showing are interstates and freeways near me. I know its not the gps because it has a strong signal and at the bottom of the display it reads the name of the streets I drive down. I just can't see them. I tested turn by turn by entering an address and they popped up to show my destination, but I didn't actually follow it just canceled. In the morning I'll set it for my drive to work & see what happens. It'd just be nice to see the road I'm on when I'm driving around without needing directions.

 

I figured this was the best place to ask something so specific, anyone have any advice?

Zoom-in more. Is there a reason you didn't install the 2015 maps (the latest for the Z and X series).

The only way that makes sense is if your wiring is totally messed-up. Start with checking the Mute wire, backup wire, and parking brake wire. Was this a used unit? The previous owner may have moved the mute wire to do the Parking Brake Bypass. 

Do you have steering-wheel controls connected?

BTW, please stop spamming the same post. Your questions won't get answered any quicker.

TestMode is much safer and easier to use than Hackmode - which installs and modifies your system. Sometimes the install goes awry, leaving your unit unable to boot.

To get into TestMode on most X and Z series units, download this file supertestmode.zip to a PC, unzip it, put TestMode.key on a FAT32 formatted SD, and insert it in your unit.

IFAIK this file doesn't work on  x950 & z150, but if it does, or someone knows one that works - please post to this thread.

Does anyone know the password to open the "HACKMODE.KEY" file? The "AV.EXE" file password is avic411 but then it askes me for the HACKMODE password and its not the same. Btw, Im on a Mac if that matters.

No, I don't. Save yourself much grief = don't  install Hackmode.  It can brick your unit. Use Testmode instead. Once you get into File Maintenance, its the same process.

To get into TestMode on most X series units (except x950), download this file supertestmode.zip to a PC, unzip it, put TestMode.key on a FAT32 formatted SD, and insert it in your unit.

TestMode is much safer and easier to use than Hackmode - which installs and modifies your system. Sometimes the install goes awry, leaving your unit unable to boot.

To get into TestMode on most X and Z series units, download this file supertestmode.zip to a PC, unzip it, put TestMode.key on a FAT32 formatted SD, and insert it in your unit.

IFAIK this file doesn't work on  x950 & z150, but if it does, or someone knows one that works - please post to this thread.