condiczek

There is SETEXEC with something called ScriptFile. Again, tried pointing it to another script or executable.. nothign happened that I could see..

It somehow works.

In first ScriptExec.ini:

SETEXEC otherone.ini

in root of sd I created otherone.ini with some ECHO.

First script done. then on every reboot it will run otherone.ini!

Not once, on every reboot.

Good job there Condi

thats nothing, Pionara is the one, who made a goooood job

RenewalIFLib.dll - now its easier then ever

http://avic411.com/i...o-replacer-v10/

I'm very confused, there is a different password for the HACKMODE.KEY file. It keeps asking and I'm using avic411 as the password and it just says incorrect. How do I get this file?

try to unpack with 7zip.

guys - people who downloaded 4 times - please REDOWNLOAD again v2.0!

accidentally I've uploaded not the proper version

now the file is the correct one

A little, handy utility, fully automatic which will replace RenewalIFLib.dll in your device

to one which you will prepare on root of SD.

No need to manually delete, copy, paste, delete, copy, paste in testmode,

all done AUTOMATICALLY in few seconds

Should work just great combined with new map update

1) UNPACK FILES TO ROOT OF SD,

2) COPY RENEWALIFLIB.DLL TO ROOT OF SD,

3) ..AND PUT TO DEVICE

Changelog:

v1.2:

- should work with SD and also with USB,

- making backup of existing dlls.

BR

condi

RenewalIFLib-AUTO-REPLACER v1.1.zip

RenewalIFLib-AUTO-REPLACER v1.2.zip

sure

yep 1st automatic version is up

btw i've got f30bt with f40bt firmware device

anyone other got it also?

it was hard to get to work update from z140, but only fw update, not the maps

edit: what I need is a spare x920 or z110 that I can play around with to speed up my development/testing cycles. It's a very slow process of trying something then taking it out to my car and going back and forth. I don't want to pull my radio out of my car, as I can live without tunes!

yeaaah I know what you feel

made that way all the hackmode versions and all the experiments, many many hours in car, even after midnight lol

now i've got my avic in my home, its very handy now to test something new

Comp - compare?

Setexec - maybe a command to execute another script inside existing one?

Have you tried to copy for example Explorer.exe to Windows with - rc?

You are the maaan!

Now i can make condi hackmode fully automatic installation !

edit:

got script ready, gonna test it today evening, avic is now being disassembled

edit2:

avic in my car, but on the front seat

tried to write some file to windows dir, unfortunatelly there is probably some extra function for it..

TST_ScriptCmdBase.cpp :> if we could see details of that error, maybe there would be some hints.

the full answer is in (unfortunatelly encrypted) script from 7z patch...

just checked your final script, work just fine on f30bt with old v3.00 testmode PLT. "for developer"

gonna keep on testing the new possibilities..

looks like that last field is 020 chars:

02010020301122334400

 

I'm guessing thats a decryption/encryption (or obfuscation) key for ScriptExec.ini plus some extra zeros?

Now to figure out how they are doing encryption...

Maybe Alberti Cipher's 20 character Latin alphabet? lol

#!/usr/bin/perl
my $filename = (shift);
open(my $fh, $filename) or die $!;
binmode($fh);
my $cnt = 0;
while ( read($fh, my $byte, 1) )
{
$byte = ord($byte) + 0x14;
$hexx = $hexx . chr($byte);
}
$cnt++;

$hexx =~ s/(.)/'FF00'.sprintf("%x",ord($1)).'00'/eg;

open FILE, ">!ENCODED_testmode.key" or die $!;
printf FILE pack 'H*', $hexx;
close FILE;

print "\n\n\nEncoded TESTMODE.KEY: \n\n------------------------------------------------------------------------------\n";
open(BINN, "!ENCODED_testmode.key");
print <BINN>;
print "\n------------------------------------------------------------------------------\n\n(saved in '!ENCODED_testmode.key' file)\n";

close $fh;

I've updated ENCODE code, now it saves binary file correctly from hex data.

Pionara please check it out. Its still not perfect - adds some data in few last characters in the end of the file, you have to cut it out.

Don't know the reason. But the base of the encoded key should be correct

holy shit. thats just fantastic!!! pionara - fckin GREAT job!

thinking further - we could replace 'handicaped' dlls from windows and get working all the win ce apps without changing references to other dlls

so many possibilities... monday morning im going to get my avic disassembled from car, and gonna put it in home for testing

Glad to see you again!

Can you delete PRG.FLG file from your limited testmode? it will make PRG0 active and you will have working testmode (and software from F30) again.

I assume that you have updated your device (and got PRG.FLG file he-he...)

 

Which features are not working on your 'semi-working' f40bt firmware?

I'm very busy lately, 1st day on new place

Please tell me - whats the source of this 'patched testmode exe' ?

And whats the solution to run it on f40bt which cant be written etc?

Or such solution doesnt exists?

Got to dismantle my avic, I've bought ac adapter for 'home-use'.

I've flashed all modules from F40BT on my F30BT - .PRG files, including EU090BOT - bootloader

Also the good news is that there is no 'version-check',

so there is no problem with upgrade, but also downgrade.

Another thing that I've found is that files which are on PRG0/PRG1, APL directories,

are not important as far as testmode is concerned.

In one word - you can delete all APL(ication) directory,

and AVIC will still boot - with 'no applicable software' message.

And it will still boot into testmode

Propably the solution for working copy/paste testmode

is to flash EU090RGD.PRG (and maybe EU090PLT.PRG)

v3 version from my F30bt for example, on locked F40bt device.

Gonna try to downgrade my v4 f30 modules when I will get some free time.

To be 100% sure of what I've wrote I've got to flash all PRG's with old v3,

write back v3 APL and check if my avic will boot correctly

Until then - everything what you do is on your own risk ;)

Oh and I will post some video proof lol.

br

condi

hi guys,

im back to business lol

got some very interesting news, will give you detailed info later.

for now I can tell you that i've got f30bt with 'semi-working' f40bt firmware.

and of course - like in f40bt - i have testmode-copy/paste disabled lol

br

condi

in some next days maybe Im going to have access to f40bt device, then I could check that 'limited' testmode...

i'd like to get f40's software on my f30...

hi guys,

loooooooooong time but yes, im still alive lol

and still got my f30bt..

i see that its still hard to get into pioneers stuff..?

even if we cant get gps free, then it would be great to get f40bt firmware..

but hey - testmode limited?

ps. been busy lately, got married, a lot of things going on

br

condi

Let's think a bit... Some piece of software keep GPS port occupied before any Pioneer staff starts, Is it sit in Windows? and why it keeps port occupied?

 

Option one: It is only protecting from hacks. When official navi starts this program release port and it will be occupied by navi software. How it checks that navi program running? should we try to run our own navi.exe and check if port have been released? Can we kill official navi program process after few seconds without restarting unit? and check ports?

 

Option two: this "uncatchable software" collect and combine signals from gyro and speed sensor and feed data to official navi using something like IPC. Can we spy comunication between programs what they exchanges? or we need to debug navi program...

1) as far as i remember i tried to run navi.exe, kill it after a while and run my gps software - there was almost always crash/freeze of the device. We could try that again, with some other methods of killing process.

2) You wrote that some software collect and combine signal - in past i was analyzing iGO settings in sys.txt - it can be configured to get gps signal from file - our devices are creating few files with gps signal log. I dont remember exactly the name of that files (it was some time ago..), but you can check it via testmode or hackmode. One of my ideas was to configure iGO to get gps position from that files, but i've abandoned it - dont want to work only with iGO - we want to get gps free for all ) but this could be a good start...

I have been speaking with one of my friends and he give me suggestion that our GPS port is not occupied but it is non-standard one and it uses it's own protocol. Does someone know software that can read state of the ports and put results to logfile. Imagine: first we run this programm and then start official software and after a while we reboot and got logfile with request to and responds from GPS.

I think that the problem is that gps port is already 'busy', before the Navi software starts. But we could make some kind of trace/debug of the Navi.exe and find out how it grants access of gps port? The question is what and how to use? And is it possible.. And what would be the next step..

Hmm... maybe we could get gps port free if we could stop/restart 'gps port device' ?

I thought about Dotfred's TaskMgr and its 'Device Manager' - Start/Stop device, - Set automatic or manual, - Find device settings in registry. Worth a try...

Or maybe gps is used by some running service? (start-stop Service Manager)

Will take a look into this, this weekend..

Condi,

 

Back when I was playing around with MioPocket there was a program on there that would allow you to run a slew of different gps programs. It is(was) called port splitter. Anyone tried using that to get the GPS going?

Already tried two port splitter apps... no success. You've got modified port splitter and gpsgate in latest version of hackmode. Its not that easy... unfortunatelly

Hey Condi how are you? I have been following this thread for some time now but am not aware of where the progress is currently or if it is stalled. It appears that users of these units are convinced these units can be hacked and modified as the previous F series units are. My question to you is, can anything be done with these units once they are hacked pertaining to running other GPS apps or other customization? If so, could you please update the first post in this thread with what can be accomplished at this point that the end user can use? Thank you.

Hi Friend, I'm fine thanks, and how are you?

I added info about not working gps signal in the beggining of the first post. I'm also convinced that it can be done, but for now we are in dead-end.

I will risk my unit and try to replace eu090rgd.prg. That will be my next step.. Just need to get some good promising modified version,

or from older unit - but with correct avics header instead of normal winceimg (like in most of old units was).

IIRC the x series doesn't have testmode anymore.

Not the old testmode, the new TESTMODE.KEY! (check here - testmode works on x920 x930 etc.)

Condiczek - I'll check it out today, I have to try testmode as i never did before

If I get chance I will give this a try today and post the results

Good luck guys and most important thing!!! MAKE A BACKUP!!!

Its more that 3gb, it will take ~1h or even more.

Nope,

Each key can be used only once and that key is used together with your radios's device ID to generate a unique password which unlocks the installer. We all know how well that technique works though. *cough*

Find US version of update, and use my technique please report if it works! (I'm 99% sure).

Details here.

Delete the '.' from the end of the URL (it should end in ".html" not ".html.").

 

http://lists.linuxtogo.org/pipermail/haret-devel/2010-February/000009.html

 

I may have something more recent, will have to check the build box when I get home later.

Thanks for pointing it out Was to tired to notice that dot

PS. Anybody interested to test 2011 update? Take a look at this thread, and please post results

got full 'usable' content of that update, will compare it to my f30bt maps will test/report later and post solution to replace maps..

i wonder if this map is newer than factory-released f30bt units?

---edit.

Looks like its the same map pack as in my (f30) unit.

Its update for F10/F20, not F30 (and not X930 also).

Nothing new for me. But if you want to take a look into map files,

then just unpack NDATA.001, you will get NDATA 3.30gb file,

mount it via ImDisk Virtual Driver (thx to Ralpharn for that great app!),

and you will get plain NDATA content, which propably could be replaced via testmode.

---edit2.

hmm nevertheless there is something new for me?

RELEASE.txt in my unit contains PLE1-3-A version(?),

in this update pack it is PLE1-3-B.

Maybe only new bluetooth firmware?

got to tomorrow copy all my NDATA dir,

and compare it with this upd.

---edit3.

solution for 2011 maps update in few easy steps,

anybody could test it? should work

you should have also fw v3.

1) get 2011 update,

2) unpack 'SD 1/Update/NDATA/NDATA.001 with 7zip,

3) mount NDATA 3.30GB file with ImDisk Virtual Driver,

4) copy NDATA directory from mounted disk,

5) run testmode with TESTMODE.KEY,

6) delete NDATA content on device (always keep full backup!!!),

7) copy new NDATA content to unit.

of course everything what i wrote and what you do is at your own risk,

im not responsible of any damage/brick. FOR EDUCATIONAL PURPOSES ONLY!