condiczek

What's in the unmounted partition? It looks pretty big.

We dont know that.. Control Panel and their applets are not working, tried some modifications without success. Thats why we cant use Storage Manager to mount it. Second option - registry - automount, unhide it - but after reboot it will back to factory state..

Here's a link to my post with the contents of the CD provided by Pioneer:

 

http://avic411.com/index.php?/topic/26072-filesystem-access/page__view__findpost__p__199279

Thats a great thing! The key to success is ScriptExec.ini - if we could modify it to point other files than 7zip.dll to be replaced, then we could replace files in ROM safely! Without fear that .img is incorrectly modified etc! So the testmode will always popup and we could replace back to stock EU080PLT.PRG!

I will check if the script works on my F30bt later this day..

BTW aero_eng16: Veeeery good move with LGPL!!!

Condi

Thanks a lot for your explantions, that makes it much clearer to me!

Is softkeyboard on the same page or is it a different issue?

 

From your words I hear that you still see a chance to get explorer (and menus) working correctly! If I can be of any help for you, just a mention it!

So far your work helped me with my biggest concern regarding F30BT, the picture show works already with TCMP .

 

Thanks a lot and best regards

Bernd

 

PS: I have corrected the shortcut for Pioneer Software in the MSR-Script, works perfect!

Yes, everything can be done. We've got to figure out method of safely-replacing rom files

Condi

thanks for your reply

 

What is behind Pioneer Software?

Is there a chance to get a Softkeyboard running?

Any idea how to activate the menus (especially load / store) in alternate software?

 

Best Regards

Bernd

Pioneer Software shortcut simple runs original Av.exe from PRG1. Thats it.

Menus - load/save etc - its not working, its all related with explorer/windows - almost every app which uses coredll.dll and ceshell.dll (especially that) will not work or not fully work. I modified a lot of apps which refused to run, but still got problems with explorer and ceshell.dll. When I use modified ceshell, then in explorer/filemanager there are corrupted icons etc. When we will get working explorer/popup windows, then it will work in other software menus etc.

Original windows dlls are limited, or being limited because of some other software (AstProc/neventwatcher?)

Now I got USB-to-USB straight cable (without chip) how to connect it safely? I can conect it via USB hub. any advice how to do it?

As I mention above- DiskRW is not working on my X930... any Ideas why?

Take a look on the photos of DiskRW - the most important thing is about the unmounted partition. Some secret/hidden things? Or some useless things haha

The last photo is most important

On your device DiskRW is not working, hm... maybe you should try with other dlls, modify them like i did, and test?

Dear All

as mentioned before I closely followed discussion from the early beginning. These days I've got my F30BT and hacked it sucessfully . Many many thanks to condi (and all coworkers) ! Hack was very easy and worked as described. Really Well Done!!! The biggest challenge (as promised by condi) is navigating in the Pioneer Service Mode and in FILE MAINTENANCE.

 

The previous device I hacked was a Medion Navi P5430 win WINCE 5.0.

There I have installed on a SD card a programm collection called MioPocket 3.0. SD card was inserted to F30BT and I checked all .exe-files. Please find the details in the attachement.

 

As a short summary:

most of programs that started correctly can open the FileMenu, but can not continue with FileOpen or FileSave! Same situation for keyboard input. JOTKBD.exe started and menu actions work well, but no characters are written to an input line of any program!

Seems that something general is missing!

Any idea whats missing and how to overcome?

 

Nevertheless some lucky surprises occured:

TCPMP, open pictures, videos and music with his own browser and displays them, unfourtunally music is not submitted to speakers, but picture show works well

Calc98CE, works with integrated keyboard, therefore input and calculations are working well!

FoxitReader, registers himself during program start. After that any PDF will open with a doubleclick in Foxit and can be read easily

GQ Viewer, open pictures with his own browser and displays them, also zoom and scroll

Rotate.exe, rotates screen correctly (not really useful but it works!)

uBook, books are loaded with integrated browser, unfourtunally it starts up in the upright mode, not really comfortable for reading, but it works

Ppaint.exe, drawing mode is working fine, character input and Load/Store is missing (similar for other paint programs)

RegEdit, displays Registry correctly, but no Import or Export (similar for other RegEditors)

 

In general I found the results worth to report, maybe helpful for some and motivation for others to overcome remaining challanges!

 

Looking forward to your comments

Bernd

 

PS: is it normal that Pioneer Software supplied by condis hackmode is not starting ?

About Pioneers Software - its only incorrect shortcut I will fix it and release in next version, but for now we dont have nothing new to release

No news??? everyone??? any update??

5 days from last post from Condiczek... I hope everything is ok.

Everything is allright guys Just got a lot of work these days..

Ralpharn

you mentioned that we can use scripts (mortscript ?) to start additional programs.

What will trigger the script to start?

best regards

bernd

You dont need to make some extra scripts to run some programs.

You can test/run it with hackmode, and file manager.

Keep in mind that many apps needs to be modified to work with other dlls.

Can you explain it little bit further? I didn't get where this "INFO/My Device/DSK1/Partition Information"...

Check attatched DiskRW from previous post!

I have a suggestion to ToDo list:

connect usb 3G/GPRS modem to use independent internet access, to load traffic info (for GPS software, that support it).

Added yes after we will get gps working, then it will be very handy thing. Like in Navigon in my android phone !

I am thinking about other way to break in to our devices.

 

First- connect it via USB. we need to run UsbClientSwitch.exe first. This file sits in Windows folder and if we can run it we probably will be able to connect to our devices by straight USB-to-USB cable. But I can't start it.

 

second option- previous Pioneer devices had Service mod, when only bootloader runs- it is made for repair Windows in case windows is not operational. To enter this mode they had to hold some buttons while switch device ON. It is pretty much as BIOS on PC. So... we can try "brute force" this key combination. if we find this service mode we can download firmware and start to play with EU090PLT.PRG (winCE image)

 

Third option- in testmode on third screen we have "Program Forced Write" option and in service manual it says that it is designed to "Write / Read Fixed Data" but I am not sure that TestMode works without WinCE.

Last option- Jtag. we have connector.

1) UsbClientSwitch.exe - you can just change between ActiveSync and Mass Storage mode. There is registry for usb, maybe it works already - you've got to check My unit is installed in car, and there is no indication that I will unmount it

2) I think that even if we delete EU090PLT.PRG - our winceimg, then it should not be totally bricked. Testmode should work. As far as Im concerned testmode is checked before PLT is loaded. Im ready to play with EU090PLT.PRG - test modified, test other etc. But there is one problem - PLT in F30BT doesnt have 'B000F' header of image.. And also dumprom/dumpromx gives us incomplete, corrupted files. I could test simply modified img, with added explorer.exe for example, but we need to figure out how to add some files without messing the image.

3) Yep, good thing to look into

Im attaching working DiskRW, there is one problem to read data - we have to point OUTPUT directory, but:

1) virtual keyboard is not working, jotkbd.exe is not working properly,

2) browse [...] button is not working (propably because of not fully working explorer/windows/ceshell),

So first we need to somehow give OUTPUT parameter, and then we can read/write image via DiskRW

Also interesting thing - check INFO/My Device/DSK1/Partition Information!

There is one NOT MOUNTED partition, maybe some pioneers secrets? Maybe some gps/audio/hw related things/apps?

PS. Flugwerk wrote that usb mouse is working, anybody has usb keyboard to check with avic?

DiskRW.zip

Hey Condi! Had some problems updating from v1.1 to v1.3. To v1.2 I had to change HMIManager script with the above, because the unit constantly rebooted. After that the unit turns on very slow. It takes a couple of seconds for the buttons on the unit to light up, and then more time for the desktop (or stock software) to show, which is realy annoying. After updating to v1.3 the same reset loop occured. So I just went back to stock for now. Can you please post all the files that are changed on the unit, so I can do a direct to v1.3 hack from stock via testmode. I would also like to try running the hack off Av.exe, maybe that will speed things up a bit.

You're right, even my unit had some problems, and it was about HMIManager.exe.

Working now, got 1.3 on Av.exe. Changing all the updates etc..

--changed. added to first post. give me info if its ok.

Still no GPS signal, but some curiosity - I managed to run TomTom on F30BT

So when we get signal - we get iGO, TomTom, Garmin(?), oh yesss...

---moving back to Av.exe - it works better, more stable etc.!

Great to hear that post results after installing hackmode!

Hello.

Thank you for the work done!

I have x920bt

Installation was successful hacking! Upgrading from 1.0 to 1.1 perfectly!

Upgrading from 1.1 to 1.2 is not working.

The process runs fine, but after installing the device continuously restarts again and again.

Please help! What am I doing wrong (translate into the root folder CONDIUPDATE sd cards are inserted into the device)

Is installing updates, pioneer reboots and again and again and again

Hi. Upgrade went ok, but propably your card is discovered on the system too slow.

Please unpack attached HMIManager.mscr file, enter pioneers testmode, delete HMIManager.mscr

from unit (/USER/PRG0/Apl/HMIManager.mscr), and copy the new one.

I had to change only 'Sleep' value in script, your card becomes available in system, and it will work

Dawgbone had the same problem

HMIManager.zip

Great work Condi. Will try the new v1.3 ASAP, but for now I forgot my SD card in the car, and it's pouring like crazy outside

Try it and tell me what you think

Great work Condi!!!

 

Info from our friend Carver:

 

As you can see it contains that mysterious AstProc.exe

 

Also I got recommendation do not mess with EU090BOT.PRG because its look like main boot-loader and error in this file can easily brick device.

Yep, boot shouldnt be touched without full certainty. AstProc could be our curse ..

For now we can kill GpsMC.exe and run other version of that app (which should be responsible for gps :>).

That the next thing which I will check.. GpsMC.exe + GPS.dll + GpsTmc.dll.. Anybody got that files dumped from F900BT for example?

I've attached script for running/testing other explorer.exe with other libraries etc. This one in v1.3 hackmode is modified, but I left CEShell.dll unmodified. If I change it to my copy, then it will a)not gonna start, b)start - with oem-info on desktop, but with some problems with icons etc., and of course exploring 'my device' etc still not working. But there is problem with CEShell.dll. So all the other libraries are modified, but not that. If you want to modify exe/dlls - just use hexeditor and change all the names in it - but save the lenght of the file! for example coredll.dll <> change to coredl1.dll or coredl_.dll. The same filename lenght.

Just unpack the attachment, copy 'CONDITOOLS' directory to SD/USB, copy your files to 'WinCE' directory, and run otherEXPLORER.exe.

I've also attached PortSplitter, modified, which is starting. I've made also a script which adds gps related registry from F900bt and then runs PortSplitter.

Just unpack the attachment, copy 'CONDITOOLS' directory to SD/USB, then run 'Port Splitter.exe' or 'RunPSwithGPSregFROMf900.exe'

PS. let me know if the attached tools are working

otherEXPLORER.zip

PortSplitter.zip

Get some pendrive, run pioneers testmode via usb! and please try to backup files to USB instead of SD. Please post results!

1.3 works for my X930BT.

I'm glad !

@Condis Some beer is on the way

 

I have a F930BT but didn't try it yet. I'm afraid of bricking it.

Some points I miss:

- Is it to difficult or why is there no new base version? Making one update is ok but three? Especially if the newer version seems to fix some installation problems.

- Can you please structure the installation steps more so it would be easier to understand what is happening (eg 1 Entering Service Mode, 1.1 ..., 2 Making backup of the original files, 2.1 ....)

Thanks very much for the beer, we (me & my girlfriend) will drink for you today!

About the updates, many people is updating hackmode instantly after its released. Thats why there are separate patches. Update procedure is very easy:

1) manually install base 1.0,

2) unpack first update to SD/USB and insert it,

3) wait for boot updated hackmode - update will be deleted after successful install from SD/USB,

2-3) repeat it for every update, sequentially

Good to point it out, when I come back home, I will make 'cumulative update' from v1.0 to v1.3, for people who has fresh start !

Oh and just check - as long as pioneers testmode works for you (100%),

and you've got backup of USER directory content, then you can feel safe!

F930BT is almost the same as F30BT, it will work ok

If you had some problem with hackmode, then just write - thats what this forum is for

br

condi

---edit:

about gps port/signal - something is keeping used/locked gps port, which is com7. Later this day/sunday I will add working PortSplitter, where I can set com7 as input, and com9/com0 as output port, but I cant start it - error on opening port. Same in SirfTech app. We've got to figure it out!

Also about apps started to work - I had to modify reference to dll libraries. Modify exe, like: from coredll.dll to coredl1.dll. 'Stock dlls' in our units are 'limited', and cause apps to not work! You can modify it manually or use ExecutabilityCheck app.

I will attach later:

1) 'working' PortSplitter,

2) some script to close currently running windows explorer and run other version - if you would like to try some other versions/solutions for fully working windows! it will be very handy, just put your files on some dir in SD/USB, run some script and it will do it all for you for further development,

3) 'cumulative update' - all updates in one pack for v1.0,

4) step by step how to modify apps to work with different libraries.

Hi,

nice work.

i have tested v1.3 with usb install. after the update my f30bt isn`t boot in hack mode.

There is a mistake in the autoupdate.mscr

 

orginal line 52:

Copy("\SDMMC\CONDIUPDATE\3.dat", "\NAND\PRG0\Apl\HMIManager.mscr", TRUE)

fix to:

Copy("\USB\CONDIUPDATE\3.dat", "\NAND\PRG0\Apl\HMIManager.mscr", TRUE)

 

 

Regards

Thank you very much friend! I wrote it 10min before I drove away from home

I just replaced 1.3 zip with usb-install fixed. Thanks again friend, thats what I expected to see as feedback

All other autoupdate things went correctly, please just enter pioneers testmode.key, and manually copy 3.dat as HMIManager.mscr

Hi to all, great job you are doing, special thank's to Condiczek.

Pionner have a good hardware, but very poor software, and i we all love to personalize our avic.

I've got a F-9210BT, exclusively for Volkswagen, Seat and Skoda cars (2010 Model).

I' m trying to extract the conten of the zip files and ask for a password.

Can please tell me.

No problem friend pass for all the files is: avic411. Please post results

v1.3 ready. please test it, because i dont have now time to do that!!!!!

will add description later!

br

condi

---edit: im on the net with my mobile. Anybody can tell me is it working ok or do i need to fix it? ;)

Finishing v1.3 ... testing...

---edit:

got some issues... sorry guys, going sleep, will fix it tomorrow/sunday.

How??? what is the trick?

Another good news!:

1) we can now kill processes! i kill GpsMC.exe process without freeze!

2) after GpsMc.exe kill, we can run other GpsMC exe!, maybe thats the key to success,

3) we got new task manager app with killing process very handy!

4) i will remake hackmode to ask question for 2-3 seconds on boot if you want to enter hackmode - now I just can do that..

5) PortSplitter app is starting now! no success with making virtual port, I'm working on it,

6) SirtTech app is running, but can't open any com port!

7) AstProc.exe process cant be killed, or maybe after kill it instantly comes back?! maybe because of that sh!t our gps port is busy..

thats (propably) all of the news of last 2 days will keep you informed guys,

must check a lot of things now. I will post some tools or hackmode 1.3, when its ready

one more time - keep your fingers crossed!

got modified gps utility working! can switch, change protocols/ports etc. further investigation..

JasonH made a video showing testmode interface.

If I will have some time today, then I will make some another video with step by step copy/paste backup.

F900BT hackable and it runs IGo as official navigation software.

Did I correctly noticed that F900BT is based on WinCE 4.2 (not 5.0?)

did u try something? i could found services.exe to try into avic

i read the 2 links, if i understand correctly services.exe have a link with devices functions, maybe its make the middle betwen this things ( hardware devices , drivers , software )Some software dont need this (can direct call devices) ,but some need.

 

if im wrong, im sorry , but my english is so fu*k bad !! heheheheh

Can u Add this to registry( Look in Picture)

Yes we can add registry to init section, but it would work if registry would stay after reboot. 'init' is already used when you have your unit on, it would 'take' changes after reboot, but registry is resetting. Your english is not so bad, my english is also not 'correct' in many places

Today I tried to point other main dll's like coredll an ceshell, in explorer.exe, to get it work. One step futher - windows explorer shows now oeminfo-version of windows ce on the desktop (related to that dlls) one step to working wince! Digging..

I run CEProcessV into my unit and into emulator and compared the results. We can see service.exe isn´t running in the unit, while it runs into the emulator. Using this same prgram I killed the process of explorer.exe of the emulator and tried to kill service.exe, the latter didn´t happen. The emulator started to work as the unit, the links wouldn´t open. I also edited a shortcut to explorer.exe and when the file isn´t available there´s an error message. So I assume

explorer.exe exisits in our unit, the only problem is that it doesn´t start. As for service.exe I will try to copy it from the emulator to SD card and run it into the unit.

 

Does anybody know where this file is and how can I copy it, because I can only see some folders and files. How can I show all files?

 

 

Condi, I would like you to make service.exe start into your script Maybe that´s the reason why IGo isn´t working.

I think its not related to services..

http://msdn.microsoft.com/en-us/library/ms884674.aspx

http://msdn.microsoft.com/en-us/library/aa450223.aspx

maybe Im wrong?

There is clear register from F900BT:

avic_f900_v322_default_reg.rar

There is register from one of updates for F10:

nx007cl_EU090PLT_registry.rar

and registry files from X930 exstracted from EU090PLT.prg:

EU090PLT_reg.rar (thanks to Carver!)

Thanks friend, thats what I need to compare/analyze/modify

One question - which one of that units are hackable (with available gps port, windows ce working etc.)?

Hmm... maaaaany more entries in F900BT registry related to GPS:

[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\GPS]
"AdcRange"="2.5"
"AdcBitNum"=dword:0000000c
"AccZNoiseLevel"="0.01"
"AccYNoiseLevel"="0.01"
"AccXNoiseLevel"="0.01"
"AccZScaleThre"="0.0701"
"AccYScaleThre"="0.0701"
"AccXScaleThre"="0.0701"
"AccZScale"="0.6"
"AccYScale"="0.6"
"AccXScale"="0.6"
"AccZZeroOffsetThre"="0.1860"
"AccYZeroOffsetThre"="0.1571"
"AccXZeroOffsetThre"="0.1571"
"AccZZeroOffset"="1.5"
"AccYZeroOffset"="1.5"
"AccXZeroOffset"="1.5"
"GyroZNoiseLevel"="720.0"
"GyroYNoiseLevel"="720.0"
"GyroXNoiseLevel"="720.0"
"GyroZScaleThre"="0.1269"
"GyroYScaleThre"="0.1269"
"GyroXScaleThre"="0.1269"
"GyroZScale"="2.5"
"GyroYScale"="2.5"
"GyroXScale"="2.5"
"GyroZZeroOffsetThre"="0.022"
"GyroYZeroOffsetThre"="0.022"
"GyroXZeroOffsetThre"="0.022"
"GyroZZeroOffset"="1.35"
"GyroYZeroOffset"="1.35"
"GyroXZeroOffset"="1.35"
"MisalignDriftRate"="0.00167"
"InitMisalignYawStd"="5.0"
"InitMisalignPitchStd"="5.0"
"InitMisalignRollStd"="5.0"
"InitMisalignYaw"="0.0"
"InitMisalignPitch"="0.0"
"InitMisalignRoll"="0.0"
"MisalignEstimationMask"=dword:00000002
"MisalignChangeDetectionMask"=dword:00000000
"OdoScaleDriftRate"="0.00003"
"InitOdoScaleStd"="0.0"
"InitOdoScale"="0.0"
"OdoVelStd"="0.1"
"OdoDirectionType"=dword:00000001
"OdoEnable"=dword:00000001
"NonHoloVelStd"="0.1"
"NonHoloEnable"=dword:00000001
"ZuptYawStd"="1.0"
"ZuptVelStd"="0.01"
"ZuptEnable"=dword:00000001
"GpsVelStdScaleUp"="1.0"
"GpsPosStdScaleUp"="1.0"
"AccZVelocityRandWalk"="0.11"
"AccYVelocityRandWalk"="0.11"
"AccXVelocityRandWalk"="0.11"
"AccScaleCorrTime"="3600.0"
"AccZScaleInstability"="0.005"
"AccYScaleInstability"="0.005"
"AccXScaleInstability"="0.005"
"AccBiasCorrTime"="3600.0"
"AccZBiasInstability"="0.05"
"AccYBiasInstability"="0.05"
"AccXBiasInstability"="0.05"
"GyroZAngularRandWalk"="3.0"
"GyroYAngularRandWalk"="6.0"
"GyroXAngularRandWalk"="6.0"
"GyroScaleCorrTime"="3600.0"
"GryoZScaleInstability"="0.005"
"GryoYScaleInstability"="0.0"
"GryoXScaleInstability"="0.0"
"GyroBiasCorrTime"="3600.0"
"GryoZBiasInstability"="100.0"
"GryoYBiasInstability"="0.0"
"GryoXBiasInstability"="0.0"
"DR_CALIBRATION_FILEPATH"="/My Flash Disk/Calibration.bin"
"DR_PROCESS_RATE"="5.0"
"DR_SAMPLE_RATE"="100.0"
"DR_MODEL"=dword:00000002
"DR_OUTPUT_DEBUGFILE"=dword:00000000
"DR_OUTPUT_SEL"=dword:00000000
"DR_TIME_OUT_WITH_ODOMETER"=dword:00000000
"DR_TIME_OUT"=dword:0000012c
"DR_ENABLE"=dword:00000001
"SynEphAvailable"=dword:00000000
"GPSEnableSpgod"=dword:00000000
"IClass"="{A32942B7-920C-486b-B0E6-92A702A99B35}"
"MC_EveryStartUpdateTime"=dword:00000001
"MC_ColdStartUIApp"="\\Windows\\ColdStartUI.exe"
"MC_StartupPlugin"="\\ResidentFlash\\StartupPlugin.dll"
"MC_EnableGpsAutoRun"=dword:00000001
"SMLongSniffNM"=dword:00001c20
"SMSleepTime_S2NM"=dword:00000708
"SMRunTimeout_S2NM"=dword:00000001
"SMSleepTimeNM"=dword:00000258
"SMRunTimeoutNM"=dword:00000001
"SMNightEtime"=dword:00000006
"SMNightStime"=dword:00000016
"SMNightModeEnable"=dword:00000001
"SMS3CON"=dword:00000048
"SMS2CON"=dword:00000012
"SMLongSniff"=dword:00001c20
"SMSleepTime_S2"=dword:00000258
"SMRunTimeout_S2"=dword:00000001
"SMSleepTime"=dword:00000258
"SMRunTimeout"=dword:00000001
"SMEnable"=dword:00000000
"SJ_EPH_FW_N"=dword:00000258
"SJ_EPH_FW"=dword:00000258
"SJ_EPH_FAIR"=dword:00001c20
"SJ_EPH_GOOD"=dword:00001c20
"SJRunTimeout"=dword:000000f0
"SJSleepTime"=dword:00000258
"SJEnable"=dword:00000000
"BackgroundLogFolder"="SDMMC"
"BackgroundLogDataEnable"=dword:00000000
"FrozenQCEnable"=dword:00000001
"HalfPpmTcxo"=dword:00000001
"TimeoutStoreParam"=dword:0000012c
"SpgodPrioritySJ"=dword:000000ff
"UseInertial"=dword:00000000
"EhFrozenLon"=dword:0003619f
"EhFrozenLat"=dword:0001001e
"FrozenLon"=dword:00000000
"FrozenLat"=dword:00000000
"Order"=dword:00000002
"Index"=dword:00000007
"Dll"="GPS.Dll"
"ParamFolder"="My Flash Disk"
"Prefix"="COM"

Its the most similar GPS registry from this registry pack Five last values almost the same as on my F30. I will try to add that registry to my F30 and test with gps port..

ok, so after reading through this thread, it seems like you can use the 'HACKMODE' to upgrade the z120bt to z130bt?

 

Here is my question:

I upgraded my z110 unit to the z120 software. If I were to want to upgrade to z130 from where I am now, would I just use the Condi HACKMODE: download all 3 versions of the file and 'upgrade' it accordingly, then just plug it into my unit & go through the motions?

Hmm.. You could try to replace your units software, without installing hackmode. You can run pioneers testmode, make backup of your USER/PRG0 & PRG1, get copy of PRG0 from z130 unit, delete PRG0 from your unit and copy z130's PRG0 Its only an idea, theory, I can't say if it works or not. You can test it. Of course at your own risk

-----edit:

I attach GPS registry from F900bt - correctly formated in MortScript - ready to be writed/modified - if somebody want to try make something with it

gps-reg-from-F900bt.zip

Found some romtools with 'dumpromx' version 1.07 (till now we had 1.06), and also 'dumpromy'? (for repack?). It might be usefull, for extract, modify/replace, repack.

Also example .bat files with commands are in it.

ROMTOOLS.zip

Good news!

I finally managed to extract all files from bin, and the executables are working.

The tool I found to work was dumpromx. All you have to do is use dumpromx instead of dumprom (the command line arguments are the same). The rest of the steps are the same. dumpromx can also be used to change files in the bin aparently, but I haven't gotten to that just yet.

GREAT NEWS! We've got a new starting point! It gives us many new possibilites, that is the thing, that we were waiting for last few days

Ok everyone lets slow down a minute with the comments back and forth with each other. Always remember that what is written cant always be interpreted as it would be verbally. Also Condi, Abb is probably one of the most valuable members on this forum and would likely be an asset to you. Abb1 is the biggest developer of hacks and mods of the F/X series units on this forum and I believe could share great knowledge at some point once the efforts here progress and I personally directed him/her to this thread in the first few days of your accomplishments. And Abb, the GPS software in the Z series is some in house garbage that Pioneer likely developed themselves and leaves a lot to be desired. Always remember that sometimes baby steps are needed before the marathon is accomplished. Even you have said you would get a Z if it could be hacked. Lets all work together here and see where this goes. These units are crippled in so many ways and are begging to be opened up to run with their true potential and working together is the way to do it.

I'm sorry guys, I had bad day, and Abb1 - I overinterpreted your words! We are in the same team