condiczek

what tool are you using for edit registry?

Just MortScript example in attachment, just edit .mscr as you wish.

There are some Strings and DWords in it.

Run RegModify.exe script to modify it, then you can check if its modified via RegEdit.exe.

None of reg editors worked for me to change values or import .reg files.

Only MortScript

RegModify.zip

I'm trying to do something with registry, made script to add some values to HKLM\Drivers\BuiltIn\GPS like:

RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "Prefix", "COM")
RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "ParamFolder", "data")
RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "Dll", "GPS.Dll")
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "Index", 7)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "Order", 2)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel0", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel1", 0)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel2", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel3", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel4", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel5", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel6", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel7", 0)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "FrozenLat", 0)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "FrozenLon", 0)
RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "TcxoXoPpmSetting", "0.5")
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "BackgroundLogDataEnable", 0)
RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "BackgroundLogFolder", "SDMMC")
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "CurGpsWeekRollerNum", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "DefaultGpsWeekNo", 469)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "CCMFlag", 0)
RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "IClass", "{A32942B7-920C-486b-B0E6-92A702A99B35}")

Comparing with other gps there is no IClass and other values, but after adding, I still cant get gps working..

I don't know if the changes are working without reboot, but we can't reboot - reseting registry..

I don't know what exactly parameters would be correct, also we have gps related entries here:

[HKEY_LOCAL_MACHINE\Drivers\Launch\GPS]
"Prefix"="COM"
"Dll"="GPS.Dll"
"Index"=dword:00000007
"Order"=dword:00000002

There is GPS.dll and GpsTmc.dll in rom \windows\, maybe easy method with replacing GpsTmc in iGO with GpsTmc from rom would work?

Havent tried that, but even if yes - then its not good solution, we have to get gps work in all the apps!

Maybe we should point it out to other GPS.dll than that in rom? Via change value in "Dll" entry? Ahh..

I've also made some scripts to add missing registry entrante related to shell/explorer etc.:

RegWriteString("HKLM", "Explorer\RunHistory", "", "")
RegWriteString("HKLM", "Services\NOTIFY", "Dll", "NOTIFY.Dll")
RegWriteString("HKLM", "Services\NOTIFY", "Prefix", "NFY")
RegWriteDWord("HKLM", "Services\NOTIFY", "Index", 0)
RegWriteDWord("HKLM", "Services\NOTIFY", "Keep", 1)
RegWriteDWord("HKLM", "Services\NOTIFY", "Order", 0)
RegWriteString("HKLM", "System\Events", "system/events/notify/APIReady", "Notifications API set ready")
RegWriteString("HKLM", "System\Events", "SYSTEM/GweApiSetReady", "Event triggered after GWES registers its API sets")
RegWriteString("HKLM", "System\Events", "SYSTEM/ShellAPIReady", "Shell APIs")

And after that copy some explorer.exe, dlls, but still cant get fully working - window instantly disappears after run.

It looks like there is lack of some resources/libraries/registry, or maybe some process instantly kill new windows/processes.

Applications which are not running are concerned in some notifications/popup windows - all of them not work.

Even MortScript is not fully working - I cant make 'message' script, or 'Choice' menu script. Limited funcionality.

Tried few versions of explorer.exe, still no luck.

I've also tried to point some other ceshell.dll, if we couldn't overwrite it in \windows\ directory, registry like:

RegWriteString("HKCR", "CLSID\{00021400-0000-0000-C000-000000000046}\InprocServer32", "", "\SDMMC\WinCE\ceshell.dll")
RegWriteString("HKCR", "CLSID\{000214A0-0000-0000-C000-000000000046}", "DefaultIcon", "\SDMMC\WinCE\ceshell.dll,-4354")
RegWriteString("HKCR", "CLSID\{000214A0-0000-0000-C000-000000000046}\InprocServer32", "", "\SDMMC\WinCE\ceshell.dll")
RegWriteString("HKCR", "CLSID\{000214A1-0000-0000-C000-000000000046}", "DefaultIcon", "\SDMMC\WinCE\ceshell.dll,-4352")
RegWriteString("HKCR", "CLSID\{000214A1-0000-0000-C000-000000000046}", "AltIcon", "\SDMMC\HURA\ceshell.dll,-4355")
RegWriteString("HKCR", "CLSID\{000214A1-0000-0000-C000-000000000046}\InprocServer32", "", "\SDMMC\WinCE\ceshell.dll")
RegWriteString("HKCR", "CLSID\{000214A2-0000-0000-C000-000000000046}\InprocServer32", "", "\SDMMC\WinCE\ceshell.dll")
RegWriteString("HKCR", "CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32", "", "\SDMMC\WinCE\ceshell.dll")

Again, no luck. I begin to think that to achieve the target we will have to change Gwes.exe, NK.exe, kill AstProc.exe or other,

in rom related thing. Keep on searching for the solution..

Anyone have full registry backup from other/older unit with working gps/windows of pioneer?

Damn, so basically, nothing is really hacked for modification. . If all the UI is hardcoded into the Avic, which is what was initially assessed, and I guess now proven, as we still cannot get into this interface for modding purposes, what is the purpose of this hack?

The purpose of hack is to get that and other abilities! All the hacks were done from the beggining?

Please stop posting such useless statements, if nothing is possible, then just lets sell all our avic devices, and close hack/mods section.

As I wrote in first post: "HACKMODE is entrance to further developing". Treat it that way.

If somebody has something useful to say, than please do it.

Every clue, help, willingness of developing is welcome.

I am confused? What is the Nav software running in these units? I thought that all Pioneer systems had iGo?

In newer units there is no iGO software. Its based on TeleAtlas maps, nothing is left from iGO, no content/maps etc.

The maps are in totally different format. We can run other gps software, but we can't get gps port to work.

Can't you change this registry entry so it point to another COM port. This way we might be able to use COM7 for other GPS navigation software (like iGO)

Yes, I wrote few scripts to change registry, but:

1) registry resets on reboot to previous state,

2) I dont know if changes works without reboot? (some changes works, but dont know about device drivers..)

3) as for now - it doesnt work, but of course Im trying to figure it out

I would like to add a change request to the list. The XM Screen should have scrollable text fields for the artist information and the song information.

 

Thank you.

It will be hard to modify pioneers executables/dlls in such direction.

Is it possible to upgrade a F20BT to a F30BT with this hack?

Just copy the new AV.exe file and you are done? Same goes for the maps, I would like some new maps

You've got access to your device. Remember about full backup of your files, and feel free to experiment with it

..for sure not only Av.exe needs to be replaced, but PRG0/PRG1 directory? You've got to figure/test it out by yourself

-----

again analyzing (F30BT) registry:

[HKEY_LOCAL_MACHINE\Drivers\Active\44]
"Hnd"=dword:000572f0
"Name"="COM7:"
"Key"="\\Drivers\\Launch\\GPS"
"ClientInfo"=dword:00000032

[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\GPS]
"GRFTYPE"=dword:00000001
"ParamFolder"="NAND\\SYSTEM\\GPS"
"CurGpsWeekRollerNum"=dword:00000001
"DefaultGpsWeekNo"=dword:0000021d
"MC_EveryStartUpdateTime"=dword:00000001
"NmeaSel3"=dword:00000001

[HKEY_LOCAL_MACHINE\Drivers\Launch\GPS]
"Prefix"="COM"
"Dll"="GPS.Dll"
"Index"=dword:00000007
"Order"=dword:00000002

Those are registry values related to GPS.. Maybe some proper modification will give us working GPS :>

I've got some clue/idea how to get working windows ce/explorer.. Will try to figure it out this weekend! Keep your fingers crossed!

Condi, are you experienced in programming? If not, can you try if my WinCE GPS program works?

 

http://forum.xda-developers.com/showthread.php?t=474582

 

You might be able to use it to turn on GPS. You might have to install the ARM4 .NET Compact Framework CAB first.

 

Let me know how far you get.

I tried all of your GPSTool versions, none of them are working/starting. Will try later with .NET framework!

All condihack version are installed. MSNdirect and BT are working fine. The only issue I see now is the significant boot time. Music and splash screen used to start almost instantly at power up, but now it is about 30 seconds before the music and splash screen start up. This did not occur until v1.2. Can this be sped up?

In v1.2 on start there is delay for 500ms, its almost nothing. My unit starts in ~10-15s. Without SD/USB its also that long?

Condi, are you experienced in programming? If not, can you try if my WinCE GPS program works?

 

http://forum.xda-developers.com/showthread.php?t=474582

 

You might be able to use it to turn on GPS. You might have to install the ARM4 .NET Compact Framework CAB first.

 

Let me know how far you get.

Sure, I can try I'm not experienced in programming, only bases.

I doubt that I can install any .cab file with that 'windows ce'.

Could this be done by extracting .cab and copying manually files? If yes, than I will try it.

http://blogs.msdn.com/b/netcfteam/archive/2005/10/11/479793.aspx

Which version for our wince 5 devices? NETCFv2.wce5.armv4i.cab?

Got your program on SD, will try it tomorrow (00:22am here ).

I tried several programs like port splitter, gpsgate, sirftech utility etc., none of them worked.

Maybe we should compare registry from older unit, where gps was available?

Thanks Condiczek

 

-Everything works fine up until 1.1>1.2 update... just like my first attempt, the unit just continually reboots...I let it reboot 15 times then I turned it off/on... Regardless, it'll continue to reboot until, I remove the SD...

-This time, BT is working with version 3.11

-After the update, HACKMODE.key is the only thing left on the SD card... yet it doesn't boot into WinCE<--just get's to the OK screen and reboots

 

Should I try to grab a HACKMODE.key from the 1.1 update? To see if it'll boot to WinCE?

Wait a minute, I think I know what's wrong... just give me five min..

--edit: PM

I was able to get updated to v1.2, but like you, my BT was hokey, and the version read ------

 

Then I somehow managed to get myself in the above situation, luckily after several attempts, I was finally able to get to file manager and restore the USER directory from backup....whhhewwww!!!!

 

Now I'm starting over... There has got to be something with our scenario (Pioneer 110-120 update(legit) and having the 2.0.0.3 update)

Odd enough, mine does NOT have the PRG.flg file????

OK so I assume that you have backup of USER content.

Get PRG0 from copy, make another one, rename it to PRG1.

Delete PRG1 from device, copy renamed directory - PRG1 (with PRG0 content).

Install HACKMODE v1., update to v1.1, update to v1.2.

And post results

Yes, it does. It works on my X930BT and after this update I manage to get registry backup using your script. Before that (on Ver1.1) it wasn't successful.

 

Result of comparison between X930BT and F30BT registry:

X930BT has none but F30BT has: [HKEY_CURRENT_USER\Software\GNS]

[HKEY_CURRENT_USER\Software\GNS\GpsRdsApi]

 

Line 2212 in X930BT: 00,00,00,00,00,bc,94,88,90,e0,77,62,90,40,ea,94,90,8c,6a,bf,9b,0f,00,00,00,\

Line 2216 in F30BT: 00,00,00,00,00,b0,ad,88,90,e0,77,62,90,40,ea,94,90,8c,6a,bf,9b,0f,00,00,00,\

 

Line 2434 in X930BT: "TimeZoneInformation"=hex:e0,01,00,00,43,00,65,00,6e,00,74,00,72,00,61,00,6c,00,\

Line 2438 in F30BT: "TimeZoneInformation"=hex:c4,ff,ff,ff,43,00,65,00,6e,00,74,00,72,00,61,00,6c,00,\

 

Line 2958 in X930BT: [HKEY_LOCAL_MACHINE\Drivers\Active\53]

"Hnd"=dword:00e4f8a0

Line 2962 in F30BT: [HKEY_LOCAL_MACHINE\Drivers\Active\53]

"Hnd"=dword:00e60550

 

Line 2966 in X930BT: [HKEY_LOCAL_MACHINE\Drivers\Active\52]

"Hnd"=dword:00e4fa30

...

"ClientInfo"=dword:00e4bc50

Line 2970 in F30BT: [HKEY_LOCAL_MACHINE\Drivers\Active\52]

"Hnd"=dword:00e4f520

...

"ClientInfo"=dword:00e4b790

 

Line 5292 in X930BT:

20,00,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,5d,3f,ca,a4,1e,09,e1,3f,\

d0,d6,78,ff,1f,1e,44,61,00,00,00,00,04,80,00,00,10,00,00,00,10,00,00,00,c3,\

7d,ab,3b,84,33,d8,08,2c,a1,96,0a,d0,89,0c,7c,52,00,00,00,5d,32,04,de,55,81,\

54,e8,3f,ba,3e,39,c0,29,a5,b1,11,c0,e1,da,b7,1b,83,1c,51,1b,35,6c,8f,95,cd,\

a8,21,ea,23,9a,8f,41,5c,2d,fb,c1,42,aa,22,24,39,6c,69,0d,a8,f1,9c,36,24,b8,\

9e,2f,65,99,e0,c8,8b,aa,4d,b3,e3,c3,59,f0,ce,ae,42,1b,d1,c9,ea,10,55,64,82,\

26,14,00,00,00,1e,85,56,48,30,0e,35,0e,69,99,05,40,23,86,25,26,e8,9d,f0,4f

Line 5309 in F30BT:

20,00,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,dd,b6,ca,a4,9e,80,e1,3f,\

d0,d6,78,ff,9f,97,44,61,00,00,00,00,04,80,00,00,10,00,00,00,10,00,00,00,c3,\

7d,ab,3b,84,33,d8,08,2c,a1,96,0a,d0,89,0c,7c,52,00,00,00,3a,7f,bd,85,0d,b3,\

67,c1,8d,60,96,84,84,4d,8b,dd,d7,c7,ed,95,4d,69,a3,0b,3f,6d,81,9c,94,9e,80,\

28,7d,73,22,2f,fb,1b,df,26,24,9a,d9,68,af,12,4c,18,43,7a,75,2b,c1,04,72,bc,\

6d,24,43,54,af,3d,1f,96,07,5d,29,8f,73,30,3a,a3,b2,7d,c8,f9,f1,1b,d2,03,d9,\

ba,14,00,00,00,7d,1b,39,c9,e7,80,79,54,16,da,0b,88,d2,71,66,13,56,ee,77,3d

Nice comparison! We've got to analyze that differences, gps values etc.

Also great to hear that v1.2 is working for you and registry backup also!!

My PRG0 and PRG1 have different files prior to hacking (pioneer ap ver 2.002 on PRG0 and 2.003 on PRG1). I started over with this procedure:

Deleted PRG.FLG

Deleted PRG0, and copied all files from PRG1 to PRG0 (now they are both the same with newest firmware 2.003)

Installed condihack v1

Updated with condihack v1.1

updated with condihack v1.2

 

Bluetooth is now working fine. The only difference was that I replaced have the same files in PRG1 and PRG0.

 

My MSNDirect is still showing as 'inactive', but that could be a seperate issue unless others have the same problem... MSN Direct also showed as 'inactive after I restored everything from backup...

Happy to read that it works now! Good that you installed all versions ascending, in next updates there will be check if installed version is the previous one, if any other then it will not update.

V1.2 Test Results

The installation worked flawless. After installing v1.2, I lost bluetooth. I tried to pair my phone again, and it just locked up the system. I rebooted and went to the service information screen and it showed Bluetooth Firmware version as "-----------". I went into test mode and deleted HMIManager.exe and replaced with the original. Rebooted again and my Bluetooth was paired to my phone and Service Information showed Bluetooth firmware version as "3.22". Thoughts? Any other test you would like me to perform?

Thanks for testing friend! I have to check it with my device. Its strange, because it uses HMIManager original exe when booting stock pioneer software.. Today I will make some more tests.

----edit:

Just tried on my unit. No bluetooth issues. Bluetooth works, paired with my phone, in system settings I see bluetooth firmware version - also 3.22. Please check if your PRG1 files are the same as in PRG0? Maybe different HMIManager.exe or other files?

PS. testing autoclicker ..

I'm also curious to know if there is any way to write a script to automatically hit the "OK" button for you..<-- that one will be last, as I seriously doubt that it's possible...

I will check autoclick on OK nice idea I've made some script with autoclicks on sony nv-u73/93 units to autounlock gps port on boot. It should work I will post info later/evening!

PS. Please confirm is v1.2 update working for you guys! I tested it twice, so it should work perfectly

Does v1.2 replace the hacked av.exe with the original Av.exe?

Yes, automatically from PRG1. Everything is automated

All you need to do is to have 1.1 already, have unmodified PRG1,

and put 1.2 update on SD/USB

I've made some scripts to auto change HMIManager,

not to do this manually from TestMode.

Now its easy as hell going sleep now, will be back in morning! good night!

Condi, can you also keep an updated list of all files that are changed or replaced as you create the updates? This would provide an easy 'back to stock' path. Just need to replace the changed/updated files with the stock files from our backup. I created a FULL backup of USER and NDATA today. NDATA took forever...

Only one which was replaced till now was Av.exe.

Now instead of it hackmode 'is in' HMIManager.exe file.

If you want to revert it back, then just delete it, copy original .exe.

Also in Apl directory there are added:

explorer.exe, explorer2.exe, MortScript.exe, and HMIManager.mscr.

Thats it.

finishing v1.2 with auto-migrate HACKMODE to HMIManager ..

--edit:

DONE. Please post results. Update only from v1.1! I used some trick to replace HMIManager - which process can't be killed (unit freeze), and can't be deleted/overwrited! Unit will temporary use PRG1 with autoscript for one reboot, replace HMI and back to normal state, everything will be nice and clean with stock exe's in PRG1

Now we've got no processes from PRG\Apl directory.

br

condi

---edit: unpacked EU090RGD - in AstProc.exe I see something like:

C:\WINCE500\platform\PF09Light\target\ARMV4I\retail\ASTPROC.pdb

and

OSSwitch_ServiceThread

OS Switch? More and more I think that like rrolff said, its 2-units device, 1-navi with wince and software, 2-audio/hw/fw - with control of audio, gps signal, hw buttons etc.

But If pioneers Navi.exe has access to gps port/signal, then we could gain that access! ...but how?

dump-EU090RGD.zip

a app killer is running

possible... look at windows explorer - try to run 'my device' - it tries to run, then instantly closes!

i've got another idea, preparing some script and going down to my car!

---edit:

OK so:

1. tried to autocopy full wince 5.0 to windows directory on boot - fail,
   
2. tried to copy 'Control Panel' only directory - control panel runs, with some new applets, but almost all of them are not working, fail,
   
3. tried to copy some dlls and explorer.exe to windows directory - the same as now, fail,
   

After that I checked again active processes:

• 
   
  
• \Windows\AstProc.exe - ?? interesting
  
• \NAND\PRG0\Apl\Av.exe - AV, part of pioneer software,
  
• \Windows\device.exe
  
• \Windows\filesys.exe
  
• \Windows\GpsMc.exe
  
• \Windows\gwes.exe
  
• \NAND\PRG0\Apl\HMIManager.exe - interesting, part of pioneer software,
  
• \Windows\NEventWatcher
  
• \Windows\NK.EXE
  
• \NAND\PRG0\Apl\Pserver.exe - part of pioneer software
  
• \NAND\PRG0\Apl\Navi.exe - Navi, part of pioneer software,
  
• \NAND\PRG0\Apl\Voice.exe - VR, part of pioneer software
  

So I changed HMIManager process to file explorer.

HMIManager is first (I think) process, before AV and Navi, which is managing all other pioneer stuff.

After changing HMIManager I've got active processes:

• \Windows\AstProc.exe
  
• \NAND\PRG0\Apl\Av.exe
  
• \Windows\device.exe
  
• \Windows\filesys.exe
  
• \Windows\GpsMc.exe
  
• \Windows\gwes.exe
  
• \NAND\PRG0\Apl\HMIManager.exe
  
• \Windows\NEventWatcher
  
• \Windows\NK.EXE
  
• \NAND\PRG0\Apl\Pserver.exe
  
• \NAND\PRG0\Apl\Navi.exe
  
• \NAND\PRG0\Apl\Voice.exe
  

So as you can see, we just had got rid of pioneer processes

One strange process left, AstProc.exe - anybody knows what it is?

As far as I can see it runs faster, tomorrow I will make update for HACKMODE,

to 'move' it from Av.exe to HMIManager.exe.

We are getting closer.

Oh and I will anticipate questions: no, gps signal/port is still not working

br

condi

Added ToDo list in first post - writed down what are we fighting for

Its good to have some goals/targets. Any suggestions and your own needs?

Other interesting news: USB Mouse is working!!!...no pointer though but I can click an navigate menues.

haha good one try also usb keyboard. until we've got not working control panel we cant change options of mouse and keyboard.

somehow we should be able to enable the pointer..

Confirmed that is exactly what was wrong!!! I have a z110 with the shortfuse upgrade and i had the PRG.FLG file did exactly what garrettoomey did and works like a champ now! Thanks man! Now where is everyone getting the igo8 software from?? Where can i get a copy?

Glad that at last you've got working hackmode about iGO8 - there is no working/free gps port - for now.

[HKEY_LOCAL_MACHINE\SOFTWARE\Information]

"ProgramDrive"="USER"

"ProgramDir0"="PRG0"

"ProgramDir1"="PRG1"

"ProgramFlag"="PRG.FLG"

"ProgramVolumeFile"="VOLUME.DAT"

Its the same, so PRG.FLG is some kind of 'switch' from PRG0 to PRG1, and it runs PRG1 apps.

I think that I will make some script, which will check for PRG.FLG - if yes, then it will run PRG0 av.exe, also user will have to copy prg1 as prg0, and hackmode file to prg1. Little twisted thing

Hey Condi excelent work here! I've tried this on my Z120BT and was able to follow your steps, however, I am not able to copy and paste USER file to the SD card. The selection is greyed out, unless I open USER and select all then copy. But when I move back to SD it will not copy to the root of SD even after the unit says that it is pasting the files. I have even made a "save file" folder on the SD to save to and it still didn't work. Am I missing a step or has Pioneer put a block on this?

I wrote all the description from my memory, there could be some mistakes

Condi,

 

There is a button for GOOG411 where the phone number is now inactive. BTW I don't have any programming skills, but I do have a question. Would we be able to reprogram the phone number? Using notepad I am able to open the file. The following phone number is inside 14252964544. Would it be as simple as just editing the phone number to a desire number?

 

Thank you very much.

 

NDATA\TEL\GOOG411.DAT file contents:

14252964544

 

BTW I'm referring to the Z110bt/z120bt model.

Make backup of the file, modify, and copy via file explorer or pioneer testmode If that .DAT file is with plain text, then it should work.

Just try But what about inactive button? Its because of that number? I will check it also, but after my work, later this day.

Great video thanks for making and posting, it will help some user to see how testmode ui works!

Can I add it to first post into description?

br

condi

Downloaded new files from above and does nothing... Am I doing it correct based on my description above?

Hi again, it should make backup to fullbackup.reg, about 0.5mb, silently without any message. Your file is still empty?

I extracted the 5 files in your zip, installed on SD, started hack mode, started file manager, navigated to SDMMC, and double clicked backupregistry.exe but nothing happens... Suggestions?

Same...

Fixed! Check it now guys, and let me know if it worked for you!!

will check it later guys when i get back to home!

Hey Condi.

 

I am thinking about a patch on the fly ,like a script to run on startup to both apply some registry hack and copy

files like explorer.exe to windows folder. in every startup the system will run the patch and goes to full work, without need

to change original EU090plt.prg. this will be safer than messing with that.

 

So i also tried to run Nk.bin extracted from EU090plt.prg into device emulator from microsoft v1 (v3 dont work in my PC) using cpucore armv5 and i get error,

i also tried to convert nk.bin to nk.nb0 and i got a normal start with blank screen , no error. Do u have some experience with creating images .bin to CE? i could not find CE SDK or Microsoft® Platform Builder for Windows CE 5.0

I've also tried to run emulator with one of bin images, of course without luck.

I'm not an expert, its just my hobby ;) We would need that kind of expert

As you noticed many of applications just doesnt run, maybe this would be solution for this problem:

http://www.t-hack.com/wiki/index.php/Disable_TrustModel

---edit: it will not be related to 'trustmodel' >> there is no certmod.dll forget about it

I am not sure how to access the registry in wince. Let me know and I can check it tomorrow morning. Attached is PRG.FLG

 

BTW, it would be nice if there was a way to tell which version on CONDIHACK is currently installed. I am not sure if v1.1 installed or not... It just flashed the boot screen a couple of times, and then loaded wince.

 

I am not sure if PRG.FLG only shows up on Pioneer updated unit or not. My understanding on Shortfuse's upgrade hack is that he increments the version number so the unit 'thinks' it's a new update so it will install. then his DLL bypasses the authentication.

Hmm... your PRG.FLG looks for me empty maybe its just dummy file like our hackmode.key

In attachment there is some app with script I made to make full backup of registry

Just run BackupRegistry.exe via file explorer, and wait some minute to get data - fullbackup.reg.

br

condi

PS. Update works the way you described after the update you have new file manager instead of the old-blueone,

and 'CONDIUPDATE' directory will be deleted. I will think how to give some info about current version.

---edit:

I've attached the files from my dump

In your unpacked dump of wince, there are three files with registry:

boot.hv, user.hv, default.hv.

Now just edit it, repack it, write it to device and... brick? or success? :D

Registry editor with HV support: http://www.ceregeditor.mdsoft.pl/files/CeRegEdit_Setup_0.0.5.2.exe

---edit:

RegistryBackup tool fixed!

Just unpack directory to SD/USB to root like:

'\SDMMC\RegistryBackup\BackupRegistry.exe' or

'\USB\RegistryBackup\BackupRegistry.exe'

and run it

RegistryBackup_ok.zip

This worked perfectly! I see 2 potential solutions for this.

1. If you have USER/PRG.FLG then copy all files from PRG1 to PRG0 and all files from PRG0 to PRG1 (from your backup). If there is a 2nd page of the file listing, be sure to copy of the 2nd page as well. Then delete USER/PRG.FLG and follow Condi's instructions. I created a complete backup of USER and copied to PC. Then I renamed PRG0 to PRG1 and PRG1 to PRG0 using my PC on the SD card of the backup. Then using test mode, I deleted USER/PRG1, USER/PRG0, and PRG.FLG. Then copied the entire renamed PRG0 and PRG1 from the SD to USER on AVIC.

 

2. Condi may choose to modify his install to look for PRG.FLG to determine which directory to use based on the PRG.FLG status. No PRG.FLG use PRG0, if PRG.FLG exists, then use PRG1...

 

Thank you to Condi and everyone else working on this project!

PRG.FLG flag-file occurs only when device was updated with official pioneer update, am I right?

I can modify script to check if PRG.FLG is on the device, but user will have to copy hackfiles to correct path (PRG1 in this situation)

Hmm... maybe easier way would be look on PRG.FLG content, and maybe automatically modify that file? Change PRG1 to PRG0?

Can you post that PRG.FLG?

Since I already had the 120 upgrade installed, it will not take shortfuses hack...

As far as Im concerned it was hack with only one .dll file?

You could just copy now that file via testmode/hackmode to get working all the fw updates

Am I right?

PS. Nice to see that our group of hacked avics is increasing !

br

condi

----edit:

I can read value of default app directory with registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Information\ProgramDir0 = PRG0

HKEY_LOCAL_MACHINE\SOFTWARE\Information\ProgramDir1 = PRG1

Could you please check your values, if they are different/reversed?

Attached full registry backup of f30bt! pass like always

registry-f30bt.zip