ltl2007

Thats what i was workin on, until i realized that that code is probably in the flash memory on the unit, not on the HD. If anybody has a way to get into the flash, them that would help A LOT!! I tried to copy explorer.exe from my PC the the HD and rename it to NAVI.EXE or AV.EXE and see if it might run, HEHE, no luck with that. Maybe in the bootscreen there is a copy utility or something.

if i remember correctly theres a few post about them. i believe they are just gps antenna switches. after your unit goes through initialization (100 miles or so) it becomes inactive.

i think the z2's were flying off the shelf because nobody knew it didnt have a bypass yet. we sold 4 or 5 when they first came out, and since march havent sold ANY!! we are selling kenwood, eclipse, or even valor instead. Also, one of our distributors said that after about 6 months or so from a product release, they get weird "anonomous" faxes on how to do the bypasses. I wonder who they are from?? Pioneer? I think yes.

ok well i messed around with the dll's and exe's and all i got was either a no boot, an error, or constant restarts. im going to open a few Dll's in C++ and see what i can do. i think i found the line that we need to edit. ive attatched a screenshot, its the hilighted line. anybody else out there know C++ really well?

henry, thanks for the info. im workin on swapping files right now. i have my fingers crossed!!

henryj, im going to swap exe's one by one tomorrow and see which one is the one causing the issue. or maybe two or more. hopefully its as simple as replacing an exe. i will let you guys know tomorrow. Also, when you were swapping drives, did the Z1 bypass work when the Z2 drive was installed?

Hey guys. I downloaded the Z1 files in the PRG0 and PRG1 folders, and except for a few DSM files, the files are identical in name and quantity. they are not the same in size. If indeed there is a registry file or boot INI then most likely on the flash memory, like i was saying so long ago. I decompiled all the apps in the folders mentioned above, and they are different. Im going to try and swap them in my Z2 and see if it does anything

hyperite, i need the files in the SDATA/PRG0/APL and PRG1/APL folders. from what i have seen in the DLL's our mods probably need to go in there. I need to compare them.

ive been trying to FTP out the Z2 image i have, but at 17GB it takes almost a week. if anybody wants one i can burn them to DVD and mail them.

for anybody out there that needs/wants this, here is a breakdown of all the files on a Z2. Z2 FILE LIST.txt

hey guys. right on with what you guys are saying. There are a bunch of other lines as well. i will try to get maybe a text file or a pdf posted on a couple things. there are a bunch of things in strating to figure out with how the OS for the Z2 works. especially that all the changestate and doaction commands are only in 3 dll's. im going to try swapping the same dll's from a Z1 and see what happens!!

why didnt u just unscrew the drive from the tray like everybody else?

it says in my last post. the filename is in the title of the app.

titos, thanks for the info. every bit helps a lot. i have another couple lines that might interest not just me and you, but maybe everybody out there might have some idea. ive attatched a jpg file. the file is aplcommonlib.dll in the SDATA/PRGO/APL folder. im still workin on a way to save it as a txt. i dont know what language this is in, but there are a lot of IF's in there, which remind me of the old QBASIC days.

about the dll, i found a file, i forget what the name is. Im currently at work. It has a bunch of lines that say ??DOACTION then the same as the attatched file i posted earlier. I will try to get some more code up tonight, maybe as a text file so everybody can look at it. Maybe thats our bypass answer right there. My brother in law is a senior programmer for a medical firm, im going to talk to him today about helping out.

hey all. i think i might have made a huge discovery in this Z2 bypass problem. I disassambled the AV.EXE file under SDATA\PRGO\APL. i found a few lines that state some "statechangebypkbstatus" and a bunch of others. there is also one that states "drivingstatusbyinterlockchangedevent" Im gonna mess around with these and see what happens. maybe we just need to take a line out somewhere!! check out the screenshot i attatched. i need to buy the software so i can copy lines of code.

hey all, I have a Z2 image from a unit that has been installed for about 3 months. If you want a copy, PM me and I can give you my FTP, or if you have one I can upload to, let me know. I can also burn it to DVD-DL and mail them out. I have cable internet, but it is wireless so its not super fast with my past experiences with my FTP server.

Hey all, i have a Z2 image from a unit that has been installed for about 3 months. PM me if you want my FTP address or if you have an address you want it sent to. Im going to try to mess around with it myself over the next few days at least.

DB, Im going to try to use AFF tonight to unlock my Z2. The old version of AFF stopped working for me (i had a hacked version). Any way I can get a key for the new one so I can supply an image to the masses. Ill even put the image up on my FTP server and give out a UN and PW to people that need the image (or wanna mess with it). Thanks, Jesse.

Hey guys. Ya i was just confirming what i read in another post about the hard drvies being locked even before first boot. Also, Hyperite i didnt have time to get my new IDE adapter today, im going to get up early tomorrow and pick one up. hopefully ill have a full image for you tomorrow night.

Hey guys. Just some more info regarding the Z2 bypass stuff. I got a brand new Z2 in today. I read from another member that the HD's in the Z1 and Z2 arent locked until the first boot. I manually folded the screen down and removed the hard drive, and plugged it into my adapter. Unfortunately, it was locked. I have a feeling that Pioneer does either a burn in or a software upload or just a function check before they ship them out, which would count as the first boot. Anywho, that was my Z2 experience today.

Ok i tried the Z2 in car with no HD. there is actually 2 switches that need to be pushed. there is one under the HD that needs to be pushed down, and the other one is pushed back by the HD cover that screws in. I taped both down to simulate a HD in place. Whatever source the Z2 was on before I took out the HD, it stayed on. A screen appeared and said "HDD is Unusable". i could hear whatever source i was on in the background. The rearview cam didnt work. I could change tracks on a cd, or radio station, or xm, but the screen stayed the same. My 2.5" HDD to 3.5" adapter isnt working today, so im

Hey guys ive been reading all your post. Yes it was me that said it will still boot without the HDD in. I was doing that on my test bench, not a car. I havent yet done it in my car. Maybe later today i can give it a try. anywho, the unit does still bootup. so we know, like some of you guys have agreed, we cant overlook the flash memory. im going to try to unlock the Z2 HD in my car today as well. o ya, and if u dont push down the switch the screen wont even come on

Hyperite, I will try to make a image of the Z2 i have tomorrow. If i can get it unlocked and working i will post tomorrow.

ditto, DB needs to delete this thread. Also, maybe we can get this whole bypassing the Z2 down to one thread so we have all our ideas in one basket. DB is that possible?? Thanks guys.