Melvin v/d berg

Well that sucks.. Still interrested in the mount command. Scripting isnt the way to go then. I'm interrested in the service manual. If you look there you see a possibility to boot from external sd card. You can find it in the wiring diagram there is a little table there. Another thing is the jtag connector. I am 90% sure that that is a way to unbrick. We can then safely modify and test all prg files. The point is the avic has a rtck wire. Adaptive clock. I dont know which (cheap) reader support that kind of jtag. The avic has 2 jtag connectors. One directly on the nand or somethin

Any progress yet? I am thinking of creating an app that uses the dll to decode. Only difficult part would be resolving the parameters needed for openfile and scanline. If there is someone who knows how to reverse engineer the dll that would be lots easier... NPCommonLib.dll has scanline. Inside scanline there is a sub function read. Inside read there is a lot of shifting going on. I think it is in there.

Thank you Condi!! Got Testmode almost working in the emulator. Testmode needed a LOT dll's. Took some time in the car with my sd card. Now the problem is that testmode want's to communicate with some data port. When I start testmode nothing happens. The following exception comes up in the debug console. I think testmode could start now on a real win ce 5.0 device. Trying some more things tommorrow. And one thing: I can see enough network things in testmode. IP, TCP etc. So an network card on the AVIC is possible. Maybe pioneer uses bluetooth to access the AVIC? romfiles.zip

pionara, true they dissamble in ida but are definitely corrupted. They don't run in the emulator. Also if you compare the dumpromx vs the one from condi you see a difference. Dumpromx adds a lot off zeros (ASCII) to some sections and some bits are different at the PE header. Condi, Would be great if you can find the script or just remember the windows ce app. I can code something to copy every file from the windows dir then. Would be great if I can run testmode on an emulator. Missing some important dll's now.

It is an old quote but could anyone help me with dumping these files. These files aren't corrupted from the post above but I can't find a way to dump the content of eu090plt on my pc. Tried dumprom,dumpromx and with parameters -5. Always corrupted.. Condi, Could you tell me how you dumped the files without corrupting them?

Pionara, Do you have some tool to encrypt scriptexec from the key in the testmode.key?

Access to the windows dir should be possible with the MOUNT command I think.. Now about decrypting the ScriptExec.ini: The exact string of testmode.key is: 006SCRIPT005NX0070000200.201002030.1122334400000ì There are two parts in here. First 20100203 which is a date 2010-02-03. Second is 112233440000 The two strings are sepparated by 0. which is in hex 3018. testmode.key always end with ì which is EC in hex. From this I think the key is 11223344, 1122334400 or 112233440000. Now about the encryption technology: In testmode.exe there is an external class (after a long search) N

It is not possible to put IGO on the x930bt or f930bt at this time... The GPS com port is in use by pioneer

Here is a scan of the pcb in the display unit. You can see the connectors here, processor and nand.

That might be also a possibility! There are so many ways we only need to execute them. I will try some things later. I already dissambled the unit once. Lot's of SMD components and I don't want to remove the radio from my dash at this time. If I'm right we can modify all system files but there is a danger of bricking? The PRG file we want to change (EU090PLT.PRG) has testmode.exe inside so a damaged EU090PLT.PRG will possibly cause a brick.

You almostly can't read the IC with a programmer. The ICs are BGA (Ball Grid Array) so soldering is almost impossible. The chip is really small and the pcb has 3 layers so tracking traces is almostly impossible... I'm sure that Pioneer can recover bricked AVIC's without soldering. The question is how. e-nand (4gbyte): IC4501 PEN002A hynix H26m31001EFR BGA flash rom (8mbit): IC4403 CXX3406 spansion al008j70bf102 BGA

I think you should connect the normal external usb connector (the cable that also has the audio jack input) to your computer. This usb connector is the USB1 controller on the tt4421 chip. This controller has a normal pin assignment (positive and negative data pins). See page 261 on the developer manual. The cn4001 pads is the USB0 controller. This usb0 controller has ULPI interface to connect. I don't know what it is exactly but is has a totally different pin assignment. (see page 232 on the developer manual). developer manual: http://www.4shared.com/get/ARDbpkFH/CSM-00364_RevC_SiRFprima_Dev

Hi guys, I'm currently also looking for a solution to mod the PRG files without the risk of bricking. The coredll.dll has to be changed I bought a f930bt and when i came home I discovered that it was locked with a password. The first thing I did was dumping the following chip: EEPROM IC1303 S-93C56BD0I-I8 The dump is in the attachment. Maybe it could be usefull. It was an huge challenge to solder to that SMD chip. After a search I found that I could retreive the password in testmode->file manager. So that problem is gone. Now on the CC monitor unit PCB there is a jtag conn