morus

15 hours ago, RonS said:

He has never posted exactly what firmware he has and that splash screen doesn't indicate a model.

Look to the lower left corner of the image he has posted. It says "AVIC-F40Bt"

Hi Mafradon,

I haven't worked on this for quite some time, so I might not remember all the details correctly. The problem is that if you want to use the internal GPS, you need to get access to the virtual gps com port that is normally blocked by navi.exe. In my hack this is done by reloading the virtual com port driver, but this causes navi.exe to lose the GPS data stream. So with this method it is not possible to have igo and navi.exe working at the same time even if you use a portsplitter, because you cannot get navi.exe to reopen the GPS com port. The only way would be to cook a new winceimg.bin such that the portsplitter gets loaded before navi.exe. But this is dangerous, because you can easily brick your HU.

Pioneerus works in a different way, i.e. it reads the NMEA sentences via undocumented Pioneer API calls and feeds them to a virtual com port driver.

Alternatively you could use the debug port on the back of the HU to connect an external GPS mouse.

4 hours ago, RonS said:

First make sure that your parking brake is detected as set. Go to Settings / Navi Settings / Connection Status  and make sure it says Parking Brake is On. When Off, some settings and functions are grayed.

Thanks Ron, but it is not an issue with the parking brake. As I said, I did a lot of tests including direct access to the parrot module via AT-commands and it is all fine. It is just the communication with the Pioneer BT application software that does not work. Somehow the settings in USER\RW\SETUP\BT\BTUNIT.DAT got messed up. That's why I need this file from a working unit. 

I have the same issue with greyed-out BT settings as many others. I have tried a lot of things like flashing different firmware versions of the BT module, erasing its stored data and verifying that the module itself is working fine via supertestmode. My final conclusion is that not the module is faulty but the pioneer software that controls it. I am pretty sure that it could be fixed by replacing the files inside the folder USER\RW\SETUP\BT with the ones from a working unit.

Does somebody have a backup copy of his unit available and could provide these files (esp. BTUNIT.DAT)? Or would somebody be so kind to copy them via supertestmode?

Just put the attached file in the root of an SD-Card, navigate to \USER\RW\SETUP, mark BT for copy, navigate to \SD and select paste.

TESTMODE.KEY

On 9.2.2018 at 2:56 PM, timmen said:

Thank you Godzilla and RonS,

just finnished updating my F920BT to the 2017 map version!

1 I used the shortfuse hack (patched the altered renewallFlib.dll in Prg1)
2 next I booted with the 2017 update on SD card and when prompted entered the password PASSWORDPASSWORD.

Like a glove!

Unfortunately the bluetooth update did not fix my limp BT.
It still reads --------------- under BT version. As if there is nothing there to update from.
Do any of you know what files need to go in which folders using testmode.key?
If at all possible..

Thanx again to the Headunit Grandmasters! 

 

I have exactly the same problem. I managed to update the BT firmware via the supertestmode but it did not solve the issue for me. It seems that some settings in the application software are messed up. It might have to do with the file in \SETUP\BT\BTUNIT.DAT . Can anyone provide a copy of this file from a working unit?

Anyway, if someone wants to try to update the BT firmware via supertestmode, just put the 3 files that are contained in the latest map update in \FIRMWARE\BT on an SD-card in the folder \AVICZ110\BLUETOOTH and select update bluetooth firmware from the "forced firmware write" submenu in the supertestmode. Use the paths exactly as given even if you don't have an avic Z110.

You can also check if your BT module is working from the testmode. Just go into the "Tel test" submenu. here you can open and init the connection to the module and pair with your phone. Once paired you can dial a phone number from this menu. My BT module works fine this way. Also the BT firmware update was successful, but in the settings BT is still greyed-out. So it definitely must be a problem of the Pioneer application SW and not of the Parrot bluetooth firmware.

Don't know which version it is exactly but should be the lastest one. Pulled it in 2017 from Mike Decaro's repo shortly before it went down. Runs nicely on my Ipod touch 4 with IOS 6.1.6. Don't trust the filename. It was generated automatically by the redeb tool. Might very well be derived from a reference to an outdated version somewhere in the deb config files.

New version with working virtual keyboard

morushack_1.3.zip

New version 1.2 with script optimizations and integrated port splitter for (hopefully) better stability of the internal GPS data stream. Use com9: at 115200 bps as the NMEA source in your preferred nav SW.

Previous versions of the hack must be uninstalled before installing this version as the runscript intercepts now navi.exe instead of voice.exe.

Long term goal is better integration with original SW (now you can switch back and forth between orig. SW and hack, but you cannot listen to mp3s or answer phone calls while in hackmode). I also plan to add a dab+ receiver (FS-Silicon verona with sermmi firmware) via com1: and an ODB trip computer (hobd-standalone is already running, just need to connect my ODB dongle via com6:). And finally I want to add support for WLAN SD-Cards and a VNC client.

morushack_1.2.zip

adzaM,

On the f30bt I start Igo via the "APL exit" debug mode. In this mode av.exe is not running. I do not know how av.exe behaves if I replace navi.exe with igo. Maybe I will try that when I find some time. So far I cannot give you any advice. Sorry.

Now even with working internal GPS! See readme.txt for instructions. PW is avic411.

For those that are trying to run Igo on japanese MRZ HUs: In order to get the internal GPS working you need to

1. kill gpsmc.exe

2. reload the com7: device driver using "reloaddrv.exe COM7:"

3. retart gpsmc.exe

See Voice.mscr for mortscript commands to perform these steps.

morushack_1.1.zip

I have made some progress in running Igo on my AVIC f30bt. This hack is heavily based on the Condi-Hackmode v. 1.4 and on the poseidondebug mode that has been found by pionara .

It allows you to run Igo 8.3 and probably also other 3rd party nav software using an external GPS receiver with sound and even TMC working.

This hack was tested only on my f30bt using the 2017 european map update. You might brick your device if you try this with older software versions. So please update your unit with the 2017 maps before you try to use this hack.

Just put all the files within the morushack_1.0 folder in the root of an SD-Card. Put this into the HU, once the testmode screen is visible go to file maintenance and navigate to \NAND folder and check if you have a file called "PRG.FLG". If you have it, go to the \NAND\PRG1\Apl folder, otherwise go to the \NAND\PRG0\Apl folder. All files and subfolders from the folder "to_be_copied_in_APL_folder" must be copied here. But before you can do this, you must delete the file "Voice.exe", because in the testmode file maintenance mode one cannot overwrite any files.

If you later on want to remove this hack, just delete all the files that have been copied to this folder and rename "Voice1.exe" in "Voice.exe".

Before you restart the HU, delete both the "TESTMODE.KEY" and the "autorun.mscr" files from the root of the SD-Card usinf the file maintenance menu.

Your HU should start as usual. Now you need to enable the hidden debug menu as follows (has to be done only once):
1. go to navigation menu, favorites. edit existing or add new favorite. (search method does not matter - just need to get to the "name" field)
2. while in "edit favorite" view, click on name button. you should now see the keyboard to edit the favorite name
3. here you type in "POSEIDONDBG ON", but then instead of hitting OK, press and hold the top center of the screen.
4. it should go back to map screen, and you have enabled debug mode.

You will notice some debugging output overlayed on the map screen. Don't worry you can turn it off in the hidden debug menu. To enter the debug menu: go to navigation menu, then press and hold top center of screen. If you get a red text that reads "ERR" or a blue text "GPS", you can turn it off via the GPS debug entry in the hidden menu. Just go to log and disable GPS logging.

You can now start the hackmode via this hidden debug menu. Open it and select "APL Exit" from the list and after 10-15 seconds you should see the windows ce desktop. Now you can launch any ce program you want. You can go back to the AVIC original software via the "restart" link on the desktop. If you want to get sound output from ce programs, you need to play an mp3 from either the sd-card or an USB drive while you chose "APL Exit". Otherwise you will have no sound other than the source that was selected while you got into the debug menu.

If you want to start automatically any software (e.g. Igo) instead of the windows ce desktop, you can put the "autorun.mscr" file in the root of the sd-card (or a USB drive) and adjust its contents with a text editor accordingly. I run Igo 8.3 in this way using the following sys.txt file:

[folders]
app="%SDCARD%/iGO8"

[interface]
skin="ui_igo8"
vga=0
mapfontscale=100
show_exit=1

[rawdisplay]
class="landscape"
highres=0
screen_x=800
screen_y=480

[tts]
tts_buffer=131072
tts_logics=3
priority="HIGH"
always_say_road_names=1
announce_street_name=1
expected_engine_delay=1400 

[debug]
skip_eula=1
enable_roadshadow=1

[map]
auto_nightmode=1

[tmc]
port=2
baud=38400
source="gns"

[gps]
port=1
baud=9600
source="nmea"

Currently the internal GPS receiver is not working, but you can use an external receiver. See the end of the Condi Hackmode thread for an explanation how to connect an external GPS receiver. I already have an idea how to enable the internal GPS receiver. However, due to lack of time it is unlikely that I will succeed...

morushack_1.0.zip

Hi morus,

 

May be I'm completely on a wrong track but I want to ask a question about GPS antenna. As far as I understand It's current antenna's port is locked by a DLL file so, if we don't want to use it's original navigation application this antenna is useless for us. Is it possible to detach this antenna from it's current connection and connect it as you explain to COM1? My unit came from Japan and it's navigation app. is totally useless for me. Thanks in advance.

No, not possible, because it's only an antenna. You need to connect a complete receiver. It does not need to be a M8N. You just need a GPS receiver that has a TTL UART output. M8N is attractive because it is highly sensitive, it supports GPS/GLONASS/BEIDOU/GALILEO, and it is relatively cheap because it is often used in chinese drones...

hi javed akhtar did you manage to run the gps to get signal from satelites?

Take a look at the condi hackmode thread. I have explained there why you can't use the GPS port. It is already opened by "NPGPSENGINE.DLL" at the point when navi.exe is started and it cannot be opened twice. You either need the "Pioneerus" hack to get access to this port (ask forum user "Sanik") or you need to use an external GPS receiver as described in the condi hackmode thread.

manio112, the mrzs seem to use the same AV-connector as the f30bt. So I am pretty sure that they will have the COM1 port available as well since it is used by the pioneer software developers as a debug port (debug output can be turned on with the "POSEIDONDBG ON" method as described by an old post of pionara here in the forum).

Here are instructions to get you going:

Connect the TX pin of the M8N to pin 24 (EXTOC) of the AV connector and the RX pin of the M8N to pin 12 (CTOEX). You can use the "KMODE" connection method for the handbrake signal detection override as described on youtube to make this connection despite missing leads on the AV connector plug. Alternatively, if you don't need any other signals from the AV connector, you can also remove the Plug and use so called "jumper cables" for breadborads to connect to the pins on the AV connector directly. That's how I did it.

GND and VCC for the M8N can be taken from the USB port of the AVIC. Just use a USB Y-adapter cable that are used to power mobile USB harddisk and cut off the secondary USB plug to tap off GND and VCC. GND is usually the black wire and VCC the red one, but I recommend to double check with a multimeter.

I am using a GY-GPSV3 M8N PCB-only module that I ordered from ebay, but you can also find M8N modules for drones that come complete with a housing and wires.

BTW., the method you suggested to get audio working does not seem to work for the f30bt, because as soon as av.exe starts it will occupy the screen. So I do have to start Igo instead of av.exe and can't start it instead of navi.exe. This seems to be also the rootcause for the missing audio, because av.exe seems to be needed in order to initialize the audio path from the codec to the speakers.

The GPS port (which is on com7:) is locked because it is not opened by navi.exe directly, but instead by a common DLL that is used by several processes. Navi.exe, av.exe, ... get the position information via a function call from this DLL. Unfortunately the port is opened at a very early stage of the boot process and registry mods do not survive a restart so a portsplitter cannot be injected. However, if I would know the function call to get the position information I could probably write a virtual com port driver that provides an NMEA stream to Igo. I think this is exactly what the PIONEERUS software does. But PIONEERUS is not free and it does not work anymore with newer software versions. Does anyone have PIONEERUS installed and could provide the files?

Here is a backup copy of the ios 6 version. Rename from .pdf to .deb and install manually with dpkg.

com.decaro.appradioextensions_2.0.1-450_iphoneos-arm.pdf

I played a bit with my good old f30bt and have now igo 8.3 running with working GPS using Condi's hackmode 1.4.

I am using an external TTL-serial-GPS receiver (u-blox m8n) on the AVIC's com1: serial port which is accessible via pins 12 and 24 of the AV connector on the back of the HU. The GPS module can be connected directly without any level shifters as both the port and the module use 3.3V signal level. Its 5V supply voltage can be taken from the USB port of the AVIC.

I have even TMC working using an external GNS TMC module that is connected to the serial port which is normally used for the CAN bus adapter on some AVIC models. It is accessible via com6:. However, this port requires levelshifting because it uses 5V signal level and the GNS module uses 3.3V signal level.

I am even able to switch back to the original nav software. The only thing that is not working is voice navigation in igo. Does anyone have an idea how to get audio from igo?

btw.: It should even be possible to use the internal GPS. If GPS debug mode is turned on from the hidden debug menu (see pionara's posts about that and use "POSEIDONDBG ON") the full NMEA data is logged in a file on the SD card. I tried to write a virtual com port driver that contiuously reads from this file. However, it does not seem to be that easy because the file is written in non-shared mode. For now I will stick to the external m8n GPS module. The m8n's excellent reception makes up for the missing dead reckoning feature nicely. And these modules are very cheap on ebay.

Here is my working sys.txt for igo8:

[folders]
app="%SDCARD%/iGO8"

[interface]
skin="ui_igo8"
vga=0
mapfontscale=100
show_exit=1

[rawdisplay]
class="landscape"
highres=0
screen_x=800
screen_y=480

[tts]
tts_buffer=131072
tts_logics=3
priority="HIGH"
always_say_road_names=1
announce_street_name=1
expected_engine_delay=1400 

[debug]
skip_eula=1
enable_roadshadow=1

[map]
auto_nightmode=1

[msnd]
enabled=0
msnd.start=0

[sound]
auto_mute=0
mute_os_key=1
queue_length=200
sound_muted=0
sound_q_length=200
sound_volume=255
use_os_volume=0
voice_muted=0
voice_volume=255


[tmc]
port=6
baud=38400
source="gns"

[gps]
port=1
baud=9600
source="nmea"

Sorry to resurrect a thread "declared dead", but I would like to point out some recent events..

The iPhone 4S can be downgraded to iOS 6.1.3 now (as long as you aren't on iOS 9.1), so all those out there (like me) who have some old iPhones hidden away in drawers might consider giving them a new purpose.

 

I would like to know if anybody still has the appradio 2.30 ipa file?

after all, appEx for iOS 6 worked amazingly!

v2.5.0 should work as well. You can find it here: https://drive.google.com/file/d/0Bwm8F8PcTszsZjBLWktuZWpyVjQ/edit?usp=sharing

Pioneer seems to disable older versions if they are started while an Internet connection is available. So you need to install a firewall from Cydia and disable Internet access for the AR app.

Prerolll, do you still have the .ipa file for v.2.3.0 ?

I have a solution for the non-working GPS in hackmode. You can connect an external GPS receiver instead of the TMC receiver on the backside of the AVICs. The connector for the TMC module is just a standard serial port with 3.3V TTL level. So you need a GPS receiver with serial NMEA output at 3.3V TTL level. Alternatively you can use an old RS232 GPS-mouse in combination with a RS232-TTL converter such as max3232. The pinout of the connector is described in the service manual of f40bt that can be found on the internet. Your alternative nav-software can then access the GPS receiver via the serial port that is associated with the TMC module. The same should be possible with the connector for the CAN module that is present on some AVICs for VW and Ford AC and PDC control, because this is also just a standard serial port.

If you want to keep the TMC receiver, you can still use this approach, because the FM6 TMC-module from GNS that is used inside the Pioneer TMC receiver features NMEA pass-through from an auxilliary serial port. You just need to connect the GPS receiver to this aux port (again 3.3V TTL-level). Somewhere I have the pinout of the FM6 module in case someone is interested in this method. I have tested the latter with Igo 8.3 on a different device (not an AVIC). Igo detected automatically the combined TMC/GPS data stream and both TMC and GPS worked nicely.

All I'm saying is that the Apple VGA Adapter is a video only device and it is not capable of handling Audio or Touch control data. 

The VGA adapter has lightning pass-through. Do you know, if it is possible to connect and operate both the VGA adapter and the lightning-to-30-pin adapter at the same time using this pass-through connector? The reason for the incompatibility of the Iphone 5 with the 30-pin cable of the avics is that there is no composite video output via the lighntning-to-30-pin adapter. However, audio and touch control signals are available with the 30-pin adapter. So, the solution could be to add composite video to the 30-pin connector via the VGA-adapter and a VGA to composite video conversion box. There is this 3,5mm plug at pioneer's 30-pin cable. One of the 4 pins on this plug is composite video. If we are lucky, all that needs to be done is to build an adapter cable to inject the composite video signal from the conversion box at this 3,5mm plug. However, this solution requires that the lightning bus is able to handle both the VGA adapter and the 30-pin adapter at the same time. It is also not clear, if the appradio app will work in this scenario.

The problem with the Apple Lightning to VGA adapter is that it only passes video.  It does not pass audio nor will it pass touch commands from the headunit back to the phone.  If you connected an Apple Lightning to USB cable from a PC to the lightning jack on the VGA adapter, you will see that the PC recognizes it as a USB charging device.  Adapting the VGA adapter to composite and connecting it to an Apple Lightning to Apple 30-pin Dock adapter will also only pass Video, thus it will also not work.

 

For the Z140, there appears to be additional processing (probably done by the uCom update) that allows it to pass audio and touch commands via Bluetooth. 

 

It does not appear that the Z130 or earlier version are capable of performing that additional processing.

 

I'm still waiting for Pioneer to do something with iOS in the car, but they did go one step in the right direction with Siri eyes free and capacitive touchscreen.

Ok, so the Lightning Bus is not able to handle more than one connected device. Is that what you are saying? I don't think that there is a real limitation on the uCom side, because uCom is only responsible for the analog A/V-routing and the tuner control. Bluetooth is controlled by the main processor. I think that pioneer just don't want to provide that update for their older models for obvious reasons. They want you to buy a new model.

Ok, another alternative would be to permanently connect an older IPhone or IPod touch that has a VNC client app installed. Then you could connect to the VNC server app on your Iphone 5 via wlan tethering. That should give you pretty much the same functionality as the appradio mode. In fact, the Mirrorlink protocol on the newer avics and appradios is based on VNC as well...

No luck with either cable - got ahold of Pioneer since their phones were actually routable today and they confimed that Z140 hardware was different.  Looks like i'll be using my backed up USER folder to go back to the previous version as well and will try the lightning to 30 pin method so I can at least get tunes even though I will have lost video, or maybe i'll sell the unit.

An alternative solution that could enable video on a pre 2012 avic with an Iphone 5 could be to buy both the lightning to VGA and the lightning to 30-pin adapters and then to provide the missing composite video signal at the 30-pin connector via a VGA to composite converter. This video signal could then be injected at the 3.5mm plug of the Pioneer 30-pin Iphone adapter cable. This could even provide full Appradio mode support...