Jump to content
AVIC411.com
carver

if anybody need, extract files from WINCEIMG.BIN

Recommended Posts

1) my avic is UC and i use winceimg.bin from AVIC_F-Series_Firmware_Update_2.006000.zip

 

2) i use WinHex and cut WINCEIMG.BIN binSize : 17340884 checksum: 0x69711813

to 4 files toc.bin, eboot.nb0, chain.bin, wince42.nb0.

 

size for file you can get in WINCEIMG.BIN TOC.

 

WINCEIMG.BIN binSize : 17340884 checksum: 0x69711813
toc.bin 1364 bytes
0000000000: 53 49 47 2D 42 49 4E 46 53 20 20 20 20 20 20 20  SIG-BINFS
0000000010: 4E 54 4F 43 01 00 00 00 20 30 00 00 0F 00 00 00  NTOC    0  ¤
0000000020: 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF              ÑÑÑÑ
0000000030: 02 00 01 00 54 4F 42 45 65 62 6F 6F 74 2E 6E 62    TOBEeboot.nb
0000000040: 30 00 00 00 00 00 00 00 02 00 00 00 00 01 00 00  0           
0000000050: 00 80 03 8C 00 80 03 8C 40 00 00 00 00 01 00 00   __ __@    
......
00000000C0: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00              
00000000D0: 49 53 46 43 57 49 4E 43 45 34 32 2E 4E 42 30 00  ISFCWINCE42.NB0
00000000E0: 00 00 00 00 02 00 00 00 AF FA 00 00 00 00 04 8E         Їъ    _
00000000F0: 00 00 04 8E A0 01 00 00 AF FA 00 00 00 00 00 00    _   Їъ
......
000000022C: 03000000 0000C09B B8152A00 # => 002a15b8 -> 2758072 eboot.nb0
0000000338: 00000000 0040008C 28050000 # => 00000528 -> 1320 chain.bin
0000000444: 00000000 00000080 A079DE00 # => 00de79a0 -> 14580128 wince42.nb0

eboot.nb0: 2758072 bytes
0000000554: FE 03 00 EA 00 00 00 00 │ 00 00 00 00 00 00 00 00  ю к
0000000564: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
0000000574: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
0000000584: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
0000000594: 45 43 45 43 B4 89 D2 9B │ B4 89 12 00 00 00 00 00  ECEC_%Т>_%
...
00002A1AFC: 44 51 D7 C6 A3 46 E8 65 │ E7 68 65 00 40 00 00 00  DQЧЖ_Fиeзhe @

chain.bin: 1320 bytes
00002A1B0C: 02 00 00 00 00 00 00 80 │ A0 79 DE 00 00 00 50 02        _ yЮ   P
00002A1B1C: 01 00 01 00 00 00 00 00 │ 4E 4B 00 00 00 00 00 00        NK
...
00002A2024: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00

wince42.nb0: 14580128 bytes
00002A2034: E8 83 01 00 28 97 01 00 │ 54 0F 03 00 4C D5 04 00  и_ (- T¤ LХ
00002A2044: E8 1C 02 00 B4 85 01 00 │ 84 1D 02 00 AC 86 04 00  и _: " â”+
00002A2054: E8 1C 02 00 C4 56 05 00 │ 84 1D 02 00 3C 37 05 00  и ДV " <7
00002A2064: D0 6E 04 00 7C 71 04 00 │ E8 83 01 00 00 00 00 00  Рn |q и_
00002A2074: 45 43 45 43 F4 60 DE 80 │ F4 60 DE 00 00 00 00 00  ECECф`Ю_ф`Ю
00002A2084: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
....
00010899C4: 00 12 00 00 C7 04 00 00 │ F0 0F 1E 80 A8 FA 53 80     З  р¤_ÐÑŠS_

 

so, after that you can use dumprom -d acivce wince42.nb0

or other way for extract, or ADD :mrgreen: files to avic windows CE.

Share this post


Link to post
Share on other sites

also, you can use

dumprom -d acivboot -5 eboot.nb0,

 

so you extract this files

dumprom -d acivboot -5 eboot.nb0,

atserisr.dll
binfs.dll
busenum.dll
ceddk.dll
coredll.dll
default.fdf
device.exe
devmgr.dll
diskcache.dll
fatfsd.dll
fatutil.dll
filesys.exe
fsdmgr.dll
hd.dll
initdb.ini
initobj.dat
mspart.dll
nk.exe
osaxst0.dll
pm.dll
regenum.dll
sdmlc.dll
tahoma.ttf
utldrv.dll
wince.nls

 

dumprom -d acivce -5 wince42.nb0

acmdwrap.dll
afd.dll
appdata.ini
asterisk.wav
asyncmac.dll
atlasserial.dll
atlce400.dll
audevman.dll
authentication.dll
autoras.dll
BKLCTL.CPL
Calibration.exe
CEATA.dll
ceconfig.h
cefobj.dll
ceshell.dll
close.2bp
close.wav
commctrl.dll
commdlg.dll
connmc.exe
connpnl.cpl
CONSHID.Dll
control.exe
control.lnk
copyrts.txt
cplmain.cpl
cplswitch.cpl
CPM_Test.exe
CPMTest.cpl
credprov.dll
credsvc.dll
critical.wav
crypt32.dll
CTLBCK.dll
ctlpnl.exe
cxport.dll
ddcore.dll
ddhel.dll
ddi.dll
ddraw.dll
default.wav
desktopdirectory.ini
dhcp.dll
dhcpv6l.dll
dsp.dll
Dw.exe
DwCtlPnl.cpl
DwUi.dll
DwXfer.dll
eap.dll
eapchap.dll
eapol.dll
eaptls.dll
empty.wav
ethman.dll
eventrst.exe
eventrst.lnk
exclam.wav
explore.lnk
explorer.exe
fatsdmlc.dll
fatutil_16k.dll
favorites.ini
fonts.ini
gps.dll
GpsMC.exe
GpsViewer.1.2P.0109.exe
gsm610.acm
gwes.exe
GYRO.dll
hidparse.dll
IECEExt.dll
imaadpcm.dll
imaging.dll
infbeg.wav
infend.wav
infintr.wav
intll.cpl
iphlpapi.dll
iPodJudge.dll
ipv6hlp.dll
jit.exe
jscript.dll
keybddr.dll
lightsdr.dll
menupop.wav
menusel.wav
mfcce400.dll
mlang.dll
mmtimer.dll
MouHid.dll
mp3dmod.dll
msacmce.dll
msasn1.dll
msdmo.dll
msfilter.dll
msim.dll
msxml3.dll
Mux07_10.dll
mydocuments.ini
ndis.dll
ndispwr.dll
ndisuio.dll
netbios.dll
netmui.dll
netui.dll
nleddrvr.dll
notify.dll
nspm.dll
ntlmssp.dll
ok.2bp
ole32.dll
oleaut32.dll
olece400.dll
openprog.wav
ppp.dll
pptp.dll
prnerr.dll
prnport.dll
programfiles.ini
programs.ini
PTDDrv.dll
PwrButton.dll
quartz.dll
question.wav
rapisrv.exe
recend.wav
recent.ini
recstart.wav
redir.dll
repllog.exe
rnaapp.exe
rra_stm.dll
rsaenh.dll
schannel.dll
SDBUS.dll
SDHC.dll
SDIO_UART.dll
SDMemory.dll
secur32.dll
serial.dll
services.exe
shcore.dll
shdocvw.dll
shell.exe
shlwapi.dll
softkb.dll
SPGOD_CE_DLL.dll
spnego.dll
ssllsp.dll
startup.ini
startup.wav
stdsm.2bp
stdsm.bmp
stguil.cpl
sysroots.p7b
system.cpl
SystemInfo.cpl
SystemInfo.exe
tapi.dll
tcpip6.dll
tcpstk.dll
timesvc.dll
toolhelp.dll
touch.dll
udp2tcp.exe
unimodem.dll
unload.exe
urlmon.dll
Usb_Info.dll
UsbClientSwitch.exe
usbd.dll
usbdisk6.dll
usbhid.dll
usbmsc.dll
usbmsfn.dll
usbotg.dll
usbprn.dll
USBSerialFn.dll
version.dll
vgd.dll
viewsm.2bp
viewsm.bmp
waveapi.dll
wavedev.dll
wceload.exe
windmax.wav
windmin.wav
windowsce.bmp
wininet.dll
winsock.dll
wlclient.dll
wmadmod.dll
wmsdmod.dll
ws2.dll
ws2instl.dll
wspm.dll
wzcsapi.dll
wzcsvc.dll
zlib.dll

 

and can study avic windows more detail.

 

also, UC 2.6 and EW 2.7 use one wince firmware, so it way good for any region.

Share this post


Link to post
Share on other sites

This info was helpful!

 

Have you successfully added files to wince42.nb0 and repackaged in into the winceimg.bin? I'm trying to add some files to the default wince image. I'm worried if I repackage it wrong, my winceimg.bin file will be corrupted and the unit will be bricked. Any thoughts?

Share this post


Link to post
Share on other sites
This info was helpful!

 

Have you successfully added files to wince42.nb0 and repackaged in into the winceimg.bin? I'm trying to add some files to the default wince image. I'm worried if I repackage it wrong, my winceimg.bin file will be corrupted and the unit will be bricked. Any thoughts?

 

My experience with cooked roms...as long as you don't touch the uboot, you can even flash an empty file. Can always enter service mode - the uboot menu - and reflash. Have a look at xda-developers for more info.

 

In any case, its at your own risk of course :wink:

Share this post


Link to post
Share on other sites

no need touch uboot,

 

for wince42. i add file, but for dumprom -

1) need add free zero bytes to end wince42.nb0

2) add you data to wince42.nb0

- for come case need delete or ass compress dll to dumprom folder.

3) delete free space in end wince42.nb0:

4) write new wince42.nb0 size in toc.bin

5) copy all back in WINCEIMG.BIN and fix new size and checksum in WINCEIMG.chk.

 

and all working fine.

 

at this moment, i looking for CSR BT driver for AVIC,

for add to WINCEIMG.BIN.

Share this post


Link to post
Share on other sites

 

at this moment, i looking for CSR BT driver for AVIC,

for add to WINCEIMG.BIN.

 

That would be great carver. Do you have a working bluetooth stack? (to install, not yet integrated in wince..)

 

If we can have the A2DP profile to receive music from the ipod it will awesome!

Share this post


Link to post
Share on other sites

After a little Google searching, it looks like the CSR Bluetooth driver's included in Windows CE 5: MSDN blog. Now getting the right registry entries and DLLs added to AVIC should be something similar to how we're enabling the Spectec 802.11g SDIO card, but we have to find them. :D

 

Have to rebuild the development system, turns out none of the Platform Builders behave themselves on Win 7 x64 so I have to reinstall the system w/ Win 7 x86 instead. Then I can see about adding these items to the emulator BSP:

 

· Bluetooth Stack with Universal Loadable Driver

· Bluetooth Stack with Integrated USB Driver

 

And see what files and registry entries get added...

Share this post


Link to post
Share on other sites

If anybody's interested, I worked with the OP and have successfully found all the tools/tricks to get new files onto the base Windows software image and also update the base system registry. I can either do a more detailed walk-through or continue on with my second project which is to build a Windows app that will automate/simplify the process for anyone wishing to update their unit's software.

 

I personally did this because in testmode the F500 unit (which has battery backup) shuts completely off when you turn the car off. This means when you start your car again, you have to wait for it to boot AND coreplayer doesn't remember what you were playing. I had previously used a temporary work around which required me to remember to close coreplayer before turning off the car, which would then save its playlist. I also didn't want to have the testmode files on every SD card I would use.

 

I have now updated the system registry to launch leetlauncher instead of the normal menu, included drivers for my CP-E Standback engine management hardware, included the WINCE Standback tuning software, added .net compact framework 2.0 to the build (big one for some of you), and made changes so that the unit suspends instead of powers off when the car is turned off.

 

If anyone is interested in any details, PM me. If you're interested in a Win App to help automate updating the core software/registry give me a "+1" or otherwise let me know it's worth the time (since I am pretty good at doing it the awkward manual way at the moment). Also, if you'd like to try my images on your unit, let me know and I'll provide a link.

Share this post


Link to post
Share on other sites

EEGeek, this is some impressive progress that you have made. The F500BT is a really nice piece of hardware, and further opening up is going to help all of us get a lot more out of it. I urge you to document your work for the community here as much as is feasible so that your work can be shared. At the same time, I am excited about your proposed Windows app.

 

Now, a few questions:


  • [*:2np0jhkq]Are you modifying the firmware on the F500BT directly, or are you modifying testmode?
    [*:2np0jhkq]There were a couple key limitations when using leetlauncher with F500BT: the standby/shutdown issue (which you have apparently addressed), and sound output. That is, those of us using the ND-500G can't get sound out of the car speakers using leetlauncher, just the internal speaker in the F500BT. Is there any change to the sound output in your setup?
    [*:2np0jhkq]Are your changes reversible? Is it just a matter of backing up the original image?

Share this post


Link to post
Share on other sites

I've started to document via the wiki; I've added a new section for Modding the Base OS of the F-series units. You can check it out. I'll eventually put a link in there to this app.

 

I'm modifying the software on the unit itself. I can boot without an SD card inserted and still get what I want. What happens is at boot time, the WINCEIMG.BIN file sitting in "My Flash Disk" is broken up into a few pieces, one of which is a compressed version of the Windows directory. A different piece contains the initial Windows registry file. It's been a pain to learn how to unpack and repack (with changes) those boot images. Now that it's possible, we can add files to those images and then copy the new WINCEIMG.BIN to a sd card. You then enter the service menu for the unit and tell it to update the windows image and it pulls that file off of the SD card and transfers it to the unit's firmware. All you have to do is copy the WINCEIMG.BIN and WINCEIMG.CKS files off of "My Flash Disk" before you do the update and you'll have a backup to restore if you screw up. No matter how badly you screw up, you can still enter the service mode, meaning you can always reflash the original image back to the unit.

 

So far I have only worked on the issues that were bothersome to me. I have fixed the shutdown issue, but haven't run into a sound issue. I use the output of the headphone jack myself since it's "preamped" (the line coming out of the backplate isn't) and I didn't want to buy an amp to drive my input line of my head unit. Since I'm not booting testmode, I very well may have fixed that issue all together since it's booting a pretty standard way. Or it may be the case that launching the original menu caused some drivers to switch modes allowing your audio output. I never launch the original menu though so that might not work. I did notice that booting "normally" launches a process called av.exe. If it's responsible for the audio output to the backplate, maybe we could just launch it by itself.

 

Fun stuff..

EEGeek, this is some impressive progress that you have made. The F500BT is a really nice piece of hardware, and further opening up is going to help all of us get a lot more out of it. I urge you to document your work for the community here as much as is feasible so that your work can be shared. At the same time, I am excited about your proposed Windows app.

 

Now, a few questions:


  • [*:3nxlvjby]Are you modifying the firmware on the F500BT directly, or are you modifying testmode?
    [*:3nxlvjby]There were a couple key limitations when using leetlauncher with F500BT: the standby/shutdown issue (which you have apparently addressed), and sound output. That is, those of us using the ND-500G can't get sound out of the car speakers using leetlauncher, just the internal speaker in the F500BT. Is there any change to the sound output in your setup?
    [*:3nxlvjby]Are your changes reversible? Is it just a matter of backing up the original image?

Share this post


Link to post
Share on other sites
I did notice that booting "normally" launches a process called av.exe. If it's responsible for the audio output to the backplate, maybe we could just launch it by itself.

 

Very likely since on the in-dash units it's the AV board that has the uCOM ASIC that controls the audio source. It sends commands to the E-Volume chip over I2C that will select which source to output (Navi, AV1, AV2, IPBus, DVD, FM Tuner, etc).

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×