carver Posted July 3, 2009 Report Share Posted July 3, 2009 1) my avic is UC and i use winceimg.bin from AVIC_F-Series_Firmware_Update_2.006000.zip 2) i use WinHex and cut WINCEIMG.BIN binSize : 17340884 checksum: 0x69711813 to 4 files toc.bin, eboot.nb0, chain.bin, wince42.nb0. size for file you can get in WINCEIMG.BIN TOC. WINCEIMG.BIN binSize : 17340884 checksum: 0x69711813 toc.bin 1364 bytes 0000000000: 53 49 47 2D 42 49 4E 46 53 20 20 20 20 20 20 20 SIG-BINFS 0000000010: 4E 54 4F 43 01 00 00 00 20 30 00 00 0F 00 00 00 NTOC 0 ¤ 0000000020: 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF ÑÑÑÑ 0000000030: 02 00 01 00 54 4F 42 45 65 62 6F 6F 74 2E 6E 62 TOBEeboot.nb 0000000040: 30 00 00 00 00 00 00 00 02 00 00 00 00 01 00 00 0 0000000050: 00 80 03 8C 00 80 03 8C 40 00 00 00 00 01 00 00 __ __@ ...... 00000000C0: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00000000D0: 49 53 46 43 57 49 4E 43 45 34 32 2E 4E 42 30 00 ISFCWINCE42.NB0 00000000E0: 00 00 00 00 02 00 00 00 AF FA 00 00 00 00 04 8E Їъ _ 00000000F0: 00 00 04 8E A0 01 00 00 AF FA 00 00 00 00 00 00 _ Їъ ...... 000000022C: 03000000 0000C09B B8152A00 # => 002a15b8 -> 2758072 eboot.nb0 0000000338: 00000000 0040008C 28050000 # => 00000528 -> 1320 chain.bin 0000000444: 00000000 00000080 A079DE00 # => 00de79a0 -> 14580128 wince42.nb0 eboot.nb0: 2758072 bytes 0000000554: FE 03 00 EA 00 00 00 00 │ 00 00 00 00 00 00 00 00 ÑŽ к 0000000564: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00 0000000574: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00 0000000584: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00 0000000594: 45 43 45 43 B4 89 D2 9B │ B4 89 12 00 00 00 00 00 ECEC_%Т>_% ... 00002A1AFC: 44 51 D7 C6 A3 46 E8 65 │ E7 68 65 00 40 00 00 00 DQЧЖ_Fиeзhe @ chain.bin: 1320 bytes 00002A1B0C: 02 00 00 00 00 00 00 80 │ A0 79 DE 00 00 00 50 02 _ yЮ P 00002A1B1C: 01 00 01 00 00 00 00 00 │ 4E 4B 00 00 00 00 00 00 NK ... 00002A2024: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00 wince42.nb0: 14580128 bytes 00002A2034: E8 83 01 00 28 97 01 00 │ 54 0F 03 00 4C D5 04 00 и_ (- T¤ LÐ¥ 00002A2044: E8 1C 02 00 B4 85 01 00 │ 84 1D 02 00 AC 86 04 00 и _: " â”+ 00002A2054: E8 1C 02 00 C4 56 05 00 │ 84 1D 02 00 3C 37 05 00 и ДV " <7 00002A2064: D0 6E 04 00 7C 71 04 00 │ E8 83 01 00 00 00 00 00 Ð n |q и_ 00002A2074: 45 43 45 43 F4 60 DE 80 │ F4 60 DE 00 00 00 00 00 ECECÑ„`Ю_Ñ„`Ю 00002A2084: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00 .... 00010899C4: 00 12 00 00 C7 04 00 00 │ F0 0F 1E 80 A8 FA 53 80 З р¤_ÐÑŠS_ so, after that you can use dumprom -d acivce wince42.nb0 or other way for extract, or ADD files to avic windows CE. Quote Link to post Share on other sites
carver Posted July 4, 2009 Author Report Share Posted July 4, 2009 also, you can use dumprom -d acivboot -5 eboot.nb0, so you extract this files dumprom -d acivboot -5 eboot.nb0, atserisr.dll binfs.dll busenum.dll ceddk.dll coredll.dll default.fdf device.exe devmgr.dll diskcache.dll fatfsd.dll fatutil.dll filesys.exe fsdmgr.dll hd.dll initdb.ini initobj.dat mspart.dll nk.exe osaxst0.dll pm.dll regenum.dll sdmlc.dll tahoma.ttf utldrv.dll wince.nls dumprom -d acivce -5 wince42.nb0 acmdwrap.dll afd.dll appdata.ini asterisk.wav asyncmac.dll atlasserial.dll atlce400.dll audevman.dll authentication.dll autoras.dll BKLCTL.CPL Calibration.exe CEATA.dll ceconfig.h cefobj.dll ceshell.dll close.2bp close.wav commctrl.dll commdlg.dll connmc.exe connpnl.cpl CONSHID.Dll control.exe control.lnk copyrts.txt cplmain.cpl cplswitch.cpl CPM_Test.exe CPMTest.cpl credprov.dll credsvc.dll critical.wav crypt32.dll CTLBCK.dll ctlpnl.exe cxport.dll ddcore.dll ddhel.dll ddi.dll ddraw.dll default.wav desktopdirectory.ini dhcp.dll dhcpv6l.dll dsp.dll Dw.exe DwCtlPnl.cpl DwUi.dll DwXfer.dll eap.dll eapchap.dll eapol.dll eaptls.dll empty.wav ethman.dll eventrst.exe eventrst.lnk exclam.wav explore.lnk explorer.exe fatsdmlc.dll fatutil_16k.dll favorites.ini fonts.ini gps.dll GpsMC.exe GpsViewer.1.2P.0109.exe gsm610.acm gwes.exe GYRO.dll hidparse.dll IECEExt.dll imaadpcm.dll imaging.dll infbeg.wav infend.wav infintr.wav intll.cpl iphlpapi.dll iPodJudge.dll ipv6hlp.dll jit.exe jscript.dll keybddr.dll lightsdr.dll menupop.wav menusel.wav mfcce400.dll mlang.dll mmtimer.dll MouHid.dll mp3dmod.dll msacmce.dll msasn1.dll msdmo.dll msfilter.dll msim.dll msxml3.dll Mux07_10.dll mydocuments.ini ndis.dll ndispwr.dll ndisuio.dll netbios.dll netmui.dll netui.dll nleddrvr.dll notify.dll nspm.dll ntlmssp.dll ok.2bp ole32.dll oleaut32.dll olece400.dll openprog.wav ppp.dll pptp.dll prnerr.dll prnport.dll programfiles.ini programs.ini PTDDrv.dll PwrButton.dll quartz.dll question.wav rapisrv.exe recend.wav recent.ini recstart.wav redir.dll repllog.exe rnaapp.exe rra_stm.dll rsaenh.dll schannel.dll SDBUS.dll SDHC.dll SDIO_UART.dll SDMemory.dll secur32.dll serial.dll services.exe shcore.dll shdocvw.dll shell.exe shlwapi.dll softkb.dll SPGOD_CE_DLL.dll spnego.dll ssllsp.dll startup.ini startup.wav stdsm.2bp stdsm.bmp stguil.cpl sysroots.p7b system.cpl SystemInfo.cpl SystemInfo.exe tapi.dll tcpip6.dll tcpstk.dll timesvc.dll toolhelp.dll touch.dll udp2tcp.exe unimodem.dll unload.exe urlmon.dll Usb_Info.dll UsbClientSwitch.exe usbd.dll usbdisk6.dll usbhid.dll usbmsc.dll usbmsfn.dll usbotg.dll usbprn.dll USBSerialFn.dll version.dll vgd.dll viewsm.2bp viewsm.bmp waveapi.dll wavedev.dll wceload.exe windmax.wav windmin.wav windowsce.bmp wininet.dll winsock.dll wlclient.dll wmadmod.dll wmsdmod.dll ws2.dll ws2instl.dll wspm.dll wzcsapi.dll wzcsvc.dll zlib.dll and can study avic windows more detail. also, UC 2.6 and EW 2.7 use one wince firmware, so it way good for any region. Quote Link to post Share on other sites
EEGeek Posted August 19, 2009 Report Share Posted August 19, 2009 This info was helpful! Have you successfully added files to wince42.nb0 and repackaged in into the winceimg.bin? I'm trying to add some files to the default wince image. I'm worried if I repackage it wrong, my winceimg.bin file will be corrupted and the unit will be bricked. Any thoughts? Quote Link to post Share on other sites
miotoo Posted August 19, 2009 Report Share Posted August 19, 2009 This info was helpful! Have you successfully added files to wince42.nb0 and repackaged in into the winceimg.bin? I'm trying to add some files to the default wince image. I'm worried if I repackage it wrong, my winceimg.bin file will be corrupted and the unit will be bricked. Any thoughts? My experience with cooked roms...as long as you don't touch the uboot, you can even flash an empty file. Can always enter service mode - the uboot menu - and reflash. Have a look at xda-developers for more info. In any case, its at your own risk of course Quote Link to post Share on other sites
EEGeek Posted August 20, 2009 Report Share Posted August 20, 2009 Thanks, I feel a bit more willing to risk it. I won't touch uboot! Quote Link to post Share on other sites
carver Posted August 26, 2009 Author Report Share Posted August 26, 2009 no need touch uboot, for wince42. i add file, but for dumprom - 1) need add free zero bytes to end wince42.nb0 2) add you data to wince42.nb0 - for come case need delete or ass compress dll to dumprom folder. 3) delete free space in end wince42.nb0: 4) write new wince42.nb0 size in toc.bin 5) copy all back in WINCEIMG.BIN and fix new size and checksum in WINCEIMG.chk. and all working fine. at this moment, i looking for CSR BT driver for AVIC, for add to WINCEIMG.BIN. Quote Link to post Share on other sites
miotoo Posted August 26, 2009 Report Share Posted August 26, 2009 at this moment, i looking for CSR BT driver for AVIC, for add to WINCEIMG.BIN. That would be great carver. Do you have a working bluetooth stack? (to install, not yet integrated in wince..) If we can have the A2DP profile to receive music from the ipod it will awesome! Quote Link to post Share on other sites
FourG Posted August 26, 2009 Report Share Posted August 26, 2009 After a little Google searching, it looks like the CSR Bluetooth driver's included in Windows CE 5: MSDN blog. Now getting the right registry entries and DLLs added to AVIC should be something similar to how we're enabling the Spectec 802.11g SDIO card, but we have to find them. Have to rebuild the development system, turns out none of the Platform Builders behave themselves on Win 7 x64 so I have to reinstall the system w/ Win 7 x86 instead. Then I can see about adding these items to the emulator BSP: · Bluetooth Stack with Universal Loadable Driver · Bluetooth Stack with Integrated USB Driver And see what files and registry entries get added... Quote Link to post Share on other sites
carver Posted August 30, 2009 Author Report Share Posted August 30, 2009 yes, BT stack from MS detect my BT Super Mini Bluetooth 2.0 Adapter Dongle (Vista Compatible) Price: $2.46 http://www.dealextreme.com/details.dx/sku.11866 also i try get BT stack from HP ipaq 31x (also SirfTitan), but i can't find files for USB connections. Quote Link to post Share on other sites
timemaster Posted March 20, 2010 Report Share Posted March 20, 2010 any progress with bluetooth stack for avic ? Quote Link to post Share on other sites
EEGeek Posted April 5, 2010 Report Share Posted April 5, 2010 If anybody's interested, I worked with the OP and have successfully found all the tools/tricks to get new files onto the base Windows software image and also update the base system registry. I can either do a more detailed walk-through or continue on with my second project which is to build a Windows app that will automate/simplify the process for anyone wishing to update their unit's software. I personally did this because in testmode the F500 unit (which has battery backup) shuts completely off when you turn the car off. This means when you start your car again, you have to wait for it to boot AND coreplayer doesn't remember what you were playing. I had previously used a temporary work around which required me to remember to close coreplayer before turning off the car, which would then save its playlist. I also didn't want to have the testmode files on every SD card I would use. I have now updated the system registry to launch leetlauncher instead of the normal menu, included drivers for my CP-E Standback engine management hardware, included the WINCE Standback tuning software, added .net compact framework 2.0 to the build (big one for some of you), and made changes so that the unit suspends instead of powers off when the car is turned off. If anyone is interested in any details, PM me. If you're interested in a Win App to help automate updating the core software/registry give me a "+1" or otherwise let me know it's worth the time (since I am pretty good at doing it the awkward manual way at the moment). Also, if you'd like to try my images on your unit, let me know and I'll provide a link. Quote Link to post Share on other sites
EEGeek Posted April 5, 2010 Report Share Posted April 5, 2010 Oh, and if you want to see the Standback software in use on the F500, here a link to that thread: http://avic411.com/forum/viewtopic.php?f=34&t=24459&start=30 Quote Link to post Share on other sites
Scotto Posted April 7, 2010 Report Share Posted April 7, 2010 EEGeek, this is some impressive progress that you have made. The F500BT is a really nice piece of hardware, and further opening up is going to help all of us get a lot more out of it. I urge you to document your work for the community here as much as is feasible so that your work can be shared. At the same time, I am excited about your proposed Windows app. Now, a few questions: [*:2np0jhkq]Are you modifying the firmware on the F500BT directly, or are you modifying testmode?[*:2np0jhkq]There were a couple key limitations when using leetlauncher with F500BT: the standby/shutdown issue (which you have apparently addressed), and sound output. That is, those of us using the ND-500G can't get sound out of the car speakers using leetlauncher, just the internal speaker in the F500BT. Is there any change to the sound output in your setup? [*:2np0jhkq]Are your changes reversible? Is it just a matter of backing up the original image? Quote Link to post Share on other sites
EEGeek Posted April 8, 2010 Report Share Posted April 8, 2010 I've started to document via the wiki; I've added a new section for Modding the Base OS of the F-series units. You can check it out. I'll eventually put a link in there to this app. I'm modifying the software on the unit itself. I can boot without an SD card inserted and still get what I want. What happens is at boot time, the WINCEIMG.BIN file sitting in "My Flash Disk" is broken up into a few pieces, one of which is a compressed version of the Windows directory. A different piece contains the initial Windows registry file. It's been a pain to learn how to unpack and repack (with changes) those boot images. Now that it's possible, we can add files to those images and then copy the new WINCEIMG.BIN to a sd card. You then enter the service menu for the unit and tell it to update the windows image and it pulls that file off of the SD card and transfers it to the unit's firmware. All you have to do is copy the WINCEIMG.BIN and WINCEIMG.CKS files off of "My Flash Disk" before you do the update and you'll have a backup to restore if you screw up. No matter how badly you screw up, you can still enter the service mode, meaning you can always reflash the original image back to the unit. So far I have only worked on the issues that were bothersome to me. I have fixed the shutdown issue, but haven't run into a sound issue. I use the output of the headphone jack myself since it's "preamped" (the line coming out of the backplate isn't) and I didn't want to buy an amp to drive my input line of my head unit. Since I'm not booting testmode, I very well may have fixed that issue all together since it's booting a pretty standard way. Or it may be the case that launching the original menu caused some drivers to switch modes allowing your audio output. I never launch the original menu though so that might not work. I did notice that booting "normally" launches a process called av.exe. If it's responsible for the audio output to the backplate, maybe we could just launch it by itself. Fun stuff.. EEGeek, this is some impressive progress that you have made. The F500BT is a really nice piece of hardware, and further opening up is going to help all of us get a lot more out of it. I urge you to document your work for the community here as much as is feasible so that your work can be shared. At the same time, I am excited about your proposed Windows app. Now, a few questions: [*:3nxlvjby]Are you modifying the firmware on the F500BT directly, or are you modifying testmode?[*:3nxlvjby]There were a couple key limitations when using leetlauncher with F500BT: the standby/shutdown issue (which you have apparently addressed), and sound output. That is, those of us using the ND-500G can't get sound out of the car speakers using leetlauncher, just the internal speaker in the F500BT. Is there any change to the sound output in your setup? [*:3nxlvjby]Are your changes reversible? Is it just a matter of backing up the original image? Quote Link to post Share on other sites
FourG Posted April 8, 2010 Report Share Posted April 8, 2010 I did notice that booting "normally" launches a process called av.exe. If it's responsible for the audio output to the backplate, maybe we could just launch it by itself. Very likely since on the in-dash units it's the AV board that has the uCOM ASIC that controls the audio source. It sends commands to the E-Volume chip over I2C that will select which source to output (Navi, AV1, AV2, IPBus, DVD, FM Tuner, etc). Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.