Jump to content


Photo

if anybody need, extract files from WINCEIMG.BIN


  • Please log in to reply
22 replies to this topic

#1 carver

carver

    Member

  • Members
  • 85 posts
  • LocationNauru

Posted 03 July 2009 - 02:53 PM

1) my avic is UC and i use winceimg.bin from AVIC_F-Series_Firmware_Update_2.006000.zip

2) i use WinHex and cut WINCEIMG.BIN binSize : 17340884 checksum: 0x69711813
to 4 files toc.bin, eboot.nb0, chain.bin, wince42.nb0.

size for file you can get in WINCEIMG.BIN TOC.

WINCEIMG.BIN binSize : 17340884 checksum: 0x69711813
toc.bin 1364 bytes
0000000000: 53 49 47 2D 42 49 4E 46 53 20 20 20 20 20 20 20  SIG-BINFS
0000000010: 4E 54 4F 43 01 00 00 00 20 30 00 00 0F 00 00 00  NTOC    0  ¤
0000000020: 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF              яяяя
0000000030: 02 00 01 00 54 4F 42 45 65 62 6F 6F 74 2E 6E 62    TOBEeboot.nb
0000000040: 30 00 00 00 00 00 00 00 02 00 00 00 00 01 00 00  0           
0000000050: 00 80 03 8C 00 80 03 8C 40 00 00 00 00 01 00 00   __ __@    
......
00000000C0: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00              
00000000D0: 49 53 46 43 57 49 4E 43 45 34 32 2E 4E 42 30 00  ISFCWINCE42.NB0
00000000E0: 00 00 00 00 02 00 00 00 AF FA 00 00 00 00 04 8E         Їъ    _
00000000F0: 00 00 04 8E A0 01 00 00 AF FA 00 00 00 00 00 00    _   Їъ
......
000000022C: 03000000 0000C09B B8152A00 # => 002a15b8 -> 2758072 eboot.nb0
0000000338: 00000000 0040008C 28050000 # => 00000528 -> 1320 chain.bin
0000000444: 00000000 00000080 A079DE00 # => 00de79a0 -> 14580128 wince42.nb0

eboot.nb0: 2758072 bytes
0000000554: FE 03 00 EA 00 00 00 00 │ 00 00 00 00 00 00 00 00  ю к
0000000564: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
0000000574: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
0000000584: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
0000000594: 45 43 45 43 B4 89 D2 9B │ B4 89 12 00 00 00 00 00  ECEC_%Т>_%
...
00002A1AFC: 44 51 D7 C6 A3 46 E8 65 │ E7 68 65 00 40 00 00 00  DQЧЖ_Fиeзhe @

chain.bin: 1320 bytes
00002A1B0C: 02 00 00 00 00 00 00 80 │ A0 79 DE 00 00 00 50 02        _ yЮ   P
00002A1B1C: 01 00 01 00 00 00 00 00 │ 4E 4B 00 00 00 00 00 00        NK
...
00002A2024: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00

wince42.nb0: 14580128 bytes
00002A2034: E8 83 01 00 28 97 01 00 │ 54 0F 03 00 4C D5 04 00  и_ (- T¤ LХ
00002A2044: E8 1C 02 00 B4 85 01 00 │ 84 1D 02 00 AC 86 04 00  и _: " ┐+
00002A2054: E8 1C 02 00 C4 56 05 00 │ 84 1D 02 00 3C 37 05 00  и ДV " <7
00002A2064: D0 6E 04 00 7C 71 04 00 │ E8 83 01 00 00 00 00 00  Рn |q и_
00002A2074: 45 43 45 43 F4 60 DE 80 │ F4 60 DE 00 00 00 00 00  ECECф`Ю_ф`Ю
00002A2084: 00 00 00 00 00 00 00 00 │ 00 00 00 00 00 00 00 00
....
00010899C4: 00 12 00 00 C7 04 00 00 │ F0 0F 1E 80 A8 FA 53 80     З  р¤_ЁъS_

so, after that you can use dumprom -d acivce wince42.nb0
or other way for extract, or ADD :mrgreen: files to avic windows CE.
/carv

#2 carver

carver

    Member

  • Members
  • 85 posts
  • LocationNauru

Posted 04 July 2009 - 08:04 AM

also, you can use
dumprom -d acivboot -5 eboot.nb0,

so you extract this files
dumprom -d acivboot -5 eboot.nb0,
atserisr.dll
binfs.dll
busenum.dll
ceddk.dll
coredll.dll
default.fdf
device.exe
devmgr.dll
diskcache.dll
fatfsd.dll
fatutil.dll
filesys.exe
fsdmgr.dll
hd.dll
initdb.ini
initobj.dat
mspart.dll
nk.exe
osaxst0.dll
pm.dll
regenum.dll
sdmlc.dll
tahoma.ttf
utldrv.dll
wince.nls

dumprom -d acivce -5 wince42.nb0
acmdwrap.dll
afd.dll
appdata.ini
asterisk.wav
asyncmac.dll
atlasserial.dll
atlce400.dll
audevman.dll
authentication.dll
autoras.dll
BKLCTL.CPL
Calibration.exe
CEATA.dll
ceconfig.h
cefobj.dll
ceshell.dll
close.2bp
close.wav
commctrl.dll
commdlg.dll
connmc.exe
connpnl.cpl
CONSHID.Dll
control.exe
control.lnk
copyrts.txt
cplmain.cpl
cplswitch.cpl
CPM_Test.exe
CPMTest.cpl
credprov.dll
credsvc.dll
critical.wav
crypt32.dll
CTLBCK.dll
ctlpnl.exe
cxport.dll
ddcore.dll
ddhel.dll
ddi.dll
ddraw.dll
default.wav
desktopdirectory.ini
dhcp.dll
dhcpv6l.dll
dsp.dll
Dw.exe
DwCtlPnl.cpl
DwUi.dll
DwXfer.dll
eap.dll
eapchap.dll
eapol.dll
eaptls.dll
empty.wav
ethman.dll
eventrst.exe
eventrst.lnk
exclam.wav
explore.lnk
explorer.exe
fatsdmlc.dll
fatutil_16k.dll
favorites.ini
fonts.ini
gps.dll
GpsMC.exe
GpsViewer.1.2P.0109.exe
gsm610.acm
gwes.exe
GYRO.dll
hidparse.dll
IECEExt.dll
imaadpcm.dll
imaging.dll
infbeg.wav
infend.wav
infintr.wav
intll.cpl
iphlpapi.dll
iPodJudge.dll
ipv6hlp.dll
jit.exe
jscript.dll
keybddr.dll
lightsdr.dll
menupop.wav
menusel.wav
mfcce400.dll
mlang.dll
mmtimer.dll
MouHid.dll
mp3dmod.dll
msacmce.dll
msasn1.dll
msdmo.dll
msfilter.dll
msim.dll
msxml3.dll
Mux07_10.dll
mydocuments.ini
ndis.dll
ndispwr.dll
ndisuio.dll
netbios.dll
netmui.dll
netui.dll
nleddrvr.dll
notify.dll
nspm.dll
ntlmssp.dll
ok.2bp
ole32.dll
oleaut32.dll
olece400.dll
openprog.wav
ppp.dll
pptp.dll
prnerr.dll
prnport.dll
programfiles.ini
programs.ini
PTDDrv.dll
PwrButton.dll
quartz.dll
question.wav
rapisrv.exe
recend.wav
recent.ini
recstart.wav
redir.dll
repllog.exe
rnaapp.exe
rra_stm.dll
rsaenh.dll
schannel.dll
SDBUS.dll
SDHC.dll
SDIO_UART.dll
SDMemory.dll
secur32.dll
serial.dll
services.exe
shcore.dll
shdocvw.dll
shell.exe
shlwapi.dll
softkb.dll
SPGOD_CE_DLL.dll
spnego.dll
ssllsp.dll
startup.ini
startup.wav
stdsm.2bp
stdsm.bmp
stguil.cpl
sysroots.p7b
system.cpl
SystemInfo.cpl
SystemInfo.exe
tapi.dll
tcpip6.dll
tcpstk.dll
timesvc.dll
toolhelp.dll
touch.dll
udp2tcp.exe
unimodem.dll
unload.exe
urlmon.dll
Usb_Info.dll
UsbClientSwitch.exe
usbd.dll
usbdisk6.dll
usbhid.dll
usbmsc.dll
usbmsfn.dll
usbotg.dll
usbprn.dll
USBSerialFn.dll
version.dll
vgd.dll
viewsm.2bp
viewsm.bmp
waveapi.dll
wavedev.dll
wceload.exe
windmax.wav
windmin.wav
windowsce.bmp
wininet.dll
winsock.dll
wlclient.dll
wmadmod.dll
wmsdmod.dll
ws2.dll
ws2instl.dll
wspm.dll
wzcsapi.dll
wzcsvc.dll
zlib.dll

and can study avic windows more detail.

also, UC 2.6 and EW 2.7 use one wince firmware, so it way good for any region.
/carv

#3 EEGeek

EEGeek

    Member

  • Members
  • 61 posts

Posted 19 August 2009 - 07:07 AM

This info was helpful!

Have you successfully added files to wince42.nb0 and repackaged in into the winceimg.bin? I'm trying to add some files to the default wince image. I'm worried if I repackage it wrong, my winceimg.bin file will be corrupted and the unit will be bricked. Any thoughts?

#4 miotoo

miotoo

    Member

  • Members
  • 126 posts

Posted 19 August 2009 - 10:08 AM

This info was helpful!

Have you successfully added files to wince42.nb0 and repackaged in into the winceimg.bin? I'm trying to add some files to the default wince image. I'm worried if I repackage it wrong, my winceimg.bin file will be corrupted and the unit will be bricked. Any thoughts?


My experience with cooked roms...as long as you don't touch the uboot, you can even flash an empty file. Can always enter service mode - the uboot menu - and reflash. Have a look at xda-developers for more info.

In any case, its at your own risk of course :wink:
If you're thinking about it now, someone has probably done it already...search first!

#5 EEGeek

EEGeek

    Member

  • Members
  • 61 posts

Posted 20 August 2009 - 05:37 AM

Thanks, I feel a bit more willing to risk it. I won't touch uboot!

#6 carver

carver

    Member

  • Members
  • 85 posts
  • LocationNauru

Posted 26 August 2009 - 10:37 AM

no need touch uboot,

for wince42. i add file, but for dumprom -
1) need add free zero bytes to end wince42.nb0
2) add you data to wince42.nb0
- for come case need delete or ass compress dll to dumprom folder.
3) delete free space in end wince42.nb0:
4) write new wince42.nb0 size in toc.bin
5) copy all back in WINCEIMG.BIN and fix new size and checksum in WINCEIMG.chk.

and all working fine.

at this moment, i looking for CSR BT driver for AVIC,
for add to WINCEIMG.BIN.
/carv

#7 miotoo

miotoo

    Member

  • Members
  • 126 posts

Posted 26 August 2009 - 12:54 PM

at this moment, i looking for CSR BT driver for AVIC,
for add to WINCEIMG.BIN.


That would be great carver. Do you have a working bluetooth stack? (to install, not yet integrated in wince..)

If we can have the A2DP profile to receive music from the ipod it will awesome!
If you're thinking about it now, someone has probably done it already...search first!

#8 FourG

FourG

    Member

  • Members
  • 267 posts
  • LocationPortland, OR, USA

Posted 26 August 2009 - 04:20 PM

After a little Google searching, it looks like the CSR Bluetooth driver's included in Windows CE 5: MSDN blog. Now getting the right registry entries and DLLs added to AVIC should be something similar to how we're enabling the Spectec 802.11g SDIO card, but we have to find them. :D

Have to rebuild the development system, turns out none of the Platform Builders behave themselves on Win 7 x64 so I have to reinstall the system w/ Win 7 x86 instead. Then I can see about adding these items to the emulator BSP:

Bluetooth Stack with Universal Loadable Driver
Bluetooth Stack with Integrated USB Driver

And see what files and registry entries get added...
Daily Driver: Suabru Outback '06 2.5i + MOMO Legacy GT Wheel + PAC SWI-PS + AVIC-F90BT + Ipod Nano 3G + Moto Droid2
In-Home Hacking Setup: Antec SU-380 ATX Power Supply + Yamaha Bookshelf Speakers + AVIC-F90BT + Spectec 802.11g

#9 carver

carver

    Member

  • Members
  • 85 posts
  • LocationNauru

Posted 30 August 2009 - 05:36 PM

yes, BT stack from MS detect my BT
Super Mini Bluetooth 2.0 Adapter Dongle (Vista Compatible) Price: $2.46
http://www.dealextre...ls.dx/sku.11866

also i try get BT stack from HP ipaq 31x (also SirfTitan), but i can't find files for USB connections.
/carv

#10 timemaster

timemaster

    Member

  • Members
  • 31 posts

Posted 20 March 2010 - 04:55 PM

any progress with bluetooth stack for avic ?

#11 EEGeek

EEGeek

    Member

  • Members
  • 61 posts

Posted 05 April 2010 - 05:50 PM

If anybody's interested, I worked with the OP and have successfully found all the tools/tricks to get new files onto the base Windows software image and also update the base system registry. I can either do a more detailed walk-through or continue on with my second project which is to build a Windows app that will automate/simplify the process for anyone wishing to update their unit's software.

I personally did this because in testmode the F500 unit (which has battery backup) shuts completely off when you turn the car off. This means when you start your car again, you have to wait for it to boot AND coreplayer doesn't remember what you were playing. I had previously used a temporary work around which required me to remember to close coreplayer before turning off the car, which would then save its playlist. I also didn't want to have the testmode files on every SD card I would use.

I have now updated the system registry to launch leetlauncher instead of the normal menu, included drivers for my CP-E Standback engine management hardware, included the WINCE Standback tuning software, added .net compact framework 2.0 to the build (big one for some of you), and made changes so that the unit suspends instead of powers off when the car is turned off.

If anyone is interested in any details, PM me. If you're interested in a Win App to help automate updating the core software/registry give me a "+1" or otherwise let me know it's worth the time (since I am pretty good at doing it the awkward manual way at the moment). Also, if you'd like to try my images on your unit, let me know and I'll provide a link.

#12 EEGeek

EEGeek

    Member

  • Members
  • 61 posts

Posted 05 April 2010 - 06:01 PM

Oh, and if you want to see the Standback software in use on the F500, here a link to that thread:

http://avic411.com/f...=24459&start=30

#13 Scotto

Scotto
  • Members
  • 11 posts

Posted 07 April 2010 - 10:52 PM

EEGeek, this is some impressive progress that you have made. The F500BT is a really nice piece of hardware, and further opening up is going to help all of us get a lot more out of it. I urge you to document your work for the community here as much as is feasible so that your work can be shared. At the same time, I am excited about your proposed Windows app.

Now, a few questions:

[*:2np0jhkq]Are you modifying the firmware on the F500BT directly, or are you modifying testmode?
[*:2np0jhkq]There were a couple key limitations when using leetlauncher with F500BT: the standby/shutdown issue (which you have apparently addressed), and sound output. That is, those of us using the ND-500G can't get sound out of the car speakers using leetlauncher, just the internal speaker in the F500BT. Is there any change to the sound output in your setup?
[*:2np0jhkq]Are your changes reversible? Is it just a matter of backing up the original image?

#14 EEGeek

EEGeek

    Member

  • Members
  • 61 posts

Posted 08 April 2010 - 12:52 AM

I've started to document via the wiki; I've added a new section for Modding the Base OS of the F-series units. You can check it out. I'll eventually put a link in there to this app.

I'm modifying the software on the unit itself. I can boot without an SD card inserted and still get what I want. What happens is at boot time, the WINCEIMG.BIN file sitting in "My Flash Disk" is broken up into a few pieces, one of which is a compressed version of the Windows directory. A different piece contains the initial Windows registry file. It's been a pain to learn how to unpack and repack (with changes) those boot images. Now that it's possible, we can add files to those images and then copy the new WINCEIMG.BIN to a sd card. You then enter the service menu for the unit and tell it to update the windows image and it pulls that file off of the SD card and transfers it to the unit's firmware. All you have to do is copy the WINCEIMG.BIN and WINCEIMG.CKS files off of "My Flash Disk" before you do the update and you'll have a backup to restore if you screw up. No matter how badly you screw up, you can still enter the service mode, meaning you can always reflash the original image back to the unit.

So far I have only worked on the issues that were bothersome to me. I have fixed the shutdown issue, but haven't run into a sound issue. I use the output of the headphone jack myself since it's "preamped" (the line coming out of the backplate isn't) and I didn't want to buy an amp to drive my input line of my head unit. Since I'm not booting testmode, I very well may have fixed that issue all together since it's booting a pretty standard way. Or it may be the case that launching the original menu caused some drivers to switch modes allowing your audio output. I never launch the original menu though so that might not work. I did notice that booting "normally" launches a process called av.exe. If it's responsible for the audio output to the backplate, maybe we could just launch it by itself.

Fun stuff..

EEGeek, this is some impressive progress that you have made. The F500BT is a really nice piece of hardware, and further opening up is going to help all of us get a lot more out of it. I urge you to document your work for the community here as much as is feasible so that your work can be shared. At the same time, I am excited about your proposed Windows app.

Now, a few questions:

[*:3nxlvjby]Are you modifying the firmware on the F500BT directly, or are you modifying testmode?
[*:3nxlvjby]There were a couple key limitations when using leetlauncher with F500BT: the standby/shutdown issue (which you have apparently addressed), and sound output. That is, those of us using the ND-500G can't get sound out of the car speakers using leetlauncher, just the internal speaker in the F500BT. Is there any change to the sound output in your setup?
[*:3nxlvjby]Are your changes reversible? Is it just a matter of backing up the original image?



#15 FourG

FourG

    Member

  • Members
  • 267 posts
  • LocationPortland, OR, USA

Posted 08 April 2010 - 02:09 AM

I did notice that booting "normally" launches a process called av.exe. If it's responsible for the audio output to the backplate, maybe we could just launch it by itself.


Very likely since on the in-dash units it's the AV board that has the uCOM ASIC that controls the audio source. It sends commands to the E-Volume chip over I2C that will select which source to output (Navi, AV1, AV2, IPBus, DVD, FM Tuner, etc).
Daily Driver: Suabru Outback '06 2.5i + MOMO Legacy GT Wheel + PAC SWI-PS + AVIC-F90BT + Ipod Nano 3G + Moto Droid2
In-Home Hacking Setup: Antec SU-380 ATX Power Supply + Yamaha Bookshelf Speakers + AVIC-F90BT + Spectec 802.11g




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users