Microsoft Automotive 5.5?

[MadMonkey]

First, I am not programmer even though I studied Machine Language in College. (a funny story in itself)

 

If the software used in these units is Microsoft Automotive 5.5, then why couldn't someone with knowledge of software development simply go to Microsoft and download the development kit and hack these units with upgrades?

 

http://msdn.microsoft.com/en-us/library/dd296800.aspx

 

The updates should be able to decompiled using the developer software would'nt you think?

 

I would be curious to see what others think of this as I have not been involved with programming in over thirty years.

[dawgbone]

I think it's the Pioneer code that needs to be massaged over the WinAuto... I think Pioneer's stuff just runs on top of WinAuto, and is only needed to talk to the hardware. I think Pioneer just rights the GUI...the GUI talks to WinAuto and WinAuto talks to the hardware.

 

If only we could do some kind of "XBox Mod-Chip" type hack... to run our very own build... then I think the doors would open up.... I would guess that it would have to be somewhere in this area...

[Blade]

I spent an hour or so reading through the winauto online guide last night since this thread piqued my interest... it appears that to REALLY hack this thing you need a full development environment. WIthout having the multiple components needed to do this, you would have to find someway to get the code out of one of the units and then plug it into a dev environ... but still, that appears to need multiple components based on the configuration of the chipsets, memory, etc...

 

The good news is that alot of the skins are written in simple XML according to the winauto dev pages.... so once we figure out how to get to that data, it should be easy to manipulate.

 

The best shot we might get at this is when Pioneer releases an update, which should contain the following components according to page 94 of the repair manual:

1. Navi Program Write . . . 
2. Platform Write . . . 
3. BootLoader Write . . . 
4. System uCom Write . . . 
5. Bluetooth Firmware Write . . . 
6. Opening Data Write . . . 

Normally the following programs which perform 
automatic version up are all written; 
    - Boot loader software 
    - Platform software 
    - Font data 
    - Application software 
Only platform software is written. 
Only boot loader software is written. 
System microcomputer software is written. 
Firmware of Bluetooth chip is written. 
* Normal writing becomes unable if power is off during the 
  writing. On this occasion, please retry firmware writing. 
* "Complete" may not be displayed while the percentage is kept to 100%. 
  If "Complete" is not displayed in 1 minute after the percentage reaches 100%, turn 
  OFF and ON ACC, and then implement the writing of Bluetooth firmware again. 
Startup screen data is written. 

 

Only once those components are decompiled can we have a shot at REALLY hacking this, although there does appear to be a chance to manipulate some of the information in some folders according to page 105:

 

11. File Maintenance 
This test provides the capability to manage files in each directory. 
In concrete terms, deletion of directory and execution of dumping are possible. 
Operation Screen for the First Phase 
The following 10 directories are becoming as the most significant directories. 
USER/
NDATA/
SD/
SD2/
SD3/
SD4/
USB/
USB2/
USB3/
USB4/ 

 

I think I remember reading that the XM logo data is stored in the NDATA area, so it might be possible to edit this area... also, I would be curious to know what data is in those other folders....

 

I look forward to seeing what the hackers out there come up with

[Geko483]

The first step of this process is getting a hold of a Microsoft Automotive v5.5 SDK or Dev Kit.

 

Then installation and connection of the device, in this case the AVIC-Z110BT.

 

Once we get this far then we can talk about decompiling, but I am unaware of any decompiler for Windows Automotive v5.5

.

Also if you want to interface with the unit directly your best bet is the JTAG connection, or SD Card because they are directly connected to the main CPU on the CC Unit board. The entire unit is controlled by the CC Unit Board, it is also where the Flash ROM (8M), DDR SDRAM (512M X 4), NAND (4GB), and SRAM (4M) are located.

 

Something to note is the power up sequence, which shows you that the Audio is first, then Nav Unit, and finally the CC Unit

 

I am currently still looking for a copy of Windows Automotive v5.5 SDK, PM if you have one.

[dawgbone]

For the time being... only thing I'm currently interested in hacking is the day time map.... While I'm not sure exactly how it would have to be done, but I was hoping that the two maps(night and day) were just two different image files... And that I could just delete the day map, and copy/rename the night map... So no matter day or night, the map's background is black.... yet it still dims correctly in conjunction with the head lights....

 

I started to try to dig into this, as VBlue showed that you can connect your laptop to the unit via BT... I got even more interested, when I saw that there is a FTP folder at the root... I then went into testmode, and realized that while you can delete files in TM.... There is no function(that I'm aware of) to copy....move...rename...etc.... Just delete...

 

As far as decompiling, and just putting it out there.... I believe you can dump any of the files on the Avic into binary or text files and save them to a SD Card while in TM... What to do from there....I dunno

It's above my head as I don't know assembly nor do I have any experiences in decompiling/reverse engineering...

[Geko483]

I started to try to dig into this, as VBlue showed that you can connect your laptop to the unit via BT... I got even more interested, when I saw that there is a FTP folder at the root... I then went into testmode, and realized that while you can delete files in TM.... There is no function(that I'm aware of) to copy....move...rename...etc.... Just delete...

 

As far as decompiling, and just putting it out there.... I believe you can dump any of the files on the Avic into binary or text files and save them to a SD Card while in TM... What to do from there....I dunno

It's above my head as I don't know assembly nor do I have any experiences in decompiling/reverse engineering...

 

Your contradicting yourself when you say that but I am interested in finding a way to dump or otherwise get the existing files off of the system. If you found a process to dump them please let me know the process you used, or are attempting to use.

 

the only process I see defined on page 94 of the service manual is a way to write to the Navi, Platform, Bootloader, System uCon, BlueTooth, and Opening Data from a USB OR SD Card

[dawgbone]

Well I was hoping that there was a way to move files from that FTP directory when connected via laptop.... I can't even find that FTP folder within the unit.... too many files and not enough time...LOL

 

If you boot the unit into testmode and enter into file maintenance, you can browse the files that make up the unit... as far as I know, you can only delete them or dump them into a binary or text file to a SD Card... I may be wrong, but I think the OS is stored on another chip, and you're only able to test read/write from within testmode....

 

Page 105 in the Service Manual...