Jump to content
AVIC411.com

Warning screen bypass on the AVIC-D2


Recommended Posts

Is there a way to make the AVIC-D2 skip that initial warning screen you get when you first power on the unit? It's not a huge deal, but annoying to have to reach over and hit the 'okay' button every time I start up the car. I'm guessing there probably isn't an easy way to do it, since this is most likely a software issue.

 

I have an Alpine nav unit in my other car with the same sort of warning screen and was never able to bypass that, either. One thing I've always liked about my Garmin Streetpilot III portable unit is that there is (believe it or not) an option in the settings to disable the boot-up warning screen. Handy. :)

Link to post
Share on other sites
  • Replies 36
  • Created
  • Last Reply

Top Posters In This Topic

Some people on the Acura forum managed to hack their factory nav to bypass the warning screen, but the Pioneer system has a different CPU and architecture so we can't hack ours the same way. It basically involved disassembling and reverse-engineering the code.

 

I want to hack ours very badly, but the software image is compressed somehow. At least, when I try to disassemble it with a disassembler, the listings don't make sense. I got stuck there because I'm not smart enough to get past that point and I seem to be the only person interested in doing this.

Link to post
Share on other sites
...I seem to be the only person interested in doing this.

 

nope.

 

The OS loader starts around 0x1000. I can disassemble there no problem. Another chunk starts at 0x1200. It's using the NEC RX OS. I'll attach some of the documentation I've found so far and the disassembler I'm using.

 

I'm also stuck without a memory map of where the code is loading. There is a memory dump feature in the service menu, but I don't have enough time to search through it. Once we get a good memory map, we can start mapping the functions....shouldn't be too hard from there.

 

Another interesting idea would be if we could get into the memory dump while the interface is running, then we could look for the location of the global that stores the flag.

necdocs.zip

Link to post
Share on other sites

Jefbarn,

Good to see someone else working on this, sounds like you've found more info than I have! Looks like you found the same Nintendo Virtual Boy disassembler that I was using too. I recompiled it with VS.NET 2005 so it has the ability to disassemble larger chunks (or the whole file if you want) and also adds some V830 opcodes so there are fewer invalid opcodes. I've attached it in case it's useful.

 

For some reason, when I start disassembly at 0x1000, there are "Invalid opcodes" at 0x1030. Is that in your listing too?

V830_dis.zip

Link to post
Share on other sites
  • 1 month later...
...I seem to be the only person interested in doing this.

 

nope.

 

The OS loader starts around 0x1000. I can disassemble there no problem. Another chunk starts at 0x1200. It's using the NEC RX OS. I'll attach some of the documentation I've found so far and the disassembler I'm using.

 

Thanks for posting the instruction set documentation -- I'm going to try to write a V830 processor module plugin for IDA Pro, and will be happy to share my results. (There was talk on a thread on another board (http://cl.acurazine.com/forums/showthread.php?t=169301) that mentioned using IDA Pro, but as far as I can tell it was in error -- the latest version does NOT have support for this chip.)

 

FWIW, the service manual for the D1 breaks the files out as follows:

 

UC050BOT.USA: Bootloader

UC050SYS.USA: System Software / OS

UC050GPS.PRG: GPS firmware

EU050APL.PRG: Application code (loaded into SDRAM)

UC050DAT.USA: Language data

 

Any one know where we can find that bootloader, and does anyone know where the nag message is stored? (as a bitmap, as text?)

-b

Link to post
Share on other sites

Nothing too crazy yet -- but I did find the text for the warning message in UC050DAT.USA.

 

String 1424 (offset=4a88): 'CAUTION: This Navi product is intended solely as a driving aid.  Review instruction manual and select route before driving.  Navi is not a substitute for your attentiveness, judgment, and care while driving or moving your vehicle.  Always observe safe driving rules and driving laws, and follow road signs even if they contradict Navi's instructions.  By pressing OK key, you accept the license agreement in the instruction manual.'

 

I'm attaching a parsed list of the strings from that file, and the simple C program I wrote to make it.

 

Assuming we do eventually figure out what needs to be patched, what's the easiest way to test it? Please don't tell me we'll have to burn a new DL DVD-R each time! :(

uc050dat-strings.zip

Link to post
Share on other sites

Assuming we do eventually figure out what needs to be patched, what's the easiest way to test it? Please don't tell me we'll have to burn a new DL DVD-R each time! :(

 

I think it's possible to slim down the map disc to fit a single layer disc by omitting some POI's and such. Then you can burn it to a DVD-RW.

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...



×
×
  • Create New...