Modify Your F-Series Base OS and Registry

[EEGeek]

If any of you would like to be able to extract the base OS out of your F-Series unit, add files to the OS image, or modify the system registry, I've created a tool to automate the process called avic-modder. I've added a wiki page with the manual instructions (if you don't want to use my app) AND a link to my app. Here's the software link again here:

 

http://www.mediafire.com/file/zmzymzgzg ... r_beta.zip

 

All you need to do is copy your WINCEIMG.BIN file from you "My Flash Disk" folder to your PC and then open it with this software. The rest should be obvious. If it's not obvious, I'll add some more instructions in here.

 

 

This has allowed me to customize my unit so I don't need to use testmode to boot a custom setup. This means if you don't like having your unit reboot every time you start your car (testmode annoyance), this can help. If you'd like to include new drivers into the OS image, this can do that too. It can also help you launch Leetlauncher or something else at boot, even with no SD card inserted.

 

The output is a new WINCEIMG.BIN and WINCEIMG.CKS file to use via the service menu to update your Windows image.

 

REMEMBER TO ALWAYS BACKUP YOUR ORIGINAL WINCEIMG.BIN and WINCEIMG.CKS FILES IN CASE SOMETHING GOES WRONG!!!

[EEGeek]

Looks like it's been downloaded 16 times, anybody tried it out yet? Comments? Suggestions?

[abb1]

Well, I was one of those that downloaded it, but I wont be playing with it until I have a day off. How does this differ though from just using 'Testmode'? Can this get me into the hardcoded scripting of the AV/Main screen which was previosly untouchable?

[Rostol]

Hi EEGeek, I was one of the 16 ... honestly, at first i thought it was your cooked rom for us to check out, not the tools to cook them ... so i Built my own rom with what i thought were the drivers for the 2.06 version for the 500BT (mine) and the rest of the tools from the X Firmware.

 

Flashed it and bricked :S ... i truly thought this was like the phones (ie as long as you don't flash uboot you're in the clear) but now i can't even get the 500 to boot to the flash page (the blue one)

 

So while thankful for your release ... my results are less than encouraging, and my week-old 500BT is dead in the water.

 

Well, I was one of those that downloaded it, but I wont be playing with it until I have a day off. How does this differ though from just using 'Testmode'? Can this get me into the hardcoded scripting of the AV/Main screen which was previosly untouchable?

Abb1: basically no ... this is for editing and rebuilding the winceimg.bin, which is divided in two the eboot: what makes the device boot (fs drivers, core, bus drivers) and what i kept from the 500BT firmware; and wince: the "windows" dir (what i used from the X Firmware)

 

Try it, run the tool, point it to a .bin file and go to %temp%\avic-modder\original and you'll see (this is completely safe it just "unzips" the bin to its contents, you can discard those dirs afterwards).

 

What REALLY bothers me is that it shoulda worked ... or at least not fail so miserably.

 

BTW: I believe what you are looking for its found in APL\Main.Res (open it with 7zip or winrar) but don't take my word for it as i had my 500BT only for a week.

 

Anyone knows if i can JTAG it ? I don't even have the correct tools to open it, smalles torx i have is T6.

[EEGeek]

Rostol, that's sad to hear! I have a F500 as well and have yet to brick it, although I didn't try to use an eboot from one version and a windows image from another version. My approach has always been baby steps. When I first flashed a new image to it, I didn't change any files, I just unpacked it, repacked it, and flashed it. The next time I added a couple files, then I changed the registry, etc etc. I already have a unit that was upgraded to 3.0 so I didn't attempt any "patchwork" like you did. I know the upgrade I did had a software code that was generated to match my hardware id. Could be related.

 

I have never heard of anyone who couldn't get to the service menu before after only upgrading the windows image. You didn't accidentally select uboot upgrade or windows upgrade "with format" right?

 

In any case, if you can get it to come up into the service menu again, I've got my stock 3.0 image files you can try.

[Chuck88]

Hey EEGeek, I don't see WINCEIMG.BIN and WINCEIMG.CLK inside the "My Flash Disk" folder, nor outside (checked today), can you point me to them please? Do I have to enable viewing System and Hidden files somehow?

 

From a downloaded copy of the AVIC Firmware 3.0 Update, I do see them at the same level as the "My Flash Disk", but not inside. Can you shed some light?

 

Anybody can tell me how to do a COMPLETE backup of the AVIC, beside the "My Flash Disk" folder

 

Thanks.

[EEGeek]

I'm not by my unit right now, but will check when I get home. I'd say, yes, turn on viewing of hidden and protected system files and then have a peek. I've only tried this on images taken from an F500 and an F90, if anyone else has success with it extracting files from other hardware versions, let me know and I'll keep tabs on them all. Likewise, if you have one that doesn't seem to work, upload your .BIN file to something like mediafire.com and then post the link. I'll then see if I can get it to support other units as well.

[ELECPRO]

Hello,

 

At start thanks for the soft, and sorry about my english, i am spanish.

 

The soft do not start and try to access to internet why?

 

Regards,

[EEGeek]

No tiene "code" para redes, entonces no va a comunicar por el internet. Que "OS" estas usando? Tienes ".NET framework 2.0" instalado? Es la unica dependencia para initializar mi software. Pero la mayoria de las personas ya lo tienen instalado.

 

De donde eres?

 

For Gringos:

It doesn't have any networking code in it so it isn't trying to do anything on the internet. What OS are you using? Do you have .NET framework 2.0 installed? You have to have that installed for it to work. But, most people have that installed already.

 

Where are you from?

[EEGeek]

BTW, I'm thinking about posting the source for this since it's not like I'm going to be selling this or anything. There's just something weird about giving away code; it makes me feel funny.

[Chuck88]

I'm not by my unit right now, but will check when I get home. I'd say, yes, turn on viewing of hidden and protected system files and then have a peek. I've only tried this on images taken from an F500 and an F90, if anyone else has success with it extracting files from other hardware versions, let me know and I'll keep tabs on them all. Likewise, if you have one that doesn't seem to work, upload your .BIN file to something like mediafire.com and then post the link. I'll then see if I can get it to support other units as well.

 

Hi EEGeek,

 

I do have System and Hidden file enabled but still nothing. Any hint would be greatly appreciated.

 

Thanks.

[Rostol]

No entiendo ... si todos hablamos un idioma l�gico porque estamos hablando en gringo-speak jajajaja

 

 

Yeah EEGeek, i skipped the whole baby-steps part ...

 

I did not update the uboot, as I knew (thought really cos was proved wrong) that was what would get me out of trouble. And i don't think i chose with format as it wouldn't be necessary ... but anyway that should format the flashdisk and the eboot partitions not the uboot one right ?

 

After the flash, on power-up, the spalsh (custom one not the Pioneer one) was shown briefly before shutting down and that is also in the flash rite ?

 

I'll see if I can buy the tools to open it today/tomorrow to see if its jtagabble.

 

Chuck88: Those 2 files are not in "My Flash Disk", you can't just back it up. There are ways to dump the rom from phones but i dont know if any are usable with these gps.

[Chuck88]

 

I'll see if I can buy the tools to open it today/tomorrow to see if its jtagabble.

 

Chuck88: Those 2 files are not in "My Flash Disk", you can't just back it up. There are ways to dump the rom from phones but i dont know if any are usable with these gps.

 

Hi Rostol,

 

It would be very surprise to me if Pioneer has left a JTAG connector on their production PCB, so I would say almost for sure, that if you want to go that way, it would require to install a JTAG connector by soldering around the ARM processor, which will be a rather delicate task to accomplish.

 

I don't know exactly what was wrong with your AVIC but it should be other ways to revive your HU. There are other posts in the Problems/Troubleshoot sections. Search in this forum for "Revive a BRICKED F90" and "FormatMBR -SDMLC" to see if any of those methods can suite your situation.

 

As for the two files, I do see them in the original files for the 3.0 FW. Do you think that once they are flashed using the Service Console, those files are broken into pieces and no longer keep the original name (unlike the F500 Series)?

 

Are you familiar with the X- or F-Series? How to make a complete backup?

 

Later.

[Rostol]

Good news !

 

Incredibly enough (with the help of a friend pressing various buttons on the front panel + reset) I managed to get into the flash menu and flahsed the 2.0 version .bin

 

Chuck: You can't really make a complete backup of the AVIC as it is. You need to copy "My Flash Disk" and get the .img and .chk from the last firmware you flashed to it. In my case its AVIC-F500BT_Firmware_Update_2.006000.zip

 

There might be a way to get it off from the AVIC, I recall there used to be a WinCE/Mobile app that dumped the rom to an SD-CARD, will try to see if i can find it for you. But the easiest is getting the firmware from Pioneer (or here if you used any of the "unofficial" ones.

 

BTW, altho i did not use either of the posts you said the info inside was great reading so thanks for that

[EEGeek]

Good news !

 

Incredibly enough (with the help of a friend pressing various buttons on the front panel + reset) I managed to get into the flash menu and flahsed the 2.0 version .bin

 

Chuck: You can't really make a complete backup of the AVIC as it is. You need to copy "My Flash Disk" and get the .img and .chk from the last firmware you flashed to it. In my case its AVIC-F500BT_Firmware_Update_2.006000.zip

 

There might be a way to get it off from the AVIC, I recall there used to be a WinCE/Mobile app that dumped the rom to an SD-CARD, will try to see if i can find it for you. But the easiest is getting the firmware from Pioneer (or here if you used any of the "unofficial" ones.

 

BTW, altho i did not use either of the posts you said the info inside was great reading so thanks for that

 

Congrats! Now on to modding again!