ShortFuse Posted September 4, 2010 Report Share Posted September 4, 2010 MOD COMMENT: I just wanted to offer a huge congrats to valued forum member ShortFuse. Over the last several months there have been numerous members claim they could do what he has done only to never be seen again. This kind of carrot dangling does no one any good at all and I honestly had no faith in this effort. I am glad to say I was wrong for my lack of faith in this instance. Now, for the first time in over a year, it now appears we may actually be able to offer UI hacks for the current crop of Pioneer navis do to his contributions. We are making no promises, but this is a big step in the right direction. I look forward to where this goes from here. Donate if you like: https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=7ELH2CPLUZLQY Phase 1 - Crack upgrade file - COMPLETE Download the v1.001 update from Pioneer. Replace AVICZ110EU090APL.VER and AVICZ110APLRenewalIFLib.dll with the files attached. Copy the AVICZ110 folder with the patched files to the root of an SD card. Insert the SD to your Z110BT and it should start updating automatically. You are now running the patched version. When you try to run a map upgrade insert anything for the password. If it's not taking it, try filling the input box with characters (no numbers). It's PERFECTLY SAFE to upgrade the 2.003. Looking at that, I'm 99% sure that the next update (2011 map if it exists) will be cracked with the same method. Don't ask me about 2012. There are reports of this working for the EU versions. I wouldn't be surprised. The APL folder (NAND1) for the US and EU version are COMPLETELY IDENTICAL. F10BT's 2.003 update is identical to Z120's 2.003 update. What makes them work different are the contents on NAND2 (the 4GB). This also means that any APL patches for the US versions will be cross compatible with other regions. I wouldn't be surprised if the F10BT is just a Z110BT upgraded to 1.001 (can any F10BT users check this?) This might also mean, you can convert from any 1.x region to any other 2.x region (ie: 1.x US to 2.x EU). I believe that Pioneer runs a region check in the application. I incorrectly called this a "version check" because the subroutine is called GetVersion(void). I did bypass this function, which means I probably bypassed the region check as an added bonus to this crack. PLEASE PLEASE PLEASE note: There is no downgrade ability at the moment. Don't just try to convert your 1.x to a different region for the fun of it. Reference Posts: <!-- l --><a class="postlink-local" href="http://avic411.com/forum/viewtopic.php?f=57&t=34478&p=229354#p229354">viewtopic.php?f=57&t=34478&p=229354#p229354</a><!-- l --> Phase 2 - Mods Step 1: Make recovery bootloader Before we start modding things we need a recovery options. It's far too easy to brick the device right now. I almost bricked it when I did the upgrade crack. We need to have an option to force recovery. This will likely be a button press sequence while the device boots (like holding Home and Mode while booting). The target files are the PRG files in BOOT and PLATFORM. Once we decode that, we can start playing around with it. The file makes reference to the WINCE kernel and WinCE dll files, so I wouldn't be surprised if this like a PPC ROM file. After some more research, it seems we can flash via recovery by access Option #3 from the Test Mode menu. Misc NAND2 Image from 2010 Firmware update: PARTCODE.TXT RELEASE.TXT NDATA�0ALLDATA.LFT NDATA�0DTR_H.DB NDATA�0ILUSTMAP.LFT NDATA�0INDEXDAT.DB NDATA�0LANDMARK.LFT NDATA�0NDB_ALLDATA.VER NDATA�0ShortCutGenre.txt NDATA�0ZonelistOnFlash.txt NDATA�0IDXGENRE_H.DB NDATA�0IDXPOI.LDB NDATA�0MAP2DCITY.LFT NDATA�0MAPLINKCOND.LFT NDATA�0MAPPARCEL.LFT NDATA�0MAPPARCEL00.LFT NDATA�0MAPRDSTMC.LFT NDATA�0MAPREGION.LFT NDATA�2HN02.LFT NDATA�2SHLDDC02.LFT NDATA�2STPTDC02.LFT NDATA�2STRTDC02.LFT NDATA�2IDXINDEX02.LDB NDATA�2IDXPOISR02.LDB NDATA�2IDXSCSR02.LFT NDATA�2MAPPARCEL02.LFT NDATA�3HN03.LFT NDATA�3SHLDDC03.LFT NDATA�3STPTDC03.LFT NDATA�3STRTDC03.LFT NDATA�3IDXINDEX03.LDB NDATA�3IDXPOISR03.LDB NDATA�3IDXSCSR03.LFT NDATA�3MAPPARCEL03.LFT NDATA�4HN04.LFT NDATA�4SHLDDC04.LFT NDATA�4STPTDC04.LFT NDATA�4STRTDC04.LFT NDATA�4IDXINDEX04.LDB NDATA�4IDXPOISR04.LDB NDATA�4IDXSCSR04.LFT NDATA�4MAP2DCITY04.LFT NDATA�4MAPPARCEL04.LFT NDATA�5HN05.LFT NDATA�5SHLDDC05.LFT NDATA�5STPTDC05.LFT NDATA�5STRTDC05.LFT NDATA�5IDXINDEX05.LDB NDATA�5IDXPOISR05.LDB NDATA�5IDXSCSR05.LFT NDATA�5MAPPARCEL05.LFT NDATA�6HN06.LFT NDATA�6SHLDDC06.LFT NDATA�6STPTDC06.LFT NDATA�6STRTDC06.LFT NDATA�6IDXINDEX06.LDB NDATA�6IDXPOISR06.LDB NDATA�6IDXSCSR06.LFT NDATA�6MAP2DCITY06.LFT NDATA�6MAPPARCEL06.LFT NDATA�7HN07.LFT NDATA�7IDX NDATA�7MAP NDATA�7SHLDDC07.LFT NDATA�7STPTDC07.LFT NDATA�7STRTDC07.LFT NDATA�7IDXINDEX07.LDB NDATA�7IDXPOISR07.LDB NDATA�7IDXSCSR07.LFT NDATA�7MAP2DCITY07.LFT NDATA�7MAPPARCEL07.LFT NDATA�8HN08.LFT NDATA�8SHLDDC08.LFT NDATA�8STPTDC08.LFT NDATA�8STRTDC08.LFT NDATA�8IDXINDEX08.LDB NDATA�8IDXPOISR08.LDB NDATA�8IDXSCSR08.LFT NDATA�8MAPPARCEL08.LFT NDATA�9HN09.LFT NDATA�9SHLDDC09.LFT NDATA�9STPTDC09.LFT NDATA�9STRTDC09.LFT NDATA�9IDXINDEX09.LDB NDATA�9IDXPOISR09.LDB NDATA�9IDXSCSR09.LFT NDATA�9MAPPARCEL09.LFT NDATA�AHN0A.LFT NDATA�ASHLDDC0A.LFT NDATA�ASTPTDC0A.LFT NDATA�ASTRTDC0A.LFT NDATA�AIDXINDEX0A.LDB NDATA�AIDXPOISR0A.LDB NDATA�AIDXSCSR0A.LFT NDATA�AMAP2DCITY0A.LFT NDATA�AMAPPARCEL0A.LFT NDATA�BHN0B.LFT NDATA�BSHLDDC0B.LFT NDATA�BSTPTDC0B.LFT NDATA�BSTRTDC0B.LFT NDATA�BIDXINDEX0B.LDB NDATA�BIDXPOISR0B.LDB NDATA�BIDXSCSR0B.LFT NDATA�BMAP2DCITY0B.LFT NDATA�BMAPPARCEL0B.LFT NDATA�CHN0C.LFT NDATA�CSHLDDC0C.LFT NDATA�CSTPTDC0C.LFT NDATA�CSTRTDC0C.LFT NDATA�CIDXINDEX0C.LDB NDATA�CIDXPOISR0C.LDB NDATA�CIDXSCSR0C.LFT NDATA�CMAP2DCITY0C.LFT NDATA�CMAPPARCEL0C.LFT NDATA�DHN0D.LFT NDATA�DSHLDDC0D.LFT NDATA�DSTPTDC0D.LFT NDATA�DSTRTDC0D.LFT NDATA�DIDXINDEX0D.LDB NDATA�DIDXPOISR0D.LDB NDATA�DIDXSCSR0D.LFT NDATA�DMAP2DCITY0D.LFT NDATA�DMAPPARCEL0D.LFT NDATA�EHN0E.LFT NDATA�ESHLDDC0E.LFT NDATA�ESTPTDC0E.LFT NDATA�ESTRTDC0E.LFT NDATA�EIDXINDEX0E.LDB NDATA�EIDXPOISR0E.LDB NDATA�EIDXSCSR0E.LFT NDATA�EMAPPARCEL0E.LFT NDATA�FHN0F.LFT NDATA�FSHLDDC0F.LFT NDATA�FSTPTDC0F.LFT NDATA�FSTRTDC0F.LFT NDATA�FIDXINDEX0F.LDB NDATA�FIDXPOISR0F.LDB NDATA�FIDXSCSR0F.LFT NDATA�FMAP2DCITY0F.LFT NDATA�FMAPPARCEL0F.LFT NDATA10HN10.LFT NDATA10SHLDDC10.LFT NDATA10STPTDC10.LFT NDATA10STRTDC10.LFT NDATA10IDXINDEX10.LDB NDATA10IDXPOISR10.LDB NDATA10IDXSCSR10.LFT NDATA10MAP2DCITY10.LFT NDATA10MAPPARCEL10.LFT NDATA11HN11.LFT NDATA11SHLDDC11.LFT NDATA11STPTDC11.LFT NDATA11STRTDC11.LFT NDATA11IDXINDEX11.LDB NDATA11IDXPOISR11.LDB NDATA11IDXSCSR11.LFT NDATA11MAP2DCITY11.LFT NDATA11MAPPARCEL11.LFT NDATA12HN12.LFT NDATA12SHLDDC12.LFT NDATA12STPTDC12.LFT NDATA12STRTDC12.LFT NDATA12IDXINDEX12.LDB NDATA12IDXPOISR12.LDB NDATA12IDXSCSR12.LFT NDATA12MAP2DCITY12.LFT NDATA12MAPPARCEL12.LFT NDATA13HN13.LFT NDATA13SHLDDC13.LFT NDATA13STPTDC13.LFT NDATA13STRTDC13.LFT NDATA13IDXINDEX13.LDB NDATA13IDXPOISR13.LDB NDATA13IDXSCSR13.LFT NDATA13MAP2DCITY13.LFT NDATA13MAPPARCEL13.LFT NDATA14HN14.LFT NDATA14SHLDDC14.LFT NDATA14STPTDC14.LFT NDATA14STRTDC14.LFT NDATA14IDXINDEX14.LDB NDATA14IDXPOISR14.LDB NDATA14IDXSCSR14.LFT NDATA14MAP2DCITY14.LFT NDATA14MAPPARCEL14.LFT NDATA15HN15.LFT NDATA15SHLDDC15.LFT NDATA15STPTDC15.LFT NDATA15STRTDC15.LFT NDATA15IDXINDEX15.LDB NDATA15IDXPOISR15.LDB NDATA15IDXSCSR15.LFT NDATA15MAPPARCEL15.LFT NDATA16HN16.LFT NDATA16SHLDDC16.LFT NDATA16STPTDC16.LFT NDATA16STRTDC16.LFT NDATA16IDXINDEX16.LDB NDATA16IDXPOISR16.LDB NDATA16IDXSCSR16.LFT NDATA16MAP2DCITY16.LFT NDATA16MAPPARCEL16.LFT NDATA17HN17.LFT NDATA17SHLDDC17.LFT NDATA17STPTDC17.LFT NDATA17STRTDC17.LFT NDATA17IDXINDEX17.LDB NDATA17IDXPOISR17.LDB NDATA17IDXSCSR17.LFT NDATA17MAP2DCITY17.LFT NDATA17MAPPARCEL17.LFT NDATA18HN18.LFT NDATA18SHLDDC18.LFT NDATA18STPTDC18.LFT NDATA18STRTDC18.LFT NDATA18IDXINDEX18.LDB NDATA18IDXPOISR18.LDB NDATA18IDXSCSR18.LFT NDATA18MAP2DCITY18.LFT NDATA18MAPPARCEL18.LFT NDATA19HN19.LFT NDATA19SHLDDC19.LFT NDATA19STPTDC19.LFT NDATA19STRTDC19.LFT NDATA19IDXINDEX19.LDB NDATA19IDXPOISR19.LDB NDATA19IDXSCSR19.LFT NDATA19MAP2DCITY19.LFT NDATA19MAPPARCEL19.LFT NDATA1AHN1A.LFT NDATA1ASHLDDC1A.LFT NDATA1ASTPTDC1A.LFT NDATA1ASTRTDC1A.LFT NDATA1AIDXINDEX1A.LDB NDATA1AIDXPOISR1A.LDB NDATA1AIDXSCSR1A.LFT NDATA1AMAPPARCEL1A.LFT NDATA1BHN1B.LFT NDATA1BSHLDDC1B.LFT NDATA1BSTPTDC1B.LFT NDATA1BSTRTDC1B.LFT NDATA1BIDXINDEX1B.LDB NDATA1BIDXPOISR1B.LDB NDATA1BIDXSCSR1B.LFT NDATA1BMAP2DCITY1B.LFT NDATA1BMAPPARCEL1B.LFT NDATA1CHN1C.LFT NDATA1CSHLDDC1C.LFT NDATA1CSTPTDC1C.LFT NDATA1CSTRTDC1C.LFT NDATA1CIDXINDEX1C.LDB NDATA1CIDXPOISR1C.LDB NDATA1CIDXSCSR1C.LFT NDATA1CMAPPARCEL1C.LFT NDATA1DHN1D.LFT NDATA1DSHLDDC1D.LFT NDATA1DSTPTDC1D.LFT NDATA1DSTRTDC1D.LFT NDATA1DIDXINDEX1D.LDB NDATA1DIDXPOISR1D.LDB NDATA1DIDXSCSR1D.LFT NDATA1DMAP2DCITY1D.LFT NDATA1DMAPPARCEL1D.LFT NDATA1EHN1E.LFT NDATA1ESHLDDC1E.LFT NDATA1ESTPTDC1E.LFT NDATA1ESTRTDC1E.LFT NDATA1EIDXINDEX1E.LDB NDATA1EIDXPOISR1E.LDB NDATA1EIDXSCSR1E.LFT NDATA1EMAP2DCITY1E.LFT NDATA1EMAPPARCEL1E.LFT NDATA1FHN1F.LFT NDATA1FSHLDDC1F.LFT NDATA1FSTPTDC1F.LFT NDATA1FSTRTDC1F.LFT NDATA1FIDXINDEX1F.LDB NDATA1FIDXPOISR1F.LDB NDATA1FIDXSCSR1F.LFT NDATA1FMAPPARCEL1F.LFT NDATA20HN20.LFT NDATA20SHLDDC20.LFT NDATA20STPTDC20.LFT NDATA20STRTDC20.LFT NDATA20IDXINDEX20.LDB NDATA20IDXPOISR20.LDB NDATA20IDXSCSR20.LFT NDATA20MAP2DCITY20.LFT NDATA20MAPPARCEL20.LFT NDATA21HN21.LFT NDATA21SHLDDC21.LFT NDATA21STPTDC21.LFT NDATA21STRTDC21.LFT NDATA21IDXINDEX21.LDB NDATA21IDXPOISR21.LDB NDATA21IDXSCSR21.LFT NDATA21MAP2DCITY21.LFT NDATA21MAPPARCEL21.LFT NDATA22HN22.LFT NDATA22SHLDDC22.LFT NDATA22STPTDC22.LFT NDATA22STRTDC22.LFT NDATA22IDXINDEX22.LDB NDATA22IDXPOISR22.LDB NDATA22IDXSCSR22.LFT NDATA22MAP2DCITY22.LFT NDATA22MAPPARCEL22.LFT NDATA23HN23.LFT NDATA23SHLDDC23.LFT NDATA23STPTDC23.LFT NDATA23STRTDC23.LFT NDATA23IDXINDEX23.LDB NDATA23IDXPOISR23.LDB NDATA23IDXSCSR23.LFT NDATA23MAP2DCITY23.LFT NDATA23MAPPARCEL23.LFT NDATA24HN24.LFT NDATA24SHLDDC24.LFT NDATA24STPTDC24.LFT NDATA24STRTDC24.LFT NDATA24IDXINDEX24.LDB NDATA24IDXPOISR24.LDB NDATA24IDXSCSR24.LFT NDATA24MAPPARCEL24.LFT NDATA25HN25.LFT NDATA25SHLDDC25.LFT NDATA25STPTDC25.LFT NDATA25STRTDC25.LFT NDATA25IDXINDEX25.LDB NDATA25IDXPOISR25.LDB NDATA25IDXSCSR25.LFT NDATA25MAP2DCITY25.LFT NDATA25MAPPARCEL25.LFT NDATA26HN26.LFT NDATA26SHLDDC26.LFT NDATA26STPTDC26.LFT NDATA26STRTDC26.LFT NDATA26IDXINDEX26.LDB NDATA26IDXPOISR26.LDB NDATA26IDXSCSR26.LFT NDATA26MAP2DCITY26.LFT NDATA26MAPPARCEL26.LFT NDATA27HN27.LFT NDATA27SHLDDC27.LFT NDATA27STPTDC27.LFT NDATA27STRTDC27.LFT NDATA27IDXINDEX27.LDB NDATA27IDXPOISR27.LDB NDATA27IDXSCSR27.LFT NDATA27MAP2DCITY27.LFT NDATA27MAPPARCEL27.LFT NDATA28HN28.LFT NDATA28SHLDDC28.LFT NDATA28STPTDC28.LFT NDATA28STRTDC28.LFT NDATA28IDXINDEX28.LDB NDATA28IDXPOISR28.LDB NDATA28IDXSCSR28.LFT NDATA28MAP2DCITY28.LFT NDATA28MAPPARCEL28.LFT NDATA29HN29.LFT NDATA29SHLDDC29.LFT NDATA29STPTDC29.LFT NDATA29STRTDC29.LFT NDATA29IDXINDEX29.LDB NDATA29IDXPOISR29.LDB NDATA29IDXSCSR29.LFT NDATA29MAPPARCEL29.LFT NDATA2AHN2A.LFT NDATA2ASHLDDC2A.LFT NDATA2ASTPTDC2A.LFT NDATA2ASTRTDC2A.LFT NDATA2AIDXINDEX2A.LDB NDATA2AIDXPOISR2A.LDB NDATA2AIDXSCSR2A.LFT NDATA2AMAPPARCEL2A.LFT NDATA2BHN2B.LFT NDATA2BSHLDDC2B.LFT NDATA2BSTPTDC2B.LFT NDATA2BSTRTDC2B.LFT NDATA2BIDXINDEX2B.LDB NDATA2BIDXPOISR2B.LDB NDATA2BIDXSCSR2B.LFT NDATA2BMAP2DCITY2B.LFT NDATA2BMAPPARCEL2B.LFT NDATA2CHN2C.LFT NDATA2CSHLDDC2C.LFT NDATA2CSTPTDC2C.LFT NDATA2CSTRTDC2C.LFT NDATA2CIDXINDEX2C.LDB NDATA2CIDXPOISR2C.LDB NDATA2CIDXSCSR2C.LFT NDATA2CMAPPARCEL2C.LFT NDATA2DHN2D.LFT NDATA2DSHLDDC2D.LFT NDATA2DSTPTDC2D.LFT NDATA2DSTRTDC2D.LFT NDATA2DIDXINDEX2D.LDB NDATA2DIDXPOISR2D.LDB NDATA2DIDXSCSR2D.LFT NDATA2DMAP2DCITY2D.LFT NDATA2DMAPPARCEL2D.LFT NDATA2EHN2E.LFT NDATA2ESHLDDC2E.LFT NDATA2ESTPTDC2E.LFT NDATA2ESTRTDC2E.LFT NDATA2EIDXINDEX2E.LDB NDATA2EIDXPOISR2E.LDB NDATA2EIDXSCSR2E.LFT NDATA2EMAP2DCITY2E.LFT NDATA2EMAPPARCEL2E.LFT NDATA2FHN2F.LFT NDATA2FSHLDDC2F.LFT NDATA2FSTPTDC2F.LFT NDATA2FSTRTDC2F.LFT NDATA2FIDXINDEX2F.LDB NDATA2FIDXPOISR2F.LDB NDATA2FIDXSCSR2F.LFT NDATA2FMAP2DCITY2F.LFT NDATA2FMAPPARCEL2F.LFT NDATA30HN30.LFT NDATA30SHLDDC30.LFT NDATA30STPTDC30.LFT NDATA30STRTDC30.LFT NDATA30IDXINDEX30.LDB NDATA30IDXPOISR30.LDB NDATA30IDXSCSR30.LFT NDATA30MAPPARCEL30.LFT NDATA31HN31.LFT NDATA31SHLDDC31.LFT NDATA31STPTDC31.LFT NDATA31STRTDC31.LFT NDATA31IDXINDEX31.LDB NDATA31IDXPOISR31.LDB NDATA31IDXSCSR31.LFT NDATA31MAP2DCITY31.LFT NDATA31MAPPARCEL31.LFT NDATA33HN33.LFT NDATA33SHLDDC33.LFT NDATA33STPTDC33.LFT NDATA33STRTDC33.LFT NDATA33IDXINDEX33.LDB NDATA33IDXPOISR33.LDB NDATA33IDXSCSR33.LFT NDATA33MAP2DCITY33.LFT NDATA33MAPPARCEL33.LFT NDATA34HN34.LFT NDATA34SHLDDC34.LFT NDATA34STPTDC34.LFT NDATA34STRTDC34.LFT NDATA34IDXINDEX34.LDB NDATA34IDXPOISR34.LDB NDATA34IDXSCSR34.LFT NDATA34MAPPARCEL34.LFT NDATA35HN35.LFT NDATA35SHLDDC35.LFT NDATA35STPTDC35.LFT NDATA35STRTDC35.LFT NDATA35IDXINDEX35.LDB NDATA35IDXPOISR35.LDB NDATA35IDXSCSR35.LFT NDATA35MAP2DCITY35.LFT NDATA35MAPPARCEL35.LFT NDATA36HN36.LFT NDATA36SHLDDC36.LFT NDATA36STPTDC36.LFT NDATA36STRTDC36.LFT NDATA36IDXINDEX36.LDB NDATA36IDXPOISR36.LDB NDATA36IDXSCSR36.LFT NDATA36MAPPARCEL36.LFT NDATA42HN42.LFT NDATA42SHLDDC42.LFT NDATA42STPTDC42.LFT NDATA42STRTDC42.LFT NDATA42IDXINDEX42.LDB NDATA42IDXPOISR42.LDB NDATA42IDXSCSR42.LFT NDATA42MAP2DCITY42.LFT NDATA42MAPPARCEL42.LFT NDATA43HN43.LFT NDATA43SHLDDC43.LFT NDATA43STPTDC43.LFT NDATA43STRTDC43.LFT NDATA43IDXINDEX43.LDB NDATA43IDXPOISR43.LDB NDATA43IDXSCSR43.LFT NDATA43MAP2DCITY43.LFT NDATA43MAPPARCEL43.LFT NDATA44HN44.LFT NDATA44SHLDDC44.LFT NDATA44STPTDC44.LFT NDATA44STRTDC44.LFT NDATA44IDXINDEX44.LDB NDATA44IDXPOISR44.LDB NDATA44IDXSCSR44.LFT NDATA44MAPPARCEL44.LFT NDATA45HN45.LFT NDATA45SHLDDC45.LFT NDATA45STPTDC45.LFT NDATA45STRTDC45.LFT NDATA45IDXINDEX45.LDB NDATA45IDXPOISR45.LDB NDATA45IDXSCSR45.LFT NDATA45MAPPARCEL45.LFT NDATA46HN46.LFT NDATA46SHLDDC46.LFT NDATA46STPTDC46.LFT NDATA46STRTDC46.LFT NDATA46IDXINDEX46.LDB NDATA46IDXPOISR46.LDB NDATA46IDXSCSR46.LFT NDATA46MAPPARCEL46.LFT NDATA47HN47.LFT NDATA47SHLDDC47.LFT NDATA47STPTDC47.LFT NDATA47STRTDC47.LFT NDATA47IDXINDEX47.LDB NDATA47IDXPOISR47.LDB NDATA47IDXSCSR47.LFT NDATA47MAPPARCEL47.LFT NDATA48HN48.LFT NDATA48SHLDDC48.LFT NDATA48STPTDC48.LFT NDATA48STRTDC48.LFT NDATA48IDXINDEX48.LDB NDATA48IDXPOISR48.LDB NDATA48IDXSCSR48.LFT NDATA48MAPPARCEL48.LFT NDATA49HN49.LFT NDATA49STRTDC49.LFT NDATA49IDXINDEX49.LDB NDATA49IDXPOISR49.LDB NDATA49IDXSCSR49.LFT NDATA49MAPPARCEL49.LFT NDATA4AHN4A.LFT NDATA4ASHLDDC4A.LFT NDATA4ASTPTDC4A.LFT NDATA4ASTRTDC4A.LFT NDATA4AIDXINDEX4A.LDB NDATA4AIDXPOISR4A.LDB NDATA4AIDXSCSR4A.LFT NDATA4AMAP2DCITY4A.LFT NDATA4AMAPPARCEL4A.LFT NDATA4BHN4B.LFT NDATA4BSHLDDC4B.LFT NDATA4BSTPTDC4B.LFT NDATA4BSTRTDC4B.LFT NDATA4BIDXINDEX4B.LDB NDATA4BIDXPOISR4B.LDB NDATA4BIDXSCSR4B.LFT NDATA4BMAPPARCEL4B.LFT NDATA4CHN4C.LFT NDATA4CSHLDDC4C.LFT NDATA4CSTPTDC4C.LFT NDATA4CSTRTDC4C.LFT NDATA4CIDXINDEX4C.LDB NDATA4CIDXPOISR4C.LDB NDATA4CIDXSCSR4C.LFT NDATA4CMAP2DCITY4C.LFT NDATA4CMAPPARCEL4C.LFT NDATA4DHN4D.LFT NDATA4DSHLDDC4D.LFT NDATA4DSTPTDC4D.LFT NDATA4DSTRTDC4D.LFT NDATA4DIDXINDEX4D.LDB NDATA4DIDXPOISR4D.LDB NDATA4DIDXSCSR4D.LFT NDATA4DMAPPARCEL4D.LFT NDATA4EHN4E.LFT NDATA4ESHLDDC4E.LFT NDATA4ESTPTDC4E.LFT NDATA4ESTRTDC4E.LFT NDATA4EIDXINDEX4E.LDB NDATA4EIDXPOISR4E.LDB NDATA4EIDXSCSR4E.LFT NDATA4EMAPPARCEL4E.LFT NDATAAVXMCATCAT01.GIF NDATAAVXMCATCAT02.GIF NDATAAVXMCATCAT03.GIF NDATAAVXMCATCAT04.GIF NDATAAVXMCATCAT05.GIF NDATAAVXMCATCAT06.GIF NDATAAVXMCATCAT07.GIF NDATAAVXMCATCAT08.GIF NDATAAVXMCATCAT09.GIF NDATAAVXMCATCAT10.GIF NDATAAVXMCATCAT11.GIF NDATAAVXMCATCAT12.GIF NDATAAVXMCATCAT13.GIF NDATAAVXMCATCAT14.GIF NDATAAVXMCATCAT15.GIF NDATAAVXMCATCAT16.GIF NDATAAVXMCATCAT17.GIF NDATAAVXMCATCAT18.GIF NDATAAVXMCATCAT19.GIF NDATAAVXMCATCATNOT.BMP NDATAAVXMDATIMAGETBL.DAT NDATAAVXMDATVERSION.DAT NDATAAVXMDPSDPS002.BMP NDATAAVXMDPSDPS004.BMP NDATAAVXMDPSDPS005.BMP NDATAAVXMDPSDPS006.BMP NDATAAVXMDPSDPS007.BMP NDATAAVXMDPSDPS008.BMP NDATAAVXMDPSDPS009.BMP NDATAAVXMDPSDPS010.BMP NDATAAVXMDPSDPS011.BMP NDATAAVXMDPSDPS012.BMP NDATAAVXMDPSDPS013.BMP NDATAAVXMDPSDPS014.BMP NDATAAVXMDPSDPS015.BMP NDATAAVXMDPSDPS016.BMP NDATAAVXMDPSDPS017.BMP NDATAAVXMDPSDPS018.BMP NDATAAVXMDPSDPS019.BMP NDATAAVXMDPSDPS020.BMP NDATAAVXMDPSDPS021.BMP NDATAAVXMDPSDPS022.BMP NDATAAVXMDPSDPS023.BMP NDATAAVXMDPSDPS024.BMP NDATAAVXMDPSDPS025.BMP NDATAAVXMDPSDPS026.BMP NDATAAVXMDPSDPS027.BMP NDATAAVXMDPSDPS028.BMP NDATAAVXMDPSDPS029.BMP NDATAAVXMDPSDPS030.BMP NDATAAVXMDPSDPS031.BMP NDATAAVXMDPSDPS032.BMP NDATAAVXMDPSDPS033.BMP NDATAAVXMDPSDPS034.BMP NDATAAVXMDPSDPS035.BMP NDATAAVXMDPSDPS036.BMP NDATAAVXMDPSDPS037.BMP NDATAAVXMDPSDPS038.BMP NDATAAVXMDPSDPS039.BMP NDATAAVXMDPSDPS040.BMP NDATAAVXMDPSDPS041.BMP NDATAAVXMDPSDPS042.BMP NDATAAVXMDPSDPS043.BMP NDATAAVXMDPSDPS044.BMP NDATAAVXMDPSDPS045.BMP NDATAAVXMDPSDPS046.BMP NDATAAVXMDPSDPS047.BMP NDATAAVXMDPSDPS048.BMP NDATAAVXMDPSDPS049.BMP NDATAAVXMDPSDPS050.BMP NDATAAVXMDPSDPS051.BMP NDATAAVXMDPSDPS052.BMP NDATAAVXMDPSDPS053.BMP NDATAAVXMDPSDPS054.BMP NDATAAVXMDPSDPS055.BMP NDATAAVXMDPSDPS056.BMP NDATAAVXMDPSDPS057.BMP NDATAAVXMDPSDPS058.BMP NDATAAVXMDPSDPS059.BMP NDATAAVXMDPSDPS060.BMP NDATAAVXMDPSDPS062.BMP NDATAAVXMDPSDPS063.BMP NDATAAVXMDPSDPS064.BMP NDATAAVXMDPSDPS065.BMP NDATAAVXMDPSDPS066.BMP NDATAAVXMDPSDPS067.BMP NDATAAVXMDPSDPS068.BMP NDATAAVXMDPSDPS069.BMP NDATAAVXMDPSDPS070.BMP NDATAAVXMDPSDPS071.BMP NDATAAVXMDPSDPS073.BMP NDATAAVXMDPSDPS074.BMP NDATAAVXMDPSDPS075.BMP NDATAAVXMDPSDPS076.BMP NDATAAVXMDPSDPS077.BMP NDATAAVXMDPSDPS078.BMP NDATAAVXMDPSDPS079.BMP NDATAAVXMDPSDPS080.BMP NDATAAVXMDPSDPS081.BMP NDATAAVXMDPSDPS082.BMP NDATAAVXMDPSDPS083.BMP NDATAAVXMDPSDPS084.BMP NDATAAVXMDPSDPS085.BMP NDATAAVXMDPSDPS086.BMP NDATAAVXMDPSDPS087.BMP NDATAAVXMDPSDPS088.BMP NDATAAVXMDPSDPS089.BMP NDATAAVXMDPSDPS090.BMP NDATAAVXMDPSDPS091.BMP NDATAAVXMDPSDPS092.BMP NDATAAVXMDPSDPS093.BMP NDATAAVXMDPSDPS094.BMP NDATAAVXMDPSDPS096.BMP NDATAAVXMDPSDPS097.BMP NDATAAVXMDPSDPS098.BMP NDATAAVXMDPSDPS100.BMP NDATAAVXMDPSDPS101.BMP NDATAAVXMDPSDPS102.BMP NDATAAVXMDPSDPS103.BMP NDATAAVXMDPSDPS104.BMP NDATAAVXMDPSDPS105.BMP NDATAAVXMDPSDPS106.BMP NDATAAVXMDPSDPS107.BMP NDATAAVXMDPSDPS108.BMP NDATAAVXMDPSDPS109.BMP NDATAAVXMDPSDPS110.BMP NDATAAVXMDPSDPS111.BMP NDATAAVXMDPSDPS112.BMP NDATAAVXMDPSDPS113.BMP NDATAAVXMDPSDPS114.BMP NDATAAVXMDPSDPS115.BMP NDATAAVXMDPSDPS116.BMP NDATAAVXMDPSDPS117.BMP NDATAAVXMDPSDPS118.BMP NDATAAVXMDPSDPS119.BMP NDATAAVXMDPSDPS120.BMP NDATAAVXMDPSDPS121.BMP NDATAAVXMDPSDPS122.BMP NDATAAVXMDPSDPS123.BMP NDATAAVXMDPSDPS124.BMP NDATAAVXMDPSDPS125.BMP NDATAAVXMDPSDPS126.BMP NDATAAVXMDPSDPS127.BMP NDATAAVXMDPSDPS128.BMP NDATAAVXMDPSDPS129.BMP NDATAAVXMDPSDPS130.BMP NDATAAVXMDPSDPS131.BMP NDATAAVXMDPSDPS132.BMP NDATAAVXMDPSDPS133.BMP NDATAAVXMDPSDPS134.BMP NDATAAVXMDPSDPS135.BMP NDATAAVXMDPSDPS139.BMP NDATAAVXMDPSDPS140.BMP NDATAAVXMDPSDPS141.BMP NDATAAVXMDPSDPS142.BMP NDATAAVXMDPSDPS143.BMP NDATAAVXMDPSDPS144.BMP NDATAAVXMDPSDPS145.BMP NDATAAVXMDPSDPS146.BMP NDATAAVXMDPSDPS147.BMP NDATAAVXMDPSDPS149.BMP NDATAAVXMDPSDPS150.BMP NDATAAVXMDPSDPS151.BMP NDATAAVXMDPSDPS152.BMP NDATAAVXMDPSDPS153.BMP NDATAAVXMDPSDPS154.BMP NDATAAVXMDPSDPS155.BMP NDATAAVXMDPSDPS156.BMP NDATAAVXMDPSDPS157.BMP NDATAAVXMDPSDPS158.BMP NDATAAVXMDPSDPS159.BMP NDATAAVXMDPSDPS161.BMP NDATAAVXMDPSDPS162.BMP NDATAAVXMDPSDPS163.BMP NDATAAVXMDPSDPS164.BMP NDATAAVXMDPSDPS165.BMP NDATAAVXMDPSDPS166.BMP NDATAAVXMDPSDPS167.BMP NDATAAVXMDPSDPS168.BMP NDATAAVXMDPSDPS169.BMP NDATAAVXMDPSDPS170.BMP NDATAAVXMDPSDPS171.BMP NDATAAVXMDPSDPS172.BMP NDATAAVXMDPSDPS173.BMP NDATAAVXMDPSDPS174.BMP NDATAAVXMDPSDPS175.BMP NDATAAVXMDPSDPS176.BMP NDATAAVXMDPSDPS177.BMP NDATAAVXMDPSDPS178.BMP NDATAAVXMDPSDPS179.BMP NDATAAVXMDPSDPS180.BMP NDATAAVXMDPSDPS181.BMP NDATAAVXMDPSDPS182.BMP NDATAAVXMDPSDPS183.BMP NDATAAVXMDPSDPS184.BMP NDATAAVXMDPSDPS185.BMP NDATAAVXMDPSDPS186.BMP NDATAAVXMDPSDPS187.BMP NDATAAVXMDPSDPS188.BMP NDATAAVXMDPSDPS189.BMP NDATAAVXMDPSDPS190.BMP NDATAAVXMDPSDPS191.BMP NDATAAVXMDPSDPS192.BMP NDATAAVXMDPSDPS193.BMP NDATAAVXMDPSDPS194.BMP NDATAAVXMDPSDPS195.BMP NDATAAVXMDPSDPS196.BMP NDATAAVXMDPSDPS197.BMP NDATAAVXMDPSDPS200.BMP NDATAAVXMDPSDPS201.BMP NDATAAVXMDPSDPS202.BMP NDATAAVXMDPSDPS203.BMP NDATAAVXMDPSDPS204.BMP NDATAAVXMDPSDPS205.BMP NDATAAVXMDPSDPS206.BMP NDATAAVXMDPSDPS207.BMP NDATAAVXMDPSDPS210.BMP NDATAAVXMDPSDPS211.BMP NDATAAVXMDPSDPS212.BMP NDATAAVXMDPSDPS213.BMP NDATAAVXMDPSDPS214.BMP NDATAAVXMDPSDPS215.BMP NDATAAVXMDPSDPS216.BMP NDATAAVXMDPSDPS217.BMP NDATAAVXMDPSDPS218.BMP NDATAAVXMDPSDPS219.BMP NDATAAVXMDPSDPS221.BMP NDATAAVXMDPSDPS222.BMP NDATAAVXMDPSDPS223.BMP NDATAAVXMDPSDPS224.BMP NDATAAVXMDPSDPS226.BMP NDATAAVXMDPSDPS227.BMP NDATAAVXMDPSDPS228.BMP NDATAAVXMDPSDPS229.BMP NDATAAVXMDPSDPS239.BMP NDATAAVXMDPSDPS245.BMP NDATAAVXMDPSDPS246.BMP NDATAAVXMDPSDPSNOT.BMP NDATAAVXMLPSLPS002.BMP NDATAAVXMLPSLPS004.BMP NDATAAVXMLPSLPS005.BMP NDATAAVXMLPSLPS006.BMP NDATAAVXMLPSLPS007.BMP NDATAAVXMLPSLPS008.BMP NDATAAVXMLPSLPS009.BMP NDATAAVXMLPSLPS010.BMP NDATAAVXMLPSLPS011.BMP NDATAAVXMLPSLPS012.BMP NDATAAVXMLPSLPS013.BMP NDATAAVXMLPSLPS014.BMP NDATAAVXMLPSLPS015.BMP NDATAAVXMLPSLPS016.BMP NDATAAVXMLPSLPS017.BMP NDATAAVXMLPSLPS018.BMP NDATAAVXMLPSLPS019.BMP NDATAAVXMLPSLPS020.BMP NDATAAVXMLPSLPS021.BMP NDATAAVXMLPSLPS022.BMP NDATAAVXMLPSLPS023.BMP NDATAAVXMLPSLPS024.BMP NDATAAVXMLPSLPS025.BMP NDATAAVXMLPSLPS026.BMP NDATAAVXMLPSLPS027.BMP NDATAAVXMLPSLPS028.BMP NDATAAVXMLPSLPS029.BMP NDATAAVXMLPSLPS030.BMP NDATAAVXMLPSLPS031.BMP NDATAAVXMLPSLPS032.BMP NDATAAVXMLPSLPS033.BMP NDATAAVXMLPSLPS034.BMP NDATAAVXMLPSLPS035.BMP NDATAAVXMLPSLPS036.BMP NDATAAVXMLPSLPS037.BMP NDATAAVXMLPSLPS038.BMP NDATAAVXMLPSLPS039.BMP NDATAAVXMLPSLPS040.BMP NDATAAVXMLPSLPS041.BMP NDATAAVXMLPSLPS042.BMP NDATAAVXMLPSLPS043.BMP NDATAAVXMLPSLPS044.BMP NDATAAVXMLPSLPS045.BMP NDATAAVXMLPSLPS046.BMP NDATAAVXMLPSLPS047.BMP NDATAAVXMLPSLPS048.BMP NDATAAVXMLPSLPS049.BMP NDATAAVXMLPSLPS050.BMP NDATAAVXMLPSLPS051.BMP NDATAAVXMLPSLPS052.BMP NDATAAVXMLPSLPS053.BMP NDATAAVXMLPSLPS054.BMP NDATAAVXMLPSLPS055.BMP NDATAAVXMLPSLPS056.BMP NDATAAVXMLPSLPS057.BMP NDATAAVXMLPSLPS058.BMP NDATAAVXMLPSLPS059.BMP NDATAAVXMLPSLPS060.BMP NDATAAVXMLPSLPS062.BMP NDATAAVXMLPSLPS063.BMP NDATAAVXMLPSLPS064.BMP NDATAAVXMLPSLPS065.BMP NDATAAVXMLPSLPS066.BMP NDATAAVXMLPSLPS067.BMP NDATAAVXMLPSLPS068.BMP NDATAAVXMLPSLPS069.BMP NDATAAVXMLPSLPS070.BMP NDATAAVXMLPSLPS071.BMP NDATAAVXMLPSLPS073.BMP NDATAAVXMLPSLPS074.BMP NDATAAVXMLPSLPS075.BMP NDATAAVXMLPSLPS076.BMP NDATAAVXMLPSLPS077.BMP NDATAAVXMLPSLPS078.BMP NDATAAVXMLPSLPS079.BMP NDATAAVXMLPSLPS080.BMP NDATAAVXMLPSLPS081.BMP NDATAAVXMLPSLPS082.BMP NDATAAVXMLPSLPS083.BMP NDATAAVXMLPSLPS084.BMP NDATAAVXMLPSLPS085.BMP NDATAAVXMLPSLPS086.BMP NDATAAVXMLPSLPS087.BMP NDATAAVXMLPSLPS088.BMP NDATAAVXMLPSLPS089.BMP NDATAAVXMLPSLPS090.BMP NDATAAVXMLPSLPS091.BMP NDATAAVXMLPSLPS092.BMP NDATAAVXMLPSLPS093.BMP NDATAAVXMLPSLPS094.BMP NDATAAVXMLPSLPS096.BMP NDATAAVXMLPSLPS097.BMP NDATAAVXMLPSLPS098.BMP NDATAAVXMLPSLPS100.BMP NDATAAVXMLPSLPS101.BMP NDATAAVXMLPSLPS102.BMP NDATAAVXMLPSLPS103.BMP NDATAAVXMLPSLPS104.BMP NDATAAVXMLPSLPS105.BMP NDATAAVXMLPSLPS106.BMP NDATAAVXMLPSLPS107.BMP NDATAAVXMLPSLPS108.BMP NDATAAVXMLPSLPS109.BMP NDATAAVXMLPSLPS110.BMP NDATAAVXMLPSLPS111.BMP NDATAAVXMLPSLPS112.BMP NDATAAVXMLPSLPS113.BMP NDATAAVXMLPSLPS114.BMP NDATAAVXMLPSLPS115.BMP NDATAAVXMLPSLPS116.BMP NDATAAVXMLPSLPS117.BMP NDATAAVXMLPSLPS118.BMP NDATAAVXMLPSLPS119.BMP NDATAAVXMLPSLPS120.BMP NDATAAVXMLPSLPS121.BMP NDATAAVXMLPSLPS122.BMP NDATAAVXMLPSLPS123.BMP NDATAAVXMLPSLPS124.BMP NDATAAVXMLPSLPS125.BMP NDATAAVXMLPSLPS126.BMP NDATAAVXMLPSLPS127.BMP NDATAAVXMLPSLPS128.BMP NDATAAVXMLPSLPS129.BMP NDATAAVXMLPSLPS130.BMP NDATAAVXMLPSLPS131.BMP NDATAAVXMLPSLPS132.BMP NDATAAVXMLPSLPS133.BMP NDATAAVXMLPSLPS134.BMP NDATAAVXMLPSLPS135.BMP NDATAAVXMLPSLPS139.BMP NDATAAVXMLPSLPS140.BMP NDATAAVXMLPSLPS141.BMP NDATAAVXMLPSLPS142.BMP NDATAAVXMLPSLPS143.BMP NDATAAVXMLPSLPS144.BMP NDATAAVXMLPSLPS145.BMP NDATAAVXMLPSLPS146.BMP NDATAAVXMLPSLPS147.BMP NDATAAVXMLPSLPS149.BMP NDATAAVXMLPSLPS150.BMP NDATAAVXMLPSLPS151.BMP NDATAAVXMLPSLPS152.BMP NDATAAVXMLPSLPS153.BMP NDATAAVXMLPSLPS154.BMP NDATAAVXMLPSLPS155.BMP NDATAAVXMLPSLPS156.BMP NDATAAVXMLPSLPS157.BMP NDATAAVXMLPSLPS158.BMP NDATAAVXMLPSLPS159.BMP NDATAAVXMLPSLPS161.BMP NDATAAVXMLPSLPS162.BMP NDATAAVXMLPSLPS163.BMP NDATAAVXMLPSLPS164.BMP NDATAAVXMLPSLPS165.BMP NDATAAVXMLPSLPS166.BMP NDATAAVXMLPSLPS167.BMP NDATAAVXMLPSLPS168.BMP NDATAAVXMLPSLPS169.BMP NDATAAVXMLPSLPS170.BMP NDATAAVXMLPSLPS171.BMP NDATAAVXMLPSLPS172.BMP NDATAAVXMLPSLPS173.BMP NDATAAVXMLPSLPS174.BMP NDATAAVXMLPSLPS175.BMP NDATAAVXMLPSLPS176.BMP NDATAAVXMLPSLPS177.BMP NDATAAVXMLPSLPS178.BMP NDATAAVXMLPSLPS179.BMP NDATAAVXMLPSLPS180.BMP NDATAAVXMLPSLPS181.BMP NDATAAVXMLPSLPS182.BMP NDATAAVXMLPSLPS183.BMP NDATAAVXMLPSLPS184.BMP NDATAAVXMLPSLPS185.BMP NDATAAVXMLPSLPS186.BMP NDATAAVXMLPSLPS187.BMP NDATAAVXMLPSLPS188.BMP NDATAAVXMLPSLPS189.BMP NDATAAVXMLPSLPS190.BMP NDATAAVXMLPSLPS191.BMP NDATAAVXMLPSLPS192.BMP NDATAAVXMLPSLPS193.BMP NDATAAVXMLPSLPS194.BMP NDATAAVXMLPSLPS195.BMP NDATAAVXMLPSLPS196.BMP NDATAAVXMLPSLPS197.BMP NDATAAVXMLPSLPS200.BMP NDATAAVXMLPSLPS201.BMP NDATAAVXMLPSLPS202.BMP NDATAAVXMLPSLPS203.BMP NDATAAVXMLPSLPS204.BMP NDATAAVXMLPSLPS205.BMP NDATAAVXMLPSLPS206.BMP NDATAAVXMLPSLPS207.BMP NDATAAVXMLPSLPS210.BMP NDATAAVXMLPSLPS211.BMP NDATAAVXMLPSLPS212.BMP NDATAAVXMLPSLPS213.BMP NDATAAVXMLPSLPS214.BMP NDATAAVXMLPSLPS215.BMP NDATAAVXMLPSLPS216.BMP NDATAAVXMLPSLPS217.BMP NDATAAVXMLPSLPS218.BMP NDATAAVXMLPSLPS219.BMP NDATAAVXMLPSLPS221.BMP NDATAAVXMLPSLPS222.BMP NDATAAVXMLPSLPS223.BMP NDATAAVXMLPSLPS224.BMP NDATAAVXMLPSLPS226.BMP NDATAAVXMLPSLPS227.BMP NDATAAVXMLPSLPS228.BMP NDATAAVXMLPSLPS229.BMP NDATAAVXMLPSLPS239.BMP NDATAAVXMLPSLPS245.BMP NDATAAVXMLPSLPS246.BMP NDATAAVXMLPSLPSNOT.BMP NDATABGPREINSTALLCurves Light Blue.bmp NDATABGPREINSTALLDefault.bmp NDATABGPREINSTALLIC Gold.bmp NDATABGPREINSTALLRipple Blue.bmp NDATABGPREINSTALLSpotlight Green.bmp NDATABTBTDEFAULT.DAT NDATAFEMAPPARCELFE.LFT NDATAINITDATAUSERRWVBTVERSION.TXT NDATAINITDATAUSERRWVBTENEN_USHFD_Dynamic.fsm NDATAINITDATAUSERRWVBTENEN_USHFD_Dynamic.fsmb NDATAINITDATAUSERRWVBTENEN_USMusicCatalog.db NDATAINITDATAUSERRWVBTENEN_USMusic_Dynamic.fsm NDATAINITDATAUSERRWVBTENEN_USMusic_Dynamic.fsmb NDATAINITDATAUSERRWVBTENEN_USVBAgent.db NDATAINITDATAUSERRWVBTENEN_USVBSystem.db NDATAINITDATAUSERRWVBTENEN_USVBTLexDynamic.dsu NDATAINITDATAUSERRWVBTENEN_USVBT_Grammar.fsm NDATAINITDATAUSERRWVBTENEN_USVBT_Grammar.fsmb NDATAL3DDAY.CTL NDATAL3DDAY.L3D NDATAL3DDAY.LST NDATAL3DDRV.TBL NDATAL3DDRV.TXT NDATAL3DNIGHT.CTL NDATAL3DNIGHT.L3D NDATAL3DNIGHT.LST NDATASDUSBFILTER.FLR NDATASDUSBMMPCONF.DAT NDATASKYGZ-NSKY_D-01.bmp NDATASKYGZ-NSKY_D-02.bmp NDATASKYGZ-NSKY_N-01.bmp NDATASKYGZ-NSKY_N-02.bmp NDATASOUNDLOPEDATA.DAT NDATASOUNDUC090SND.ENU NDATASOUNDUC090SND.FRE NDATASOUNDUC090SND.SPA NDATASOUNDUC090TTS.ENU NDATASOUNDUC090TTS.FRE NDATASOUNDUC090TTS.SPA NDATAsymbolSL_GP_MAPOVER.symb NDATAsymbolSL_GP_TEXBD.symb NDATAsymbolSL_GP_TEXBN.symb NDATAsymbolSL_GP_TEXRD.symb NDATAsymbolSL_GP_TEXRN.symb NDATATELGOOG411.DAT NDATATTSDataPP.DAT NDATATTSDataENUdepes_enu.dat NDATATTSDataENUdepes_enu_samantha.dat NDATATTSDataENUphonmap_enu_samantha.dat NDATATTSDataENUsynth_samantha_dri40_155mrf22_270_06.dat NDATATTSDataENUsysdct_enu_cfg2.dat NDATATTSDataENUtokentn_enu.dat NDATATTSDataENUuselect_samantha_dri40.dat NDATATTSDataENUvauto_pipeline_enu_samantha_22_dri40_155mrf22.hdr NDATATTSDataFRFdepes_frf.dat NDATATTSDataFRFdepes_frf_virginie.dat NDATATTSDataFRFphonmap_frf_virginie.dat NDATATTSDataFRFsynth_virginie_dri40_155mrf22_270_06.dat NDATATTSDataFRFsysdct_frf_cfg1.dat NDATATTSDataFRFtokentn_frf.dat NDATATTSDataFRFuselect_virginie_dri40.dat NDATATTSDataFRFvauto_pipeline_frf_virginie_22_dri40_155mrf22.hdr NDATATTSDataSPEdepes_spe.dat NDATATTSDataSPEdepes_spe_monica.dat NDATATTSDataSPEphonmap_spe_monica.dat NDATATTSDataSPEsynth_monica_dri40_155mrf22_270_06.dat NDATATTSDataSPEsysdct_spe_cfg1.dat NDATATTSDataSPEtokentn_spe.dat NDATATTSDataSPEuselect_monica_dri40.dat NDATATTSDataSPEvauto_pipeline_spe_monica_22_dri40_155mrf22.hdr NDATATTSDataTransDataENUapdb_tp_samantha_dri40_lrfix.apdb NDATATTSDataTransDataENUTTS_DIC_ENU.bdc NDATATTSDataTransDataENUTTS_PRON_ENU.bdc NDATATTSDataTransDataENUTTS_TRANS_ENU.rul NDATATTSDataTransDataFRFTTS_DIC_FRF.bdc NDATATTSDataTransDataFRFTTS_PRON_FRF.bdc NDATATTSDataTransDataFRFTTS_TRANS_FRF.rul NDATATTSDataTransDataSPETTS_DIC_SPE.bdc NDATATTSDataTransDataSPETTS_PRON_SPE.bdc NDATATTSDataTransDataSPETTS_TRANS_SPE.rul NDATAVBTPOILIST0.DB NDATAVBTVERSION.TXT NDATAVBTENEN_USAEGrammars.vba NDATAVBTENEN_USState.fsm NDATAVBTENEN_USVBTAsrModel.dat NDATAVBTENEN_USVBTDDG2P.DAT NDATAVBTENEN_USVBTLex.dsu NDATAVBTENEN_USVBTMP3DDG2P.dat NDATAINITDATAUSERSETUP is empty Total image space: 3,802,103,808 Free image space: 668,868,808 Image cluster size: 8,192 Boot Sector OEM: MSWIN4.1 Serial Number: 07F10006 Bytes/Sector: 512 Sectors/Cluster: 16 File System: TFAT32 Disk Label: DONT_DEL015 NDATASDUSBFILTER.FLR file contents: SDMMCNDB SDMMCPC SDMMCVoice SDMMCFirmware SDMMCLT SDMMCdebug SDMMCUPDATE SDMMCTypeManager SDMMCVersion NDATATELGOOG411.DAT file contents: 14252964544 [*:1hfjomq9]The firmware update themselves have no executable code.[*:1hfjomq9]NDATAINITDATAUSERRWVBTENEN_USMusicCatalog is in SQLite Format 3[*:1hfjomq9]NDATAVBTPOILIST0 is in SQLite Format 3 Pioneer.Z110BT.Upgrade.Unlocker-ShortFuse.zip Quote Link to post Share on other sites
VBLUE42 Posted September 4, 2010 Report Share Posted September 4, 2010 Good luck. Quote Link to post Share on other sites
ShortFuse Posted September 5, 2010 Author Report Share Posted September 5, 2010 Okay, I think the hack you guys really care about is the password hack. It's stupid easy if you've ever cracked something before. I'm working on making a keygen. The code itself will be in the RenewalIFLib.dll under USER\PRG\APL. I'll play with modifying other stuff later. It seems RenewalIFLib decodes AUTHINFO.DAT and VERINFO.DAT I would just patch the dll and make it skip this but it seems to write a file as well. It might break something else later and then maybe you'll be permanently stuck. It's probably just safer to make a keygen. Quote Link to post Share on other sites
VBLUE42 Posted September 5, 2010 Report Share Posted September 5, 2010 What is your opinion on the possibility of UI hacks based on what you have seen so far? Quote Link to post Share on other sites
rgarjr Posted September 5, 2010 Report Share Posted September 5, 2010 Crack it Quote Link to post Share on other sites
ShortFuse Posted September 5, 2010 Author Report Share Posted September 5, 2010 What is your opinion on the possibility of UI hacks based on what you have seen so far? THE BMP files can be modified. A lot of graphic files are packed so I"ll have to see how to unpack them. I'm still running the stock Z110BT so I'll have to update first. The voices can seemingly be changed. There are two NAND devices. They're called NAND and NAND2. NAND is where the application itself lives. I'm sure it's probably 64MB or 128MB. The second (NAND2) is a 4GB. That's where the NDATA writes to. We can modify that by changing the NDATA files and running the update. Flashing files to NAND1, I'm not sure yet. By the way, the Operating System being "Windows Automative 5.5" is not true. It's WinCE 5.0. I'm sure there's no check. You can probably replace navi.exe from APL with a WINCE app and it'll run. I'll look into play with all this but first, I'm going to try to decrypt the DAT files so I can actually use the new firmware. Can somebody describe the firmware upgrade process to me? The steps? Oh yeah, I'm sure you can also modify the voice. Pioneer uses Scansoft's Vocalizer for WinCE You can grab a demo here: ftp://ftp.scansoft.com/pub/intel/ I'm pretty sure that's what the VBT files are Quote Link to post Share on other sites
VBLUE42 Posted September 5, 2010 Report Share Posted September 5, 2010 Ok can you please keep this thread updated and stick with it. Or at least let everyone know if you get to a point where you no longer want to continue. There have been so many that have claimed they could and would do what you are claiming only to never be seen again. Please don't be one of those people. Once this gets to a promising point I will gladly sticky this and any other topics that are promising. Quote Link to post Share on other sites
ShortFuse Posted September 5, 2010 Author Report Share Posted September 5, 2010 Ok can you please keep this thread updated and stick with it. Or at least let everyone know if you get to a point where you no longer want to continue. There have been so many that have claimed they could and would do what you are claiming only to never be seen again. Please don't be one of those people. Once this gets to a promising point I will gladly sticky this and any other topics that are promising. K, I'll try to post as much as I can. I'm not that great of a cracker. Regardless, I'll contribute as much as possible. If I can't, hopefully somebody can continue work. Quote Link to post Share on other sites
ShortFuse Posted September 5, 2010 Author Report Share Posted September 5, 2010 Updated: Added Decrypt subroutine from RenewalIFLib.dll Quote Link to post Share on other sites
ShortFuse Posted September 5, 2010 Author Report Share Posted September 5, 2010 The key file here is RenewalIFLib.dll from the APL directory. Decompiled with Desquirr: AL_AUTH_Operation::PassAttestation(ushort const *) 10002648 _PassAttestation_AL_AUTH_Operation__QAA_AW4AL_AUTH_PasswordResult__PBG_Z: 10002648 R12 = SP; 1000264c /* push LR */ 1000264c /* push R12 */ 1000264c /* push R11 */ 1000264c /* push R8 */ 1000264c /* push R7 */ 1000264c /* push R6 */ 1000264c /* push R5 */ 1000264c /* push R4 */ 10002650 R11 = & 0x20; 10002658 R6 = R1; 1000265c R7 = R0; 10002668 var_24 = * unk_10010CCC; 1000266c R8 = 0x20000000; 10002680 /* Low-level instruction of type 31 */ 10002684 R5 = 3; 10002688 Cond = R6; 1000268c if (Cond != 0) goto loc_100026B4; 10002690 R3 = _Output_AL_Log__SAXKPBDZZ; 10002694 R1 = "ERROR: NULL Password"; 100026a0 /* Low-level instruction of type 31 */ 100026a4 loc_100026A4: 100026a8 sub_1000600C(var_24, R1, R2, R3); 100026ac R5 = 3; 100026b0 goto loc_100028CC; 100026b4 loc_100026B4: 100026bc Cond = wcslen(R6) - 0x10; 100026c0 if (Cond == 0) goto loc_100026DC; 100026c4 R3 = _Output_AL_Log__SAXKPBDZZ; 100026c8 R1 = "ERROR: SIZE Password"; 100026d4 /* Low-level instruction of type 31 */ 100026d8 goto loc_100026A4; 100026dc loc_100026DC: 100026e8 memset(R11 - var_4C, 0, 0x11); 1000270c Cond = * _NCharToChar__YAHPBGHPADH_Z(R6, 0x10, R11 - var_4C, 0x10) - 0x10; 10002710 if (Cond != 0) goto loc_100026A4; 10002718 var_A4 = 0; 1000271c R3 = 0; 10002724 var_A0 = R3; 10002728 var_9C = R3; 1000272c var_98 = R3; 10002738 var_A8 = strlen(R11 - var_4C); 10002750 Cond = ?ConvertHexStrToBin@AL_AUTH_Operation@@QAAJPAEKPBEK@Z(R7, R11 - var_A4, 0x10, R11 - var_4C); 10002754 if (Cond == 0) goto loc_10002774; 10002758 R3 = _Output_AL_Log__SAXKPBDZZ; 1000275c R1 = "ERROR: CONVERT ERROR: Password:%s"; 10002760 R2 = R11 - var_4C; 1000276c /* Low-level instruction of type 31 */ 10002770 goto loc_100026A4; 10002774 loc_10002774: 10002784 var_8C = 0; 10002788 memset(R11 - var_8B, 0, 7); 10002790 R6 = 0; 100027ac var_84 = R6; 100027b0 var_80 = R6; 100027b4 var_7C = R6; 100027b8 var_78 = R6; 100027bc var_94 = R11 - var_8C; 100027c0 var_90 = 0x18; 100027c4 R0 = ?Decrypt@AL_AUTH_Operation@@QAAJPBGAAUAL_AUTH_CryptoDataBuff@@PBK@Z(R7, * off_1001057C, R11 - var_94, R11 - var_A4); 100027c8 R6 = R0; 100027d4 ??0AL_AUTH_File@@QAA@ABUAL_AUTH_FileInfo@@@Z(R11 - var_74, R11 - var_8C, R2, R3); 100027d8 R2 = 0x14; 100027dc R1 = 0; 100027e0 R0 = R11 - var_38; 100027e4 loc_100027E4: 100027e4 memset(R0, R1, R2); 100027f4 memset(R11 - var_58, 0, 10); 100027f8 R3 = 0xf0000002; 100027fc R7 = R3 | 0x660000; 10002800 Cond = R6; 10002804 if (Cond != 0) goto loc_10002864; 1000280c R0 = ?Check@AL_AUTH_File@@QBA_NXZ(R11 - var_74, R1, R2, R3); 10002810 Cond = R0 - 1; 10002814 if (Cond != 0) goto loc_10002860; 10002818 R0 = ?Instance@AL_VersionManagerIFBase@@SAPAV1@XZ(R0, R1, R2, R3); 1000281c Cond = R0; 10002820 if (Cond == 0) goto loc_10002888; 10002834 /* Low-level instruction of type 31 */ 1000283c R6 = R0; 10002858 * _NCharToChar__YAHPBGHPADH_Z(R11 - var_38, 10, R11 - var_58, 10); 1000285c goto loc_10002864; 10002860 loc_10002860: 10002860 R6 = R7; 10002864 loc_10002864: 10002864 Cond = R6 - R7; 10002868 if (Cond == 0) goto loc_100028B8; 1000286c if (Cond <= 0) goto loc_100028BC; 10002870 R3 = 0xf0660004; 10002878 Cond = R6 - R3; 1000287c if (Cond <= 0) goto loc_100028B0; 10002880 Cond = R6; 10002884 if (Cond != 0) goto loc_100028BC; 10002888 loc_10002888: 10002890 R1 = ?GetVersion@AL_AUTH_File@@QBAPBDXZ(R11 - var_74, R1, R2, R3); 100028a0 Cond = strncmp(R11 - var_58, R1, 10); 100028a4 if (Cond != 0) goto loc_100028B8; 100028a8 R5 = 0; 100028ac goto loc_100028BC; 100028b0 loc_100028B0: 100028b0 R5 = 2; 100028b4 goto loc_100028BC; 100028b8 loc_100028B8: 100028b8 R5 = 1; 100028bc loc_100028BC: 100028bc R0 = R11 - var_74; 100028c0 loc_100028C0: 100028c0 ??1AL_AUTH_File@@UAA@XZ(R0, R1, R2, R3); 100028c8 sub_1000600C(var_24, R1, R2, R3); 100028cc loc_100028CC: 100028cc R0 = R5; 100028d4 /* pop */ 100028d4 /* pop */ 100028d4 /* pop */ 100028d4 /* pop */ 100028d4 /* pop */ 100028d4 /* pop */ 100028d4 /* pop */ 100028d4 return R0; AL_AUTH_Operation::Decrypt(ushort const *,AL_AUTH_CryptoDataBuffer &,ulong const *) var_28= -0x28 var_24= -0x24 var_20= -0x20 var_1C= -0x1C 10002244 _Decrypt_AL_AUTH_Operation__QAAJPBGAAUAL_AUTH_CryptoDataBuff__PBK_Z: 10002244 /* push LR */ 10002244 /* push R8 */ 10002244 /* push R7 */ 10002244 /* push R6 */ 10002244 /* push R5 */ 10002244 /* push R4 */ 1000224c R7 = R3; 10002250 R4 = R2; 10002254 Cond = R1; 10002254 R5 = R1; 10002258 R8 = R0; 1000225c if (Cond == 0) goto loc_100023BC; 10002264 Cond = * R4; 10002268 if (Cond == 0) goto loc_100023BC; 10002270 Cond = * (R4 + 4) & 7; 10002274 if (Cond != 0) goto loc_100023BC; 1000227c R0 = ??2@YAPAXI@Z(0x400); 10002280 Cond = R0; 10002280 R6 = R0; 10002284 if (Cond != 0) goto loc_10002288; 10002284 R5 = 0xf06600ff; 10002288 loc_10002288: 10002288 if (Cond == 0) goto loc_100023E8; 10002298 memset(R6, 0, 0x400); 100022a0 R3 = * (R4 + 4) + 8; 100022a4 Cond = R3 - 0x400; 100022a8 if (Cond <= 0) goto loc_100022D8; 100022c8 * _Output_AL_Log__SAXKPBDZZ(0x20000000 | 0x80000, "DECRYPT ERROR: MemSize:%d, EncryptedSize:%d", 0x400, R3); 100022d0 R5 = 0xf0000000 | 0x660000; 100022d4 goto loc_10002330; 100022d8 loc_100022D8: 100022e4 var_28 = R6; 100022e8 var_24 = R3; 100022ec R0 = ?ReadEncryptedFile@AL_AUTH_Operation@@AAAJPBGAAUAL_AUTH_CryptoDataBuff@@@Z(R8, R5, & var_28, R3); 100022f0 Cond = R0; 100022f0 R5 = R0; 100022f4 if (Cond == 0) goto loc_1000233C; 10002314 * _ErrorRec_AL_Error__SAXPBDKJK_Z("$Id: AL_AUTH_Operation.cpp 58126 2009-03-23 10:09:44Z yuliangde $", 0xc6, R5, -1); 1000232c /* Low-level instruction of type 31 */ 10002330 loc_10002330: 10002334 ??3@YAXPAX@Z(R6); 10002338 goto loc_100023E8; 1000233c loc_1000233C: 1000233c R1 = var_28; 10002340 R5 = * (R4 + 4); 10002350 var_20 = * R1; 10002354 R3 = * (R1 + 4); 1000235c var_1C = R3; 10002360 memcpy(* R4, R1 + 8, R5); 10002368 ??3@YAXPAX@Z(R6); 1000236c Cond = R7; 10002370 R0 = & var_28; 10002374 if (Cond != 0) goto loc_10002398; 10002378 ?GetInternalAccessKey@AL_AUTH_KeyLib@@SAXPAK@Z(R0, R1, R2, R3); 1000238c ?DecryptInternalAccessKey@AL_AUTH_CryptoLib@@SAXPAKPBK1K@Z(* R4, & var_28, & var_20, R5 >> 3); 10002390 R5 = 0; 10002394 goto loc_100023E8; 10002398 loc_10002398: 1000239c ?GetExternalAccessKey@AL_AUTH_KeyLib@@SAXPAKPBK@Z(R0, R7, R2, R3); 100023b0 ?DecryptExternalAccessKey@AL_AUTH_CryptoLib@@SAXPAKPBK1K@Z(* R4, & var_28, & var_20, R5 >> 3); 100023b4 R5 = 0; 100023b8 goto loc_100023E8; 100023bc loc_100023BC: 100023dc * _Output_AL_Log__SAXKPBDZZ(0x20080000, "DECRYPT ERROR: Buff:%08x, Size:%d", * R4, * (R4 + 4)); 100023e4 R5 = 0xf0000000 | 0x660000; 100023e8 loc_100023E8: 100023e8 R0 = R5; 100023f0 /* pop */ 100023f0 /* pop */ 100023f0 /* pop */ 100023f0 /* pop */ 100023f0 /* pop */ 100023f0 return R0; Okay, if you guys want a crack, it'll be done in AL_AUTH_Operation::PassAttestation(ushort const *) in the RenewalIFLib.dll You can see a somewhat decompiling there in C but I'm also just looking at straight assembly code in IDA Pro. Basically, this function is the end-all checking function. It tests your password. Here's how it works. The function returns R0, but before that, Ignoring the POPs, R0 is set to equal the value of R5. Here are all the function we care about: loc_1000600C (UNKNOWN1): (probably a message box or debugging log) loc_100026A4 (FAILED): GOTO UNKNOWN1 R5 = 3 (MOV R5, #3) GOTO FINISH loc_100028CC (FINISH): R0 = R5 /POP/ Return R0 Here's how it works: [*:1p0x1fp4]Check if you put a password. If you didn't: Respond: "ERROR: NULL password"GOTO FAILED (which goes to FINISH) [*:1p0x1fp4]Check the length of your password. If it's not the right length:Respond: "ERROR: SIZE password"GOTO FAILED [*:1p0x1fp4]Run your password through a character conversion function. If it fails:GOTO FAILED(interesting there's no error message) [*:1p0x1fp4]Convert your pass from string to binary (hex).If this fails:Respond: "ERROR: CONVERT ERROR: Password: %s" (%s being your password)GOTO FAILED [*:1p0x1fp4]Decrypts your password via AL_AUTH_Operation::Decrypt[*:1p0x1fp4]Probably looks for AUTHINFO.DAT since it calls AL_AUTH_File::AL_AUTH_File(AL_AUTH_FileInfo const &)[*:1p0x1fp4]At loc_100027E4, it checks some values, but I'm not entirely sure what's going on, but I know if it fails:Skip to step 12 [*:1p0x1fp4]AL_AUTH_File::Check, If True:SET R6 = R7Skip to step 12 [*:1p0x1fp4]Initialize VersionManager, if goodSkip to step 15 [*:1p0x1fp4]Another character conversion ???[*:1p0x1fp4]If R6 = R7Skip to 17 [*:1p0x1fp4]If R6 < R7 Skip to 18 [*:1p0x1fp4]If R6 <= 0xF0660004 (This will run if R6 > R7)R5 = 2Skip to 18 [*:1p0x1fp4]If R6 = 0Skip to 18 [*:1p0x1fp4]Get VersionFile. It calls AL_AUTH_File::GetVersion(void)[*:1p0x1fp4]Compare Version. If False R5 = 0Skip to 18 [*:1p0x1fp4]R5 = 1[*:1p0x1fp4]Do something... not sure[*:1p0x1fp4]Close AuthInfo files. It calls AL_AUTH_File::~AL_AUTH_File(void)[*:1p0x1fp4](FINISH) Return R5 Here's what I figure. R5 Values [*:1p0x1fp4]0 = New version. Do Update.[*:1p0x1fp4]1 = Same version. Don't Update.[*:1p0x1fp4]2 = No authfile. I'm not sure what it'll do.[*:1p0x1fp4]3 = Failed. Don't update. Here's my guess. I crack it by saying, if it goes to FAILED, set R5 = 0 instead of 3. So you can put a blank (or at least 1 character) for a password and it'll accept it as correct. Now, you're asking. How do I crack it? Easy. TL;DR Open RenewalIFLib.dll in a hex editor. Go to 0x1AAC. Change 03 to 00. Let me know if that works for you guys. Quote Link to post Share on other sites
lmclaurin777 Posted September 5, 2010 Report Share Posted September 5, 2010 After reading this thread, I think I just grew a set of buck teeth, and now I just keep saying duhhhhhhhh. LOL Quote Link to post Share on other sites
ShortFuse Posted September 5, 2010 Author Report Share Posted September 5, 2010 Bad news. The SD upgrade doesn't run the cracked lib on the SD. It runs off the internal NAND. I have to make a fake update. If you haven't upgraded to 1001, there's a good chance it'll work for you. I'm going to see if I can find another way for us 1001s. If you still have 1000, post here. Quote Link to post Share on other sites
ShortFuse Posted September 5, 2010 Author Report Share Posted September 5, 2010 Good news! i found out how to falsify updates! File mods, here we come! Quote Link to post Share on other sites
VBLUE42 Posted September 5, 2010 Report Share Posted September 5, 2010 Good news! i found out how to falsify updates! File mods, here we come! Ok, what does this mean exactly. Quote Link to post Share on other sites
ShortFuse Posted September 5, 2010 Author Report Share Posted September 5, 2010 WOAH!!!!!!! It worked!!!! I'm updating it now. Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.