Cracking the Z110/20BT: F10/F20BT included? Region changing?

[dodd_000]

Guys Thanks for all the detailed help.

 

I am havine one small problem though. When I tried to install the 1.002 i end up with a repeating loop that keeps rebooting my unit and telling me the the installation failed. Any thought on how I can get this to quit and allow me to get the SD card out.

 

Thanks

 

 

 

Props to you guys SHORTFUSE THX Much

 

Enjoy..

None of this was my hard work it for sure took a team.

AVIC411 FTW

 

Download this file. Pioneer.Z110BT.Upgrade.Unlocker-ShortFuse.zip

http://avic411.com/forum/download/file.php?id=9893 know the location of the file where you downloaded the file to on your hard drive.

 

 

Now Download this file from pioneer. 1.001000.zip

http://ds1.downloadtech.net/cn1010/firmware/1.001000.zip know the location of the file where you downloaded the file to on your hard drive.

 

Now open up your c:\drive and make a new folder called update.

 

Now in the folder c:\update extract the contents of both of the downloads into the folder c:\Update

 

Use winrar or what ever app you like that will uncompress files.

 

You should now have two folders with files now in the c:\updates folder.

 

c:\updates\1.001000 This has lots of files and folders in it.

and

c:\update\Pioneer.Z110BT.Upgrade.Unlocker-ShortFuse\ This will have three files in this folder.

 

Replace the file, in the following location

c:\update\AVICZ110\EU090APL.VER

with this file

c:\update\Pioneer.Z110BT.Upgrade.Unlocker-ShortFuse\EU090APL.VER

 

Replace the file, in the following location

c:\update\AVICZ110\APL\RenewalIFLib.dll

with this file

c:\update\Pioneer.Z110BT.Upgrade.Unlocker-ShortFuse\RenewalIFLib.dll

 

 

Format SD (Right click sd card under my computer and format) format in FAT32 the card needs to be 4gb or larger to complete all steps.

 

Now Copy the folder

c:\update\AVICZ110

to the root of an SD card.

Lets say your sd card is j: drive.

You will now have one folder on the j: drive.

 

j:\AVICZ110 (Plus all the contents of the folder.)

 

Now insert the SD to your Z110BT and it should start updating automatically.

 

 

Now how to do the update to os version 2.0

 

Once downloaded with your favorite utorrent client and unrared, you will have two folders that represent two separate SD cards.

 

You must install a torrent application, before the torrent file below will do you any good. Below are clients for both mac and windows.

 

Windows Utorrent client can be found here.http://www.utorrent.com/downloads/complete?os=win

Mac Utorrent client can be found here.http://www.utorrent.com/downloads/complete?os=mac

The update OS torrent file can be found here http://avic411.com/forum/download/file.php?id=9668

 

 

 

 

 

You can do all this from one sd card or two.

 

Once torrent is downloaded.

You will have a folder CNSD-110FM default location under c:\doc settings\your username\downloads

Open the folder c:\doc settings\your username\downloads\CNSD-110FM you will see two more folders

default location

c:\doc settings\your username\downloads\CNSD-110FM\SD1

and

c:\doc settings\your username\downloads\CNSD-110FM\SD2

 

Open these folders and extract contents with winrar to

c:\uploads\CNSD-110FM-SD1

c:\uploads\CNSD-110FM-SD2

 

TIME for another FAT32 format

Format your SD card in fat32 right click on the sd card and select format under my computer.

Copy content of folder c:\update\CNSD-110FM-SD1

and put it on the root of the SD drive.

 

lets say sd drive is is j:\ drive it really could be any letter f:\ u:\ c:\ k:\ .. I don't know the driver letter for your SD card. ( You do have a SD card reader RIGHT?)

you will have two folders and one file on j:\ drive

 

j:\Firmware (folder) plus all the content of the folder

j:\Update (folder) plus all the content of the folder

j:\CARDINFO.cif (file)

 

 

now take the sd card and put it in the z110bt

 

This will start the upgrade it will ask for serial.. just type leters until you can type no more.. (no numbers) letters only.Then continue. This takes about 25 min..

 

After OS install version 2.0 has been installed, the bluetooth needs to be updated two times.

With the same card you just updated the os with do the following steps.

 

a) press (Home button) to display top menu.

touch (system settings)

c) touch (bluetooth settings)

d) confirm bluetooth version is 2.50

e) scroll to bottom of list touch ( firmware update)

f) confirm update

g) after finish takes maybe 5-6 min confirm 3.10 version is now on unit under bluetooth setting page

h)once update finishes click ok. now eject sd card.

 

Get new SD card or format the existing sd card

 

i) copy content of c:\update\CNSD-110FM-SD2 folder onto the root of the new or cleanly formated sd card

j) press (Home button) to display top menu.

k) touch (system settings)

l) touch (bluetooth settings)

m) confirm bluetooth version is 3.10

n) scroll to bottom of list touch ( firmware update)

o) confirm update to 3.11

 

 

If I missed something please let me know.

 

 

Thx agian guys.

[ShortFuse]

Am I correct in guessing that Pioneer is using pretty much the same software for their other products (X910/X920), F series???

I haven't looked at the X910 / X920 so I don't know. I do know that there are similar Nav units based on the same core system. The only hardware identical versions are Z110BT, Z1120BT, F10BT and F20BT. The rest are similar, but not identical.

 

I do know I can crack RenewalIFLib.dll for the F310 exactly how I did for the Z110.

 

Man, running Android with haret sounds so cool it would require a lot more development though, especially without the exact specs, adresses, protocols to use the HW.

 

I would be already happy if using iGO or other apps would be possible, or using an Eye-Fi card and have internet access through an accesspoint...

 

As for Android, it's probably not as hard as you think. The service manual goes into a ridiculous amount of detail. The CPU is a SIRFPrima. The CPU has already been made to work on android.

http://justamp.blogspot.com/2009/11/gps ... tform.html

If we can get our hands on the filesystem/rom, we can start taking a crack at it.

Take a look at pic #3

 

Eye-Fi card wouldn't work since that's more for accessing file systems. I was about to say "Google Maps is out of the question because there's no internet" but I just remembered we have a USB port and Bluetooth DUN.

 

I like the sound of that....

So basically, if things go awry, you're saying that you could boot into TESTMODE, and run one of Pioneer's updates to get things back in check? Granted if we can figure out how to boot into TESTMODE on a SD card...

 

The absolute safest method is do it the same way Pioneer does it: Figure out what needs to be on the SD card or how to trigger this +B, ACC and use the password they want.

 

The most probable method is, instead of telling the system to boot with NAVI.EXE, I tell it to boot with a launcher app or for now, TotalCommander. From there, I can launch TestMode.exe, modify/copy files directly, or just go to NAVI.EXE. This exists in the ROM.NB0 image (packed in EU090PLT.PRG). The risk is, if you brick this, you can't get into TESTMODE to restore anything

 

But, the good news it. TESTMODE is not the REAL bootloader. There should be a Ethernet or COM port you can connect to (maybe with with solder points) where you should be able to send commands to the rom. The native bootloader is the XIP.BIN file packed inside EU090BOT.PRG. As long as EU090POT.PRG is never modified and we can get to this bootloader, we can never brick it. Now, that's if we can access this Eth/COM port. Well, WinMo hackers have modified the bootloader so reverse engineering shouldn't be impossible. I just hope the bootloader allows you to flash from the SD port with a BIN file.

 

The unpacked XIP.BIN has references to certain files

NK.img (maybe EU090PLT.NB0)

NK.bin (maybe XIP.BIN)

NK2.img (maybe EU090RGD.NB0)

 

so an SD restore might be possible.

[ShortFuse]

Guys Thanks for all the detailed help.

 

I am havine one small problem though. When I tried to install the 1.002 i end up with a repeating loop that keeps rebooting my unit and telling me the the installation failed. Any thought on how I can get this to quit and allow me to get the SD card out.

 

Thanks

 

I wonder what you did. I'm assuming you used the cracked files on something other than the 1.001 update. (Maybe the 2.0 upgrade files?)

 

As for opening it. Try holding down the eject button while you power it on. (or shortly after you power it on)

[dawgbone]

I'm gonna go ahead and just assume that dropping TESTMODE.exe onto a SD card, inserting it, and powering back on the unit, is not going to work...<-- I don't have a SD card on me ATM...

 

In other words, we need the GGS1080....

 

I'm kinda excited about it.... Being that the built in file manager allows you to copy/paste files around(to/from SD card)... Also the ability to copy files over via a BT connected laptop...<--although I have not personally tried yet...

[rrolff]

Am I correct in guessing that Pioneer is using pretty much the same software for their other products (X910/X920), F series???

 

Yes for the 920 but the 910 and F series use different software. Regardless those units have been hacked for a while so this is irrelevant.

 

????? How is it irrelevant ?????

 

I would now guess that each Pioneer is running the same NAVI (with exception of display driver), likely same/similar file structure.

 

I'd hazard a guess that in a few days, some of the things done on previous Pioneers (hacks) will become very relevant.

 

Maybe it's time to remove your thread on TESTMODE

[rrolff]

I would be already happy if using iGO or other apps would be possible, or using an Eye-Fi card and have internet access through an accesspoint...

 

I too would love me a little iGo. Ran it for a while on a random Chinese WINCE HU. I don't think Android works - because of the 'radio/sound' layer - and that dev (which IMHO is really good comparing with the other WINCE HUs) - but a nice CE filemanager, maybe a bit of CE IE, added with a touch of CE WiFi USB driver would allow my Android to stream Internet service into the car... We can all wish..........

[VBLUE42]

Am I correct in guessing that Pioneer is using pretty much the same software for their other products (X910/X920), F series???

 

Yes for the 920 but the 910 and F series use different software. Regardless those units have been hacked for a while so this is irrelevant.

 

????? How is it irrelevant ?????

 

I would now guess that each Pioneer is running the same NAVI (with exception of display driver), likely same/similar file structure.

 

I'd hazard a guess that in a few days, some of the things done on previous Pioneers (hacks) will become very relevant.

 

Maybe it's time to remove your thread on TESTMODE

 

Its irrelevant because they have already been hacked and this method would not apply. And they are not running the same NAVI. And as long as TESTMODE still doesn't work in the same way it does on those units, those threads will remain.

[TXFrdOwner]

If someone ever put the hack on video while they go through the process, it'll be cool to post it online (youtube) or something.

[netgo]

This news makes me login. Great. And it works for me.

 

Two questions.

 

1. It is possible to remove 'ok' welcome screen?

2. There is a tahoma font file. I have a lot of musics from asia (Korean and Japan titles) Currently 120BT cannot display foreign characters. If we updated this font file, what will happen?

 

Thank you!

[whobedaplaya]

If someone ever put the hack on video while they go through the process, it'll be cool to post it online (youtube) or something.

Yeah, my bad on that. I actually recorded the entire process but accidentally erased the SD card it was on

[rrolff]

 

Yes for the 920 but the 910 and F series use different software. Regardless those units have been hacked for a while so this is irrelevant.

 

????? How is it irrelevant ?????

 

I would now guess that each Pioneer is running the same NAVI (with exception of display driver), likely same/similar file structure.

 

I'd hazard a guess that in a few days, some of the things done on previous Pioneers (hacks) will become very relevant.

 

Maybe it's time to remove your thread on TESTMODE

 

Its irrelevant because they have already been hacked and this method would not apply. And they are not running the same NAVI. And as long as TESTMODE still doesn't work in the same way it does on those units, those threads will remain.

 

The hacks (which can also be called mods) will likely be portable across platforms - unless you have some knowledge that hasn't been posted (please go ahead).

 

Testmode seems to be similar, and likely runs - it's being researched now (again, unless I'm missing something).

 

As far as Navis go, please explains the exact versions etc from each Pioneer unit - I didn't know that was already identified (???)

 

It seems to me that once this gets opened up a bit more, we will see they share an almost identical software lineage...

 

You seem to have other info - please enlighten us...

[VBLUE42]

Its all over the F and X series forums.

[alexbass311]

Thank-you ShortFuse, worked perfectly (except for the fact that I accidentally killed my battery by playing with the HU for so long after the install, my bad)

[rcs72]

How long should the downloading of the torrent file take using uTorrent? Right now I've been downloading for close to 2 hrs?

[VBLUE42]

Longer then that.