PatrickFernandes Posted May 11, 2011 Report Share Posted May 11, 2011 look this pic, there a jtag conection in CC CPU and a Order to Testmode Stages, maybe can help us Quote Link to post Share on other sites
rrolff Posted May 11, 2011 Report Share Posted May 11, 2011 https://rs516l32.rapidshare.com/#!download|516dt|281150261|Pioneer_Avic-z110bt_Avic-f10bt_Service_Manual_Repair_Guide.pdf|26106 Here is a very detailed service manual - schematics, block diagrams et al. Its for the Z110 - but they clearly all share the same architecture. Note commands etc. It does look like there are 2 pieces working here... Enjoy! Quote Link to post Share on other sites
ShortFuse Posted May 11, 2011 Report Share Posted May 11, 2011 This relevant to my interests. I'll check it out tomorrow. The nice thing is we can launch executables without bricking (I think). I might have to dust off my WinCE dev tools, but this is genuinely exciting Quote Link to post Share on other sites
Tudor Z Posted May 11, 2011 Report Share Posted May 11, 2011 So as you can see, we just had got rid of pioneer processes One strange process left, AstProc.exe - anybody knows what it is? br condi Well I don't know what it is, but I can tell you where it's from: EU090RGD.PRG . This is also a rom bin, which contains the following files: AstProc.exe, ceconfig.h, coredll.dll, nk.exe, snapshot_secureos.dat The bin can be unpacked with the same method I described, but I noticed "dumprom" screws with the exe's (and dll's probably), because they are not runnable on other WinCE's. Quote Link to post Share on other sites
garrettoomey Posted May 11, 2011 Report Share Posted May 11, 2011 I think I have found the reason that some people have the PRG.FLG file... If you just did the upgrade from Z110 to Z120 (official or Shortfuze), you should not have the flag, and will be using PRG0. If you upgraded (either method) and then installed the additional pioneer firmware update (Version 2.003), then you will have PRG.FLG and PRG1 will be used. http://www.pioneerelectronics.com/PUSA/Car/GPS-Navigation/AVIC-Z120BT Quote Link to post Share on other sites
condiczek Posted May 11, 2011 Author Report Share Posted May 11, 2011 finishing v1.2 with auto-migrate HACKMODE to HMIManager .. --edit: DONE. Please post results. Update only from v1.1! I used some trick to replace HMIManager - which process can't be killed (unit freeze), and can't be deleted/overwrited! Unit will temporary use PRG1 with autoscript for one reboot, replace HMI and back to normal state, everything will be nice and clean with stock exe's in PRG1 Now we've got no processes from PRG\Apl directory. br condi ---edit: unpacked EU090RGD - in AstProc.exe I see something like: C:\WINCE500\platform\PF09Light\target\ARMV4I\retail\ASTPROC.pdb and OSSwitch_ServiceThread OS Switch? More and more I think that like rrolff said, its 2-units device, 1-navi with wince and software, 2-audio/hw/fw - with control of audio, gps signal, hw buttons etc. But If pioneers Navi.exe has access to gps port/signal, then we could gain that access! ...but how? dump-EU090RGD.zip Quote Link to post Share on other sites
garrettoomey Posted May 11, 2011 Report Share Posted May 11, 2011 Condi, can you also keep an updated list of all files that are changed or replaced as you create the updates? This would provide an easy 'back to stock' path. Just need to replace the changed/updated files with the stock files from our backup. I created a FULL backup of USER and NDATA today. NDATA took forever... Quote Link to post Share on other sites
condiczek Posted May 11, 2011 Author Report Share Posted May 11, 2011 Condi, can you also keep an updated list of all files that are changed or replaced as you create the updates? This would provide an easy 'back to stock' path. Just need to replace the changed/updated files with the stock files from our backup. I created a FULL backup of USER and NDATA today. NDATA took forever... Only one which was replaced till now was Av.exe. Now instead of it hackmode 'is in' HMIManager.exe file. If you want to revert it back, then just delete it, copy original .exe. Also in Apl directory there are added: explorer.exe, explorer2.exe, MortScript.exe, and HMIManager.mscr. Thats it. Quote Link to post Share on other sites
garrettoomey Posted May 11, 2011 Report Share Posted May 11, 2011 Only one which was replaced till now was Av.exe. Now instead of it hackmode 'is in' HMIManager.exe file. Does v1.2 replace the hacked av.exe with the original Av.exe? Quote Link to post Share on other sites
condiczek Posted May 11, 2011 Author Report Share Posted May 11, 2011 Does v1.2 replace the hacked av.exe with the original Av.exe? Yes, automatically from PRG1. Everything is automated All you need to do is to have 1.1 already, have unmodified PRG1, and put 1.2 update on SD/USB I've made some scripts to auto change HMIManager, not to do this manually from TestMode. Now its easy as hell going sleep now, will be back in morning! good night! Quote Link to post Share on other sites
emerson.jared Posted May 11, 2011 Report Share Posted May 11, 2011 Yes, automatically from PRG1. Everything is automated All you need to do is to have 1.1 already, have unmodified PRG1, and put 1.2 update on SD/USB I've made some scripts to auto change HMIManager, not to do this manually from TestMode. Now its easy as hell going sleep now, will be back in morning! good night! What about the few of us that had to rename prg0 to prg1 and prg1 to prg0 and delete the prg.flg file? will the 1.2 update still work right? Quote Link to post Share on other sites
garrettoomey Posted May 11, 2011 Report Share Posted May 11, 2011 What about the few of us that had to rename prg0 to prg1 and prg1 to prg0 and delete the prg.flg file? will the 1.2 update still work right? I checked the Av.exe files from both PRG1 and PRG0, and they are the same. It should work fine. I will update mine to v1.2 tomorrow and post results. Quote Link to post Share on other sites
PatrickFernandes Posted May 12, 2011 Report Share Posted May 12, 2011 finishing v1.2 with auto-migrate HACKMODE to HMIManager .. --edit: DONE. Please post results. Update only from v1.1! I used some trick to replace HMIManager - which process can't be killed (unit freeze), and can't be deleted/overwrited! Unit will temporary use PRG1 with autoscript for one reboot, replace HMI and back to normal state, everything will be nice and clean with stock exe's in PRG1 Now we've got no processes from PRG\Apl directory. br condi ---edit: unpacked EU090RGD - in AstProc.exe I see something like: C:\WINCE500\platform\PF09Light\target\ARMV4I\retail\ASTPROC.pdb and OSSwitch_ServiceThread OS Switch? More and more I think that like rrolff said, its 2-units device, 1-navi with wince and software, 2-audio/hw/fw - with control of audio, gps signal, hw buttons etc. But If pioneers Navi.exe has access to gps port/signal, then we could gain that access! ...but how? I agree, if u check service manual , u can see there is a cc unit and all parts is pluged into monitor , dvd , gps board, there are a ac97 audio chip, like onboard pc motherboard, into CC board but i think its work only receive nav and digital audio, the tuner is other unit! Try Google for SiRFprima probably the CPU of our Avic units, there a lot of info about GPS and Multimedia units using this Chipset ,maybe a info about bootloader or a unbrick method! we can know how our system work! http://www.windowsfordevices.com/c/a/News/CSR-SiRFprimaAuto/ Quote Link to post Share on other sites
VBLUE42 Posted May 12, 2011 Report Share Posted May 12, 2011 Holy sh*t you guys are taking the ball and running with it. If I didn't have an iPad in the dash right now, I would so be all over this. Keep up the awesome work guys. And Garrett, its nice to see you active here. Quote Link to post Share on other sites
dawgbone Posted May 12, 2011 Report Share Posted May 12, 2011 Indeed!!! This is some awesome stuff!!! Special thanks to Garret, as I believe I'll fall into that category with the .flg file.... I've yet to play with this stuff, but at least, I have a somewhat decent idea of what to look out for.... Thanks again... I'm not so much on getting a 3rd party Navi going as much as everyone else.... But the more mods the better.... I'm jumping in to try to figure out how I can make "daytime" map background black like "nighttime".... yet leaving the dimmer function functional....(daytime map is hard to see street names...looks better..etc) I'm also curious to know if there is any way to write a script to automatically hit the "OK" button for you..<-- that one will be last, as I seriously doubt that it's possible... Regardless... Good job fellas... I speak for many, that I appreciate the efforts... this is good stuff... Quote Link to post Share on other sites
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.