Condi's HACKMODE v2.2 - AUTOINSTALL! working also with F40BT, X940BT etc! [updated: 27.09.2012]

[PatrickFernandes]

look this pic, there a jtag conection in CC CPU and a Order to Testmode Stages, maybe can help us

[rrolff]

https://rs516l32.rapidshare.com/#!download|516dt|281150261|Pioneer_Avic-z110bt_Avic-f10bt_Service_Manual_Repair_Guide.pdf|26106

 

Here is a very detailed service manual - schematics, block diagrams et al. Its for the Z110 - but they clearly all share the same architecture. Note commands etc.

 

It does look like there are 2 pieces working here...

 

Enjoy!

[ShortFuse]

This relevant to my interests. I'll check it out tomorrow. The nice thing is we can launch executables without bricking (I think). I might have to dust off my WinCE dev tools, but this is genuinely exciting

[Tudor Z]

 

So as you can see, we just had got rid of pioneer processes

One strange process left, AstProc.exe - anybody knows what it is?

 

br

condi

 

Well I don't know what it is, but I can tell you where it's from: EU090RGD.PRG . This is also a rom bin, which contains the following files:

AstProc.exe, ceconfig.h, coredll.dll, nk.exe, snapshot_secureos.dat

The bin can be unpacked with the same method I described, but I noticed "dumprom" screws with the exe's (and dll's probably), because they are not runnable on other WinCE's.

[garrettoomey]

I think I have found the reason that some people have the PRG.FLG file...

If you just did the upgrade from Z110 to Z120 (official or Shortfuze), you should not have the flag, and will be using PRG0. If you upgraded (either method) and then installed the additional pioneer firmware update (Version 2.003), then you will have PRG.FLG and PRG1 will be used.

 

http://www.pioneerelectronics.com/PUSA/Car/GPS-Navigation/AVIC-Z120BT

[condiczek]

finishing v1.2 with auto-migrate HACKMODE to HMIManager ..

 

--edit:

 

DONE. Please post results. Update only from v1.1! I used some trick to replace HMIManager - which process can't be killed (unit freeze), and can't be deleted/overwrited! Unit will temporary use PRG1 with autoscript for one reboot, replace HMI and back to normal state, everything will be nice and clean with stock exe's in PRG1

Now we've got no processes from PRG\Apl directory.

 

br

condi

 

---edit: unpacked EU090RGD - in AstProc.exe I see something like:

 

C:\WINCE500\platform\PF09Light\target\ARMV4I\retail\ASTPROC.pdb

and

OSSwitch_ServiceThread

 

OS Switch? More and more I think that like rrolff said, its 2-units device, 1-navi with wince and software, 2-audio/hw/fw - with control of audio, gps signal, hw buttons etc.

But If pioneers Navi.exe has access to gps port/signal, then we could gain that access! ...but how?

dump-EU090RGD.zip

[garrettoomey]

Condi, can you also keep an updated list of all files that are changed or replaced as you create the updates? This would provide an easy 'back to stock' path. Just need to replace the changed/updated files with the stock files from our backup. I created a FULL backup of USER and NDATA today. NDATA took forever...

[condiczek]

Condi, can you also keep an updated list of all files that are changed or replaced as you create the updates? This would provide an easy 'back to stock' path. Just need to replace the changed/updated files with the stock files from our backup. I created a FULL backup of USER and NDATA today. NDATA took forever...

 

Only one which was replaced till now was Av.exe.

Now instead of it hackmode 'is in' HMIManager.exe file.

If you want to revert it back, then just delete it, copy original .exe.

 

Also in Apl directory there are added:

explorer.exe, explorer2.exe, MortScript.exe, and HMIManager.mscr.

Thats it.

[garrettoomey]

Only one which was replaced till now was Av.exe.

Now instead of it hackmode 'is in' HMIManager.exe file.

Does v1.2 replace the hacked av.exe with the original Av.exe?

[condiczek]

Does v1.2 replace the hacked av.exe with the original Av.exe?

 

Yes, automatically from PRG1. Everything is automated

All you need to do is to have 1.1 already, have unmodified PRG1,

and put 1.2 update on SD/USB

I've made some scripts to auto change HMIManager,

not to do this manually from TestMode.

Now its easy as hell going sleep now, will be back in morning! good night!

[emerson.jared]

Yes, automatically from PRG1. Everything is automated

All you need to do is to have 1.1 already, have unmodified PRG1,

and put 1.2 update on SD/USB

I've made some scripts to auto change HMIManager,

not to do this manually from TestMode.

Now its easy as hell going sleep now, will be back in morning! good night!

 

 

What about the few of us that had to rename prg0 to prg1 and prg1 to prg0 and delete the prg.flg file? will the 1.2 update still work right?

[garrettoomey]

What about the few of us that had to rename prg0 to prg1 and prg1 to prg0 and delete the prg.flg file? will the 1.2 update still work right?

I checked the Av.exe files from both PRG1 and PRG0, and they are the same. It should work fine. I will update mine to v1.2 tomorrow and post results.

[PatrickFernandes]

finishing v1.2 with auto-migrate HACKMODE to HMIManager ..

 

--edit:

 

DONE. Please post results. Update only from v1.1! I used some trick to replace HMIManager - which process can't be killed (unit freeze), and can't be deleted/overwrited! Unit will temporary use PRG1 with autoscript for one reboot, replace HMI and back to normal state, everything will be nice and clean with stock exe's in PRG1

Now we've got no processes from PRG\Apl directory.

 

br

condi

 

---edit: unpacked EU090RGD - in AstProc.exe I see something like:

 

C:\WINCE500\platform\PF09Light\target\ARMV4I\retail\ASTPROC.pdb

and

OSSwitch_ServiceThread

 

OS Switch? More and more I think that like rrolff said, its 2-units device, 1-navi with wince and software, 2-audio/hw/fw - with control of audio, gps signal, hw buttons etc.

But If pioneers Navi.exe has access to gps port/signal, then we could gain that access! ...but how?

 

I agree, if u check service manual , u can see there is a cc unit and all parts is pluged into monitor , dvd , gps board, there are a ac97 audio chip, like onboard pc motherboard, into CC board but i think its work only receive nav and digital audio, the tuner is other unit!

 

 

Try Google for SiRFprima probably the CPU of our Avic units, there a lot of info about GPS and Multimedia units using this Chipset ,maybe a info about bootloader or a unbrick method! we can know how our system work!

 

http://www.windowsfordevices.com/c/a/News/CSR-SiRFprimaAuto/

[VBLUE42]

Holy sh*t you guys are taking the ball and running with it. If I didn't have an iPad in the dash right now, I would so be all over this. Keep up the awesome work guys. And Garrett, its nice to see you active here.

[dawgbone]

Indeed!!! This is some awesome stuff!!!

Special thanks to Garret, as I believe I'll fall into that category with the .flg file.... I've yet to play with this stuff, but at least, I have a somewhat decent idea of what to look out for.... Thanks again...

 

 

I'm not so much on getting a 3rd party Navi going as much as everyone else.... But the more mods the better....

 

I'm jumping in to try to figure out how I can make "daytime" map background black like "nighttime".... yet leaving the dimmer function functional....(daytime map is hard to see street names...looks better..etc)

I'm also curious to know if there is any way to write a script to automatically hit the "OK" button for you..<-- that one will be last, as I seriously doubt that it's possible...

 

Regardless...

 

Good job fellas... I speak for many, that I appreciate the efforts... this is good stuff...