Condi's HACKMODE v2.2 - AUTOINSTALL! working also with F40BT, X940BT etc! [updated: 27.09.2012]

[condiczek]

I'm also curious to know if there is any way to write a script to automatically hit the "OK" button for you..<-- that one will be last, as I seriously doubt that it's possible...

 

I will check autoclick on OK nice idea I've made some script with autoclicks on sony nv-u73/93 units to autounlock gps port on boot. It should work I will post info later/evening!

 

PS. Please confirm is v1.2 update working for you guys! I tested it twice, so it should work perfectly

[garrettoomey]

Please confirm is v1.2 update working for you guys! I tested it twice, so it should work perfectly

V1.2 Test Results

The installation worked flawless. After installing v1.2, I lost bluetooth. I tried to pair my phone again, and it just locked up the system. I rebooted and went to the service information screen and it showed Bluetooth Firmware version as "-----------". I went into test mode and deleted HMIManager.exe and replaced with the original. Rebooted again and my Bluetooth was paired to my phone and Service Information showed Bluetooth firmware version as "3.22". Thoughts? Any other test you would like me to perform?

[condiczek]

V1.2 Test Results

The installation worked flawless. After installing v1.2, I lost bluetooth. I tried to pair my phone again, and it just locked up the system. I rebooted and went to the service information screen and it showed Bluetooth Firmware version as "-----------". I went into test mode and deleted HMIManager.exe and replaced with the original. Rebooted again and my Bluetooth was paired to my phone and Service Information showed Bluetooth firmware version as "3.22". Thoughts? Any other test you would like me to perform?

 

Thanks for testing friend! I have to check it with my device. Its strange, because it uses HMIManager original exe when booting stock pioneer software.. Today I will make some more tests.

 

----edit:

Just tried on my unit. No bluetooth issues. Bluetooth works, paired with my phone, in system settings I see bluetooth firmware version - also 3.22. Please check if your PRG1 files are the same as in PRG0? Maybe different HMIManager.exe or other files?

 

PS. testing autoclicker ..

[Ralpharn]

PS. Please confirm is v1.2 update working for you guys! I tested it twice, so it should work perfectly

Yes, it does. It works on my X930BT and after this update I manage to get registry backup using your script. Before that (on Ver1.1) it wasn't successful.

 

Result of comparison between X930BT and F30BT registry:

X930BT has none but F30BT has: [HKEY_CURRENT_USER\Software\GNS]

[HKEY_CURRENT_USER\Software\GNS\GpsRdsApi]

 

Line 2212 in X930BT: 00,00,00,00,00,bc,94,88,90,e0,77,62,90,40,ea,94,90,8c,6a,bf,9b,0f,00,00,00,\

Line 2216 in F30BT: 00,00,00,00,00,b0,ad,88,90,e0,77,62,90,40,ea,94,90,8c,6a,bf,9b,0f,00,00,00,\

 

Line 2434 in X930BT: "TimeZoneInformation"=hex:e0,01,00,00,43,00,65,00,6e,00,74,00,72,00,61,00,6c,00,\

Line 2438 in F30BT: "TimeZoneInformation"=hex:c4,ff,ff,ff,43,00,65,00,6e,00,74,00,72,00,61,00,6c,00,\

 

Line 2958 in X930BT: [HKEY_LOCAL_MACHINE\Drivers\Active\53]

"Hnd"=dword:00e4f8a0

Line 2962 in F30BT: [HKEY_LOCAL_MACHINE\Drivers\Active\53]

"Hnd"=dword:00e60550

 

Line 2966 in X930BT: [HKEY_LOCAL_MACHINE\Drivers\Active\52]

"Hnd"=dword:00e4fa30

...

"ClientInfo"=dword:00e4bc50

Line 2970 in F30BT: [HKEY_LOCAL_MACHINE\Drivers\Active\52]

"Hnd"=dword:00e4f520

...

"ClientInfo"=dword:00e4b790

 

Line 5292 in X930BT:

20,00,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,5d,3f,ca,a4,1e,09,e1,3f,\

d0,d6,78,ff,1f,1e,44,61,00,00,00,00,04,80,00,00,10,00,00,00,10,00,00,00,c3,\

7d,ab,3b,84,33,d8,08,2c,a1,96,0a,d0,89,0c,7c,52,00,00,00,5d,32,04,de,55,81,\

54,e8,3f,ba,3e,39,c0,29,a5,b1,11,c0,e1,da,b7,1b,83,1c,51,1b,35,6c,8f,95,cd,\

a8,21,ea,23,9a,8f,41,5c,2d,fb,c1,42,aa,22,24,39,6c,69,0d,a8,f1,9c,36,24,b8,\

9e,2f,65,99,e0,c8,8b,aa,4d,b3,e3,c3,59,f0,ce,ae,42,1b,d1,c9,ea,10,55,64,82,\

26,14,00,00,00,1e,85,56,48,30,0e,35,0e,69,99,05,40,23,86,25,26,e8,9d,f0,4f

Line 5309 in F30BT:

20,00,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,dd,b6,ca,a4,9e,80,e1,3f,\

d0,d6,78,ff,9f,97,44,61,00,00,00,00,04,80,00,00,10,00,00,00,10,00,00,00,c3,\

7d,ab,3b,84,33,d8,08,2c,a1,96,0a,d0,89,0c,7c,52,00,00,00,3a,7f,bd,85,0d,b3,\

67,c1,8d,60,96,84,84,4d,8b,dd,d7,c7,ed,95,4d,69,a3,0b,3f,6d,81,9c,94,9e,80,\

28,7d,73,22,2f,fb,1b,df,26,24,9a,d9,68,af,12,4c,18,43,7a,75,2b,c1,04,72,bc,\

6d,24,43,54,af,3d,1f,96,07,5d,29,8f,73,30,3a,a3,b2,7d,c8,f9,f1,1b,d2,03,d9,\

ba,14,00,00,00,7d,1b,39,c9,e7,80,79,54,16,da,0b,88,d2,71,66,13,56,ee,77,3d

[garrettoomey]

Thanks for testing friend! I have to check it with my device. Its strange, because it uses HMIManager original exe when booting stock pioneer software.. Today I will make some more tests.

 

----edit:

Just tried on my unit. No bluetooth issues. Bluetooth works, paired with my phone, in system settings I see bluetooth firmware version - also 3.22. Please check if your PRG1 files are the same as in PRG0? Maybe different HMIManager.exe or other files?

My PRG0 and PRG1 have different files prior to hacking (pioneer ap ver 2.002 on PRG0 and 2.003 on PRG1). I started over with this procedure:

Deleted PRG.FLG

Deleted PRG0, and copied all files from PRG1 to PRG0 (now they are both the same with newest firmware 2.003)

Installed condihack v1

Updated with condihack v1.1

updated with condihack v1.2

 

Bluetooth is now working fine. The only difference was that I replaced have the same files in PRG1 and PRG0.

 

My MSNDirect is still showing as 'inactive', but that could be a seperate issue unless others have the same problem... MSN Direct also showed as 'inactive after I restored everything from backup...

[condiczek]

Yes, it does. It works on my X930BT and after this update I manage to get registry backup using your script. Before that (on Ver1.1) it wasn't successful.

 

Result of comparison between X930BT and F30BT registry:

X930BT has none but F30BT has: [HKEY_CURRENT_USER\Software\GNS]

[HKEY_CURRENT_USER\Software\GNS\GpsRdsApi]

 

Line 2212 in X930BT: 00,00,00,00,00,bc,94,88,90,e0,77,62,90,40,ea,94,90,8c,6a,bf,9b,0f,00,00,00,\

Line 2216 in F30BT: 00,00,00,00,00,b0,ad,88,90,e0,77,62,90,40,ea,94,90,8c,6a,bf,9b,0f,00,00,00,\

 

Line 2434 in X930BT: "TimeZoneInformation"=hex:e0,01,00,00,43,00,65,00,6e,00,74,00,72,00,61,00,6c,00,\

Line 2438 in F30BT: "TimeZoneInformation"=hex:c4,ff,ff,ff,43,00,65,00,6e,00,74,00,72,00,61,00,6c,00,\

 

Line 2958 in X930BT: [HKEY_LOCAL_MACHINE\Drivers\Active\53]

"Hnd"=dword:00e4f8a0

Line 2962 in F30BT: [HKEY_LOCAL_MACHINE\Drivers\Active\53]

"Hnd"=dword:00e60550

 

Line 2966 in X930BT: [HKEY_LOCAL_MACHINE\Drivers\Active\52]

"Hnd"=dword:00e4fa30

...

"ClientInfo"=dword:00e4bc50

Line 2970 in F30BT: [HKEY_LOCAL_MACHINE\Drivers\Active\52]

"Hnd"=dword:00e4f520

...

"ClientInfo"=dword:00e4b790

 

Line 5292 in X930BT:

20,00,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,5d,3f,ca,a4,1e,09,e1,3f,\

d0,d6,78,ff,1f,1e,44,61,00,00,00,00,04,80,00,00,10,00,00,00,10,00,00,00,c3,\

7d,ab,3b,84,33,d8,08,2c,a1,96,0a,d0,89,0c,7c,52,00,00,00,5d,32,04,de,55,81,\

54,e8,3f,ba,3e,39,c0,29,a5,b1,11,c0,e1,da,b7,1b,83,1c,51,1b,35,6c,8f,95,cd,\

a8,21,ea,23,9a,8f,41,5c,2d,fb,c1,42,aa,22,24,39,6c,69,0d,a8,f1,9c,36,24,b8,\

9e,2f,65,99,e0,c8,8b,aa,4d,b3,e3,c3,59,f0,ce,ae,42,1b,d1,c9,ea,10,55,64,82,\

26,14,00,00,00,1e,85,56,48,30,0e,35,0e,69,99,05,40,23,86,25,26,e8,9d,f0,4f

Line 5309 in F30BT:

20,00,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,dd,b6,ca,a4,9e,80,e1,3f,\

d0,d6,78,ff,9f,97,44,61,00,00,00,00,04,80,00,00,10,00,00,00,10,00,00,00,c3,\

7d,ab,3b,84,33,d8,08,2c,a1,96,0a,d0,89,0c,7c,52,00,00,00,3a,7f,bd,85,0d,b3,\

67,c1,8d,60,96,84,84,4d,8b,dd,d7,c7,ed,95,4d,69,a3,0b,3f,6d,81,9c,94,9e,80,\

28,7d,73,22,2f,fb,1b,df,26,24,9a,d9,68,af,12,4c,18,43,7a,75,2b,c1,04,72,bc,\

6d,24,43,54,af,3d,1f,96,07,5d,29,8f,73,30,3a,a3,b2,7d,c8,f9,f1,1b,d2,03,d9,\

ba,14,00,00,00,7d,1b,39,c9,e7,80,79,54,16,da,0b,88,d2,71,66,13,56,ee,77,3d

Nice comparison! We've got to analyze that differences, gps values etc.

Also great to hear that v1.2 is working for you and registry backup also!!

 

My PRG0 and PRG1 have different files prior to hacking (pioneer ap ver 2.002 on PRG0 and 2.003 on PRG1). I started over with this procedure:

Deleted PRG.FLG

Deleted PRG0, and copied all files from PRG1 to PRG0 (now they are both the same with newest firmware 2.003)

Installed condihack v1

Updated with condihack v1.1

updated with condihack v1.2

 

Bluetooth is now working fine. The only difference was that I replaced have the same files in PRG1 and PRG0.

 

My MSNDirect is still showing as 'inactive', but that could be a seperate issue unless others have the same problem... MSN Direct also showed as 'inactive after I restored everything from backup...

Happy to read that it works now! Good that you installed all versions ascending, in next updates there will be check if installed version is the previous one, if any other then it will not update.

[dawgbone]

I have a problem. I followed the instructions, but now when I boot, I get the following loop: "Program update failed. Restarting".

 

Details:

Avic Z110BT upgraded to Z120BT (paid Pioneer update)

 

Downloaded v1.0 and extracted to root of SD.

Insert SD in Z110 and started auto started testmode.

Copy/Pasted USER and have the backup saved on PC.

My PRG0 and PRG1 were different, so I deleted PR1 from AVIC and copied PRG0 files to PRG1.

Deleted USER/PRG0/apl/Av.exe from z110.

Copied all files from SD/CONDIHACK (v1) to USER/PRG0/apl

Exited File Maintenance.

Turn off unit, and Turn on Unit.

Get "System update failed, restarting" loop.

Remove all SD from Z110, Get "Program Update Started, Program update failed, restarting" loop.

Insert Service Test Mode SD, Get "Program Update Started, Program update failed, restarting" loop.

Insert Condihack SD, Get "Program Update Started, Program update failed, restarting" loop.

Insert Pioneer's CNSD-110FM SD, Get "Program Update Started, Program update failed, restarting" loop.

Remove all SD from Z110, Get "Program Update Started, Program update failed, restarting" loop.

 

Got a brick on my hands... Any suggestions?

 

 

 

I was able to get updated to v1.2, but like you, my BT was hokey, and the version read ------

 

Then I somehow managed to get myself in the above situation, luckily after several attempts, I was finally able to get to file manager and restore the USER directory from backup....whhhewwww!!!!

 

Now I'm starting over... There has got to be something with our scenario (Pioneer 110-120 update(legit) and having the 2.0.0.3 update)

Odd enough, mine does NOT have the PRG.flg file????

[condiczek]

I was able to get updated to v1.2, but like you, my BT was hokey, and the version read ------

 

Then I somehow managed to get myself in the above situation, luckily after several attempts, I was finally able to get to file manager and restore the USER directory from backup....whhhewwww!!!!

 

Now I'm starting over... There has got to be something with our scenario (Pioneer 110-120 update(legit) and having the 2.0.0.3 update)

Odd enough, mine does NOT have the PRG.flg file????

 

OK so I assume that you have backup of USER content.

Get PRG0 from copy, make another one, rename it to PRG1.

Delete PRG1 from device, copy renamed directory - PRG1 (with PRG0 content).

Install HACKMODE v1., update to v1.1, update to v1.2.

And post results

[dawgbone]

Thanks Condiczek

 

-Everything works fine up until 1.1>1.2 update... just like my first attempt, the unit just continually reboots...I let it reboot 15 times then I turned it off/on... Regardless, it'll continue to reboot until, I remove the SD...

-This time, BT is working with version 3.11

-After the update, HACKMODE.key is the only thing left on the SD card... yet it doesn't boot into WinCE<--just get's to the OK screen and reboots

 

Should I try to grab a HACKMODE.key from the 1.1 update? To see if it'll boot to WinCE?

[condiczek]

Thanks Condiczek

 

-Everything works fine up until 1.1>1.2 update... just like my first attempt, the unit just continually reboots...I let it reboot 15 times then I turned it off/on... Regardless, it'll continue to reboot until, I remove the SD...

-This time, BT is working with version 3.11

-After the update, HACKMODE.key is the only thing left on the SD card... yet it doesn't boot into WinCE<--just get's to the OK screen and reboots

 

Should I try to grab a HACKMODE.key from the 1.1 update? To see if it'll boot to WinCE?

 

Wait a minute, I think I know what's wrong... just give me five min..

 

--edit: PM

[dawgbone]

Thanks again Condiczek....

I'm back up and kicking... Just in case this should arise with others, Condi figured out that my unit is a bit slower than most in regard to how long it takes for it to recognize the USB/SD...(high interior temps....crappy SD card???)

 

A simple tweak to the timeout/sleep in his HMIManager.mscr file is all that was needed.

 

Thanks also for checking into the autoclicker.... I know many would use your hack for this mod alone....

[ShortFuse]

Condi, are you experienced in programming? If not, can you try if my WinCE GPS program works?

 

http://forum.xda-developers.com/showthread.php?t=474582

 

You might be able to use it to turn on GPS. You might have to install the ARM4 .NET Compact Framework CAB first.

 

Let me know how far you get.

[condiczek]

Condi, are you experienced in programming? If not, can you try if my WinCE GPS program works?

 

http://forum.xda-developers.com/showthread.php?t=474582

 

You might be able to use it to turn on GPS. You might have to install the ARM4 .NET Compact Framework CAB first.

 

Let me know how far you get.

 

Sure, I can try I'm not experienced in programming, only bases.

I doubt that I can install any .cab file with that 'windows ce'.

Could this be done by extracting .cab and copying manually files? If yes, than I will try it.

http://blogs.msdn.com/b/netcfteam/archive/2005/10/11/479793.aspx

Which version for our wince 5 devices? NETCFv2.wce5.armv4i.cab?

Got your program on SD, will try it tomorrow (00:22am here ).

I tried several programs like port splitter, gpsgate, sirftech utility etc., none of them worked.

 

Maybe we should compare registry from older unit, where gps was available?

[garrettoomey]

All condihack version are installed. MSNdirect and BT are working fine. The only issue I see now is the significant boot time. Music and splash screen used to start almost instantly at power up, but now it is about 30 seconds before the music and splash screen start up. This did not occur until v1.2. Can this be sped up?

[dawgbone]