Condi's HACKMODE v2.2 - AUTOINSTALL! working also with F40BT, X940BT etc! [updated: 27.09.2012]

[Ralpharn]

Simple question: do you have the little "lock" switch that's on most SD card set to the "on" position?

MicroSD has no lock.

[Ralpharn]

There is clear register from F900BT:

avic_f900_v322_default_reg.rar

There is register from one of updates for F10:

nx007cl_EU090PLT_registry.rar

and registry files from X930 exstracted from EU090PLT.prg:

EU090PLT_reg.rar (thanks to Carver!)

[PatrickFernandes]

More usefull Tools to Windows Ce Such as process killer and more others

i didnt try yeath!

check this http://www.xs4all.nl/~itsme/projects/xda/tools.html

 

these are:

 

pps - dumps active wince processes

pdblist - dumps wince databases

pdel - delete wince file

pdir - list wince directory

pmkdir - create wince directory

pget - copy file from wince

pkill - kill wince process

preboot - reboot wince device

ppostmsg - send/post windows msgs to wince windows

pmemdump - copy memory block from wince

psetmem - set RAM memory location in your device

pmemmap - list available memory blocks on wince

pput - copy file to wince

pregutl - manipulate the wince registry

prun - run program in wince

dump - hexdump local file.

pdebug - capture debugoutput of processes

pdocread - raw read from disk-on-chip in your device

pdocwrite - raw write from disk-on-chip in your device

psdread - raw read from sd card in your device

psdwrite - raw write to the sd card in your device

pnewbmp - write new bootsplash bitmap to rom

pnewbootloader - replace your bootloader

prapi - interface to wince provisioning config api

psynctime - sync time with pc.

 

NOTE: sdread, sdwrite, postmsg, memdump, setmem and regutl are similar tools, but operate on your pc, instead of a remote device.

 

.... experimental stuff:

pgsmdump - attempt at memory dumper for gsm.

pget2 - attempt at improvement of pget

tlbdump - dumps virtual to physical memory mapping

riltest - dumps all kinds of info from the phone via ril

pcmon - attempt to talk 'rsupgrade'-protocol

testpi - tool to find out what handles are open on your PPC

tsttffs - tool to experiment with the trueffs API

 

All Files Pack link

Edited May 16, 2011 by PatrickFernandes

[dawgbone]

MicroSD has no lock.

 

Like others have mentioned... start a new thread...

Let's try to figure this one out... so far you're the only one, but it would be great to know why....

 

That is... if you're willing to stick in there till we get a hold of what's going on...

 

Thanks

[nystc23]

ok, so after reading through this thread, it seems like you can use the 'HACKMODE' to upgrade the z120bt to z130bt?

 

Here is my question:

I upgraded my z110 unit to the z120 software. If I were to want to upgrade to z130 from where I am now, would I just use the Condi HACKMODE: download all 3 versions of the file and 'upgrade' it accordingly, then just plug it into my unit & go through the motions?

[VBLUE42]

Well no one can answer that for sure until the 130 upgrade is released but at this point anything is possible.

[condiczek]

There is clear register from F900BT:

avic_f900_v322_default_reg.rar

There is register from one of updates for F10:

nx007cl_EU090PLT_registry.rar

and registry files from X930 exstracted from EU090PLT.prg:

EU090PLT_reg.rar (thanks to Carver!)

Thanks friend, thats what I need to compare/analyze/modify

One question - which one of that units are hackable (with available gps port, windows ce working etc.)?

Hmm... maaaaany more entries in F900BT registry related to GPS:

 

[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\GPS]
"AdcRange"="2.5"
"AdcBitNum"=dword:0000000c
"AccZNoiseLevel"="0.01"
"AccYNoiseLevel"="0.01"
"AccXNoiseLevel"="0.01"
"AccZScaleThre"="0.0701"
"AccYScaleThre"="0.0701"
"AccXScaleThre"="0.0701"
"AccZScale"="0.6"
"AccYScale"="0.6"
"AccXScale"="0.6"
"AccZZeroOffsetThre"="0.1860"
"AccYZeroOffsetThre"="0.1571"
"AccXZeroOffsetThre"="0.1571"
"AccZZeroOffset"="1.5"
"AccYZeroOffset"="1.5"
"AccXZeroOffset"="1.5"
"GyroZNoiseLevel"="720.0"
"GyroYNoiseLevel"="720.0"
"GyroXNoiseLevel"="720.0"
"GyroZScaleThre"="0.1269"
"GyroYScaleThre"="0.1269"
"GyroXScaleThre"="0.1269"
"GyroZScale"="2.5"
"GyroYScale"="2.5"
"GyroXScale"="2.5"
"GyroZZeroOffsetThre"="0.022"
"GyroYZeroOffsetThre"="0.022"
"GyroXZeroOffsetThre"="0.022"
"GyroZZeroOffset"="1.35"
"GyroYZeroOffset"="1.35"
"GyroXZeroOffset"="1.35"
"MisalignDriftRate"="0.00167"
"InitMisalignYawStd"="5.0"
"InitMisalignPitchStd"="5.0"
"InitMisalignRollStd"="5.0"
"InitMisalignYaw"="0.0"
"InitMisalignPitch"="0.0"
"InitMisalignRoll"="0.0"
"MisalignEstimationMask"=dword:00000002
"MisalignChangeDetectionMask"=dword:00000000
"OdoScaleDriftRate"="0.00003"
"InitOdoScaleStd"="0.0"
"InitOdoScale"="0.0"
"OdoVelStd"="0.1"
"OdoDirectionType"=dword:00000001
"OdoEnable"=dword:00000001
"NonHoloVelStd"="0.1"
"NonHoloEnable"=dword:00000001
"ZuptYawStd"="1.0"
"ZuptVelStd"="0.01"
"ZuptEnable"=dword:00000001
"GpsVelStdScaleUp"="1.0"
"GpsPosStdScaleUp"="1.0"
"AccZVelocityRandWalk"="0.11"
"AccYVelocityRandWalk"="0.11"
"AccXVelocityRandWalk"="0.11"
"AccScaleCorrTime"="3600.0"
"AccZScaleInstability"="0.005"
"AccYScaleInstability"="0.005"
"AccXScaleInstability"="0.005"
"AccBiasCorrTime"="3600.0"
"AccZBiasInstability"="0.05"
"AccYBiasInstability"="0.05"
"AccXBiasInstability"="0.05"
"GyroZAngularRandWalk"="3.0"
"GyroYAngularRandWalk"="6.0"
"GyroXAngularRandWalk"="6.0"
"GyroScaleCorrTime"="3600.0"
"GryoZScaleInstability"="0.005"
"GryoYScaleInstability"="0.0"
"GryoXScaleInstability"="0.0"
"GyroBiasCorrTime"="3600.0"
"GryoZBiasInstability"="100.0"
"GryoYBiasInstability"="0.0"
"GryoXBiasInstability"="0.0"
"DR_CALIBRATION_FILEPATH"="/My Flash Disk/Calibration.bin"
"DR_PROCESS_RATE"="5.0"
"DR_SAMPLE_RATE"="100.0"
"DR_MODEL"=dword:00000002
"DR_OUTPUT_DEBUGFILE"=dword:00000000
"DR_OUTPUT_SEL"=dword:00000000
"DR_TIME_OUT_WITH_ODOMETER"=dword:00000000
"DR_TIME_OUT"=dword:0000012c
"DR_ENABLE"=dword:00000001
"SynEphAvailable"=dword:00000000
"GPSEnableSpgod"=dword:00000000
"IClass"="{A32942B7-920C-486b-B0E6-92A702A99B35}"
"MC_EveryStartUpdateTime"=dword:00000001
"MC_ColdStartUIApp"="\\Windows\\ColdStartUI.exe"
"MC_StartupPlugin"="\\ResidentFlash\\StartupPlugin.dll"
"MC_EnableGpsAutoRun"=dword:00000001
"SMLongSniffNM"=dword:00001c20
"SMSleepTime_S2NM"=dword:00000708
"SMRunTimeout_S2NM"=dword:00000001
"SMSleepTimeNM"=dword:00000258
"SMRunTimeoutNM"=dword:00000001
"SMNightEtime"=dword:00000006
"SMNightStime"=dword:00000016
"SMNightModeEnable"=dword:00000001
"SMS3CON"=dword:00000048
"SMS2CON"=dword:00000012
"SMLongSniff"=dword:00001c20
"SMSleepTime_S2"=dword:00000258
"SMRunTimeout_S2"=dword:00000001
"SMSleepTime"=dword:00000258
"SMRunTimeout"=dword:00000001
"SMEnable"=dword:00000000
"SJ_EPH_FW_N"=dword:00000258
"SJ_EPH_FW"=dword:00000258
"SJ_EPH_FAIR"=dword:00001c20
"SJ_EPH_GOOD"=dword:00001c20
"SJRunTimeout"=dword:000000f0
"SJSleepTime"=dword:00000258
"SJEnable"=dword:00000000
"BackgroundLogFolder"="SDMMC"
"BackgroundLogDataEnable"=dword:00000000
"FrozenQCEnable"=dword:00000001
"HalfPpmTcxo"=dword:00000001
"TimeoutStoreParam"=dword:0000012c
"SpgodPrioritySJ"=dword:000000ff
"UseInertial"=dword:00000000
"EhFrozenLon"=dword:0003619f
"EhFrozenLat"=dword:0001001e
"FrozenLon"=dword:00000000
"FrozenLat"=dword:00000000
"Order"=dword:00000002
"Index"=dword:00000007
"Dll"="GPS.Dll"
"ParamFolder"="My Flash Disk"
"Prefix"="COM"

Its the most similar GPS registry from this registry pack Five last values almost the same as on my F30. I will try to add that registry to my F30 and test with gps port..

 

ok, so after reading through this thread, it seems like you can use the 'HACKMODE' to upgrade the z120bt to z130bt?

 

Here is my question:

I upgraded my z110 unit to the z120 software. If I were to want to upgrade to z130 from where I am now, would I just use the Condi HACKMODE: download all 3 versions of the file and 'upgrade' it accordingly, then just plug it into my unit & go through the motions?

Hmm.. You could try to replace your units software, without installing hackmode. You can run pioneers testmode, make backup of your USER/PRG0 & PRG1, get copy of PRG0 from z130 unit, delete PRG0 from your unit and copy z130's PRG0 Its only an idea, theory, I can't say if it works or not. You can test it. Of course at your own risk

 

 

-----edit:

I attach GPS registry from F900bt - correctly formated in MortScript - ready to be writed/modified - if somebody want to try make something with it

gps-reg-from-F900bt.zip

[PatrickFernandes]

I run CEProcessV into my unit and into emulator and compared the results. We can see service.exe isn´t running in the unit, while it runs into the emulator. Using this same prgram I killed the process of explorer.exe of the emulator and tried to kill service.exe, the latter didn´t happen. The emulator started to work as the unit, the links wouldn´t open. I also edited a shortcut to explorer.exe and when the file isn´t available there´s an error message. So I assume

explorer.exe exisits in our unit, the only problem is that it doesn´t start. As for service.exe I will try to copy it from the emulator to SD card and run it into the unit.

 

Does anybody know where this file is and how can I copy it, because I can only see some folders and files. How can I show all files?

 

 

Condi, I would like you to make service.exe start into your script Maybe that´s the reason why IGo isn´t working.

[condiczek]

I run CEProcessV into my unit and into emulator and compared the results. We can see service.exe isn´t running in the unit, while it runs into the emulator. Using this same prgram I killed the process of explorer.exe of the emulator and tried to kill service.exe, the latter didn´t happen. The emulator started to work as the unit, the links wouldn´t open. I also edited a shortcut to explorer.exe and when the file isn´t available there´s an error message. So I assume

explorer.exe exisits in our unit, the only problem is that it doesn´t start. As for service.exe I will try to copy it from the emulator to SD card and run it into the unit.

 

Does anybody know where this file is and how can I copy it, because I can only see some folders and files. How can I show all files?

 

 

Condi, I would like you to make service.exe start into your script Maybe that´s the reason why IGo isn´t working.

 

I think its not related to services..

http://msdn.microsoft.com/en-us/library/ms884674.aspx

http://msdn.microsoft.com/en-us/library/aa450223.aspx

maybe Im wrong?

[Ralpharn]

One question - which one of that units are hackable (with available gps port, windows ce working etc.)?

F900BT hackable and it runs IGo as official navigation software.

[PatrickFernandes]

I think its not related to services..

http://msdn.microsoft.com/en-us/library/ms884674.aspx

http://msdn.microsoft.com/en-us/library/aa450223.aspx

maybe Im wrong?

 

did u try something? i could found services.exe to try into avic

i read the 2 links, if i understand correctly services.exe have a link with devices functions, maybe its make the middle betwen this things ( hardware devices , drivers , software )Some software dont need this (can direct call devices) ,but some need.

 

if im wrong, im sorry , but my english is so fu*k bad !! heheheheh

Can u Add this to registry( Look in Picture)

[condiczek]

F900BT hackable and it runs IGo as official navigation software.

Did I correctly noticed that F900BT is based on WinCE 4.2 (not 5.0?)

 

did u try something? i could found services.exe to try into avic

i read the 2 links, if i understand correctly services.exe have a link with devices functions, maybe its make the middle betwen this things ( hardware devices , drivers , software )Some software dont need this (can direct call devices) ,but some need.

 

if im wrong, im sorry , but my english is so fu*k bad !! heheheheh

Can u Add this to registry( Look in Picture)

Yes we can add registry to init section, but it would work if registry would stay after reboot. 'init' is already used when you have your unit on, it would 'take' changes after reboot, but registry is resetting. Your english is not so bad, my english is also not 'correct' in many places

 

Today I tried to point other main dll's like coredll an ceshell, in explorer.exe, to get it work. One step futher - windows explorer shows now oeminfo-version of windows ce on the desktop (related to that dlls) one step to working wince! Digging..

[PatrickFernandes]

Did I correctly noticed that F900BT is based on WinCE 4.2 (not 5.0?)

 

 

Yes we can add registry to init section, but it would work if registry would stay after reboot. 'init' is already used when you have your unit on, it would 'take' changes after reboot, but registry is resetting. Your english is not so bad, my english is also not 'correct' in many places

 

Today I tried to point other main dll's like coredll an ceshell, in explorer.exe, to get it work. One step futher - windows explorer shows now oeminfo-version of windows ce on the desktop (related to that dlls) one step to working wince! Digging..

 

Nice,

if i get a registry backup of a fully working windows can u overwrite our registry on the fly?i tried put .reg and run into my device and no luck,

 

i tried run GPSMC.EXE from dump of my z120 into emulator, in debug windows i see the system try find gps on com 7 .

i tried too o lot of Process killer and task managers to kill pioneer´s Shit , but no luck too

i open testmode.exe into Ida pro disassembler and see lot of references to process NEventWatcher. a procedure check for NEventWatcher running. i wanna kill NEventWatcher and see what this do!

[Thevil1]

MicroSD has no lock.

 

 

I'm currently trying to use a Sandisk 8GB micro sd card in an SD card adapter, it does have a lock but I've made sure it is not locked. I have a 2GB card and same issue. I will try to reformat the card and reload Condi's Hackmode on to it. Will try this later today.

[Thevil1]

Like others have mentioned... start a new thread...

Let's try to figure this one out... so far you're the only one, but it would be great to know why....

 

That is... if you're willing to stick in there till we get a hold of what's going on...

 

Thanks

 

 

I'll stick it out, and start a new thread as suggested. tested the SD card with service mode. Z120 failed to write to SD cards each time. This will have to wait.