Condi's HACKMODE v2.2 - AUTOINSTALL! working also with F40BT, X940BT etc! [updated: 27.09.2012]

[rayn]

No offence taken and im cool. It's just the matter of taking a generalized question and turning it technical. The handbrake ground is certainly not the issue. Its got the bypass applied and yes I can watch movies it a 130bt. Its not options being grey'd out. They are available but just wont execute

[ThumperPup]

Any news on Web Browsing Via BT from mobile phone ?

[Ralpharn]

Its not options being grey'd out. They are available but just wont execute

Can you please explain it further what particular function is not working, I can check it on my X930BT and if it is afterhack issue- we will try to resolve it.

[rayn]

Sorry not going to retype everything I already said

[odskaggs2]

SInce my x930bt is broken I decided to look over the hardware. I confirmed it has a sirfprima tt442 chip.

Maybe these files will help the developers

SiRFSoCMgr_v6.1.5.rar

PRDM-0028-A4_HowToRepairHW_Nboot.pdf.rar

[Ralpharn]

Sorry not going to retype everything I already said

I've checked my X930BT with V1.4 of hackmode - it starts to play from same source and same spot where it was shut off (i've used SD and DVD full of mp3s.

I suggest you to put everything back from your backup and check it, then put v1.4 hack again- and check it again.

[Ralpharn]

SInce my x930bt is broken I decided to look over the hardware. I confirmed it has a sirfprima tt442 chip.

Maybe these files will help the developers

If you have it open- can you please take few good pictures of circuit boards from your unit?

[odskaggs2]

Sure I can. What would circuits you like a picture of?

[odskaggs2]

Okay I've attached pictures of the sirf chip and of a spansion nor flash chip.

[odskaggs2]

Those pics are off a x930bt. I've been looking at the copies of sirfflash and sirfsocmgr that I have. Neither one supports the spansion model in the x930bt but it looks easy to add from the sirfflash manual.

 

To support additional flash types:

1. Obtain the device code (ID), manufacturer code (ID), capacity, and sector map

information for the intended flash type. This information is typically available from

the flash data sheet.

2. Using a text editor, open the CHIPLIST.TXT file.

3. Using the same format that is already in the file, add the device name, manufacturer

name, device code, manufacturer code, capacity and sector map information, and

the driver file name at the bottom of the existing list.

The driver file name must be GENERIC.BIN.

4. Follow the steps detailed in “Downloading Software using SiRFflash” on page 5-1.

[Melvin v/d berg]

Hi guys,

 

I'm currently also looking for a solution to mod the PRG files without the risk of bricking. The coredll.dll has to be changed

I bought a f930bt and when i came home I discovered that it was locked with a password. The first thing I did was dumping the following chip:

 

EEPROM

IC1303

S-93C56BD0I-I8

The dump is in the attachment. Maybe it could be usefull. It was an huge challenge to solder to that SMD chip.

After a search I found that I could retreive the password in testmode->file manager. So that problem is gone.

 

Now on the CC monitor unit PCB there is a jtag connector (CN4621). This has the following pinout:

 

1 TMS

2 TDI

3 TDO

4 TCK

5 GNDD

6 ?

7 NTRST (P-NTRST)

8 P-TDI

9 P-TMS

10 P-TCK

11 RTCK (P-RTCK)

12 P-TDO

13 NSRST (P-NSRST)

14 TEST4 (TESTMODE4)

15 JTGRST (JTG_RST)

 

Everything with a P- for it is from the CPU (tt4421).

An interresting thing is the TESTMODE4 pin. Maybe this is just to enter test mode I don't know.

 

If you have a look at http://forum.gps-club.ru/index.php?showtopic=19265 and translate it you will notice that they connect a gps with a simulair cpu to usb.

I found out that the tt4421 cpu has a usb OTG. This means that we can connect it to a computer instead of an peripheral device. This could be a way to flash/restore the nand.

I don't think pioneer will open an avic when it is bricked. There is a way without opening it.

On the russian page you will read that they connect it with a kind of usb to rs232 cable. On PRDM-0028-A4_HowToRepairHW_Nboot.pdf (russian page) I see for beeing able to choose something from the nboot debug message log you need to hold the power and reset buttons. We need to find a way to choose the option 8 so we can start SIRFSoCMgr and dump and update the NK Image.

You can also update the nboot and eboot from this.

 

If all that could not work than we have to look at the JTAG connector. This has TDI, TMS, TCK, TDO, NSRST, NTRST and JTGRST.

eepromdump.zip

[odskaggs2]

So I see the cn4001 pads on the board. According to the sirfprima developer manual the chip has builtin usb transceiver/controller. I wonder if I can connect usb directly to cn4001 ? Sirfsocmgr and sirfflash both have usb options. Now I need to practice soldering surface mount .5mm ribbon connectors.

[Melvin v/d berg]

I think you should connect the normal external usb connector (the cable that also has the audio jack input) to your computer. This usb connector is the USB1 controller on the tt4421 chip. This controller has a normal pin assignment (positive and negative data pins). See page 261 on the developer manual.

The cn4001 pads is the USB0 controller. This usb0 controller has ULPI interface to connect. I don't know what it is exactly but is has a totally different pin assignment. (see page 232 on the developer manual).

developer manual: http://www.4shared.com/get/ARDbpkFH/CSM-00364_RevC_SiRFprima_Devel.html

[Ralpharn]

Sure I can. What would circuits you like a picture of?

Just good pictures of entire circuit boards, where letters on chips are readable.

[FourG]

ULPI is an industry standard interface for a chip to connect to an external USB PHY (the part of a chip that handles sending and receiving the bits over the cable). You'd have to build some sort of circuit with a transceiver chip, a USB connector and whatever other support circuits to provide required power/config to the transceiver to connect your stuff to USB0. Example: http://www.slscorp.com/products/santacruz-snap-on-board/usb-20-ulpi.html

 

The cn4001 pads is the USB0 controller. This usb0 controller has ULPI interface to connect. I don't know what it is exactly but is has a totally different pin assignment. (see page 232 on the developer manual).

developer manual: http://www.4shared.c...rima_Devel.html