Jump to content
AVIC411.com

Condi's HACKMODE v2.2 - AUTOINSTALL! working also with F40BT, X940BT etc! [updated: 27.09.2012]


Recommended Posts

Hey Condi thanks for the update!

Windows boots from an image as i see it, editing stuff in it will not have any effect after restart as it loads windows from that image again. I've written what image file I think it is in my previous post. Unfortunately I haven't managed to decompress it. Damn Windows Automotive 5.5 Basic :)

 

--Update--

I managed to decompress the image file with the windows ROM: EU090PLT.PRG with NK.BIN toolset. HOWEVER, before you can use the tools you have to delete the custom header from the file:

ĄZZĄ ÚlŇ‚Ňq         EU090PLT˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙B000FF

The file must start with B000FF so delete the above header until B000FF.

After that use the NK.BIN toolset:

to dump the content of a nk.bin:

 

1) viewbin.exe nk.bin

 

write down start and length

 

2) cvrtbin -r -a START -w 32 -l LENGTH nk.bin

 

this command converts the nk.bin to a nk.nb0 (START and LENGTH from the command bevor)

 

3) dumprom.exe -d dump -v -5 nk.nb0

 

the content of the nk.bin will be written in the directory "dump". It must exists, otherwise an error occurs.

 

I'm not sure if a repacked version of the image file will work, because the bootloader knows the size of the rom, and I don't think it will like a different sized one, also it's a little risky because TestMode might not work afterwards. If anyone has any experience with these, please feel free to share your knowledge :)

 

EDIT - USE dumpromx instead. See newer post!

Nkbintools.zip

Link to post
Share on other sites
  • Replies 1.2k
  • Created
  • Last Reply

Top Posters In This Topic

Hey Condi thanks for the update!

Windows boots from an image as i see it, editing stuff in it will not have any effect after restart as it loads windows from that image again. I've written what image file I think it is in my previous post. Unfortunately I haven't managed to decompress it. Damn Windows Automotive 5.5 Basic :)

 

--Update--

I managed to decompress the image file with the windows ROM: EU090PLT.PRG with NK.BIN toolset. HOWEVER, before you can use the tools you have to delete the custom header from the file:

ĄZZĄ ÚlŇ‚Ňq         EU090PLT˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙B000FF

The file must start with B000FF so delete the above header until B000FF.

After that use the NK.BIN toolset:

 

 

I'm not sure if a repacked version of the image file will work, because the bootloader knows the size of the rom, and I don't think it will like a different sized one, also it's a little risky because TestMode might not work afterwards. If anyone has any experience with these, please feel free to share your knowledge :)

 

I've attached the files from my dump. Passw is "avic411".

 

Hey man,

Great Job

 

Now we need try emulate nk.bin , compare with a full system , merge both

remove this dummy user and any autostart file. Then revert into EU090PLT.PRG

and test in unit!

 

Or Simply Download a Full CE.bin from Ms Download insert the header of EU090PLT.PRG and run in unit!

 

i will try this here but my car is far , becouse im not at home!

 

Good Luck

Let´s Hack!!

Link to post
Share on other sites

I have a problem. I followed the instructions, but now when I boot, I get the following loop: "Program update failed. Restarting".

 

Details:

Avic Z110BT upgraded to Z120BT (paid Pioneer update)

 

Downloaded v1.0 and extracted to root of SD.

Insert SD in Z110 and started auto started testmode.

Copy/Pasted USER and have the backup saved on PC.

My PRG0 and PRG1 were different, so I deleted PR1 from AVIC and copied PRG0 files to PRG1.

Deleted USER/PRG0/apl/Av.exe from z110.

Copied all files from SD/CONDIHACK (v1) to USER/PRG0/apl

Exited File Maintenance.

Turn off unit, and Turn on Unit.

Get "System update failed, restarting" loop.

Remove all SD from Z110, Get "Program Update Started, Program update failed, restarting" loop.

Insert Service Test Mode SD, Get "Program Update Started, Program update failed, restarting" loop.

Insert Condihack SD, Get "Program Update Started, Program update failed, restarting" loop.

Insert Pioneer's CNSD-110FM SD, Get "Program Update Started, Program update failed, restarting" loop.

Remove all SD from Z110, Get "Program Update Started, Program update failed, restarting" loop.

 

Got a brick on my hands... Any suggestions?

Link to post
Share on other sites

@garrettoomey - Try getting into test mode without sd card: turn on ignition, keep home button pressed and press previous, next, previous, next and so on while keeping home button pressed until the unit restarts, it should enter testmode now. Hope it works!

Link to post
Share on other sites

@garrettoomey - Try getting into test mode without sd card: turn on ignition, keep home button pressed and press previous, next, previous, next and so on while keeping home button pressed until the unit restarts, it should enter testmode now. Hope it works!

 

That worked! I was able to restore PRG0 and PRG1 with the backup files. It now boots stock again. Now I will try to figure out what went wrong...

Thank you for the quick response and help!

Link to post
Share on other sites

That worked! I was able to restore PRG0 and PRG1 with the backup files. It now boots stock again. Now I will try to figure out what went wrong...

Thank you for the quick response and help!

 

Ohh thats good news :)

Thats why backup is so important ;)..

Even if you had brick, now we know that you can easy get it back to work :)

Try again to install hackmode, try again without replacing PRG1 with PRG0!

Maybe stock genuine pioneer update doesnt need to replace PRG1, maybe only cracked update!

Figure out what went wrong with your unit, and post your thoughts!

Link to post
Share on other sites

Ohh thats good news :)

Thats why backup is so important ;)..

Even if you had brick, now we know that you can easy get it back to work :)

Try again to install hackmode, try again without replacing PRG1 with PRG0!

Maybe stock genuine pioneer update doesnt need to replace PRG1, maybe only cracked update!

Figure out what went wrong with your unit, and post your thoughts!

 

When i delete pr1 and copy pr0 to pr1 folder i notice there 2 pages of files into pr0 folder when u select all files , it select only first page files, not second page, u need copy all and go to second page and copy the rest of files. look that maybe can be your problem.

 

my unit is a z110bt updated to z120.

Link to post
Share on other sites

Hey Condi thanks for the update!

Windows boots from an image as i see it, editing stuff in it will not have any effect after restart as it loads windows from that image again. I've written what image file I think it is in my previous post. Unfortunately I haven't managed to decompress it. Damn Windows Automotive 5.5 Basic :)

 

--Update--

I managed to decompress the image file with the windows ROM: EU090PLT.PRG with NK.BIN toolset. HOWEVER, before you can use the tools you have to delete the custom header from the file:

ĄZZĄ ÚlŇ‚Ňq         EU090PLT˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙B000FF

The file must start with B000FF so delete the above header until B000FF.

After that use the NK.BIN toolset:

 

 

I'm not sure if a repacked version of the image file will work, because the bootloader knows the size of the rom, and I don't think it will like a different sized one, also it's a little risky because TestMode might not work afterwards. If anyone has any experience with these, please feel free to share your knowledge :)

 

I've attached the files from my dump. Passw is "avic411".

 

Great work! I will see what we can do with this later when i get back home! We've got good progress :)

 

Can you please post it here?

 

BTW Gps build on SiRF chip. (GRF3i-0336S)

 

Yes no problem, later this day. We are getting closer to working gps :)

 

When i delete pr1 and copy pr0 to pr1 folder i notice there 2 pages of files into pr0 folder when u select all files , it select only first page files, not second page, u need copy all and go to second page and copy the rest of files. look that maybe can be your problem.

 

my unit is a z110bt updated to z120.

 

Thats very propably! Let see what garrettoomey will say :)

Link to post
Share on other sites

That worked! I was able to restore PRG0 and PRG1 with the backup files. It now boots stock again. Now I will try to figure out what went wrong...

Thank you for the quick response and help!

 

Glad I could help out man! Hope this will not stop you from helping out in hacking these units ;)

Link to post
Share on other sites

Can anyone that is successfully using the hack (installed to PRG0) let me know if they have a file on their AVIC: USER/PRG.FLG

I can not get to hacked mode if I install to PRG0, it just boots normal. This is the same with and without copying PRG0 files to PRG1. I believe Pioneer is using another dummy/blank file called PRG.FLG to determine the current working PRG folder (0 or 1)... One would be current working, and the other would be the previous software version.

 

I am going to install CONDIHACK on PRG1 and see what happens.

Link to post
Share on other sites

Can anyone that is successfully using the hack (installed to PRG0) let me know if they have a file on their AVIC: USER/PRG.FLG

I can not get to hacked mode if I install to PRG0, it just boots normal. This is the same with and without copying PRG0 files to PRG1. I believe Pioneer is using another dummy/blank file called PRG.FLG to determine the current working PRG folder (0 or 1)... One would be current working, and the other would be the previous software version.

 

I am going to install CONDIHACK on PRG1 and see what happens.

I installed CONDIHACK on PRG1, and after the restart, it goes into an upgrade progress as I believe it is supposed to do. After it restarts, it hangs on the boot background. I assume this is because CONDI scripts are hard coded to look in PGR0, and my hacks are in PRG1.

 

This would also explain the problem that emerson.jared was having. He installed hacks on PRG0 (as instructed), yet it will only boot normal (not hacked mode). I would assume he has the PRG.FLG flag and is acutally booting from PRG1...

 

I am now going to move all files from PRG0 to PRG1 and all files from PRG1 to PRG0, then delete PRG.FLG. I think this will make the CONDIHACK work. I will update again shortly...

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...



×
×
  • Create New...