Condi's HACKMODE v2.2 - AUTOINSTALL! working also with F40BT, X940BT etc! [updated: 27.09.2012]

[abb1]

It's in the early stages. Condi is able to run iGo nav software but hasn't been able to tap into the GPS port.

I am confused? What is the Nav software running in these units? I thought that all Pioneer systems had iGo?

[condiczek]

Damn, so basically, nothing is really hacked for modification. . If all the UI is hardcoded into the Avic, which is what was initially assessed, and I guess now proven, as we still cannot get into this interface for modding purposes, what is the purpose of this hack?

 

The purpose of hack is to get that and other abilities! All the hacks were done from the beggining?

Please stop posting such useless statements, if nothing is possible, then just lets sell all our avic devices, and close hack/mods section.

 

As I wrote in first post: "HACKMODE is entrance to further developing". Treat it that way.

If somebody has something useful to say, than please do it.

Every clue, help, willingness of developing is welcome.

 

I am confused? What is the Nav software running in these units? I thought that all Pioneer systems had iGo?

In newer units there is no iGO software. Its based on TeleAtlas maps, nothing is left from iGO, no content/maps etc.

The maps are in totally different format. We can run other gps software, but we can't get gps port to work.

[abb1]

Please stop posting such useless statements, if nothing is possible, then just lets sell all our avic devices, and close hack/mods section.

 

Sorry, obviously, I offended you! I did not mean to do that! I just wanted a quick rundown on what this was now cabable of doing. Nothing we are doing here is useless, but a means to get to a certain direction. I was just seeing how far we have gotten without reading 13 pages which I do not have time for. I will not post here any more in this thread! Sorry

[Krms]

I am confused? What is the Nav software running in these units? I thought that all Pioneer systems had iGo?

 

Hold on a bit Abb1, we went from having nothing to having a potential backdoor into the our "unhackable" Avics. Using Condi's work we are hoping someone or even a collected few will be able to access the GPS port and/or run WinCE Explorer to it's full potential.

 

Getting to Testmode is one thing, running IGO, Explorer and File manager is a hack.

[condiczek]

I'm trying to do something with registry, made script to add some values to HKLM\Drivers\BuiltIn\GPS like:

 

RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "Prefix", "COM")
RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "ParamFolder", "data")
RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "Dll", "GPS.Dll")
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "Index", 7)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "Order", 2)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel0", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel1", 0)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel2", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel3", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel4", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel5", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel6", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "NmeaSel7", 0)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "FrozenLat", 0)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "FrozenLon", 0)
RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "TcxoXoPpmSetting", "0.5")
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "BackgroundLogDataEnable", 0)
RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "BackgroundLogFolder", "SDMMC")
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "CurGpsWeekRollerNum", 1)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "DefaultGpsWeekNo", 469)
RegWriteDWord("HKLM", "Drivers\BuiltIn\GPS", "CCMFlag", 0)
RegWriteString("HKLM", "Drivers\BuiltIn\GPS", "IClass", "{A32942B7-920C-486b-B0E6-92A702A99B35}")

 

Comparing with other gps there is no IClass and other values, but after adding, I still cant get gps working..

I don't know if the changes are working without reboot, but we can't reboot - reseting registry..

I don't know what exactly parameters would be correct, also we have gps related entries here:

[HKEY_LOCAL_MACHINE\Drivers\Launch\GPS]
"Prefix"="COM"
"Dll"="GPS.Dll"
"Index"=dword:00000007
"Order"=dword:00000002

There is GPS.dll and GpsTmc.dll in rom \windows\, maybe easy method with replacing GpsTmc in iGO with GpsTmc from rom would work?

Havent tried that, but even if yes - then its not good solution, we have to get gps work in all the apps!

Maybe we should point it out to other GPS.dll than that in rom? Via change value in "Dll" entry? Ahh..

 

I've also made some scripts to add missing registry entrante related to shell/explorer etc.:

 

RegWriteString("HKLM", "Explorer\RunHistory", "", "")
RegWriteString("HKLM", "Services\NOTIFY", "Dll", "NOTIFY.Dll")
RegWriteString("HKLM", "Services\NOTIFY", "Prefix", "NFY")
RegWriteDWord("HKLM", "Services\NOTIFY", "Index", 0)
RegWriteDWord("HKLM", "Services\NOTIFY", "Keep", 1)
RegWriteDWord("HKLM", "Services\NOTIFY", "Order", 0)
RegWriteString("HKLM", "System\Events", "system/events/notify/APIReady", "Notifications API set ready")
RegWriteString("HKLM", "System\Events", "SYSTEM/GweApiSetReady", "Event triggered after GWES registers its API sets")
RegWriteString("HKLM", "System\Events", "SYSTEM/ShellAPIReady", "Shell APIs")

And after that copy some explorer.exe, dlls, but still cant get fully working - window instantly disappears after run.

It looks like there is lack of some resources/libraries/registry, or maybe some process instantly kill new windows/processes.

Applications which are not running are concerned in some notifications/popup windows - all of them not work.

Even MortScript is not fully working - I cant make 'message' script, or 'Choice' menu script. Limited funcionality.

Tried few versions of explorer.exe, still no luck.

 

I've also tried to point some other ceshell.dll, if we couldn't overwrite it in \windows\ directory, registry like:

RegWriteString("HKCR", "CLSID\{00021400-0000-0000-C000-000000000046}\InprocServer32", "", "\SDMMC\WinCE\ceshell.dll")
RegWriteString("HKCR", "CLSID\{000214A0-0000-0000-C000-000000000046}", "DefaultIcon", "\SDMMC\WinCE\ceshell.dll,-4354")
RegWriteString("HKCR", "CLSID\{000214A0-0000-0000-C000-000000000046}\InprocServer32", "", "\SDMMC\WinCE\ceshell.dll")
RegWriteString("HKCR", "CLSID\{000214A1-0000-0000-C000-000000000046}", "DefaultIcon", "\SDMMC\WinCE\ceshell.dll,-4352")
RegWriteString("HKCR", "CLSID\{000214A1-0000-0000-C000-000000000046}", "AltIcon", "\SDMMC\HURA\ceshell.dll,-4355")
RegWriteString("HKCR", "CLSID\{000214A1-0000-0000-C000-000000000046}\InprocServer32", "", "\SDMMC\WinCE\ceshell.dll")
RegWriteString("HKCR", "CLSID\{000214A2-0000-0000-C000-000000000046}\InprocServer32", "", "\SDMMC\WinCE\ceshell.dll")
RegWriteString("HKCR", "CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InprocServer32", "", "\SDMMC\WinCE\ceshell.dll")

 

Again, no luck. I begin to think that to achieve the target we will have to change Gwes.exe, NK.exe, kill AstProc.exe or other,

in rom related thing. Keep on searching for the solution..

 

Anyone have full registry backup from other/older unit with working gps/windows of pioneer?

[Ralpharn]

I'm trying to do something with registry...

what tool are you using for edit registry?

[condiczek]

what tool are you using for edit registry?

Just MortScript example in attachment, just edit .mscr as you wish.

There are some Strings and DWords in it.

Run RegModify.exe script to modify it, then you can check if its modified via RegEdit.exe.

None of reg editors worked for me to change values or import .reg files.

Only MortScript

RegModify.zip

[Tudor Z]

Good news!

I finally managed to extract all files from bin, and the executables are working.

The tool I found to work was dumpromx. All you have to do is use dumpromx instead of dumprom (the command line arguments are the same). The rest of the steps are the same. dumpromx can also be used to change files in the bin aparently, but I haven't gotten to that just yet.

[PatrickFernandes]

Good news!

I finally managed to extract all files from bin, and the executables are working.

The tool I found to work was dumpromx. All you have to do is use dumpromx instead of dumprom (the command line arguments are the same). The rest of the steps are the same. dumpromx can also be used to change files in the bin aparently, but I haven't gotten to that just yet.

 

 

Yheeaaa,, great job man!

i search for dumpromx and found that http://avic411.com/index.php?/topic/31170-modify-base-os/

 

did u try run the bin into MS device emulator???

i will try later!

[VBLUE42]

Ok everyone lets slow down a minute with the comments back and forth with each other. Always remember that what is written cant always be interpreted as it would be verbally. Also Condi, Abb is probably one of the most valuable members on this forum and would likely be an asset to you. Abb1 is the biggest developer of hacks and mods of the F/X series units on this forum and I believe could share great knowledge at some point once the efforts here progress and I personally directed him/her to this thread in the first few days of your accomplishments. And Abb, the GPS software in the Z series is some in house garbage that Pioneer likely developed themselves and leaves a lot to be desired. Always remember that sometimes baby steps are needed before the marathon is accomplished. Even you have said you would get a Z if it could be hacked. Lets all work together here and see where this goes. These units are crippled in so many ways and are begging to be opened up to run with their true potential and working together is the way to do it.

[Tudor Z]

Couldn't get it to work in device emulator, but I'm probably missing something. But I have a few ideas so I will keep on digging

[condiczek]

Good news!

I finally managed to extract all files from bin, and the executables are working.

The tool I found to work was dumpromx. All you have to do is use dumpromx instead of dumprom (the command line arguments are the same). The rest of the steps are the same. dumpromx can also be used to change files in the bin aparently, but I haven't gotten to that just yet.

GREAT NEWS! We've got a new starting point! It gives us many new possibilites, that is the thing, that we were waiting for last few days

 

Ok everyone lets slow down a minute with the comments back and forth with each other. Always remember that what is written cant always be interpreted as it would be verbally. Also Condi, Abb is probably one of the most valuable members on this forum and would likely be an asset to you. Abb1 is the biggest developer of hacks and mods of the F/X series units on this forum and I believe could share great knowledge at some point once the efforts here progress and I personally directed him/her to this thread in the first few days of your accomplishments. And Abb, the GPS software in the Z series is some in house garbage that Pioneer likely developed themselves and leaves a lot to be desired. Always remember that sometimes baby steps are needed before the marathon is accomplished. Even you have said you would get a Z if it could be hacked. Lets all work together here and see where this goes. These units are crippled in so many ways and are begging to be opened up to run with their true potential and working together is the way to do it.

 

I'm sorry guys, I had bad day, and Abb1 - I overinterpreted your words! We are in the same team

[condiczek]

Found some romtools with 'dumpromx' version 1.07 (till now we had 1.06), and also 'dumpromy'? (for repack?). It might be usefull, for extract, modify/replace, repack.

Also example .bat files with commands are in it.

ROMTOOLS.zip

[Thevil1]

Are you by chance on a Mac when you create the folder? What permissions are on that folder?

The only time it won't let me copy/paste, is if I'm trying to copy a system file from one directory of the Avic, to another.... But if I copy it first to a SD card, I'm then able to copy it back to a system directory...

Can you copy and paste any other random file to and from? Have you tried to just copy a single file?

 

Allot of this is still new to me, so forgive me for my questions... Just figure the more we know the better...

 

 

On WIndows 7, PC. No permissions, all open and not write protected. I simply can not copy any file from the AVIC to the SD card. Going to try to use a smaller card 2G, if this doesn't work then I give up!

[yuri.staal]

On WIndows 7, PC. No permissions, all open and not write protected. I simply can not copy any file from the AVIC to the SD card. Going to try to use a smaller card 2G, if this doesn't work then I give up!

 

Simple question: do you have the little "lock" switch that's on most SD card set to the "on" position?