Condi's HACKMODE v2.2 - AUTOINSTALL! working also with F40BT, X940BT etc! [updated: 27.09.2012]

[theycallmeruffi]

Its times like these where it would be nice to know a pioneer engineer

So we can beat them up for developing horrible software

 

Thanks for the hardwork so far. Its much appreciated!

I'm going to try this on my x920 soon. I also dabble into SW dev (usually for servers) but im going to take a look at this.

[PatrickFernandes]

I cant attach files again, !!! Somebady can solve this,??? Vblue??? i make a Zip with a CE emulator in english, to share here!

[kttii]

Download Emulator at Attachments! Sorry i can´t attach this , there a error !

contact-me with PM and i send to you!

 

Just unzip and Click Run.bat

if u have a dump put it into My Dump folder and open in emulator

GPSMC.exe try open Com7 look at photo

 

 

Ah, I misunderstood you. The emulator you are referring to (Chuck88's AVIC Emulator for WinCE) uses an NK.bin from another system right (not z120bt)? I have been trying to load the .PRG files from my z120bt as bin (and even as .nb0) into the emulator.

[PatrickFernandes]

Ah, I misunderstood you. The emulator you are referring to (Chuck88's AVIC Emulator for WinCE) uses an NK.bin from another system right (not z120bt)? I have been trying to load the .PRG files from my z120bt as bin (and even as .nb0) into the emulator.

Right man, but the chuck88´s have a russian language, i change the file with another copy of CE and heve a english version!

tomorow i try post again! i try a lot run the original nk.bin from pioneer and nb0, but none work!

[Ralpharn]

About our mysterious unmonted partition:

I have it in separate file, but I have problem to upload it here.

so here a link to 4shared.

 

hidden partition files contain:

 

00000000-00100200-EU090RGD.bin (3rd copy of EU090RGD.PRG like in USER\PRG0(1)\PLATFORM)

00100200-03144600-EU090PLT.bin (3rd copy of windows image!!!)

03144600-03200000-EU092OPN.bin (welcome screen - 16 bit BMP without header)

03200000-03300200-EU090RGD.bin (4th copy of EU090RGD.PRG)

03300200-06344600-EU090PLT.bin (4th copy of windows image!!!!!!!!!!!!!!!!)

06344600-06400000-EU092OPN.bin (welcome screen - again!!!)

 

I have welcome screen customised so this welcome screen is exactly the one unit uses.

 

Bad thing we have no EU090BOT.PRG or/and configs of the unit.

May be it is another hidden patition somewhere?

Why this dump is less then entire 4GB chip volume?

Where is lost 143,130,624bytes?

ImDisk shows another unmounted patition at the end of the drive (check image before) Partition4! but it has 0 length. May be DiskRW didn't copied entire image...

[kttii]

Dumprom of:

 

EU090BOT.PRG > EU090BOT.bin > EU090BOT.nb0:

nk.exe

 

EU090RGD.PRG > EU090RGD.bin > EU090RGD.nb0:

AstProc.exe
nk.exe
coredll.dll
ceconfig.h
snapshot_secureos.dat

[condiczek]

How can i dump the maps? I can't enter in testmode or something similar...

 

@condiczek: Any ideas?

I'm sorry friend, no other ideas how to help you.. Check all the versions of testmode available in the internet,

check that 4shared collection, for our devices GGS1080 work, maybe other version will work for you!

 

Condi, where do we stand on finding out the process that is capturing that port?

All guys here are doing great job, we all are working to find the solution!

 

So we can beat them up for developing horrible software

 

Thanks for the hardwork so far. Its much appreciated!

I'm going to try this on my x920 soon. I also dabble into SW dev (usually for servers) but im going to take a look at this.

Everyone is welcome to help! All the work/research is appreciated

 

I've got read.img file from memory and using ImDisk Virtual Driver can mount them to my PC but

it shows 2 unmounted partitions, and if I mount any of them it says that drive is not formated.

Fat32 partitions can be mount as normal drives.

We do not know which port is our GPS antenna uses.

We do not know which module keeps this port occupied.

About our mysterious unmonted partition:

I have it in separate file, but I have problem to upload it here.

so here a link to 4shared.

 

hidden partition files contain:

 

00000000-00100200-EU090RGD.bin (3rd copy of EU090RGD.PRG like in USER\PRG0(1)\PLATFORM)

00100200-03144600-EU090PLT.bin (3rd copy of windows image!!!)

03144600-03200000-EU092OPN.bin (welcome screen - 16 bit BMP without header)

03200000-03300200-EU090RGD.bin (4th copy of EU090RGD.PRG)

03300200-06344600-EU090PLT.bin (4th copy of windows image!!!!!!!!!!!!!!!!)

06344600-06400000-EU092OPN.bin (welcome screen - again!!!)

 

I have welcome screen customised so this welcome screen is exactly the one unit uses.

 

Bad thing we have no EU090BOT.PRG or/and configs of the unit.

May be it is another hidden patition somewhere?

Why this dump is less then entire 4GB chip volume?

Where is lost 143,130,624bytes?

ImDisk shows another unmounted patition at the end of the drive (check image before) Partition4! but it has 0 length. May be DiskRW didn't copied entire image...

 

Im almost sure that gps port is com7!

GREAT work friend We are getting closer day by day!

If there is no EU090BOT.PRG bootloader, then maybe after getting corrupted EU090PLT.PRG, or even deleted - it should still be repairable, maybe even testmode working?

We can still look into /NAND/PRG0/BOOT/EU090BOT.PRG

About your list of partition content - .bin files are repeated, doubled, because of PRG0 and second PRG1 copy. One set of RGD+PLT+OPN in PRG0, and another one in PRG1. To get windows in full working condition we need to replace system resources, the most important is coredll.dll, commctrl.dll etc.

 

coredll.dll is in RGD part.

I've got another idea how to get fully working gps/audio etc.

RGD contains: AstProc.exe, nk.exe, coredll.dll, ceconfig.h and snapshot_secureos.dat.

We need to replace coredll.dll, and maybe edit ceconfig.h to get full working windows ce, and..

 

the main idea - make copy of AstProc.exe as AstProc1.exe, replace AstProc.exe with mortscript with some condition - for example: if hackmode.key exists on sd - then run explorer, else run AstProc1.exe. Similar as now with hackmode. We should take a look into AstProc.exe - maybe some IDA Pro analyze etc.

 

I will upload complete dumped AstProc.exe and NEventWatcher.exe (not corrupted/shortened like from dumpromx.exe) later, but now my sdcard-reader isnt working.

 

---edit:

attached interesting not corrupted - complete rom files like: coredll.dll (which is limited in our wince), NEventWatcher.exe, TestMode.exe, and device dlls NP....dll, NPCommonLib.dll, NEventBaseLib.dll etc.

romfiles.zip

[socci4]

I'm sorry friend, no other ideas how to help you.. Check all the versions of testmode available in the internet,

check that 4shared collection, for our devices GGS1080 work, maybe other version will work for you!

 

Thank you!

Nothing happens with the other files...

 

I downloaded F220 service manual and i found this:

 

How to Use Test Mode

Jig No : GGS1092

Startup procedures

1. Store the Test Mode folder on GGS1092 to the SD card root.

2. Download a ID file from the Service Site and copy it to the “Test Mode†folder on the SD card.

3. Insert the SD card in which the program is stored to the Navi unit and attach the Navi unit to the Cradle unit.

4. Turn ON the BUP and ACC of the main unit/AVH.

5. Press the Reset button on the Navi unit.

6. Press the Mode button on the AVH and go to the Navi source.

7. Test Mode will start up automatically.

* The touch panel may become inactive due to the state transition. Perform ACC_OFF/ON in that case.

 

Any ideas on where can i get GGS1092 and ID file?

[Bernd]

Any ideas on where can i get GGS1092 and ID file?

 

@socci4: Have you tried to ask a Pioneer service point or the shop where you have bougth your Navi ?

[socci4]

@socci4: Have you tried to ask a Pioneer service point or the shop where you have bougth your Navi ?

 

I bought the Navi online. I asked and they said they aren't a service point, they only sell. I can try to ask a Pioneer Service Point... What else can i do?

[condiczek]

I bought the Navi online. I asked and they said they aren't a service point, they only sell. I can try to ask a Pioneer Service Point... What else can i do?

 

Try attached testmode - it should be uncompressed to SD like:

/SDMMC/TestMode/..." - files in TestMode directory in root of sd.

Post results, pass like always - avic411

f220.zip

[socci4]

Try attached testmode - it should be uncompressed to SD like:

/SDMMC/TestMode/..." - files in TestMode directory in root of sd.

Post results, pass like always.

 

Thank you! It asks for a password (the ZIP file)... What is the pwd?

[GunFlavoured]

Thank you! It asks for a password (the ZIP file)... What is the pwd?

 

Post results, pass like always - avic411

[cesarlh2]

Good afternoon.

I have an AVIC F20-BT and I can not install successfully HACKMODE. If installed according to instructions on the AVIC PRG0 start in normal mode even with the KEY file in the root of the SD. If I install it on and I have PRG1 KEY file in the root of the SD AVIC does not start in any way. And if I have the folder in PRG0 HACKMODE and other files PRG1 HACKMODE start mode if I have the KEY file in the root of the SD but the AVIC not start in any way.

How is it possible?, Anyone who can help me? I'm going crazy and no longer do.

Thank you very much for your time.

[socci4]

Try attached testmode - it should be uncompressed to SD like:

/SDMMC/TestMode/..." - files in TestMode directory in root of sd.

Post results, pass like always - avic411

 

IT WORKS!!!! :grin:

Man, you're great!

 

I think GPS Port is already unlocked (COM2), i can see data log with the tool included in your hack!

 

Now i'm trying to run iGo, but i have some problem. It appears and disappear instantly!

 

UPDATE:

iGo Primo 1.1 shows up a black screen. I can't fix this... I tried to change some parameters in sys.txt but it doesn't work.

iGo Primo 1.2 starts up and then disappear (memory problem?)

Garmin Navigator XT 5.0 doesn't start (if i double click on the exe, nothing happens)

TomTom 7 starts, but it says: "Your device is incompatible with TomTom NAVIGATOR" and i have to click "OK" to close the app

 

Here is iGo Primo 1.1 crash log:

------------------------------------------------------

------------------------------------------------------

------------------ Crash Log Begin -------------------

 

 

Current System time: "2011-06-22 20:38:12"

Build version: 8.5.11.168090

Build configuration: Product--ARCHFAM

OS version: 5.0

 

Uptime: 0 h 0 m 0 sec 0 msec

 

Memory Stats:

 

FreeMemory: 99 MB, 936 KB, 0 B

TotalUseableMemory: 100 MB, 968 KB, 0 B

MaxMemory: 129 MB, 0 KB, 0 B

ReservedMemory: 1 MB, 0 KB, 0 B

ActualCacheSize: 0 MB, 0 KB, 0 B

GarbageSize: 0 MB, 0 KB, 0 B

 

 

Exception: 0xc0000005

At address: 0x0071803c

Access violation writing address: 0xeb0a4c97

0x0071803c (A)

 

 

WinCE CallStack snapshot (function names according to map file \Storage Card\Primo\NNGNAVI.map):

 

0x0c6d2328 (A)

0x0c6d1980 (A)

0x0c6d1b38 (A)

0x0c6d1c00 (A)

0x0c51a210 (A)

0x0df8c868 (A)

0x0df93850 (A)

0x8808818c (A)

0x880b1e7c (A)

0x8808bfb0 (A)

0x880880a4 (A)

 

 

Global status:

 

bInFocus: 0

bMouseDown: 0

bInLogic: 0

bInRender: 0

CurrentState[128]:

GPS Pos: (0.000000,0.000000)

Camera: pos:(0.000000,0.000000) rot:0 persp:0 zoom:0.000000 eng=0)

 

 

------------------- Crash Log End --------------------

------------------------------------------------------

------------------------------------------------------

 

 

 

 

Some notes:

- I can write on both partition

- I can access to COM2 GPS with the Sirf Tool in your hack pack

- There's explorer.exe

- It has 128MB of RAM