Jump to content

Condi's HACKMODE v2.2 - AUTOINSTALL! working also with F40BT, X940BT etc! [updated: 27.09.2012]

Recommended Posts


I have problem.My devise is avic-z120bt upgraded to z130bt with shortfuse hack. and is this possible to change region settings my devise?,because i get it in US,but live in Europe .For example, the radio frequency settings, I cant get radio stations that are even, only odd stations are set on the radio.I don't think i can over-write the same version level. AFAIK, US and EU are the same version number - just different maps and other stuff.There may be some way to hack the HU using TestMode to set the version number. Or it might be possible to hack the version number in the EU CNSD-210FM upgrade to be greater than 3.0. But either of those could be dangerous - could brick the HU if done incorrectly.How can i back to the original (factory) software."Real" hackers help me with the on this thread.

Link to post
Share on other sites
  • Replies 1.2k
  • Created
  • Last Reply

Top Posters In This Topic

Found my notes on setting up a Windows + Cygwin + CEGCC Haret build environment, was in Feb 2011 so there may be some drift and updates required.


9. Copy out/haret.exe over to your Testmode SD, eject, boot to test mode and run haret.exe from your SD card.

can u share this haret.exe to try at my z120bt ? i need a compile a kernel or your file have a linux distro included?


I compiled haret (Thanks to FourG for the good tutorial) and started it in Hack-Mode on my F930BT but the result was disappointing: Nothing happened.


Does somebody know which type of processor is inside the F930BT?

Link to post
Share on other sites

I compiled haret (Thanks to FourG for the good tutorial) and started it in Hack-Mode on my F930BT but the result was disappointing: Nothing happened.


Does somebody know which type of processor is inside the F930BT?

You can create an empty text file in the same directory as haret.exe which will cause HaRET to log a lot of information about its discovery process. From http://htc-linux.org...n#Early_logging:


The easiest way to enable logging in HaRET is to create a file "earlyharetlog.txt" in the same directory as the haret.exe program. The next time one runs HaRET, it will create a file "haretlog.txt" with logging information.


The resulting "haretlog.txt" file contains information on the device and the actions that HaRET performs during startup. It will also record all commands executed by HaRET.


When reporting an issue, please create the "haretlog.txt" file as described above and forward it (with a description of the problem) to the HaRET mailing list.


That same page has some pretty good info about HaRET in general, with some HTC-specifics mixed in.


In your haretlog.txt, look for something resembling this:


Trying to detect machine (Plat='PIONEER' OEM='Handheld Reference Board BSP version:TitanHHV1.0.47')
Wince reports processor: core=ARM1136JF-S name=TN2X0A cat= vend=Centrality


That will give you a good start on your search for more documentation on the processor.

Link to post
Share on other sites

@FourG Thank you, I will try.


Do you know if system libraries like COREDLL.dll are used? The COREDLL.dll of the system is limited some way and for other programs a file COREDL1.dll in the same directory is needed.


@Condi What is the best way to change the references of a program from COREDLL.dll to COREDL1.dll? Hex-Editor?

Link to post
Share on other sites
  • 2 weeks later...

Hey guys,

So back near the beginning of this thread, I saw some people talking about uncompressing image.img to get the image files out, but noone seemed to be successful. I managed to do it, but I posted it over in the X series forums because I'm working with an X930BT. However, I think it should be similar, if not exactly the same for you guys. If anyone's still interested, have a look at my writeup here.

Link to post
Share on other sites

We need a summary of the 42 pages of this LONG topic . I need to figure out what will we do next?


My questions are

1- Is the problem that we don't know the app or process which use the GPS port?

2- Is it confirmed the GPS port ? and what is it?

3- why we don't try to crush into the Pioneer OS it self . we may succeed in replacing the Navi part of the system with what we need


I am trying to find a tool like ( Network monitor ) on windows . it will help to find the process and application which use the GPS port .


Please help Us keep this topic alive!


Link to post
Share on other sites

1. No. looks like it is blocked at OS level.

2. No. But com7 is suspected.

3. We have 4 copies of OS image. Two of them in hidden partition.

We can extract files from image, but do not know how to save changes in these images.


EU090PLT.PRG first 0x200 butes - header, there is CRC32 and size.

then 0xC0000 Unknown area. It has some info but we do not know such format.

Than image in nb0 format - use something like dumpromx to read it.

(do not forget -5 for dumprom/dumpromx ) (thanks ot Carver)

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.


  • Create New...