Condi's HACKMODE v2.2 - AUTOINSTALL! working also with F40BT, X940BT etc! [updated: 27.09.2012]

[elnefary]

Ok My plan is to locate the eprom IC and read all its contents and check what is the structure of files and drives . I will check the service manual and get back

[Melvin v/d berg]

Ok My plan is to locate the eprom IC and read all its contents and check what is the structure of files and drives . I will check the service manual and get back

 

You almostly can't read the IC with a programmer. The ICs are BGA (Ball Grid Array) so soldering is almost impossible.

The chip is really small and the pcb has 3 layers so tracking traces is almostly impossible...

 

I'm sure that Pioneer can recover bricked AVIC's without soldering. The question is how.

 

 

e-nand (4gbyte):

IC4501

PEN002A

hynix H26m31001EFR

BGA

 

flash rom (8mbit):

IC4403

CXX3406

spansion al008j70bf102

BGA

[elnefary]

You almostly can't read the IC with a programmer. The ICs are BGA (Ball Grid Array) so soldering is almost impossible.

The chip is really small and the pcb has 3 layers so tracking traces is almostly impossible...

 

I'm sure that Pioneer can recover bricked AVIC's without soldering. The question is how.

 

 

e-nand (4gbyte):

IC4501

PEN002A

hynix H26m31001EFR

BGA

 

flash rom (8mbit):

IC4403

CXX3406

spansion al008j70bf102

BGA

 

 

 

from service manual we have a controller that connects the 4 memory elements . I think this is the key to scan all addresses and find the file structure

can anybody agree with me and find a solution to sniff this data?

http://imageshack.us/photo/my-images/857/ramdv.jpg/

[elnefary]

Please KEEP this thread alive . I hope we can do it . we are so close!!

[orchid]

Hi guys! I got a unit can acess the service mode using V1.4. But I couldn't find the copy and paste command.So I put the hack files into the img file\prg0 and flash the unit. But some files were not copied to the foder as a result I could access the ce desk with no explore no any software can be use.

Please help. Thanks.

[elnefary]

Hi guys! I got a unit can acess the service mode using V1.4. But I couldn't find the copy and paste command.So I put the hack files into the img file\prg0 and flash the unit. But some files were not copied to the foder as a result I could access the ce desk with no explore no any software can be use.

Please help. Thanks.

 

In V1.4 it is not possible to copy or paste . only delete . you have to upgrade to 2.000 or higher to able to copy or paste using the stock TEST MODE . or using hack mode provided here .

[Melvin v/d berg]

from service manual we have a controller that connects the 4 memory elements . I think this is the key to scan all addresses and find the file structure

can anybody agree with me and find a solution to sniff this data?

http://imageshack.us.../857/ramdv.jpg/

 

That might be also a possibility! There are so many ways we only need to execute them.

I will try some things later. I already dissambled the unit once. Lot's of SMD components and I don't want to remove the radio from my dash at this time.

 

If I'm right we can modify all system files but there is a danger of bricking?

The PRG file we want to change (EU090PLT.PRG) has testmode.exe inside so a damaged EU090PLT.PRG will possibly cause a brick.

[orchid]

 

In V1.4 it is not possible to copy or paste . only delete . you have to upgrade to 2.000 or higher to able to copy or paste using the stock TEST MODE . or using hack mode provided here .

Where could I get V2.0?

[Ralpharn]

Take a look here. They made some progress in replacing images in image.img file.

[m3_chris]

Simply tring to get the password to an avicx930. I just saved the file to my sd card with nothing else on it. When I enter the sd card to the unit nothing happens. when I view the sd card I see the file named 1.4 base install via test mode. Am I doing something wrong.

 

I am a dealer that has a unit locked up by a customer, and pioneer even wants to charge us to unlock.

 

-Chris

[Melvin v/d berg]

Here is a scan of the pcb in the display unit.

You can see the connectors here, processor and nand.

[ezequielbbaptista]

Hi!

 

I need a help please,

I have a AVCX-930BT but i don't know like to put IGO but i not know to do this.

Thanks for you help

[Melvin v/d berg]

Hi!

 

I need a help please,

I have a AVCX-930BT but i don't know like to put IGO but i not know to do this.

Thanks for you help

 

It is not possible to put IGO on the x930bt or f930bt at this time...

The GPS com port is in use by pioneer

[pentolino]

Hello everyone,

as far as you may know, is it possible to force U220 (F220 in Europe..) to launch something like a "resolution forced change" in registry at startup?

Igo primo 2.0 works like a charm through test mode but U220/F220 have different resolution from AVH8400 and it would be great to understand if it's a u220/f220 hardware limitation or just a WinCe configuration.

 

thanks!

[randomwalk101]

Hi guys,

with all this hacking going on with the Pioneer unit, is it possible to hack the backed up binary to remove that stupid start up warning on the navi screen? That would be freaking awesome if someone can do it. It is so annoying to touch "OK" everytime the car is started.