Jump to content
AVIC411.com

F310BT hack is real


Recommended Posts

  • Replies 116
  • Created
  • Last Reply

Top Posters In This Topic

from the fw update from this thread.. it's the one that puts a folder called "QI_037_CNSD_130FM"

trying to put that on a sd and updating from there even after patching RenewalIFLib.dll didnt really work. It would reboot into update mode but kept getting some error about cant read SD card.

Anyhow, had to kick it out of update mode by booting into testmode/explorer and deleting My Flash Disk\System\?? (cant remember exactly what).

 

To upgrade, first upgraded wince img:

take winceimg.bin/.cks from "QI_037_CNSD_130FM", put Update/user/prg/plt, and put them in root of sd card

boot into testmode, and run AplUpdate.exe from inside of Update/USER/PRG/APL folder. Hit the second button on that app and the unit will restart into wince update flashing with the winceimg.bin/.cks in the root of the sd card. (In case you get any ideas... Don't be tempted to use a non f320bt, f310bt, or u310bt firmware ....)

 

Then I wiped out "My Flash Disk" (this may not be completely necessary). Then from Update/USER/PRG, copied over APL & Fonts folder, and EL090APL.HTM /.VER to My Flash Disk/PRG0/

Also, copied Update/VERINFO.DAT over to My Flash Disk/SYSTEM/RENEWAL/ - this seems to be what gives it the version info in the app.

 

Reset/reboot after that into 2.001

 

Just need a dump of Maps/POI (My Flash Disk 2) or dump of update SD card to figure out how to get poi/maps updated...

Link to post
Share on other sites

now, i'm thinking we can use maps/pois from Z110 update (cnsd-210FM), but unfortunately, even after I strip out alot of stuf (canada, other langs, etc), it's still like 2+ GB and wont fit on "My Flash Disk2" which is ~1.8 GB.

 

I'm guessing the official CNSD-230FM for u310bt family either is pared and squeezed down to fit on 1.8 gb space, or they use some trick to run maps and/or pois off of the SD card.

 

Now... They use lots of flag (.FLG) files in various places to trigger behavior, or have specially named folders that are significant. Perhaps someone with the poi/map update can tell us how it works for them?

Do the pois or maps run from sd card? What does the file/folder structure on sdcard look like?

Link to post
Share on other sites

Yeah, im not sure why navgate apps arent running either. I get same thing.. Perhaps something else is needed? (some flag or version file?) Really need to compare My Flash Disk and My Flash Disk2 contents from legit upgraded u310/f310

 

Could be that there are support files/folders in My Flash Disk2/NDATA that are needed (and created by normal upgarde)...

Link to post
Share on other sites

If anybody is interested I've got IGO8 working (GPS, TMC, Sound, POIs, Speed Cameras etc) together with the original Pioneer software so that I can switch between IGO8 and the Pioneer AV using the mode button on my F320BT (Upgraded F310BT). I promised TOPCU58 I would but its taken me a few months.

Its using the Condi hackmode and some additional registry hacks I discovered. See my post on page 37 of the Condi's Hackmode post in the F Series forum. - It should work with your U310BTs with a little tweak or two.

 

Somniac.

Link to post
Share on other sites

thanks somniac.. i had a similar idea: intercept and lock com port before it gets locked by pioneer process, then free it up for igo, etc.

after looking at some regdumps and the rom launch order in registry (i thought it might be \windows\NEventWatcher.exe who is the "master" launcher and may be locking this)

 

we may be able to do a simplified version of this that doesnt need full condi install.

I suspect with mortscript we can intercept one of the regular exes and do some varation of this:

1. make needed reg changes to comport

2. sleep small amount of time if needed

3. launch igo or whatever (dash, etc)

4. launch original program that we intercepted

 

my other concerns were the way that some functions were "tied" to the navigation program (navi.exe).

I think with the newer 2.001 software some of this has been broken out into other pieces and may make it easier to hack

or at least provide a startup menu to do a one-time (per boot session) switch between nav systems.

 

 

Link to post
Share on other sites

ok. good news is the com hack seems to work, but bad news is that it's only partially :(

 

here is the very simple way i did it with intercepting HMIManager.exe as a mortscript (renamed original to HMIManager.exe):


currentport = RegRead("HKLM", "\Drivers\BuiltIn\GPS_HWCOM", "Index") 
If (currentport = 2)
RegWriteDWord("HKLM", "\Drivers\BuiltIn\GPS_HWCOM", "Index", 4)
Reset
EndIf
Run("\Storage Card\iGO8\iGO8.exe")

 

so it will do a soft reboot with the comport changed, and igo8.3 will launch and see the gps.

Problem is with the various buttons/panels are inoperative without some of the HMIManager and friends (av.exe?)

 

So... I tried doing the interception at navi.exe, and igo seems to launch (and i seem to see the audio controls overlay, and even popup about my BT phone connecting,) however Igo just freezes at MAINSCREEN LOAD.

Looking at the igo8 folder on the sdcard, i see a dump log in crash.txt.

Access violation. So i suspect some intentional misbehavior or other various unsavoury acts on behalf of HMIManager when watching or interacting with "Friends" like navi.exe, etc.

 

So If we can somehow make HMIManager happy to run igo in place of navi.exe, we may be able to have the av controls overlay (controlled by buttons), and perhaps even BT.

 

I think if we can do that we can put some kind of mortscript menu switch to boot regular nav vs igo/etc nav, as it may be necessary to boot into original nav in order to change any settings (at least this early in the game).

 

man that nav software is sooo crappy, and so intertwined with the functionality of everything else :((

Link to post
Share on other sites

from the fw update from this thread.. it's the one that puts a folder called "QI_037_CNSD_130FM"

trying to put that on a sd and updating from there even after patching RenewalIFLib.dll didnt really work. It would reboot into update mode but kept getting some error about cant read SD card.

Anyhow, had to kick it out of update mode by booting into testmode/explorer and deleting My Flash Disk\System\?? (cant remember exactly what).

 

To upgrade, first upgraded wince img:

take winceimg.bin/.cks from "QI_037_CNSD_130FM", put Update/user/prg/plt, and put them in root of sd card

boot into testmode, and run AplUpdate.exe from inside of Update/USER/PRG/APL folder. Hit the second button on that app and the unit will restart into wince update flashing with the winceimg.bin/.cks in the root of the sd card. (In case you get any ideas... Don't be tempted to use a non f320bt, f310bt, or u310bt firmware ....)

 

Then I wiped out "My Flash Disk" (this may not be completely necessary). Then from Update/USER/PRG, copied over APL & Fonts folder, and EL090APL.HTM /.VER to My Flash Disk/PRG0/

Also, copied Update/VERINFO.DAT over to My Flash Disk/SYSTEM/RENEWAL/ - this seems to be what gives it the version info in the app.

 

Reset/reboot after that into 2.001

 

Just need a dump of Maps/POI (My Flash Disk 2) or dump of update SD card to figure out how to get poi/maps updated...

how many sd cards did you have to use for this update. im sorry but im not understanding clearly

Link to post
Share on other sites

ok fellas. success here thanks to others work. 8)

 

As the others reported, none of the avic apps seem to work with this for some reason.

However, as i started to look at the crappy avic apps, realized that we could just get whatever apps (nav, etc) we want to run via this method and retain the av/ipod controls and some basic bt phone controls (answer/hangup/vol).

 

So here's what I did to get your own custom apps running (in app mode):

- patched AppsLib.dll which does the checking of program.enc and program.pwd so that it doesnt matter what program.exe you use. Need to stick this in \My Flash Disk\PRG0\APL (if your system is booting into PRG0 app)

- appended \Storage Card\AVIC-APPS\Applist.dat to have a new entry: "Launcher" which is just a mortscript and you can do what you like

- whenever avic boots up, HMIManager.exe checks (via AppsLib.dll) "\My Flash Disk\System\AppsLib\Apps.dat" and executes the file path in there (provided it passes validation - snicker...)

- this mortscript is geared to launch igo if you have it, but could launch any nav.

- it checks if gps com port is 2, and remaps and resets (dropping Apps.dat in above folder so it will launch again), then runs igo.

- should reset port back to normal after you exit igo

 

 

- thumbs for Launcher icon in Apps is just showing blank... (not on Windows.. perhaps one must use mspaint to generate thumbs?)

 

Let me know how it works...

http://ul.to/09oa5srw

Link to post
Share on other sites

rodinhas,

no, the original avic apps (clock, video player, photo viewer) don't work for some reason. They don't even work when you execute them directly, so something else is up.

This does not change anything else about the stock setup, except for adding a 4th app, Launcher, that will run whatever you want. From there you could implement whatever you want.

Also, You could replace the other apps (clock, video player, photo viewer) with any other version of this app, for example, ones from MioPocket collection, etc.

 

 

dvel85,

I only need one sdcard. It only updates the OS image and application. The map/poi data is still old, because so far, I have not seen anybody post links to the "complete" CNSD-130FM (or better yet, CNSD-239FM) sd card images.

 

I suspect we can engineer proper upgrades from a complete image, should somebody be able to post em...

Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...



×
×
  • Create New...