Bypass AVIC-Z2

[bobmun]

I don't know if it is connector 1 or 2. where the cell phone mute wire is now there are no empty pins on that connector, if you ground that wire where it is at you will mute the sound. on the other connector there are 4 empty pins just like the z1 and grounding any of them has no effect.

[8AxleEd]

I don't think that it is the GPS antenna because if it were that would make the Z2 unbypassable because you can't interrupt it, shy of disconnecting the antenna.

 

That sounds like a someone going to the doctor and saying, "I don't think I have brain cancer, because that would be really hard to treat."

 

This is the same unit being shipped all over the world, to places where watching video while driving is not illegal, are they supposed to have the unit hanging out so they can disconnect and reconnect the antenna? That alone tells me it can't be the antenna.

 

That is why software is such a great thing. You can produce the exact same hardware without any retooling of the production lines, and then load in different software depending on its shipping destination.

 

Right now, the evidence you presented suggests that the hack requires some software modification. It is far easier to engange and disengage the parking brake to see what happens then it is to assume it is the parking brake and then try pull-up resistors on that wire. That is why I have been asking these questions.

 

You can resolve this issue very easily by trying your experiment again with the gps antenna either disconnected, or covered with tin foil or some sort of metal enclosure. You can also try and disconnect the vss wire and see what happens with that. However, it is best to try only one thing at a time as this allows for better isolation of the solution.

 

It still stands that the vss wire does not take 4 minutes to initialize. It works the moment the car moves. GPS can easily take 4 minutes to do a cold start, which is what you described (It was set to the factory default location in L.A.). How do you resolve that from the tests you made and come to the conclusion that it is the vss signal?

 

If you left your GPS running longer than 12 minutes, and you left it off for less than two hours (so the ephemeris didn't expire, ephemeris gives a curve fit for location in space of the satellite given UTC time), it can do a warm start and come up much quicker. If you want to try that scenario, that would be useful too. Under those circumstances, are you able to watch the DVD for up to four minutes while driving slowly? Why not try some of those things and let us know what you find out?

[tunez]

Just came back from another test drive. The results are as follows, tried disconnected either the VSS and GPS antenna at different times. Left with the GPS antenna disconnected - speed sense connected and had video all the time, pluged it back in and it kills the video shortly thereafter. Tried it the other way around and it just didn't work. It will also lock out with no GPS antenna connected, by connecting and disconnecting the VSS. Not too sure what to make of this. My head hurts, is it 4:20 yet?

[bobmun]

according to this ebay auction the avic-z2 bypass has been figured out!?

 

http://cgi.ebay.com/AVIC-Z2-Video-Lockout-Bypass_W0QQitemZ150111201309QQihZ005QQcategoryZ47103QQssPageNameZWDVWQQrdZ1QQcmdZViewItem

 

anyone know if this is true?

Maybe we should just all chip in and have someone try it. Ok, everybody pony up .05!

 

On a side note: 5 people have already bought it, maybe we could contact one of them.

 

Another note, this guy also sells Z1 bypasses ($1.99). Sounds like it's just the "Flash your headlights" method: "It did work but has to be done every time u start the vehicle" (feedback)

 

this is just the cut the gps antenna wire and install a switch method.

[8AxleEd]

When the update disc came out for the Z1, it changed the bypass on the Z1 from the light flashing method to grounding two wires. All the upgrade was was a CD, I'm pretty sure it didn't start changing any hardware Its also been said that if you upgrade a Z1 to a Z2 using the new upgrade disc, it'll disable your bypass. The bypass is written into the Z1/2s software.

 

Knowing some of the history of other modifications this is great. Do we have a list of what they all were? Is it possible that it could just be a combination of other things?

 

For instance, if you have two wires that were grounded, there are three other combinations.

 

ground, ground

ground, pull-up

pull-up, ground

pull-up, pull-up

 

Are there any other wires that could be tried?

[AlarmsETC]

The VSS wire on the pioneer Avic Units is primarily used for "Vehicle Dynamics" and then for more precise speed calculations when calculating distance. The unit may also utilize VSS in times where there aren't sufficient satellite coverage.

 

So, the 'solution' has nothing to do with VSS wire. Nor does discounting the GPS antenna offer a solution or a bypass. It's more like 'ghetto engineering'......

 

It will be an issue of varying voltage and or pulsing a wire on the unit more than likely during boot up, itself. The Unit itself does not have any connections to simply jumper out. So yes, like the engineer type person said, The lockout is PURELY a software driven feature, very similiar to how they did the Z1.

 

Just trying to answer alot of the 'myths' and 'guesses' going on hoping to focus attention more so. Sorry can't be of more help!

[8AxleEd]

So, the 'solution' has nothing to do with VSS wire. Nor does discounting the GPS antenna offer a solution or a bypass. It's more like 'ghetto engineering'......

 

Sorry to give the impression that disconnecting the antenna was a solution. I was asking people to disconnect the antenna, and the brake wire, and the vss wire to find out what happens, to see how the Z2 reacts. I wanted to see what happened when they did those things. By how the unit reacted when the antenna was disconnected showed that it was a software issue.

 

Because it is a software issue, the hack will only work when a certain condition is met at a certain time that opens a pre-programmed back door that unlocks the unit during motion.

 

This back door could be grounding pins, or using pull-up resistors. It might be sending a pulse on a wire. It could even be modulating the dimmer controls three times in a row during the boot sequence. The point is that it is whatever the navigation software is programmed to look at.

 

One thing is constant though, there are a limited number of inputs going into the unit. Those inputs are wires like the brake signal, or the vss signal. Other inputs could be pressing a sequence with the touch screen. So far, it appears that all of the historical hacks have not come from pressing the screen, that leaves hard inputs on the back of the unit. Someone mentioned a previous hack was grounding two lines. If there are only two lines, then there are four possibilities if you are looking at a binary system. If it is going to be a pulse train, then it will probably be too hard to guess what it is. Be mindful that looking at a pulse train on a port pin is a lot more work for the software to recognize. A back door is more likely to not be too difficult to open because the programmers didn't have a lot of time to spend implementing it.

 

So, the question for those that have one of these units is, "how many inputs can one modulate a signal on?" Is it just two lines, or are there more?

[8AxleEd]

The results are as follows, tried disconnected either the VSS and GPS antenna at different times. Left with the GPS antenna disconnected - speed sense connected and had video all the time, pluged it back in and it kills the video shortly thereafter. Tried it the other way around and it just didn't work. It will also lock out with no GPS antenna connected, by connecting and disconnecting the VSS. Not too sure what to make of this.

 

Thanks for trying that stuff, the behavior is useful to know. Looks like it is definetly a software issue. We just have to figure out, or wait for the leak, as to what hoops to go through to get the software to unlock the system when in motiion.

[C6VetteRocks]

according to this ebay auction the avic-z2 bypass has been figured out!?

 

http://cgi.ebay.com/AVIC-Z2-Video-Lockout-...

 

anyone know if this is true?

 

Most likely it's just a switch to disconnect the nav antenna and VSS wire and ground the parking brake. Anything else, I would believe it when I see it.

 

Paid the 10 bucks, yes nav antenna switch.

[sportsfan21]

according to this ebay auction the avic-z2 bypass has been figured out!?

 

http://cgi.ebay.com/AVIC-Z2-Video-Lockout-...

 

anyone know if this is true?

 

Most likely it's just a switch to disconnect the nav antenna and VSS wire and ground the parking brake. Anything else, I would believe it when I see it.

 

Paid the 10 bucks, yes nav antenna switch.

 

Yea thats what we figured.

 

It also explains why when I emailed him to confirm it was a real bypass and not something that you hurt my navi accuracy like a switch on the antenna he never wrote back.

[darkmcknight]

not to sound too stupid but i am a novice, what type of switch would i need to use for the backup camera trick for playing dvds? and what are the steps exactly?

[sportsfan21]

not to sound too stupid but i am a novice, what type of switch would i need to use for the backup camera trick for playing dvds? and what are the steps exactly?

 

You would need to take an RCA cable and connect the video out to the rear camera in.

 

You would also need to put 12V+ on one side of a switch and the reverse gear input on the other.

 

Flip the switch and it'll make the AVIC think that you are in reverse, and it'll switch to the camera input, which will be your video out.

[ltl2007]

Hey all. Im working on a Z2 bypass as well. I tore down a Z1 and a Z2 today. There are absolutely NO differences in hardware. There is a mainboard NEXT to the HDD that is the flash memory module. It even has a Microsoft sticker that says dont tamper, blah blah with our software. I thought I might be able to pull the OS off the flash drive, but im a senior installer, not an electronics engineer. I did switch the flash module from the Z1 to the Z2, and the old Z1 bypass worked on the Z2, and in the Z1 with the Z2 brain, it didnt work. I also have an inside rep at Pioneer that confirmed that the bypass is in the software. I dont know if all the "upgrades" are on the HDD or the flash drive, but if someone out there can get the OS off a Z1 or even a Z2 and manipulate the code, I have a feeling that might be our only route. Or if someone can get ahold of a Z1 software disc, or Z2, i can decompile it and see if there is a backdoor somewhere. But for now, the only thing i can think of is maybe order a flash memory board from a Z1 and swap it into a Z2. Sorry if I seem like im rambling. email me if you have any more detailed questions. Jesse@louderthanlife.net

[brikkman1]

but if you do that, would that basically make the z2 a z1 if everything is the same besides the chip?

I would assume things such as 3d images learning crap and etc would not exist at all. Any thoughts on that?

Did you check to see if you had all the new features?

[ltl2007]

well thats what im not sure about. i did a bench test for operations only. I dont know if the upgrades are on the HDD or the flash drive. hell, if pioneer didnt stop making the Z1 im sure we would still be selling them at our shop more so then the Z2. Our only option for some customers are the Z2's. If it means downgrading so they can watch a DVD and operate the nav, i have a feeling 90% of them wouldnt care. Better yet, like i said in my last post, im sure there is a line of code in the OS that says something like "if VSS or GPS is >10MPH then disable (dvd and nav) = 1. I have a feeling all thats needed is either change the MPH to like 200, or change the 1 to a 0 and turn off the disable. Anybody have any idea about that? Also brikkman ill see if i can get them back apart tomorrow at work and maybe do a little driving. I have a feeling that the new upgrades are in the HDD, with all the other nav info.