Bypass AVIC-Z2

[Hyperite]

Okay, great. Why not let them address the issues I posted and see if they can offer a satisfactory answer as to what they are doing. If you happen to be one of them, then your opinion has far more weight if you can address those issues.

I AM one of them... what is my opinion and why do I need to weigh it against anybody else's?

 

 

You don't seem to know what you are talking about. GPS stands for *GLOBAL* Positioning system.

Just because it uses the word "global" doesn't mean it works the same anywhere on the globe, it just means it's used to find your relative position ON the globe. If I walk from point A to point B, I've just become a global traveler, even if they're 20 feet apart.

 

 

 

As for what you call a "rant about GPS memory address references", I was very specific about how to find a solution. It doesn't sound like you understood what I wrote, because I didn't mention a GPS memory address. If you can address those specific issues I brought up, then your opinion will carry more weight.

I was referring to this:

The GPS is most likely an NMEA stream on a serial port. What address is that port? Is it on the chip, or is it on an external chip? What is the chip select for it? What is the address range for the memory? How do you set those chip selects? How do you access the hard drive, or the file system? What variant of the intel processor is there? What ports does it have built in? Are there any differences in instruction set?

All valid questions, but not ones that we require answers to for this project, but again, if i'm working on it and you're not, my "opinion" automatically carries more "weight".

 

 

I can, however, at least try to direct you all towards the right direction.

And what's that? What steps would you take if you had one in front of you that you can't do right now? I'm open to suggestions, and if there's something you'd like me to try, feel free to say it.

[8AxleEd]

Okay, great. Why not let them address the issues I posted and see if they can offer a satisfactory answer as to what they are doing. If you happen to be one of them, then your opinion has far more weight if you can address those issues.

I AM one of them... what is my opinion and why do I need to weigh it against anybody else's?

 

If you have a good idea, then it should stand on its own merits with full disclosure and complete transparency. If you can address the problems I mentioned with regard to recompiling, then you might be capable of changing the software. If you can't, or don't understand what I was talking about, then you will not succeed. So far, I haven't seen you give any reasons for your objections, I have only read the objections. That doesn't carry much weight.

 

 

Just because it uses the word "global" doesn't mean it works the same anywhere on the globe, it just means it's used to find your relative position ON the globe. If I walk from point A to point B, I've just become a global traveler, even if they're 20 feet apart.

 

You really don't know what you are talking about. Don't look at just one word. Look at the entire acronym. What part of "*Global* *Positioning* *System*" don't you understand? It gives you positions globally. GPS does not natively calculate positions from some other relative position. Where would it start? What do you do before you travlled the 20 feet? According to you, it won't give you a position because you haven't moved. Who would buy a product like that?? GPS takes range measurements from satellites in space that are three earth radius high in space, the distance is between 67 to 87 milliseconds in time. Based on these range measurements, it triangulates a position in ECEF coordinates (Earth Centered Earth Fixed), it then translates that into Latitude, Longitude, and Altitude coordinates in radians, then it converts those units to degrees. A relative coordinate system, that used by surveyors, called East North Up puts an imaginary tangental plane on the earth. That sort of coordinate system breaks down when a great circle distance starts to diverge from the coordinate plane.

 

Why are you arguing this with me? Why do you think you know how GPS works? I do know how it works, and it is very clear to me that you have no understanding of how it works. Are you trying to push my buttons or something??

 

 

I was referring to this:

The GPS is most likely an NMEA stream on a serial port. What address is that port? Is it on the chip, or is it on an external chip? What is the chip select for it? What is the address range for the memory? How do you set those chip selects? How do you access the hard drive, or the file system? What variant of the intel processor is there? What ports does it have built in? Are there any differences in instruction set?

 

Yes, I knew what you were referring to. However, if you read it more carefully, I was referring to the address of a serial port, not the address of a GPS system. The GPS system will not be on the same address and data bus as the rest of the system.

 

All valid questions, but not ones that we require answers to for this project, but again, if i'm working on it and you're not, my "opinion" automatically carries more "weight".

 

Sophistry. Does the opinion of the coach of a team in sports have less weight than the player? The players are on the field, the coach isn't playing - yet his opinion is valued. The opinion that matters is the one that stands on its own merit. As it turns out, I know a lot more about GPS than you ever will. It appears that you don't understand why you need to know more about the system before you can recompile your code in the manner being tried. I'm not telling you that you can't try to dissassemble the code and recompile it. I'm saying that there are easier things to try first. I'm saying that if you must try that route after the other routes have come to dead ends, that you need to do more investigation before you can start recompiling the code. I even outlined the safest way to hack this code with a hex editor because it avoids the need to tell the linker where all of the static variables are and it avoids the need to tell the linker something about the memory map of the system. Do you know what .dlls you need to link against? You need to tell that to the linker too. Do you understand?

 

 

 

And what's that? What steps would you take if you had one in front of you that you can't do right now? I'm open to suggestions, and if there's something you'd like me to try, feel free to say it.

 

Just read this thread, I've outlined a few things to try first. I don't need to repackage it for you. I don't think you are too lazy to look back.

[C6VetteRocks]

First if I want to listen to this I can just go to a meeting at work. Second, Hyperite you’re a perfect example of the old adage, “ Remain silent and be thought of as ignorant least you speak and prove itâ€. Third, 8AxleEd you have proven you have experience and education, you really don’t need to keep expanding on it. It really doesn’t matter which one of you have the PHD, what matters is getting the bypass. Now since I have been doing hardware and software for more years than I like to remember, 8AxleEd is correct. Unless you’re a Pioneer programmer with all their SW tools, since I doubt they write their code in C++ for IA32®, you will have almost no shot at recompiling working code. The HEX option is the best and easiest. But even this counts on the Pioneer SW Engineers being too lazy to change the augment names between Z1, Z2, or the European versions of SW. If by chance they were that kind, then you should be able to find match the augment names. Then try replacing the HEX values. Of course you are still banking on them not changing what the value means. But if your lucky and the object is only 8 bits wide, you only need to try it for 0x00 through 0xFF. If it’s 16 bits like everything else now you have 0x0000 through 0xFFFF, to make it easy for you that’s 65535 combinations. So unless the Pioneer SW engineers didn’t get the “make it hard to bypass†memo, you’re a crack code reverse engineering professional, just get lucky, they way your going about it most likely not prove fruitful. I’m not suggesting stop trying, there are just too many If, Then, Else, statements to be hopeful. Maybe like one entry in one of these threads had it, Pioneer made the Z2 un-by-passable. Which means my wife gets the new Z2 and I’ll live with the Z1 as is or SW updated if it doesn’t mess up the current bypass.

[Hyperite]

Ok, then you've proved you know what to do and I don't, so...do it? I guess I'll stop working on it and wait for you to post the solution, since i now see that i'm wasting my time.

[titos]

i agree if this guy knows so much why dont he figure it out all we are trying to do is put our heads together to try to figure this thing out so if your going to be negetive stay out PLEASE!!!!!!!!!!

[brandon]

i agree if this guy knows so much why dont he figure it out all we are trying to do is put our heads together to try to figure this thing out so if your going to be negetive stay out PLEASE!!!!!!!!!!

 

You two are both taking what 8AxleEd said waaaaaaay too personally. Obviously hes got quite a bit of knowledge on the subject. Yes he came across kind of abrasive and a little "holier than thou," but he is giving his experience and knowledge and helping by turning you away from avenues that will lead nowhere. Or, that will lead to more headaches that are not needed.

 

I will say that between you guys bickering at each other it looks more like a "whos cock is bigger" contest, or in this case "whos brain is bigger," and less like people working together towards a common goal.

[rjedlich]

After spending over 20 cumulative hours installing my AVIC-Z2 in my 04 Escalade, the most anti-climatic event was finding that the Z2 doesn't have a bypass (yet). Reading through this site and and scattering of other sites, it feels like something that will just take time to figure out. Hopefully, it won't be the end of the line for bypasses...

 

So, in lieu of a solution surfacing and allowing the real technical guru's (or those with extraordinary amounts of time available to decompile / reverse engineer the entire system, I offer some detective work...

 

Being new to all this, I wanted to understand some basics from anyone who would know better. Here are a few questions:

 

1. Why do previous generation units have a bypass capability? For example, is bypass intended for demonstration, testing, non-automotive use, or foreign / legal use flexibility. Understanding this I believe will at least help determine IF and HOW a bypass exists in the Z2.

 

2. Has Pioneer ever officially communicated through dealer and/or consumer channels that a bypass exists? Curious to see if such a communication existed, there would likely be a stated purpose.

 

3. Does Pioneer do all of it's warranty work in-house or do they outsource? If so, to who? If they outsource any repair work there's more opportunity for information leaks, schematics, publications, etc..

 

4. If there's strong belief it is software, and there is a legitimate internal need for bypass recognized by Pioneer (per question 1), then there must be a mechanism to enable the bypass. Somewhere I read (forget - too much reading) that the Z2 still accepts a single toggle of illumination lead during initial boot to disable - is this true still? (have not tested it myself, yet). Also, if Pioneer truly went the route of software - most systems I know have diagnostic / low level configuration screens built in and accessible by some combination of events (i.e. holding X down while booting, easter egg on menu's, etc..). Has anyone seen a Pioneer with the equivalent of a BIOS changes screen? Per question 3 above, that would clearly be a part of their arsenal of diagnostics. Somewhere in there maybe is the new soft switch for bypass...

 

5. For those who have pulled and viewed the contents of the files in the flash memory / HDD, any text found of interest (not internal object information, text for output) that does not match with known text? For example "advanced settings" or "bench" etc..

 

For kicks I have called their installation support line trying to squeak some hints out of them - cold fish. My last call I explained how this is in rear of RV etc etc... Semi-Programmed response: lawsuits. Please protect me from myself.

 

Oh well, just another anxious Z2 owner looking to get the shackles off...

 

Cheers,

Atreides

[KIDD]

what is the # to the install support line

[rjedlich]

Pioneer Support

800-421-1404

 

Bunch of prompts to get to the Navigation support unit... Pretty much they are programmed to be absolutely mumm on anything bypass related. It was kind of funny actually, cause at one point he was like "Bypass? There are no such things." lol..

 

Cheers,

Atreides

[rjedlich]

After much searching I am still not able to find a AVIC-Z2 service manual... (anyone know where one can be found?). I did get my hands on a AVIC-N3 service manual though - need some coffee now having skimmed through all 350 pages. The N3 does have test and technician screens available - so the Z2 MUST I have no doubt. Some functionality includes flashing RAM, wiping drives, calibrating DVD etc etc etc.. Some minor information on EPROM edits, but it seemed only in relation to LCD config. Unfortunately, i've seen nothing in there in my quick glance that speaks to "bypass" or similar language.

 

Ever diligent...

Atreides

[miamijdm]

hey guys, if any of you can try this to see if I'm not crazy. One of my installers here called me and said that they GROUNDED the illumination wire and the unit is working in the bypass mode.. I have not seen this or can confirm, but was wondering if one of you can try this.. thanks and take care..

[8AxleEd]

Hyperite, brandon is right about my motivation. I'm not trying to offend you, I was trying to prevent going down a dead end. We don't have infinite resources on this forum, and we can reach our goal more quickly if we avoid dead ends.

 

I do not have a Z2 in my posession because there is no face plate yet available for my 2006 Volvo v70. It should be available in another month or so.

 

I was not trying to be too pretentious, or "holier than thou" as Brandon put it. If I came across that way, I am sorry. Actually, I was trying to be more of the opposite. I don't care for it when people feel a need to post their credentials to prove that they are an authority. I figured it would be better to demonstrate that I knew what I was talking about. In my situation, maybe it is better that I do tell you what my experinece is, because it could be helpful to the group. I work for a GPS company. I have ten years experience specifically designing GPS receivers as embedded systems. Before that, I was an engineer at Apple, I worked on the OS for the first PowerPC Mac. My experience could be helpful, and I was trying to direct everyone towards a more fruitful path. I'm sorry if I ruffled anyone's feathers.

[8AxleEd]

I think we are getting some good ideas now.

 

rjedlich, I think your point #5 is what we havne't done, and one thing that might prove useful to do. For those that have a Z2 it is useful to try and do things that will trigger the lockout, and then look at any existing log files. It is also useful to look through any preference files. Anything ending in .txt.

 

rjedlich, I think you have a terrific idea with finding a service manual. I was thinking about that this morning too.

 

Here is something to add to the service manual idea.

 

So far, we know that the European model is bypassable. Think about what the differences between here and Europe are. The DVD region! NTSC and PAL. While computer displays don't really care about 24Hz vs 30Hz refresh rates, it may well be something that the Nav Unit is looking at. My guess is that if someone got a service manual, the DVD region and signal setting (NTSC or PAL) may well determine a different path for bypass on the Z2. There may also be a preference file (.txt hopefully) that specifies the DVD format. That might be enough to trick the unit to think it is a European model. The question is whether NTSC DVDs will still play if the region is switched. Maybe there is a regionless mode. It could be that doing this type of trick may work but be useless. It is worth a try though.

 

ltl2007, you are an installer, right? Can you get hold of a AVIC-Z1/Z2 service manual? There is usually something called "service man mode" that can be entered by entering a certain key sequence at startup.

[rjedlich]

From reading the N3 service manual, region code is set via the DVD service screens (accessed via input combination of cursor key - gotta be some equivalent in the Z1/Z2)... Just a rough guess, these items will be stored on the flash ram / eprom as opposed to file data on the hard drive. Anyways, will be testing ideas out over weekend. Tonight I will test that illumination grounding idea - worth a shot... (have to open things up anyways to integrate my factory rear dvd into head unit..).

 

Cheers

[eramos70]

Please guys don't give up working on this bypass. If I could help I would, however I'm just a average joe who is a enduser, with a Z2 having to pull over on the side of the road whenever I need input new address information, what a PITA.

A lot of the information exchanged goes over my head anyway.

 

I've been following this thread since it originated and my hat goes off to you guys who are determined to get this unit bypassed.

I know there are other things that you guys could be doing with your time, thats why I appreciate you guys dedicating the time and effort and hope your perseverance results in achieving a bypass.

 

Thanks again!