Z1 Hardware

[Guest isdnmatt]

What about the plug that just says "extension"? What is that used for?

[XessReality]

Pulp... yea i got that that is why you took it apart, just trying to help....i saw those referances and drew the same conclusions. not sure you got my main point though....
The Data Cable that is exclusive to xm nav traffic may be the lead you are looking for. Think about it this way, it cant be a totally propriatary cable type or transmission protocall, as that would hinder interopporability with nav traffic recievers made by other vendors and would require an extra step for pioneer in integrating the nav unit with the avic series.

sorry if i'm being redundant, just wanted to express my thought clearly...

[Pulp_Fiction]

[quote name="XessReality"]Pulp... yea i got that that is why you took it apart, just trying to help....i saw those referances and drew the same conclusions. not sure you got my main point though....
The Data Cable that is exclusive to xm nav traffic may be the lead you are looking for. Think about it this way, it cant be a totally propriatary cable type or transmission protocall, as that would hinder interopporability with nav traffic recievers made by other vendors and would require an extra step for pioneer in integrating the nav unit with the avic series.

sorry if i'm being redundant, just wanted to express my thought clearly...[/quote]

Well since I do have the nav traffic maybe I'll just take it apart next. :lol:

[tech10002]

I can't seem to find a data sheet using normal web searches. I'll have to look at work where I can access some more proprietary databases. It looks like Pioneer is using some version of this processor though: Hitachi HD6417750BP200 . It looks like it does support the JTAG standard, so that's a definite plus for us.

Pulp, when you refer to the TSOP flash devices in that picture, do you mean the two BGA chips in the upper right corner? If so, that's a bummer. I was hoping for something in TSOP or TQFP package that I could remove, read, and reinstall easily. I HATE BGA. LOL

[Pulp_Fiction]

[quote name="tech10002"]I can't seem to find a data sheet using normal web searches. I'll have to look at work where I can access some more proprietary databases. It looks like Pioneer is using some version of this processor though: Hitachi HD6417750BP200 . It looks like it does support the JTAG standard, so that's a definite plus for us.

Pulp, when you refer to the TSOP flash devices in that picture, do you mean the two BGA chips in the upper right corner? If so, that's a bummer. I was hoping for something in TSOP or TQFP package that I could remove, read, and reinstall easily. I HATE BGA. LOL[/quote]

Yes those are what I'm referring to. I use the term TSOP too liberally I think. I see thin chip I call it a TSOP. LOL

[Guest]

[quote name="Pulp_Fiction"]Processor: It is about 1 and 1/4" square. No brand name on the processor but the following writing:
R8A73820A
HA01BGV might be HA01BCV
BB09165
0609 JAPAN

I'm betting one of these is a serial number.

Google was unable to help with these numbers.

I don't know if Samsung makes processors but most of the chips are samsung's.

Large pics at these links. 1-2 meg each.


Check out all the crazy writing on the top of my DVD drive. Looks like it went through a lot of hands or something.
[url]http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/dvdtop.jpg[/url]

Here is the bottom of the DVD drive:
[url]http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/dvdbottom.jpg[/url]

Here is the processor module. The lid was soldered on and I already put it back before I found the pics were a little blurry. Sorry. I didn't see enough information to make opening it back up worth the effort.
[url]http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/processormodule.jpg[/url][/quote]

Thanks for the pics.
Can we get a high res and clear shot of all boards both front and back?
I am looking to see if they use the same processor for navi as in all the other DVD nav units and if it has IMODEON labeled on the board somewhere like in the AVIC-9,90,80,88,N1, N2, N3, and EU models. That is the key to those units being bypassed. "Interlock Mode"
I'll also see if I can get my hands on a service manual. My guess it is completly different since it runs on a different OS.

[Pulp_Fiction]

[quote name="Anonymous"] [quote name="Pulp_Fiction"]Processor: It is about 1 and 1/4" square. No brand name on the processor but the following writing:
R8A73820A
HA01BGV might be HA01BCV
BB09165
0609 JAPAN

I'm betting one of these is a serial number.

Google was unable to help with these numbers.

I don't know if Samsung makes processors but most of the chips are samsung's.

Large pics at these links. 1-2 meg each.


Check out all the crazy writing on the top of my DVD drive. Looks like it went through a lot of hands or something.
[url]http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/dvdtop.jpg[/url]

Here is the bottom of the DVD drive:
[url]http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/dvdbottom.jpg[/url]

Here is the processor module. The lid was soldered on and I already put it back before I found the pics were a little blurry. Sorry. I didn't see enough information to make opening it back up worth the effort.
[url]http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/processormodule.jpg[/url][/quote]

Thanks for the pics.
Can we get a high res and clear shot of all boards both front and back?
I am looking to see if they use the same processor for navi as in all the other DVD nav units and if it has IMODEON labeled on the board somewhere like in the AVIC-9,90,80,88,N1, N2, N3, and EU models. That is the key to those units being bypassed. "Interlock Mode"
I'll also see if I can get my hands on a service manual. My guess it is completly different since it runs on a different OS.[/quote]

I think I posted the best I had but I'll check later. "Interlock Mode" sounds familiar. I think I read something about that on one of the chip white papers I read.

[GnatGoSplat]

Anyone still playing around with the Z1/Z2/Z3 inner workings?

I don't have a Z yet... just looking for one that's a good price first, but I thought I'd play around with the firmware update and see what I could figure out.

I've attached the registry I extracted from it. It appears the main control program is NEventWatcher.exe. There are definitely USB as well as serial port drivers. Video/navi lockout are most likely software-controlled. If someone could reverse-engineer NEventWatcher.exe and its libraries, many AVIC-Z* secrets could be exposed.

[Hyperite]

We were only concerned with the secrets as they pertained to a bypass. Now that it's all cleared up, everybody kinda gave up on messing with the software. Probably for the best, as it was quite frustrating.

[GnatGoSplat]

A software-based bypass would still be nice as it would have virtually no cost involved (firmware can be updated via CD-R).

Plus, you could get rid of that horribly annoying warning screen, or does the Z1 not have that? My D1 has it and I really hate that screen.

Being able to add in IE, ability to use either Wifi or a cell phone as a modem, adding in Explorer, people writing custom apps, the possibilities are unlimited. It's a shame Windows Automotive isn't as well hacked as Windows Mobile.

BTW, if anyone knows where I can get Platform Builder, PM me!