Jump to content
AVIC411.com

Upgrading NEX4000 to NEX4100 - Work in Progress


Recommended Posts

  • Replies 623
  • Created
  • Last Reply

Top Posters In This Topic

Something we are missing here is a map..  I'm using a 150version (x1xx series) firmware.  I will ignore the version.  I'm trying to create the start of a scatter chart here.   Add more information as it is discovered... Actual partition names, locations in /dev/block, EMMC layouts.. that sort of thing.  Eventually we will blow this thing wide open for modification, but we have to start by mapping it out. 

 

common name - associated ver file - location in update

boot.img -  BOT.VER - BOOT/BOT.PRG

bootloader  - BTL.VER - n/a

UNKNOWN - BT.VER  GPS/GPS.PRG    

userdata - DAT.VER - USERDATA/DAT.PRG 

UNKNOWN - DTV.VER - DTV/DTV.PRG

UNKNOWN - ERY.VER - RECOVERYEASY/ERY.PRG

UNKNOWN - GPS.VER - GPS/GPS.PRG 

UNKNOWN - OPN.VER - PG150OPN/OPN.PRG

system.img - PLT.VER - PLATFORM/PLT.PRG

recovery.img - REC.VER - RECOVERY/REC.PRG

UNKNOWN - WWR.VER - WWR/WWR.PRG

UNKNOWN - SNAPSHOT.VER SNAPSHOT/SNAPSHOT.PRG

HIBENDIR HIBENDIR  (Special partition)

 

The update apparently has unused files in the BLUETOOTH folder.  BTHBTL.PRG, BTHSAF.PRG, and BTHUDP.PRG

 

Now, for you "x0xx" people..  Please direct your attention to the BT and GPS lines.  Apparently the same image is placed on the BT and GPS...  which would explain why BT stops working on your system after flashing the image.  We need to get the old BT image emplaced.

 

 

 

I am downloading the sdcard now.  I haven't had time to work with it yet.  I've got 10 8-gb SDs on order from amazon for $5 each.    They should be here on Sunday (according to tracking).  

 

I was looking at the information to figure out why, after upgrading my NEX8100 from 1.03>1.03,  the next time it said 1.08>1.03.  Some data on the device must have been overwritten with improper versioning.  So lets look at the image header..

defaultheader="00010801010000000100000000000000504A313430504C5402100000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"

The key here is  this string of characters "50 4A 31 34 30 50 4C 54".   This is hex for  PJ140PLT which is the versioning information.  PJ140 is the Pioneer platform J version 140, and the PLT partition.   Each partition has its own 3-letter identifier.  

defaultheaderver="A55A5AA5C00000000001080101000000010000002C000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF010000000100000050004C004100540046004F0052004D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000050004A0031003400300050004C0054002E005000520047000000000000000000000000000000000000000000000000000000000000000000"

The same style of information is in this, but I believe it contains the 1.08 right here...  540046004F0052004D   

 

I'm still trying to figure out why my deck was bricked by that last update.   I'm waiting on SDCards.  I'm downloading the SD Image currently.   I'm still looking at the firmware.    I have a wife and kids and full time job as well, so I don't have a ton of time but I will keep this updated. 

 

 

@bass_rock, any chance you could make an update to the script to handle resigning various partitions?  Currently PLT is hardcoded.   I'd like it if, when you get a chance, you could update to handle any partition through update.   We need, maybe a set of scripts or, something that would handle rewriting any sort of image..  So that way our "x0xx" image buddies can play with "x1xx" versions after we figure out the differences in the SDCard. 

Link to post
Share on other sites

Also just tried a cross-upgrade with the old GPS prg and the GPS ver file. It upgraded but still no bluetooth audio.

Use the old kernel and the old BT partitions.  They would need to be resigned.  If you can resign a kernel, I can work on some things that will allow us to log to the SDCard.  After you remove the header from the kernel you can use a tool to separate the kernel, ramdisk, and kernel parameters.  Then the ramdisk can be mounted and we can see what's going on.   I'd like to add in a "dmesg>/extsdcard/log.txt or something to the /init.rc file .  I don't know what the partitions look like just yet but we could get a better idea from the recovery's /etc/recovery.fstab, or the normal fstab on the boot partition.    The easyrecovery appears to be a boot.img format as well.   Either way we need logs and this is how we get it.  I'd know a lot more about how to attack this if I had the full SDCard image. 

Link to post
Share on other sites

Use the old kernel and the old BT partitions.  They would need to be resigned.  If you can resign a kernel, I can work on some things that will allow us to log to the SDCard.  After you remove the header from the kernel you can use a tool to separate the kernel, ramdisk, and kernel parameters.  Then the ramdisk can be mounted and we can see what's going on.   I'd like to add in a "dmesg>/extsdcard/log.txt or something to the /init.rc file .  I don't know what the partitions look like just yet but we could get a better idea from the recovery's /etc/recovery.fstab, or the normal fstab on the boot partition.    The easyrecovery appears to be a boot.img format as well.   Either way we need logs and this is how we get it.  I'd know a lot more about how to attack this if I had the full SDCard image. 

 

Happy to try that but I am unsure which PRG contains the kernel and ramdisk partitions.

Link to post
Share on other sites

Happy to try that but I am unsure which PRG contains the kernel and ramdisk partitions.

Here's how to extract the boogimg.cfg, the zImage and the initrd.img
#remove headers and create standard boot.img files
dd if=AVICE5100NEX/BOOT/PJ150BOT.PRG skip=1  of=/home/adamoutler/Desktop/boot.img
dd if=AVICE5100NEX/RECOVERY/PJ150REC.PRG skip=1  of=/home/adamoutler/Desktop/recovery.img
cd /home/adamoutler/Desktop
abootimg -x boot.img
first things first, in the bootimg.cfg, make "bootsize = 0x416800" blank so it should be "bootsize =" then save the file.

 

Now lets get into the image. You'll need the mkbootimg tools from here https://builds.casual-dev.com/index.php?dir=random%2FAVIC%2F

adamoutler@adamoutler-desktop:~/Desktop$ kernelwork/mkbootimg_tools/mkboot ./boot.img ./newUnpack & decompress ./boot.img to ./new  kernel         : /home/adamoutler/Desktop/new/zImage  ramdisk        : /home/adamoutler/Desktop/new/ramdisk.gz  page size      : 2048  kernel size    : 4095984  ramdisk size   : 187481  base           : 0x10800000  kernel addr    : 0x10808000  ramdisk addr   : 0x11800000  second_addr    : 0x11700000  tags addr      : 0x10800100  cmd line       : console=ttymxc0,115200 init=/init video=mxcfb0:dev=ldb,bpp=32 video=mxcfb1:off video=mxcfb2:off fbmem=10M vmalloc=400M androidboot.console=ttymxc0 androidboot.hardware=freescaleramdisk is gzip format.Unpack completed.adamoutler@adamoutler-desktop:~/Desktop$ cd newadamoutler@adamoutler-desktop:~/Desktop/new$ lsimg_info  ramdisk  ramdisk.gz  zImageadamoutler@adamoutler-desktop:~/Desktop/new$ cd ramdisk/adamoutler@adamoutler-desktop:~/Desktop/new/ramdisk$ lsdata             init.freescale.rc      init.trace.rc  systemdefault.prop     init.freescale.usb.rc  init.usb.rc    ueventd.freescale.rcdev              init.goldfish.rc       proc           ueventd.goldfish.rcfstab.freescale  init.km500.rc          sbin           ueventd.rcinit             init.rc                sysadamoutler@adamoutler-desktop:~/Desktop/new/ramdisk$
And that should get things started.

 

Link to this image is in your PM, I think that this image will greatly help.

Thanks. I'm mirroring that here: https://builds.casual-dev.com/index.php?dir=random%2FAVIC%2F
Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

Loading...



×
×
  • Create New...