Jump to content


Photo

Map Update Hack using "ShortFuse" method - Z110-Z140;X920-X940

maps update hack

  • Please log in to reply
50 replies to this topic

#1 RonS

RonS

    Established Member

  • Moderators
  • 1634 posts
  • LocationBelleair Beach, Florida

Posted 14 August 2017 - 05:38 PM

This is a hack to prepare your unit to install a map/firmware update. Confirmed to allow firmware updates for all Z110, Z120, Z130, Z140, X920, X930, X940 - and probably their corresponding rest-of-the-world units. I can't say whether it will work with the very old units, and it won't work with the model numbers ending in 50 or greater,  or Nex units. 
 
Abstract:
This was an early method used to hack map update releases. I believe it was published by member ShortFuse. Use this hack to allow installation of new update releases without requiring a unique password from Pioneer (which binds the update's unique media serial number to a specific headunit's serial number). It involves patching a DLL on the headunit prior to installing the update.

UPDATE: See post #15 for an easy automated installation of a pre-hacked file. No Testmode or hex file editing needed. I'll leave the rest of this original post here for educational purposes. If you use the script method, steps 1 - 4 below can be skipped. But read 5 & 6.
 
I only recommend this hack for those experienced with modifying/hacking their AVIC units. This is just an interim method to install the maps/firmware until a more "user friendly" way has been engineered. It requires familiarity with use of TestMode to copy/paste/delete files on your headunit. TestMode's user interface is not intuitive and very frustrating and error prone. I recommend watching JasonH's youtube tutorial - but do not install Condi's Hackmode. Just  download supertestmode.zip; unzip it; copy TESTMODE.KEY to your SD; insert in your headunit. I also recommend making a backup of all the files/folders on your headunit in the USER folder before trying anything. Put that SD away and keep it. If you brick your headunit with no backup, I won't be helping you. Let me be clear here. The danger isn't that this hack will damage your unit. The danger is that you will inadvertently delete something important using TestMode. If you use care it is perfectly safe.
 
1. First Boot into TestMode.
 You'll need to identify the "active" set of files. There are two \USER\PRGx directories on your HU. The active one is indicated by the presence or absence of a file named \USER\PRG.FLG  If this file is not present, the active application files are in \USER\PRG0\APL. Otherwise, the active files are in \USER\PRG1\APL.  Upon further research I see most people using this hack say to use the USER\PRG0\APL file. From now on I'll just call it the APL_Directory.
 
2. Get a copy of APL_Directory/RenewallFlib.dll.  If you still have the files from the last map update installation, you can also get it from there. Actually I don't know if it matters where you get the file. Copy it to an SD and then move it to your computer.
 
3. Using a hex file editor (like HxD.exe) apply these changes to your copy of RenewallFlib.dll. Using HxD.exe - when using Find or Replace make sure you set to it to Hex Values. It defaults to String data type. Also, put spaces between the hex bytes (a byte in hex has two numbers....03 50 A0 E3).  (Note: if the expected values are not found at that offset location, do not continue - your firmware is not compatible). See Alternate Patch Method below.

  • Offset 000019F0:  0350A0E3 replace with 0050A0E3
  • Offset 00001A10:  0350A0E3 replace with 0050A0E3
  • Offset 00001A3C:  0350A0E3 replace with 0050A0E3
  • Offset 00001AD8:  0350A0E3 replace with 0050A0E3
  • Offset 00001C1C:  0250A0E3 replace with 0050A0E3
  • Offset 00001C24:  0150A0E3 replace with 0050A0E3

IMPORTANT - do not modify the file on your new map/firmware installation SD -  this will cause the installation to fail. Use a different SD with Testmode.key and the patched file.
 
4. Copy the file back to your HU into the same APL_Directory. Hint: you must delete the old one before you can "Paste" the file back. TestMode silently ignores overwrites. 
It is a very good idea to keep a copy of the original file. This DLL (library) only gets used during firmware updates. 
Edit: It wouldn't hurt (and might help) if you copied the modified file into both APL folders (\USER\PRG0\APL and \USER\PRG1\APL). This way you are sure the hacked DLL will be used.
 
5. Install the unmodified map update. (see separate thread for map updates and instructions)
Restart you head unit and insert the map update SD.  With this "ShortFuse" hack installed on your headunit, the update will work as described in the release documentation. When prompted for the password from Pioneer, the password you enter will not be validated in the normal manner. I suspect you could enter anything that is 16 characters long but I recommend entering PASSWORDPASSWORD just because I know that works. If the update software rejects that password, you did something wrong.
 
6. If the map update fails to complete and you are stuck with a wrong or incorrect SD message:

  • boot into testmode. 
  • go into file maintenance
  • remove the file USER\SYSTEM\Download\StartKnd.log

This will kick the unit out of upgrade mode, and it should restart into regular mode on next power up (remember to remove the TestMode SD).
 
Enjoy!
 
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// 
Alternate Patch Method.
There are multiple version of the RenewalIFLib.dll file. For some the offsets of this patch could be slightly different. In that case, try using this method.
 
Using HxD (hex editor), load up the RenewalIFLib.dll file you copied from PRG0\APL
Enter the Search/Replace dialogue and make sure Datatype is Hex-values[/size]
Search For: 03 50 A0 E3  Replace with:  00 50 A0 E3
In Search Direction select All
Then click Replace All
You should see a dialog box saying Replaced 4 occurrences of "03 50 A0 E0". Press OK.
 
Now, the fuzzy part. Search at or nearby these addresses and replace:

  • At or near Offset 00001C1C: find 0250A0E3 replace with 0050A0E3
  • At or near Offset 00001C24: find 0150A0E3 replace with 0050A0E3

If the above worked, save the file and continue at step 4 above. If not, something is wrong. Do not save the file.



#2 ric90

ric90
  • Members
  • 6 posts

Posted 19 August 2017 - 08:50 AM

Hello guys but this update is also good for the F-series?

#3 RonS

RonS

    Established Member

  • Moderators
  • 1634 posts
  • LocationBelleair Beach, Florida

Posted 19 August 2017 - 12:07 PM

Hello guys but this update is also good for the F-series?

This hack should also work for many F series. I believe it was actually developed for the F series. At least WinCE based units since around 2009.



#4 egoneyer

egoneyer
  • Members
  • 9 posts

Posted 29 August 2017 - 04:58 PM

Thank you! I will try it immediatly and report the result!



#5 egoneyer

egoneyer
  • Members
  • 9 posts

Posted 29 August 2017 - 05:48 PM

It works! I just tried it again and now it's updating!

I keep you up to date, when it's complete



#6 Joy

Joy
  • Members
  • 6 posts

Posted 29 August 2017 - 06:02 PM

Hi RonS, I'm stuck with "Wrong SD" message. I used an old VERINFO.DAT on the new SD. My bad. But I don't have a file in the Download folder. It's empty. Any tips or tricks?

 

Thanks in advance!



#7 RonS

RonS

    Established Member

  • Moderators
  • 1634 posts
  • LocationBelleair Beach, Florida

Posted 29 August 2017 - 06:09 PM

Hi RonS, I'm stuck with "Wrong SD" message. I used an old VERINFO.DAT on the new SD. My bad. But I don't have a file in the Download folder. It's empty. Any tips or tricks?

 

Thanks in advance!

Did it actually ask for a password and start the update? What happens if you eject the SD and reboot? I'd go back to the correct (original) VERINFO.DAT. That file is tied to a specific update version, and might be what triggered the Wrong SD message.



#8 Joy

Joy
  • Members
  • 6 posts

Posted 29 August 2017 - 06:15 PM

No it didn't ask for a password. It started so I was quite happy. For a brief moment. If eject and reboot, the infamous message "wrong sd" appears.

 

I don't know how to go back. I see a folder "RENEWAL" in the system directory...



#9 Joy

Joy
  • Members
  • 6 posts

Posted 29 August 2017 - 06:22 PM

Wait a moment. Suddenly there was that log file in the Download directory. I removed it. And it works fine again. Don't know why it wasn't there before. Checked it multiple times. Pfewwww. Thanks!



#10 egoneyer

egoneyer
  • Members
  • 9 posts

Posted 29 August 2017 - 06:38 PM

Update Comlpete!

Thanks for your Support, RonS!



#11 RonS

RonS

    Established Member

  • Moderators
  • 1634 posts
  • LocationBelleair Beach, Florida

Posted 29 August 2017 - 06:55 PM

Update Comlpete!

Thanks for your Support, RonS!

Great news. AFAIK you're the first to verify it works on F series.



#12 Joy

Joy
  • Members
  • 6 posts

Posted 29 August 2017 - 09:17 PM

It works on the F930BT as well.



#13 maunav90

maunav90
  • Members
  • 1 posts

Posted 30 August 2017 - 05:13 PM

I downloaded the Supertest for my F840BT but opens the menu of copy files for the update... how can i solve this?



#14 RonS

RonS

    Established Member

  • Moderators
  • 1634 posts
  • LocationBelleair Beach, Florida

Posted 30 August 2017 - 05:39 PM

I downloaded the Supertest for my F840BT but opens the menu of copy files for the update... how can i solve this?

From what I understand from your post, that's what it is supposed to do. If you don't understand the details of these instructions, you shouldn't be attempting this hack. It is easy to damage your unit.

 

To get an understanding of TestMode see several of the videos on Youtube. Like this one https://www.youtube....h?v=ipoK6dfCp_Q



#15 RonS

RonS

    Established Member

  • Moderators
  • 1634 posts
  • LocationBelleair Beach, Florida

Posted 06 September 2017 - 10:50 PM

I have an easy way to install the ShortFuse hack with no TestMode,  editing or patching involved. I've tested as much as I can on my unit. So I'm releasing here for you guys. 

 

Just download this attached zip, unzip, and copy the 3 files to the root of a blank fat32 formatted SD. When you insert it into your AVIC it runs a script that will backup both your existing RenewalIFLib.dll files, then overwrite them with a pre-hacked one. If, for some reason, this  doesn't allow installing the 2017 maps on your unit, the backup files could be manually re-installed. But that isn't really necessary. So it should do no permanent harm if it doesn't work. However, I have high confidence it will.

 

 

When you insert the SD, it will prompt you to press any key (button) to continue - or - turn off the ignition to abort.  If you decide to abort, just turn off and on your unit - then eject the SD. Nothing on your unit will have changed. But in order to re-run, you'll need to re-build the SD from the zipped files  (since Testmode.key has been deleted off the SD). Unless some error message is shown, there is no reason to rerun this script. You will just overwrite the same files.

 

Otherwise, it will copy your original RenewalIFLib.dll files from USER/PRG0/APL and USER/PRG1/APL onto the SD and rename them RenewalIFLib.dl0 and RenewalIFLib.dl1, Then it will copy the pre-hacked RenewalIFLib.dll in their place on the AVIC unit.

 

Note: this zip has a special Testmode.key that should only be used to run scripts. It isn't the supertestmode version that allows running the maintenance menu. Also, to prevent over-writing your backed-up original RenewalIFLib.dll files on the SD, the script deletes TestMode.key on the SD.  So if you insert it again, nothing will happen.  It can only be run again with manual intervention. Don't try rerunning it unless you know what you are doing. Overwriting your original RenewalIFLib.dll files on the SD isn't necessarily a huge problem, but it might make recovery (in the unlikely event it is necessary) a little more difficult.

 

Oh yeah, you'll still need to download and run the map update and enter the dummy password PASSWORDPASSWORD when asked for the Pioneer password. This should work for the US and EU maps.

Attached Files






0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users