Jump to content
AVIC411.com
RonS

Map Update Hack using "ShortFuse" method - Z110-Z140;X920-X940

Recommended Posts

This is a hack to prepare your unit to install a map/firmware update. Confirmed to allow firmware updates for all Z110, Z120, Z130, Z140, X920, X930, X940 - and probably their corresponding rest-of-the-world units. I can't say whether it will work with the very old units, and it won't work with the model numbers ending in 50 or greater,  or Nex units. 
 

This should work with the following F series models:

F10BT, F20BT, F30BT, F40BT, F840BT, F8430BT, F920BT, F930BT, F940BT, F9210BT, F9220BT, F9310BT

 

Abstract:
This was an early method used to hack map update releases. I believe it was published many years ago by member ShortFuse. Use this hack to allow installation of new update releases without requiring a unique password from Pioneer (which binds the update's unique media serial number to a specific headunit's serial number). It involves patching a DLL on the headunit prior to installing the update.

UPDATE: See  Easy method  for an automated installation of a pre-hacked file. No Testmode or hex file editing needed. I'll leave the rest of this original post here for educational purposes. If you use the script method, steps 1 - 4 below can be skipped. But read 5 & 6.
 
I only recommend this hack for those experienced with modifying/hacking their AVIC units. It requires familiarity with use of TestMode to copy/paste/delete files on your headunit. TestMode's user interface is not intuitive and very frustrating and error prone. I recommend watching JasonH's youtube tutorial - but do not install Condi's Hackmode. Just  download supertestmode.zip; unzip it; copy TESTMODE.KEY to your SD; insert in your headunit. I also recommend making a backup of all the files/folders on your headunit in the USER folder before trying anything. Put that SD away and keep it. If you brick your headunit with no backup, I won't be helping you. Let me be clear here. The danger isn't that this hack will damage your unit. The danger is that you will inadvertently delete something important using TestMode. If you use care it is perfectly safe.
 
1. First Boot into TestMode.
 You'll need to identify the "active" set of files. There are two \USER\PRGx directories on your HU. The active one is indicated by the presence or absence of a file named \USER\PRG.FLG  If this file is not present, the active application files are in \USER\PRG0\APL. Otherwise, the active files are in \USER\PRG1\APL.  Upon further research I see most people using this hack say to use the USER\PRG0\APL file. From now on I'll just call it the APL_Directory.
 
2. Get a copy of APL_Directory/RenewallFlib.dll.  If you still have the files from the last map update installation, you can also get it from there. Actually I don't know if it matters where you get the file. Copy it to an SD and then move it to your computer.
 
3. Using a hex file editor (like HxD.exe) apply these changes to your copy of RenewallFlib.dll. Using HxD.exe - when using Find or Replace make sure you set to it to Hex Values. It defaults to String data type. Also, put spaces between the hex bytes (a byte in hex has two numbers....03 50 A0 E3).  (Note: if the expected values are not found at that offset location, do not continue - your firmware is not compatible). See Alternate Patch Method below.

  • Offset 000019F0:  0350A0E3 replace with 0050A0E3
  • Offset 00001A10:  0350A0E3 replace with 0050A0E3
  • Offset 00001A3C:  0350A0E3 replace with 0050A0E3
  • Offset 00001AD8:  0350A0E3 replace with 0050A0E3
  • Offset 00001C1C:  0250A0E3 replace with 0050A0E3
  • Offset 00001C24:  0150A0E3 replace with 0050A0E3

IMPORTANT - do not modify the file on your new map/firmware installation SD -  this will cause the installation to fail. Use a different SD with Testmode.key and the patched file.
 
4. Copy the file back to your HU into the same APL_Directory. Hint: you must delete the old one before you can "Paste" the file back. TestMode silently ignores overwrites. 
It is a very good idea to keep a copy of the original file. This DLL (library) only gets used during firmware updates. 
Edit: It wouldn't hurt (and might help) if you copied the modified file into both APL folders (\USER\PRG0\APL and \USER\PRG1\APL). This way you are sure the hacked DLL will be used.
 
5. Install the unmodified map update. (see separate thread for map updates and instructions)
When you are ready to install a map update for your supported AVIC model, just restart your head unit and insert the map update SD.  With the "ShortFuse" hack installed on your head unit, the update will work as described in the release documentation. When prompted for the password from Pioneer, the password you enter will not be validated in the normal manner. I suspect you could enter anything that is 16 characters long but I recommend entering PASSWORDPASSWORD just because I know that works. If the update software rejects that password, you did something wrong.
 
6. If the map update fails to complete and you are stuck with a wrong or incorrect SD message:

  • boot into testmode. 
  • go into file maintenance
  • remove the file USER\SYSTEM\Download\StartKnd.log

This will kick the unit out of upgrade mode, and it should restart into regular mode on next power up (remember to remove the TestMode SD). You should still be running with your previous firmware and maps.
 

Enjoy!
 
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// 
Alternate Patch Method.
There are multiple version of the RenewalIFLib.dll file. For some the offsets of this patch could be slightly different. In that case, try using this method.
 
Using HxD (hex editor), load up the RenewalIFLib.dll file you copied from PRG0\APL
Enter the Search/Replace dialogue and make sure Datatype is Hex-values[/size]
Search For: 03 50 A0 E3  Replace with:  00 50 A0 E3
In Search Direction select All
Then click Replace All
You should see a dialog box saying Replaced 4 occurrences of "03 50 A0 E0". Press OK.
 
Now, the fuzzy part. Search at or nearby these addresses and replace:

  • At or near Offset 00001C1C: find 0250A0E3 replace with 0050A0E3
  • At or near Offset 00001C24: find 0150A0E3 replace with 0050A0E3

If the above worked, save the file and continue at step 4 above. If not, something is wrong. Do not save the file.

Share this post


Link to post
Share on other sites
On 8/19/2017 at 4:50 AM, ric90 said:

Hello guys but this update is also good for the F-series?

This isn't an update. It is a hack to existings files on your unit to bypass Pioneer password verification during the update installation.  It should also work for many F series. I believe it was actually developed for the F series. At least WinCE based units since around 2009.

Share this post


Link to post
Share on other sites

Hi RonS, I'm stuck with "Wrong SD" message. I used an old VERINFO.DAT on the new SD. My bad. But I don't have a file in the Download folder. It's empty. Any tips or tricks?

 

Thanks in advance!

Share this post


Link to post
Share on other sites

Hi RonS, I'm stuck with "Wrong SD" message. I used an old VERINFO.DAT on the new SD. My bad. But I don't have a file in the Download folder. It's empty. Any tips or tricks?

 

Thanks in advance!

Did it actually ask for a password and start the update? What happens if you eject the SD and reboot? I'd go back to the correct (original) VERINFO.DAT. That file is tied to a specific update version, and might be what triggered the Wrong SD message.

Share this post


Link to post
Share on other sites

No it didn't ask for a password. It started so I was quite happy. For a brief moment. If eject and reboot, the infamous message "wrong sd" appears.

 

I don't know how to go back. I see a folder "RENEWAL" in the system directory...

Share this post


Link to post
Share on other sites

Wait a moment. Suddenly there was that log file in the Download directory. I removed it. And it works fine again. Don't know why it wasn't there before. Checked it multiple times. Pfewwww. Thanks!

Share this post


Link to post
Share on other sites

Update Comlpete!

Thanks for your Support, RonS!

Great news. AFAIK you're the first to verify it works on F series.

Share this post


Link to post
Share on other sites

I downloaded the Supertest for my F840BT but opens the menu of copy files for the update... how can i solve this?

From what I understand from your post, that's what it is supposed to do. If you don't understand the details of these instructions, you shouldn't be attempting this hack. It is easy to damage your unit.

 

To get an understanding of TestMode see several of the videos on Youtube. Like this one https://www.youtube.com/watch?v=ipoK6dfCp_Q

Share this post


Link to post
Share on other sites

I have an easy way to install the ShortFuse hack with no TestMode,  editing or patching involved. I've tested as much as I can on my unit. So I'm releasing here for you guys. 

 

Just download this attached zip, unzip, and copy the 3 files to the root of a blank fat32 formatted SD. When you insert it into your AVIC it runs a script that will backup both your existing RenewalIFLib.dll files, then overwrite them with a pre-hacked one. If, for some reason, this  doesn't allow installing the 2017 maps on your unit, the backup files could be manually re-installed. But that isn't really necessary. So it should do no permanent harm if it doesn't work. However, I have high confidence it will.

 

 

When you insert the SD, it will prompt you to press any key (button) to continue - or - turn off the ignition to abort.  If you decide to abort, just turn off and on your unit - then eject the SD. Nothing on your unit will have changed. But in order to re-run, you'll need to re-build the SD from the zipped files  (since Testmode.key has been deleted off the SD). Unless some error message is shown, there is no reason to rerun this script. You will just overwrite the same files.

 

Otherwise, it will copy your original RenewalIFLib.dll files from USER/PRG0/APL and USER/PRG1/APL onto the SD and rename them RenewalIFLib.dl0 and RenewalIFLib.dl1, Then it will copy the pre-hacked RenewalIFLib.dll in their place on the AVIC unit.

 

Note: this zip has a special Testmode.key that should only be used to run scripts. It isn't the supertestmode version that allows running the maintenance menu. Also, to prevent over-writing your backed-up original RenewalIFLib.dll files on the SD, the script deletes TestMode.key on the SD.  So if you insert it again, nothing will happen.  It can only be run again with manual intervention. Don't try rerunning it unless you know what you are doing. Overwriting your original RenewalIFLib.dll files on the SD isn't necessarily a huge problem, but it might make recovery (in the unlikely event it is necessary) a little more difficult.

 

Oh yeah, you'll still need to download and run the map update and enter the dummy password PASSWORDPASSWORD when asked for the Pioneer password. This should work for the US and EU maps.

 

 

ShortFuseScript.zip

Edited by RonS
Re-uploaded ShortfuseScript.zip

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now

×