This is a hack to prepare your unit to install a map/firmware update. Confirmed to allow firmware updates for all Z110, Z120, Z130, Z140, X920, X930, X940 - and probably their corresponding rest-of-the-world units. I can't say whether it will work with the very old units, and it won't work with the model numbers ending in 50 or greater, or Nex units.
This was an early method used to hack map update releases. I believe it was published by member ShortFuse. Use this hack to allow installation of new update releases without requiring a unique password from Pioneer (which binds the update's unique media serial number to a specific headunit's serial number). It involves patching a DLL on the headunit prior to installing the update.
UPDATE: See post #15 for an easy automated installation of a pre-hacked file. No Testmode or hex file editing needed. I'll leave the rest of this original post here for educational purposes. If you use the script method, steps 1 - 4 below can be skipped. But read 5 & 6.
I only recommend this hack for those experienced with modifying/hacking their AVIC units. This is just an interim method to install the maps/firmware until a more "user friendly" way has been engineered. It requires familiarity with use of TestMode to copy/paste/delete files on your headunit. TestMode's user interface is not intuitive and very frustrating and error prone. I recommend watching JasonH's youtube tutorial - but do not install Condi's Hackmode. Just download supertestmode.zip; unzip it; copy TESTMODE.KEY to your SD; insert in your headunit. I also recommend making a backup of all the files/folders on your headunit in the USER folder before trying anything. Put that SD away and keep it. If you brick your headunit with no backup, I won't be helping you. Let me be clear here. The danger isn't that this hack will damage your unit. The danger is that you will inadvertently delete something important using TestMode. If you use care it is perfectly safe.
1. First Boot into TestMode.
You'll need to identify the "active" set of files. There are two \USER\PRGx directories on your HU. The active one is indicated by the presence or absence of a file named \USER\PRG.FLG If this file is not present, the active application files are in \USER\PRG0\APL. Otherwise, the active files are in \USER\PRG1\APL.
Upon further research I see most people using this hack say to use the USER\PRG0\APL file. From now on I'll just call it the APL_Directory.
2. Get a copy of APL_Directory/RenewallFlib.dll. If you still have the files from the last map update installation, you can also get it from there. Actually I don't know if it matters where you get the file. Copy it to an SD and then move it to your computer.
3. Using a hex file editor (like HxD.exe) apply these changes to your copy of RenewallFlib.dll. Using HxD.exe - when using Find or Replace make sure you set to it to Hex Values. It defaults to String data type. Also, put spaces between the hex bytes (a byte in hex has two numbers....03 50 A0 E3). (Note: if the expected values are not found at that offset location, do not continue - your firmware is not compatible). See Alternate Patch Method below.
- Offset 000019F0: 0350A0E3 replace with 0050A0E3
- Offset 00001A10: 0350A0E3 replace with 0050A0E3
- Offset 00001A3C: 0350A0E3 replace with 0050A0E3
- Offset 00001AD8: 0350A0E3 replace with 0050A0E3
- Offset 00001C1C: 0250A0E3 replace with 0050A0E3
- Offset 00001C24: 0150A0E3 replace with 0050A0E3
IMPORTANT - do not modify the file on your new map/firmware installation SD - this will cause the installation to fail. Use a different SD with Testmode.key and the patched file.
4. Copy the file back to your HU into the same APL_Directory. Hint: you must delete the old one before you can "Paste" the file back. TestMode silently ignores overwrites.
It is a very good idea to keep a copy of the original file. This DLL (library) only gets used during firmware updates.
Edit: It wouldn't hurt (and might help) if you copied the modified file into both APL folders (\USER\PRG0\APL and \USER\PRG1\APL). This way you are sure the hacked DLL will be used.
5. Install the unmodified map update. (see separate thread for map updates and instructions)
Restart you head unit and insert the map update SD. With this "ShortFuse" hack installed on your headunit, the update will work as described in the release documentation. When prompted for the password from Pioneer, the password you enter will not be validated in the normal manner. I suspect you could enter anything that is 16 characters long but I recommend entering PASSWORDPASSWORD just because I know that works. If the update software rejects that password, you did something wrong.
6. If the map update fails to complete and you are stuck with a wrong or incorrect SD message:
- boot into testmode.
- go into file maintenance
- remove the file USER\SYSTEM\Download\StartKnd.log
This will kick the unit out of upgrade mode, and it should restart into regular mode on next power up (remember to remove the TestMode SD).
Alternate Patch Method.
There are multiple version of the RenewalIFLib.dll file. For some the offsets of this patch could be slightly different. In that case, try using this method.
Using HxD (hex editor), load up the RenewalIFLib.dll file you copied from PRG0\APL
Enter the Search/Replace dialogue and make sure Datatype is Hex-values[/size]
Search For: 03 50 A0 E3 Replace with: 00 50 A0 E3
In Search Direction select All
Then click Replace All
You should see a dialog box saying Replaced 4 occurrences of "03 50 A0 E0". Press OK.
Now, the fuzzy part. Search at or nearby these addresses and replace:
- At or near Offset 00001C1C: find 0250A0E3 replace with 0050A0E3
- At or near Offset 00001C24: find 0150A0E3 replace with 0050A0E3
If the above worked, save the file and continue at step 4 above. If not, something is wrong. Do not save the file.