bushing

This screen? This means the internal SD card can't be read:

Come on, if we're going by how much this stuff is worth doing now ...

Hi guys! I already have the apk / odex files disassembled to .smali, I can share them if anyone else wants to look at them Sofakng, yes, I have some background in EE, glad you like the blog posts! I have a crafted "update" that you can apply using one of the test modes that can patch the PLCaution nag screen out. It also offers a couple different ways of backing up your internal SD card to external USB or SD; you can use a built-in EasyRecovery mode to re-image the internal SD without opening up the case (or you can use the image to restore the internal card manually if that doesn't w

Yes, I did try going back from the "SET ON" message. Someone with more practice reversing Android apps could probably find this in five minutes, let me know if anyone wants the APK / ODEX ... But if I'm doing it on my own, here's what the layout for the AV "Off" screen is (when you're in the AV screen, but all sources are off) -- http://pastie.org/private/z0brsx08glku0erwteuvg After staring at that for a while, I boil that down to <CTL_Control_ViewGroupBase layout_width=fill_parent layout_height=fill_parent> <CTL_Control_ImageViewBase width=267 height=144 marginLeft=63

Yeah, the SD card password just isn't useful for most people because it's pretty difficult to use -- and I'm not even sure it's the same for all units! More useful would be a dump of the SD card, because any(?) system will boot an unlocked card; I can't release my image, but hopefully I've provided enough information for someone else to reproduce this and post an image. No need to "root" the thing, it's pre-rooted, if you can manage to turn on ADB or find the correct serial port and enable it (I believe that both of these are possible by pressing hidden buttons in the display, much like t

Possibly; there's a lot of parts missing on my 5000NEX compared to the most expensive models (e.g. HDMI input, internal (visible SD slot), CAN bus interface of some sort? What specific features would you like to try "upgrade"? Thanks for the kind words! Sometimes you just need to find a project that annoys you enough to make it worth the time. This counts, for me. In principle, there's nothing keeping us from rooting these boxes, though more research is necessary to figure out how to e.g. enable ADB. (There seems to be a hidden debug menu that will allow this, but I haven't

I'm doing a bit of reversing of my AVIC-5000NEX with the goal of eventually making my own update that disables the nag screen. I'm still quite a ways away from that, but I wrote up a blog post that some of you might find interesting.

I have a lot of fun plans for this one --- plans made significantly easier by finding schematic and service info for the NEX series. Hell, I found the Avic-D1 manual several places, and with a bit of digging I found complete schematics and partial source code for the AppRadios on GoogleCode (wtf?!?) Any suggestions?

I also tried replacing struct_0 with struct_0 ... and same result (freeze).

Great! Time to pick this back up, then. I put some updated files (disassembly, etc) here: http://people.freedesktop.org/~bbyer/av ... 07.lst.bz2 I'd like to draw your attention to this table of function pointers: 08C27B40 unktable: struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 struct_0 There are two other similar tables (0x8c2804c, 0x8b4eda0), but I can't find references to the first two, only to the latter (TaskTable). I experimented bef

Sorry, i've been busy, but I've had a number of requests for this, so here ya go -- from memory. Getting into the Service mode on AVIC-D1 (and D2?) 1. Turn car on, AVIC unit should power on. 2. Hold down OPEN button so that the panel flips down all of the way (as if you were going to replace the Map DVD 3. Using a paperclip (etc), press the Reset button on the LCD panel -- this is inside a small hole next to the directional (joystick) control. Hold down the button. 4. While holding down the reset button, press the DVD drive Eject button (the lower of the two eject buttons, it says "RO

Okay, I'm pretty much stuck here, so I'm posting what I have so far in the hopes that someone else might be able to get further. The "Application" code is contained on the DVD as EU050APL.PRG, and it references strings in the file UC050DAT.USA. http://people.freedesktop.org/~bbyer/avic/eu050apl.prg http://people.freedesktop.org/~bbyer/avic/UC050DAT.USA A parsed version of the strings file is here: http://people.freedesktop.org/~bbyer/avic/UC050DAT.USA.txt That was produced with this program: http://people.freedesktop.org/~bbyer/avic/parse-dat.c In order to modify either

Thanks If you scroll back up to http://avic411.com/forum/viewtopic.php?p=25112#25112, that's one of the strings in UC050DAT.USA; the "hard" part was finally figuring out the checksum so that it would actually let me reflash that file using the service menu. (If you don't fix the checksum, it will try to reflash, but it will tell you it failed, and it will refuse to boot until you insert a DVD with a valid copy of that file, which it will then reflash.) I'll post the checksum program in a bit, but what I'm really trying to do is patch the code (in EU050APL.PRG) to skip the screen entirel

I've still been working on this, off and on for the past few months. I wrote a V830 disassembler plugin for IDA Pro. While it's not perfect, it works well enough to disassemble most of UC050SYS. I believe the code that verifies the checksums is in there, but I haven't been able to figure out where. Does anyone here read assembly? I'd be happy to email my partial disassembly...