Pretty quiet around here...has anyone been able to determine where the firmware code is on the DVD and which CPU instruction set it uses?

With that info it should be easy to disassemble the code and make small changes...such as getting rid of that blasted nag screen on the map everytime the unit is powered up. If the code uses a checksum that can be maintained on a small tweak by using a small jump instruction and putting dead opcodes in between to maintain the checksum.

i've just been poking around my AVIC N1s code, it looks like it uses an NEC 78K derivative, i just did a partial disassembly and it looks like the 78K works..

the PRG files are the code.


i saw a pic of a circuit board on here, but the image isn't clear enough to read the cpus model number.


looks like the gps unit spits out standard NMEA strings i wonder if you could hook into them for other things

thinking about it, i wish there was a way to get the d1,d2 to save teh audio settings, after losing power (ie. disconnecting battery)

charliex said:

i've just been poking around my AVIC N1s code, it looks like it uses an NEC 78K derivative, i just did a partial disassembly and it looks like the 78K works..

the PRG files are the code.


i saw a pic of a circuit board on here, but the image isn't clear enough to read the cpus model number.


looks like the gps unit spits out standard NMEA strings i wonder if you could hook into them for other things

Excellent, that is enought to start an examination since that will tell me what the opcode bytes are for that CPU. With that it should be possible to trace back what opcodes launch the nag screen, since the text string will be present for it, and attempt to change the instruction bytes to go around it.

Can you point me to where you got your disassembler from?

sorry Vandal, i forget to recheck the forums, IDA Pro from datarescue.com