1. Hit the reset button(don't need to hold it down for any specified time). 2. As soon as you let go, hold both the menu and map keys.

3. Very soon you will see a blue screen with the words "Please press reset key again" -DON'T press the reset key!

4. If you push the menu or map up/down, left/right you will see dots appear on the bottom.

After a few combinations, you will see"Pass Key Failed. Retry Again!!"

To me this indicates it is waiting for the button sequence to reveal a service menu.

I tried a bunch of combos, but was not ablle to get in. Wish I had pictures, but knowing the members here, someone will not only post them, but the correct code as well.

Cheers!

hmmm thats very neat i wonder how many buttons long the password is

The code is 5 buttons long, and there are 7 possible entries on the panel MENU, MAP, UP, DOWN , LEFT, RIGHT, and CENTER CLICK, eject and rotation on the knob are not recognized so there are 7^5 or 16,807 combination's with repeats or 5,040 with no repeats, too many to brute force one at a time by hand, any device devs have any idea where the code for this screen would be, seems like it might be on a bios or something since it happens right after reset and comes on way before any win ce stuff is started

The AVIC-Z2 had Up, Up, Down, Down, Enter as a password. I wonder if the F Series has something similar.

The AVIC-Z2 had Up, Up, Down, Down, Enter as a password. I wonder if the F Series has something similar.

Same with the D2, it's Up, Up, Down, Down, press the joystick in (enter).

Didnt work for me...

Has anyone tried the corners of the touch screen yet?

Some of the WinCE based products we use in the broadcasting business utilize the corners as part of the passcode.

I'm working on cracking this puppy!

I tipy up up up up up end my screen goes bleck!!

I tipy up up up up up end my screen goes bleck!!

W T F

so THIS is what i was doing when my screen went blue and i thought i had JUST messed up my new avic haha on the next road trip ill get the passanger to try random things

The code is 5 buttons long, and there are 7 possible entries on the panel MENU, MAP, UP, DOWN , LEFT, RIGHT, and CENTER CLICK, eject and rotation on the knob are not recognized so there are 7^5 or 16,807 combination's with repeats or 5,040 with no repeats, too many to brute force one at a time by hand, any device devs have any idea where the code for this screen would be, seems like it might be on a bios or something since it happens right after reset and comes on way before any win ce stuff is started

..

Do you know what this will all allow us to do? Would custom firmware be a possibility? Or maybe just a modified version fixing many flaws would be awesome.

I really hope that one day we can have a ROM image which included a wince.nls and registry enteries with international font support.

Check with the ROM Developers at XDA-Developers.com in the forum under Raphel. Those guys do some nasty stuff with Windows Mobile, maybe they can make something for us?

Well if this works and custom FW are possible this will become a whole new ballgame. That's what I like to hear for sure.

This unit could easily become a homebrew device of choice for in car computing.

I'm coding inclined, but please developers and coding people get to work and figure out how was cna utilize this NEW information.

its like Christmas again

This procedure actually doesn't work on mine. Unit resets and goes into this weird mode where all LED's flash constantly but Avic functions properly. Anyone else tried or care to try?

Does anyone know what type of CPU the F series uses? If it is ARM or x86 I plan on pulling it apart. Reverse engineering is a hobby of mine and this sort of thing will be easy to find (the proper code) Mine gets in tommorow so hopefully I can start breaking it soon.

Bad HAL 9K, it's a SiRF/Centrality Titan ARM processor. ARM1136EJ1 core, ARM V6 instruction set.

Summary of the proc's at http://pdadb.net/index.php?m=cpu&id=a11gst.

Does anyone know what type of CPU the F series uses? If it is ARM or x86 I plan on pulling it apart. Reverse engineering is a hobby of mine and this sort of thing will be easy to find (the proper code) Mine gets in tommorow so hopefully I can start breaking it soon.

ARM.

Outstanding, as soon as I get it I will do a rom dump and start up IDA.

* Can't wait!

Outstanding, as soon as I get it I will do a rom dump and start up IDA.

 

* Can't wait!

Have fun. IDA'ing EZRider executable is quite educational...

Why wait for it to get to your door? You could check out this thread to find the FTP site jbhardling set up with backup images, etc. av.exe, systemsetting.exe, mainmenu.exe and shell.exe in the flash disk's APL folder are probably useful to look at for the Pioneer system calls and how they use their DLLs.

I already got my system, i did dumped the file system but that is as far as I have gotten right now. I am still doing some of the standard hacks.