Hello

I have just installed a F900 series (before I used PDAs/PNAs for many years) and after I accessed to operating system via Testmode I found something very familiar to me.

I have certain experience in modding an hp iPAQ310 (also 800x480, CE5.0, also a pre-igo8.0 inside) and what I found in the AVIC's Windows CE is almost the same (same CPU speeds, same processor, etc) that what is inside the iPAQ. Therefore many hacks already discussed on gpspassion iPAQ 310 thread could be potentially valid for the AVIC.

http://www.gpspassion.com/forumsen/topi ... chpage=163

One hack that I read in the past on above forum and I have previously used on the iPAQ is what I want to offer to anybody in the forum.

On windows CE it is possible to run another navigation programe without need to replace the suite. To do that it is possible to use a "fake" navigation programme that redirect to the navigation programme (i.e. in the Storage Disk). On this forum (sorry I don't know which page) it has published this fake program that run on Windows CE 5.0 that force the system to run a shortcut that has to be in the same folder with the same name (.lnk).

Thus if we substitute the original EZRIDER.exe (renaming it) by this fake programme and put a shortcut to the navigation program that we want to run and rename the shortcut as EZRIDER.lnk then when the AVIC will try to start EZRIDER.exe it will start the programme that we have choosen on the shortcut (i.e. iGO8.3)

If anyone want to test it, I have attached what I used on the iPAQ310. (remember to edit the shortcut to the place, flolder and .exe that you want to run)

I look forward to the results, Im eager to test but dont have the time right now.

Just keep in mind there are some potential issues you might encounter when you don't run Pioneer's iGo 8:

• 
  [*:1isj3er0]non-EZRIDER.exe apps may not handle Bluetooth handsfree calls (incoming or outgoing) correctly (seems like Tel.exe expects EZRIDER to handle the display of the phone controls)
  [*:1isj3er0]Missing Nav tie-ins to Mainmenu.exe and AV.exe (search your data.zip for "other.pioneer" type calls in the UI files, there are 5 or 6 IIRC). The alternate Nav app would need some way of executing the same commands out to the Pioneer apps in "Storage Disk/APL/". You might end up with a "System starting" overlay if the Nav software doesn't tell Mainmenu it's done initializing.
  [*:1isj3er0]AV.exe may not be able to overlay the audio menu on-top of the non-EZRIDER app (no song info, source switching w/out going back to Menu first)

Not meant to discourage using this technique, hoping to keep track of the issues encountered and how to work around them.

Just keep in mind there are some potential issues you might encounter when you don't run Pioneer's iGo 8:

 

• 
  [*:1q2c11ob]non-EZRIDER.exe apps may not handle Bluetooth handsfree calls (incoming or outgoing) correctly (seems like Tel.exe expects EZRIDER to handle the display of the phone controls)
  [*:1q2c11ob]Missing Nav tie-ins to Mainmenu.exe and AV.exe (search your data.zip for "other.pioneer" type calls in the UI files, there are 5 or 6 IIRC). The alternate Nav app would need some way of executing the same commands out to the Pioneer apps in "Storage Disk/APL/". You might end up with a "System starting" overlay if the Nav software doesn't tell Mainmenu it's done initializing.
  [*:1q2c11ob]AV.exe may not be able to overlay the audio menu on-top of the non-EZRIDER app (no song info, source switching w/out going back to Menu first)

 

Not meant to discourage using this technique, hoping to keep track of the issues encountered and how to work around them.

As far as I can tell, if one of Pioneer's shell executables (mainmenu, probably) does not receive a signal from iGO/EZRider after a certain time, it assumes that something is hosed and reboots the system.

As far as I can tell, if one of Pioneer's shell executables (mainmenu, probably) does not receive a signal from iGO/EZRider after a certain time, it assumes that something is hosed and reboots the system.

Could be... The F90/F900-BT schematics for the AV board (in the service manual) do have a watchdog timer signal coming back from the Navi unit to the uCOM. The whole point of a watchdog timer is if it doesn't get reset by a signal in X s/ms/whatever it's assumed that the software has hung and the reset pin to the whole system gets pulled. Guess we also need to figure out which GPIO that signal's connected to so we can write our own interrupt routine to periodically reset the timer if we're running some other Nav software (or alternatively send the message/RPC to Mainmenu, etc to fool it into thinking EZRider's up and running).

Isn't there a way to emulate the necessary applications as running, yet using no memory allocation? This would prevent the unit from rebooting.

What exactly does the unit look for, just the application name in the services/processes list, or something else? Is it looking for other running processes?

I'm no programmer, but I'm sure emulating the necessary applications to do what you want with the unit can be done.

Isn't there a way to emulate the necessary applications as running, yet using no memory allocation? This would prevent the unit from rebooting.

Anything's possible. Just takes someone with time (not me, at least for a few months), resources and determination.

What exactly does the unit look for, just the application name in the services/processes list, or something else? Is it looking for other running processes?

Tough to say, I'm sure Leetcoder or someone else more savvy with what the .exes are doing could tell you for sure (if I had an Arm4 de-compiler at my disposal, I could make a more informed guess). There seems to be a specific API that EZRider's using in the UI files (example from "ui_pioneer\common\ui\start.ui" below):

;send message to mainmenu
	EXEC "other.pioneer.postmessage" "MainMenu" "WM_APP_AV_IGOMAP" 0	

Notice it calls out the API routine ("other.pioneer.postmessage"), the .exe/process to send the message to ("MainMenu") and several arguments ("WM_APP_AV_IGOMAP" which is likely a typedef/enum/#define in the API header, and 0 which could be anything at this point). Since it mentions "postmessage" it may be using some sort of message passing interface (mailbox, shared memory space, etc) for the inter-process communication.

I'm no programmer, but I'm sure emulating the necessary applications to do what you want with the unit can be done.

See my earlier statement regarding time + money == results. If Pioneer had more time or thrown more money at the problem, I don't think we'd be as upset with the result now, would we.

Ok, let me show what happen.

Yesterday although it was the third day using the AVIC I can not resit to do the tweak and ...

1) The system start to boot as usual,

2) The iGO8 start normally although the banner stating that the system is starting does not dissapear.

3) The iGO8 work normally but the banner does not dissapear.

4) The Menu and Map button does not work as usual as in my case (running iGO8 with gurjon skin) the menu switch betwwen Cockpit and Map. I noticed also that there is no voice from iGO8.

5) After a couple of minutes, without having dissapeared the ban and without any access to AV source, etc. the system reset and start again in the same loop.

Thus, as summary, good try but definitively there is a upper SW layer that seems to be waiting for a EZRIDER answer and after some time force the unit to reset (I think is called watchdog).

Nevertheless I want to point out that the GURJON Skin for the iGO8.3 at 800x480 is designed to control the bluetooth as well as other external programmes (see www.gurjon.com) but obvioulsy thinking on iPAQ310 and thus it is supplied with some specific .exe (i.e. hp_bt.exe, etc.).

Therefore if anybody relly know what is necessary in principle this skin could be modded to incorporate the necessary links.

Cheers.