if anybody need, extract files from WINCEIMG.BIN

Posted Jul 03, 2009 · 14:53 UTC#1

1) my avic is UC and i use winceimg.bin from AVIC_F-Series_Firmware_Update_2.006000.zip

2) i use WinHex and cut WINCEIMG.BIN binSize : 17340884 checksum: 0x69711813

to 4 files toc.bin, eboot.nb0, chain.bin, wince42.nb0.

size for file you can get in WINCEIMG.BIN TOC.

WINCEIMG.BIN binSize : 17340884 checksum: 0x69711813
toc.bin 1364 bytes
0000000000: 53 49 47 2D 42 49 4E 46 53 20 20 20 20 20 20 20  SIG-BINFS
0000000010: 4E 54 4F 43 01 00 00 00 20 30 00 00 0F 00 00 00  NTOC    0  Â¤
0000000020: 00 00 00 00 00 00 00 00 00 00 00 00 FF FF FF FF              ÑÑÑÑ
0000000030: 02 00 01 00 54 4F 42 45 65 62 6F 6F 74 2E 6E 62    TOBEeboot.nb
0000000040: 30 00 00 00 00 00 00 00 02 00 00 00 00 01 00 00  0           
0000000050: 00 80 03 8C 00 80 03 8C 40 00 00 00 00 01 00 00   __ __@    
......
00000000C0: 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00              
00000000D0: 49 53 46 43 57 49 4E 43 45 34 32 2E 4E 42 30 00  ISFCWINCE42.NB0
00000000E0: 00 00 00 00 02 00 00 00 AF FA 00 00 00 00 04 8E         Ð‡ÑŠ    _
00000000F0: 00 00 04 8E A0 01 00 00 AF FA 00 00 00 00 00 00    _Â   Ð‡ÑŠ
......
000000022C: 03000000 0000C09B B8152A00 # => 002a15b8 -> 2758072 eboot.nb0
0000000338: 00000000 0040008C 28050000 # => 00000528 -> 1320 chain.bin
0000000444: 00000000 00000080 A079DE00 # => 00de79a0 -> 14580128 wince42.nb0

eboot.nb0: 2758072 bytes
0000000554: FE 03 00 EA 00 00 00 00 â”‚ 00 00 00 00 00 00 00 00  ÑŽ Ðº
0000000564: 00 00 00 00 00 00 00 00 â”‚ 00 00 00 00 00 00 00 00
0000000574: 00 00 00 00 00 00 00 00 â”‚ 00 00 00 00 00 00 00 00
0000000584: 00 00 00 00 00 00 00 00 â”‚ 00 00 00 00 00 00 00 00
0000000594: 45 43 45 43 B4 89 D2 9B â”‚ B4 89 12 00 00 00 00 00  ECEC_%Ð¢>_%
...
00002A1AFC: 44 51 D7 C6 A3 46 E8 65 â”‚ E7 68 65 00 40 00 00 00  DQÐ§Ð–_FÐ¸eÐ·he @

chain.bin: 1320 bytes
00002A1B0C: 02 00 00 00 00 00 00 80 â”‚ A0 79 DE 00 00 00 50 02        _Â yÐ®   P
00002A1B1C: 01 00 01 00 00 00 00 00 â”‚ 4E 4B 00 00 00 00 00 00        NK
...
00002A2024: 00 00 00 00 00 00 00 00 â”‚ 00 00 00 00 00 00 00 00

wince42.nb0: 14580128 bytes
00002A2034: E8 83 01 00 28 97 01 00 â”‚ 54 0F 03 00 4C D5 04 00  Ð¸_ (- TÂ¤ LÐ¥
00002A2044: E8 1C 02 00 B4 85 01 00 â”‚ 84 1D 02 00 AC 86 04 00  Ð¸ _: " â”+
00002A2054: E8 1C 02 00 C4 56 05 00 â”‚ 84 1D 02 00 3C 37 05 00  Ð¸ Ð”V " <7
00002A2064: D0 6E 04 00 7C 71 04 00 â”‚ E8 83 01 00 00 00 00 00  Ð n |q Ð¸_
00002A2074: 45 43 45 43 F4 60 DE 80 â”‚ F4 60 DE 00 00 00 00 00  ECECÑ„`Ð®_Ñ„`Ð®
00002A2084: 00 00 00 00 00 00 00 00 â”‚ 00 00 00 00 00 00 00 00
....
00010899C4: 00 12 00 00 C7 04 00 00 â”‚ F0 0F 1E 80 A8 FA 53 80     Ð—  Ñ€Â¤_ÐÑŠS_

so, after that you can use dumprom -d acivce wince42.nb0

or other way for extract, or ADD :mrgreen: files to avic windows CE.

Posted Jul 04, 2009 · 08:04 UTC#2

also, you can use

dumprom -d acivboot -5 eboot.nb0,

so you extract this files

dumprom -d acivboot -5 eboot.nb0,

atserisr.dll
binfs.dll
busenum.dll
ceddk.dll
coredll.dll
default.fdf
device.exe
devmgr.dll
diskcache.dll
fatfsd.dll
fatutil.dll
filesys.exe
fsdmgr.dll
hd.dll
initdb.ini
initobj.dat
mspart.dll
nk.exe
osaxst0.dll
pm.dll
regenum.dll
sdmlc.dll
tahoma.ttf
utldrv.dll
wince.nls

dumprom -d acivce -5 wince42.nb0

acmdwrap.dll
afd.dll
appdata.ini
asterisk.wav
asyncmac.dll
atlasserial.dll
atlce400.dll
audevman.dll
authentication.dll
autoras.dll
BKLCTL.CPL
Calibration.exe
CEATA.dll
ceconfig.h
cefobj.dll
ceshell.dll
close.2bp
close.wav
commctrl.dll
commdlg.dll
connmc.exe
connpnl.cpl
CONSHID.Dll
control.exe
control.lnk
copyrts.txt
cplmain.cpl
cplswitch.cpl
CPM_Test.exe
CPMTest.cpl
credprov.dll
credsvc.dll
critical.wav
crypt32.dll
CTLBCK.dll
ctlpnl.exe
cxport.dll
ddcore.dll
ddhel.dll
ddi.dll
ddraw.dll
default.wav
desktopdirectory.ini
dhcp.dll
dhcpv6l.dll
dsp.dll
Dw.exe
DwCtlPnl.cpl
DwUi.dll
DwXfer.dll
eap.dll
eapchap.dll
eapol.dll
eaptls.dll
empty.wav
ethman.dll
eventrst.exe
eventrst.lnk
exclam.wav
explore.lnk
explorer.exe
fatsdmlc.dll
fatutil_16k.dll
favorites.ini
fonts.ini
gps.dll
GpsMC.exe
GpsViewer.1.2P.0109.exe
gsm610.acm
gwes.exe
GYRO.dll
hidparse.dll
IECEExt.dll
imaadpcm.dll
imaging.dll
infbeg.wav
infend.wav
infintr.wav
intll.cpl
iphlpapi.dll
iPodJudge.dll
ipv6hlp.dll
jit.exe
jscript.dll
keybddr.dll
lightsdr.dll
menupop.wav
menusel.wav
mfcce400.dll
mlang.dll
mmtimer.dll
MouHid.dll
mp3dmod.dll
msacmce.dll
msasn1.dll
msdmo.dll
msfilter.dll
msim.dll
msxml3.dll
Mux07_10.dll
mydocuments.ini
ndis.dll
ndispwr.dll
ndisuio.dll
netbios.dll
netmui.dll
netui.dll
nleddrvr.dll
notify.dll
nspm.dll
ntlmssp.dll
ok.2bp
ole32.dll
oleaut32.dll
olece400.dll
openprog.wav
ppp.dll
pptp.dll
prnerr.dll
prnport.dll
programfiles.ini
programs.ini
PTDDrv.dll
PwrButton.dll
quartz.dll
question.wav
rapisrv.exe
recend.wav
recent.ini
recstart.wav
redir.dll
repllog.exe
rnaapp.exe
rra_stm.dll
rsaenh.dll
schannel.dll
SDBUS.dll
SDHC.dll
SDIO_UART.dll
SDMemory.dll
secur32.dll
serial.dll
services.exe
shcore.dll
shdocvw.dll
shell.exe
shlwapi.dll
softkb.dll
SPGOD_CE_DLL.dll
spnego.dll
ssllsp.dll
startup.ini
startup.wav
stdsm.2bp
stdsm.bmp
stguil.cpl
sysroots.p7b
system.cpl
SystemInfo.cpl
SystemInfo.exe
tapi.dll
tcpip6.dll
tcpstk.dll
timesvc.dll
toolhelp.dll
touch.dll
udp2tcp.exe
unimodem.dll
unload.exe
urlmon.dll
Usb_Info.dll
UsbClientSwitch.exe
usbd.dll
usbdisk6.dll
usbhid.dll
usbmsc.dll
usbmsfn.dll
usbotg.dll
usbprn.dll
USBSerialFn.dll
version.dll
vgd.dll
viewsm.2bp
viewsm.bmp
waveapi.dll
wavedev.dll
wceload.exe
windmax.wav
windmin.wav
windowsce.bmp
wininet.dll
winsock.dll
wlclient.dll
wmadmod.dll
wmsdmod.dll
ws2.dll
ws2instl.dll
wspm.dll
wzcsapi.dll
wzcsvc.dll
zlib.dll

and can study avic windows more detail.

also, UC 2.6 and EW 2.7 use one wince firmware, so it way good for any region.

Posted Aug 19, 2009 · 07:07 UTC#3

This info was helpful!

Have you successfully added files to wince42.nb0 and repackaged in into the winceimg.bin? I'm trying to add some files to the default wince image. I'm worried if I repackage it wrong, my winceimg.bin file will be corrupted and the unit will be bricked. Any thoughts?

Posted Aug 19, 2009 · 10:08 UTC#4

This info was helpful!

Have you successfully added files to wince42.nb0 and repackaged in into the winceimg.bin? I'm trying to add some files to the default wince image. I'm worried if I repackage it wrong, my winceimg.bin file will be corrupted and the unit will be bricked. Any thoughts?

My experience with cooked roms...as long as you don't touch the uboot, you can even flash an empty file. Can always enter service mode - the uboot menu - and reflash. Have a look at xda-developers for more info.

In any case, its at your own risk of course :wink:

Posted Aug 20, 2009 · 05:37 UTC#5

Thanks, I feel a bit more willing to risk it. I won't touch uboot!

Posted Aug 26, 2009 · 10:37 UTC#6

no need touch uboot,

for wince42. i add file, but for dumprom -

1) need add free zero bytes to end wince42.nb0

2) add you data to wince42.nb0

- for come case need delete or ass compress dll to dumprom folder.

3) delete free space in end wince42.nb0:

4) write new wince42.nb0 size in toc.bin

5) copy all back in WINCEIMG.BIN and fix new size and checksum in WINCEIMG.chk.

and all working fine.

at this moment, i looking for CSR BT driver for AVIC,

for add to WINCEIMG.BIN.

Posted Aug 26, 2009 · 12:54 UTC#7

at this moment, i looking for CSR BT driver for AVIC,

for add to WINCEIMG.BIN.

That would be great carver. Do you have a working bluetooth stack? (to install, not yet integrated in wince..)

If we can have the A2DP profile to receive music from the ipod it will awesome!

Posted Aug 26, 2009 · 16:20 UTC#8

After a little Google searching, it looks like the CSR Bluetooth driver's included in Windows CE 5: MSDN blog. Now getting the right registry entries and DLLs added to AVIC should be something similar to how we're enabling the Spectec 802.11g SDIO card, but we have to find them.

Have to rebuild the development system, turns out none of the Platform Builders behave themselves on Win 7 x64 so I have to reinstall the system w/ Win 7 x86 instead. Then I can see about adding these items to the emulator BSP:

· Bluetooth Stack with Universal Loadable Driver

· Bluetooth Stack with Integrated USB Driver

And see what files and registry entries get added...

Posted Aug 30, 2009 · 17:36 UTC#9

yes, BT stack from MS detect my BT

Super Mini Bluetooth 2.0 Adapter Dongle (Vista Compatible) Price: $2.46

http://www.dealextreme.com/details.dx/sku.11866

also i try get BT stack from HP ipaq 31x (also SirfTitan), but i can't find files for USB connections.

Posted Mar 20, 2010 · 16:55 UTC#10

any progress with bluetooth stack for avic ?

Posted Apr 05, 2010 · 17:50 UTC#11

If anybody's interested, I worked with the OP and have successfully found all the tools/tricks to get new files onto the base Windows software image and also update the base system registry. I can either do a more detailed walk-through or continue on with my second project which is to build a Windows app that will automate/simplify the process for anyone wishing to update their unit's software.

I personally did this because in testmode the F500 unit (which has battery backup) shuts completely off when you turn the car off. This means when you start your car again, you have to wait for it to boot AND coreplayer doesn't remember what you were playing. I had previously used a temporary work around which required me to remember to close coreplayer before turning off the car, which would then save its playlist. I also didn't want to have the testmode files on every SD card I would use.

I have now updated the system registry to launch leetlauncher instead of the normal menu, included drivers for my CP-E Standback engine management hardware, included the WINCE Standback tuning software, added .net compact framework 2.0 to the build (big one for some of you), and made changes so that the unit suspends instead of powers off when the car is turned off.

If anyone is interested in any details, PM me. If you're interested in a Win App to help automate updating the core software/registry give me a "+1" or otherwise let me know it's worth the time (since I am pretty good at doing it the awkward manual way at the moment). Also, if you'd like to try my images on your unit, let me know and I'll provide a link.

Posted Apr 05, 2010 · 18:01 UTC#12

Oh, and if you want to see the Standback software in use on the F500, here a link to that thread:

http://avic411.com/forum/viewtopic.php?f=34&t=24459&start=30

Posted Apr 07, 2010 · 22:52 UTC#13

EEGeek, this is some impressive progress that you have made. The F500BT is a really nice piece of hardware, and further opening up is going to help all of us get a lot more out of it. I urge you to document your work for the community here as much as is feasible so that your work can be shared. At the same time, I am excited about your proposed Windows app.

Now, a few questions:

[*:2np0jhkq]Are you modifying the firmware on the F500BT directly, or are you modifying testmode?
[*:2np0jhkq]There were a couple key limitations when using leetlauncher with F500BT: the standby/shutdown issue (which you have apparently addressed), and sound output. That is, those of us using the ND-500G can't get sound out of the car speakers using leetlauncher, just the internal speaker in the F500BT. Is there any change to the sound output in your setup?
[*:2np0jhkq]Are your changes reversible? Is it just a matter of backing up the original image?

Posted Apr 08, 2010 · 00:52 UTC#14

I've started to document via the wiki; I've added a new section for Modding the Base OS of the F-series units. You can check it out. I'll eventually put a link in there to this app.

I'm modifying the software on the unit itself. I can boot without an SD card inserted and still get what I want. What happens is at boot time, the WINCEIMG.BIN file sitting in "My Flash Disk" is broken up into a few pieces, one of which is a compressed version of the Windows directory. A different piece contains the initial Windows registry file. It's been a pain to learn how to unpack and repack (with changes) those boot images. Now that it's possible, we can add files to those images and then copy the new WINCEIMG.BIN to a sd card. You then enter the service menu for the unit and tell it to update the windows image and it pulls that file off of the SD card and transfers it to the unit's firmware. All you have to do is copy the WINCEIMG.BIN and WINCEIMG.CKS files off of "My Flash Disk" before you do the update and you'll have a backup to restore if you screw up. No matter how badly you screw up, you can still enter the service mode, meaning you can always reflash the original image back to the unit.

So far I have only worked on the issues that were bothersome to me. I have fixed the shutdown issue, but haven't run into a sound issue. I use the output of the headphone jack myself since it's "preamped" (the line coming out of the backplate isn't) and I didn't want to buy an amp to drive my input line of my head unit. Since I'm not booting testmode, I very well may have fixed that issue all together since it's booting a pretty standard way. Or it may be the case that launching the original menu caused some drivers to switch modes allowing your audio output. I never launch the original menu though so that might not work. I did notice that booting "normally" launches a process called av.exe. If it's responsible for the audio output to the backplate, maybe we could just launch it by itself.

Fun stuff..

EEGeek, this is some impressive progress that you have made. The F500BT is a really nice piece of hardware, and further opening up is going to help all of us get a lot more out of it. I urge you to document your work for the community here as much as is feasible so that your work can be shared. At the same time, I am excited about your proposed Windows app.

Now, a few questions:

[*:3nxlvjby]Are you modifying the firmware on the F500BT directly, or are you modifying testmode?
[*:3nxlvjby]There were a couple key limitations when using leetlauncher with F500BT: the standby/shutdown issue (which you have apparently addressed), and sound output. That is, those of us using the ND-500G can't get sound out of the car speakers using leetlauncher, just the internal speaker in the F500BT. Is there any change to the sound output in your setup?
[*:3nxlvjby]Are your changes reversible? Is it just a matter of backing up the original image?

Posted Apr 08, 2010 · 02:09 UTC#15

I did notice that booting "normally" launches a process called av.exe. If it's responsible for the audio output to the backplate, maybe we could just launch it by itself.

Very likely since on the in-dash units it's the AV board that has the uCOM ASIC that controls the audio source. It sends commands to the E-Volume chip over I2C that will select which source to output (Navi, AV1, AV2, IPBus, DVD, FM Tuner, etc).

Posted Apr 11, 2010 · 02:54 UTC#16

http://www.mediafire.com/?sharekey=3da5 ... e37b913e74

For anyone wanting to play with an alpha version of the software.

You must trim your default.reg file down a little (remove some unused crap inside) in order for it to generate an image successfully.

*edit* this alpha software is old now. Go to the Wiki's "Modify Base OS" page to download the most recent beta version.

Posted Apr 16, 2010 · 23:48 UTC#17

The "Modify Base OS" wiki page now has my avic-modder beta application link with full functionality. You just need to copy your WINCEIMG.BIN file off of your "My Flash Drive" and open it with this program. If how to use it isn't obvious for you, just pm me.

Posted Apr 20, 2010 · 20:20 UTC#18

The "Modify Base OS" wiki page now has my avic-modder beta application link with full functionality. You just need to copy your WINCEIMG.BIN file off of your "My Flash Drive" and open it with this program. If how to use it isn't obvious for you, just pm me.

I am using an AVIC-X710BT, where exactly is located the WINCEIMG.BIN and .CKS files?

I don't have it inside "My Flash Disk" folder.

Thanks.

Posted Apr 20, 2010 · 22:21 UTC#19

The "Modify Base OS" wiki page now has my avic-modder beta application link with full functionality. You just need to copy your WINCEIMG.BIN file off of your "My Flash Drive" and open it with this program. If how to use it isn't obvious for you, just pm me.

I am using an AVIC-X710BT, where exactly is located the WINCEIMG.BIN and .CKS files?

I don't have it inside "My Flash Disk" folder.

Thanks.

If it's not there, you could always pull it from one of the official upgrade images for the X-series Pioneer has on their site. It's usually under a folder in the upgrade image, at least it is for the F-series upgrade images.

Posted Apr 20, 2010 · 23:33 UTC#20

Yeah, from what I know, after upgrading to FW 3.0x, a F-Series AVIC will be become a X-Series AVIC, so their firmware should be the same.

I just don't want to miss something when performing a complete backup, I mean COMPLETE.

Is there anyone who has knowledge on this, or refer me to another post for complete backup?

Thanks.

Posted Apr 21, 2010 · 00:01 UTC#21

You're system's complete "state" is all stored on the internal flash storage drive. This drive is seen as the "My Flash Disk" directory in Windows Explorer. When you look at the whole Windows directory itself, the files you see aren't actually sitting on a real drive, they've been extracted at boot time from the flash disk and put into a RAM disk. That's why if you make any change to the files in the Windows directory, they're all wiped out on reboot. So, even though the Windows directory and boot files don't show up in "My Flash Disk", that's where they got extracted from. All the other files (like the navigation and bluetooth stuff) are stored in extracted for on the actual flash disk. Only the Windows/boot files are packaged up and extracted at boot time.

That was all just to help you visualize it. My main point is that a "full backup" of your unit is copying everything from the internal Flash Disk, including system and hidden files. Even though you see items outside of "My Flash Disk", they all originally came from there at boot time.

I'd find the WINCEIMG.BIN file first and worry about backing everything else up later. The most important thing is to find and backup your Windows image. Remember, in Windows there is a check box option for viewing hidden files and a separate check box for allowing you to view protected OS files. Make sure you can see both.

Where do you live? If it happens to be in the AZ area, you could stop by and I could help you do everything.

Yeah, from what I know, after upgrading to FW 3.0x, a F-Series AVIC will be become a X-Series AVIC, so their firmware should be the same.

I just don't want to miss something when performing a complete backup, I mean COMPLETE.

Is there anyone who has knowledge on this, or refer me to another post for complete backup?

Thanks.

Posted Apr 21, 2010 · 00:47 UTC#22

Hey EEGeek,

You surprise me on your offering to help complete strangers. Sincerely thank you from my heart :oops: . I live in Canada though :mrgreen: .

Appreciate your detailed explanation on the file/folder structure, I already backup everything from the "My Flash Disk" with System and Hidden files showing turned ON. My only concern is the WINCEIMG.BIN and .CKS files.

Just FYI: with the F or X Series, the customized settings are not resetted upon system restart, because they are back-powered by the car's battery when the system is turned "OFF", unlike the F500 Series. They are however resetted after entering Testmode.

Correct me if I am wrong, the WinCE and .BIN and .CKS are in EEPROM or some kind of flash ROM, you can only modify them when you are in Service Mode and reprogram them.

From the great works that you have done, I would think that I could theoretically embed my own prefered fonts and registry setting directly into the WINCEIMG.BIN file, then flash the unit using the Service Mode, so no more tedious reworks after entering the Testmode. Is this the point of your works?

Thanks again. :wink:

Posted Apr 21, 2010 · 02:49 UTC#23

No problem.

Yes, the point was to avoid all the problems with testmode and to add things like .NET Compact Framework.

I don't know where your OS Image files are if they aren't in the obvious places. Sorry!