If any of you would like to be able to extract the base OS out of your F-Series unit, add files to the OS image, or modify the system registry, I've created a tool to automate the process called avic-modder. I've added a wiki page with the manual instructions (if you don't want to use my app) AND a link to my app. Here's the software link again here:

http://www.mediafire.com/file/zmzymzgzg ... r_beta.zip

All you need to do is copy your WINCEIMG.BIN file from you "My Flash Disk" folder to your PC and then open it with this software. The rest should be obvious. If it's not obvious, I'll add some more instructions in here.

This has allowed me to customize my unit so I don't need to use testmode to boot a custom setup. This means if you don't like having your unit reboot every time you start your car (testmode annoyance), this can help. If you'd like to include new drivers into the OS image, this can do that too. It can also help you launch Leetlauncher or something else at boot, even with no SD card inserted.

The output is a new WINCEIMG.BIN and WINCEIMG.CKS file to use via the service menu to update your Windows image.

REMEMBER TO ALWAYS BACKUP YOUR ORIGINAL WINCEIMG.BIN and WINCEIMG.CKS FILES IN CASE SOMETHING GOES WRONG!!!

Looks like it's been downloaded 16 times, anybody tried it out yet? Comments? Suggestions?

Well, I was one of those that downloaded it, but I wont be playing with it until I have a day off. How does this differ though from just using 'Testmode'? Can this get me into the hardcoded scripting of the AV/Main screen which was previosly untouchable?

Hi EEGeek, I was one of the 16 ... honestly, at first i thought it was your cooked rom for us to check out, not the tools to cook them ... so i Built my own rom with what i thought were the drivers for the 2.06 version for the 500BT (mine) and the rest of the tools from the X Firmware.

Flashed it and bricked :S ... i truly thought this was like the phones (ie as long as you don't flash uboot you're in the clear) but now i can't even get the 500 to boot to the flash page (the blue one)

So while thankful for your release ... my results are less than encouraging, and my week-old 500BT is dead in the water.

Well, I was one of those that downloaded it, but I wont be playing with it until I have a day off. How does this differ though from just using 'Testmode'? Can this get me into the hardcoded scripting of the AV/Main screen which was previosly untouchable?

Abb1: basically no ... this is for editing and rebuilding the winceimg.bin, which is divided in two the eboot: what makes the device boot (fs drivers, core, bus drivers) and what i kept from the 500BT firmware; and wince: the "windows" dir (what i used from the X Firmware)

Try it, run the tool, point it to a .bin file and go to %temp%\avic-modder\original and you'll see (this is completely safe it just "unzips" the bin to its contents, you can discard those dirs afterwards).

What REALLY bothers me is that it shoulda worked ... or at least not fail so miserably.

BTW: I believe what you are looking for its found in APL\Main.Res (open it with 7zip or winrar) but don't take my word for it as i had my 500BT only for a week.

Anyone knows if i can JTAG it ? I don't even have the correct tools to open it, smalles torx i have is T6.

Rostol, that's sad to hear! I have a F500 as well and have yet to brick it, although I didn't try to use an eboot from one version and a windows image from another version. My approach has always been baby steps. When I first flashed a new image to it, I didn't change any files, I just unpacked it, repacked it, and flashed it. The next time I added a couple files, then I changed the registry, etc etc. I already have a unit that was upgraded to 3.0 so I didn't attempt any "patchwork" like you did. I know the upgrade I did had a software code that was generated to match my hardware id. Could be related.

I have never heard of anyone who couldn't get to the service menu before after only upgrading the windows image. You didn't accidentally select uboot upgrade or windows upgrade "with format" right?

In any case, if you can get it to come up into the service menu again, I've got my stock 3.0 image files you can try.

Hey EEGeek, I don't see WINCEIMG.BIN and WINCEIMG.CLK inside the "My Flash Disk" folder, nor outside (checked today), can you point me to them please? Do I have to enable viewing System and Hidden files somehow?

From a downloaded copy of the AVIC Firmware 3.0 Update, I do see them at the same level as the "My Flash Disk", but not inside. Can you shed some light?

Anybody can tell me how to do a COMPLETE backup of the AVIC, beside the "My Flash Disk" folder

Thanks.

I'm not by my unit right now, but will check when I get home. I'd say, yes, turn on viewing of hidden and protected system files and then have a peek. I've only tried this on images taken from an F500 and an F90, if anyone else has success with it extracting files from other hardware versions, let me know and I'll keep tabs on them all. Likewise, if you have one that doesn't seem to work, upload your .BIN file to something like mediafire.com and then post the link. I'll then see if I can get it to support other units as well.

Hello,

At start thanks for the soft, and sorry about my english, i am spanish.

The soft do not start and try to access to internet why?

Regards,

No tiene "code" para redes, entonces no va a comunicar por el internet. Que "OS" estas usando? Tienes ".NET framework 2.0" instalado? Es la unica dependencia para initializar mi software. Pero la mayoria de las personas ya lo tienen instalado.

De donde eres?

For Gringos:

It doesn't have any networking code in it so it isn't trying to do anything on the internet. What OS are you using? Do you have .NET framework 2.0 installed? You have to have that installed for it to work. But, most people have that installed already.

Where are you from?

BTW, I'm thinking about posting the source for this since it's not like I'm going to be selling this or anything. There's just something weird about giving away code; it makes me feel funny.

I'm not by my unit right now, but will check when I get home. I'd say, yes, turn on viewing of hidden and protected system files and then have a peek. I've only tried this on images taken from an F500 and an F90, if anyone else has success with it extracting files from other hardware versions, let me know and I'll keep tabs on them all. Likewise, if you have one that doesn't seem to work, upload your .BIN file to something like mediafire.com and then post the link. I'll then see if I can get it to support other units as well.

Hi EEGeek,

I do have System and Hidden file enabled but still nothing. Any hint would be greatly appreciated.

Thanks.

No entiendo ... si todos hablamos un idioma l�gico porque estamos hablando en gringo-speak jajajaja

Yeah EEGeek, i skipped the whole baby-steps part ...

I did not update the uboot, as I knew (thought really cos was proved wrong) that was what would get me out of trouble. And i don't think i chose with format as it wouldn't be necessary ... but anyway that should format the flashdisk and the eboot partitions not the uboot one right ?

After the flash, on power-up, the spalsh (custom one not the Pioneer one) was shown briefly before shutting down and that is also in the flash rite ?

I'll see if I can buy the tools to open it today/tomorrow to see if its jtagabble.

Chuck88: Those 2 files are not in "My Flash Disk", you can't just back it up. There are ways to dump the rom from phones but i dont know if any are usable with these gps.

 

I'll see if I can buy the tools to open it today/tomorrow to see if its jtagabble.

 

Chuck88: Those 2 files are not in "My Flash Disk", you can't just back it up. There are ways to dump the rom from phones but i dont know if any are usable with these gps.

Hi Rostol,

It would be very surprise to me if Pioneer has left a JTAG connector on their production PCB, so I would say almost for sure, that if you want to go that way, it would require to install a JTAG connector by soldering around the ARM processor, which will be a rather delicate task to accomplish.

I don't know exactly what was wrong with your AVIC but it should be other ways to revive your HU. There are other posts in the Problems/Troubleshoot sections. Search in this forum for "Revive a BRICKED F90" and "FormatMBR -SDMLC" to see if any of those methods can suite your situation.

As for the two files, I do see them in the original files for the 3.0 FW. Do you think that once they are flashed using the Service Console, those files are broken into pieces and no longer keep the original name (unlike the F500 Series)?

Are you familiar with the X- or F-Series? How to make a complete backup?

Later.

Good news !

Incredibly enough (with the help of a friend pressing various buttons on the front panel + reset) I managed to get into the flash menu and flahsed the 2.0 version .bin

Chuck: You can't really make a complete backup of the AVIC as it is. You need to copy "My Flash Disk" and get the .img and .chk from the last firmware you flashed to it. In my case its AVIC-F500BT_Firmware_Update_2.006000.zip

There might be a way to get it off from the AVIC, I recall there used to be a WinCE/Mobile app that dumped the rom to an SD-CARD, will try to see if i can find it for you. But the easiest is getting the firmware from Pioneer (or here if you used any of the "unofficial" ones.

BTW, altho i did not use either of the posts you said the info inside was great reading so thanks for that

Good news !

 

Incredibly enough (with the help of a friend pressing various buttons on the front panel + reset) I managed to get into the flash menu and flahsed the 2.0 version .bin

 

Chuck: You can't really make a complete backup of the AVIC as it is. You need to copy "My Flash Disk" and get the .img and .chk from the last firmware you flashed to it. In my case its AVIC-F500BT_Firmware_Update_2.006000.zip

 

There might be a way to get it off from the AVIC, I recall there used to be a WinCE/Mobile app that dumped the rom to an SD-CARD, will try to see if i can find it for you. But the easiest is getting the firmware from Pioneer (or here if you used any of the "unofficial" ones.

 

BTW, altho i did not use either of the posts you said the info inside was great reading so thanks for that

Congrats! Now on to modding again!

Good news !

 

Incredibly enough (with the help of a friend pressing various buttons on the front panel + reset) I managed to get into the flash menu and flahsed the 2.0 version .bin

 

Chuck: You can't really make a complete backup of the AVIC as it is. You need to copy "My Flash Disk" and get the .img and .chk from the last firmware you flashed to it. In my case its AVIC-F500BT_Firmware_Update_2.006000.zip

 

There might be a way to get it off from the AVIC, I recall there used to be a WinCE/Mobile app that dumped the rom to an SD-CARD, will try to see if i can find it for you. But the easiest is getting the firmware from Pioneer (or here if you used any of the "unofficial" ones.

 

BTW, altho i did not use either of the posts you said the info inside was great reading so thanks for that

Good for you my friend .

I am just wondering why do you want to go back to FW 2.0 . Your problem has nothing to do with the FW version.

For anyone who doesn't just want to use the avic-modder, I can also just post my personal cooked image for my F500. It includes .net cf 2.0, some extra drivers, and auto launches leet launcher and core player since we mainly use it for music. It also removes the driver for the power button which prevents it from shutting down all the way when you turn your car off. I then have an app I wrote (also included and auto-launched in the image) that polls the power and hibernates when it detects a change in power state (car turned off). Works well...

EEGeek: I'd love to have it, as my firmware hacking skills left a lot to be desired. At least as a starting point, chances are that i'll just change some settings and change the iGo skin to the one i like diMka HD and leave it at that.

I was just now thinking about putting leet launcher in the Flash and run it and iGo from there. Leaving Garmin XT on the SD (i use it when i travel as the rest of the country is too basic in the iGo maps).

Chuck88: Thanks : )

I "went back" to 2.0 cos AFAIK its the newest official one. After the scare i had i wanted it back to the way it was originally.

I am having some small issues tho, volume knob is not working i can only control the volume by software. And also no backlight control its stuck full on. and i like the auto-dimming at night of this skin.

Chuck88: Thanks : )

I "went back" to 2.0 cos AFAIK its the newest official one. After the scare i had i wanted it back to the way it was originally.

 

I am having some small issues tho, volume knob is not working i can only control the volume by software. And also no backlight control its stuck full on. and i like the auto-dimming at night of this skin.

Yeah you might be just right (on the 2.0 FW), as I seem always forgot the MOD in this thread is for the portable F500 owners .

EEGeek: please make sure that when posting your mod images, state that it is ONLY FOR F500. Lot of newbies don't make the difference and would end up like in Ristol's adventure. Thanks for sharing ...

Ok I failed twice over the weekend to update the F500 to 3.0 ... now that i know i can still get into the flash menu I have the courage to keep on playing.

So EEGeek, could you post a quick guide on how you did yours ? (maybe on a new separate thread) I am guessing i am starting with the wrong codebase for it. Which one did you get the files and the .bin file from? I am using this one:

AVIC_X-Series_Firmware_Update which i got from a post here.

And your tool to edit the .bin.

Any help would be appreciated.

Ok I failed twice over the weekend to update the F500 to 3.0 ... now that i know i can still get into the flash menu I have the courage to keep on playing.

 

So EEGeek, could you post a quick guide on how you did yours ? (maybe on a new separate thread) I am guessing i am starting with the wrong codebase for it. Which one did you get the files and the .bin file from? I am using this one:

AVIC_X-Series_Firmware_Update which i got from a post here.

 

And your tool to edit the .bin.

 

Any help would be appreciated.

I'm pretty sure I pulled the image off of my unit directly, don't remember exactly how. It worked for me and I haven't had many comments on here in a while so I haven't been messing with it much lately; just been enjoying my modified image.

I paid for the 3.0 update when it came out so mine started from 3.0.

Ok, I just went and found a random image laying around and posted it online for you: http://www.mediafire.com/file/tuijnxmg2yi/just%20for%20testing.zip

I don't know exactly what's in it, but it's based off of 3.0. This doesn't obviously change the applications and whatnot (the bulk of the 3.0 update); it's only the windows image.

What this image PROBABLY has in it:

no power button driver (makes it not hard shutdown unit when you turn your car off)

my hiberate daemon autostarts (senses a change in the power state and hibernates unit when car turns off)

drivers included for Standback engine control unit

.NET Compact Framework 2.0 is installed in this image

It attempts to launch leetlauncher and core player at startup, but I think I didn't include them in the image; it must point to the SD card to launch them. Well, this image is just for test/play anyways!

I'll help you with anything you need. Just let me know. I'll even cook you up rom if your scared to use my app.

Ok, this image may also include my engine management software from this thread in it:

http://avic411.com/forum/viewtopic.php?f=34&t=24459&start=30#p192051

Another note: seeing as I removed the power button driver from the Windows image, the power button isn't usable from a WINDOWS PERSPECTIVE. It still works to turn the unit on, bring it out of standby, or hard reset via holding it down. These are all hardware interrupts that function without that driver. The one ability you lose, is the ability to hit the button while the unit is running and have it turn off or standby. That means you either have to turn the car off (or disconnect ext power) or hold the button down if you really want to manually turn it off. I never have to do this though, just turn car off and unit sleeps, turn car on, it comes back. It even continues playing music if it was when you turned the car off. I think it's AWESOME if I do say so...

I didn't know the 3.0 update was for sale

But probably its too "expensive" for me, seeing as I don't live in the US so I don't need the map update, just software (can you buy only the SW upgrade?)

I had read the engine management thread, and was wondering if your interface would work in my car, seeing its a twin turbo BMW an X5 3.0D so i guess not, but it is twin-turbo and BMW !

Going away for 3 days today and will be using the GPS a lot so i wont update it until i get back. But what you did with the power is similar to what i wanted. I wanted a quick press to sleep a long press to reset, but i think yours will do perfectly.

I'll let you know how everything works out in a few days.

Thanks for everything

Hi EEGeek,

I'm trying to add Korean Font to WinCEIMG and I'm not having much success with it. I have following registry entries and font file. It seems that total size was too big. Is it possible that you could help me with it?

Thanks,

REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FontLink]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FontLink\SkipTable]

"Tahoma"="005c,00a5,007e,0391-03c9,2026,2116,221a,25a0-25ff"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FontLink\SystemLink]

"Symbol"="\\My Flash Disk\\Data\\Mappyfon.ttf,SKCC_Gothic"

"Courier New"="\\My Flash Disk\\Data\\Mappyfon.ttf,SKCC_Gothic"

"Tahoma"="\\My Flash Disk\\Data\\Mappyfon.ttf,SKCC_Gothic"

"Times New Roman"="\\My Flash Disk\\Data\\Mappyfon.ttf,SKCC_Gothic"

"Arial"="\\My Flash Disk\\Data\\Mappyfon.ttf,SKCC_Gothic"

[HKEY_LOCAL_MACHINE\System\GDI]

"FontLinkMethods"=dword:00000001