MOD COMMENT: I just wanted to offer a huge congrats to valued forum member ShortFuse. Over the last several months there have been numerous members claim they could do what he has done only to never be seen again. This kind of carrot dangling does no one any good at all and I honestly had no faith in this effort. I am glad to say I was wrong for my lack of faith in this instance. Now, for the first time in over a year, it now appears we may actually be able to offer UI hacks for the current crop of Pioneer navis do to his contributions. We are making no promises, but this is a big step in the right direction. I look forward to where this goes from here.

Donate if you like:

https://www.paypal.com/cgi-bin/webscr?cmd=_s-xclick&hosted_button_id=7ELH2CPLUZLQY

Phase 1 - Crack upgrade file - COMPLETE

Download the v1.001 update from Pioneer.

Replace AVICZ110EU090APL.VER and AVICZ110APLRenewalIFLib.dll with the files attached.

Copy the AVICZ110 folder with the patched files to the root of an SD card.

Insert the SD to your Z110BT and it should start updating automatically.

You are now running the patched version. When you try to run a map upgrade insert anything for the password. If it's not taking it, try filling the input box with characters (no numbers).

It's PERFECTLY SAFE to upgrade the 2.003. Looking at that, I'm 99% sure that the next update (2011 map if it exists) will be cracked with the same method. Don't ask me about 2012.

There are reports of this working for the EU versions. I wouldn't be surprised. The APL folder (NAND1) for the US and EU version are COMPLETELY IDENTICAL. F10BT's 2.003 update is identical to Z120's 2.003 update. What makes them work different are the contents on NAND2 (the 4GB). This also means that any APL patches for the US versions will be cross compatible with other regions. I wouldn't be surprised if the F10BT is just a Z110BT upgraded to 1.001 (can any F10BT users check this?)

This might also mean, you can convert from any 1.x region to any other 2.x region (ie: 1.x US to 2.x EU). I believe that Pioneer runs a region check in the application. I incorrectly called this a "version check" because the subroutine is called GetVersion(void). I did bypass this function, which means I probably bypassed the region check as an added bonus to this crack.

PLEASE PLEASE PLEASE note: There is no downgrade ability at the moment. Don't just try to convert your 1.x to a different region for the fun of it.

Reference Posts:

<!-- l --><a class="postlink-local" href="http://avic411.com/forum/viewtopic.php?f=57&t=34478&p=229354#p229354">viewtopic.php?f=57&t=34478&p=229354#p229354</a><!-- l -->

Phase 2 - Mods

Step 1: Make recovery bootloader

Before we start modding things we need a recovery options. It's far too easy to brick the device right now. I almost bricked it when I did the upgrade crack. We need to have an option to force recovery. This will likely be a button press sequence while the device boots (like holding Home and Mode while booting).

The target files are the PRG files in BOOT and PLATFORM. Once we decode that, we can start playing around with it.

The file makes reference to the WINCE kernel and WinCE dll files, so I wouldn't be surprised if this like a PPC ROM file.

After some more research, it seems we can flash via recovery by access Option #3 from the Test Mode menu.

Misc

NAND2 Image from 2010 Firmware update:

PARTCODE.TXT
RELEASE.TXT
NDATA�0ALLDATA.LFT
NDATA�0DTR_H.DB
NDATA�0ILUSTMAP.LFT
NDATA�0INDEXDAT.DB
NDATA�0LANDMARK.LFT
NDATA�0NDB_ALLDATA.VER
NDATA�0ShortCutGenre.txt
NDATA�0ZonelistOnFlash.txt
NDATA�0IDXGENRE_H.DB
NDATA�0IDXPOI.LDB
NDATA�0MAP2DCITY.LFT
NDATA�0MAPLINKCOND.LFT
NDATA�0MAPPARCEL.LFT
NDATA�0MAPPARCEL00.LFT
NDATA�0MAPRDSTMC.LFT
NDATA�0MAPREGION.LFT
NDATA�2HN02.LFT
NDATA�2SHLDDC02.LFT
NDATA�2STPTDC02.LFT
NDATA�2STRTDC02.LFT
NDATA�2IDXINDEX02.LDB
NDATA�2IDXPOISR02.LDB
NDATA�2IDXSCSR02.LFT
NDATA�2MAPPARCEL02.LFT
NDATA�3HN03.LFT
NDATA�3SHLDDC03.LFT
NDATA�3STPTDC03.LFT
NDATA�3STRTDC03.LFT
NDATA�3IDXINDEX03.LDB
NDATA�3IDXPOISR03.LDB
NDATA�3IDXSCSR03.LFT
NDATA�3MAPPARCEL03.LFT
NDATA�4HN04.LFT
NDATA�4SHLDDC04.LFT
NDATA�4STPTDC04.LFT
NDATA�4STRTDC04.LFT
NDATA�4IDXINDEX04.LDB
NDATA�4IDXPOISR04.LDB
NDATA�4IDXSCSR04.LFT
NDATA�4MAP2DCITY04.LFT
NDATA�4MAPPARCEL04.LFT
NDATA�5HN05.LFT
NDATA�5SHLDDC05.LFT
NDATA�5STPTDC05.LFT
NDATA�5STRTDC05.LFT
NDATA�5IDXINDEX05.LDB
NDATA�5IDXPOISR05.LDB
NDATA�5IDXSCSR05.LFT
NDATA�5MAPPARCEL05.LFT
NDATA�6HN06.LFT
NDATA�6SHLDDC06.LFT
NDATA�6STPTDC06.LFT
NDATA�6STRTDC06.LFT
NDATA�6IDXINDEX06.LDB
NDATA�6IDXPOISR06.LDB
NDATA�6IDXSCSR06.LFT
NDATA�6MAP2DCITY06.LFT
NDATA�6MAPPARCEL06.LFT
NDATA�7HN07.LFT
NDATA�7IDX
NDATA�7MAP
NDATA�7SHLDDC07.LFT
NDATA�7STPTDC07.LFT
NDATA�7STRTDC07.LFT
NDATA�7IDXINDEX07.LDB
NDATA�7IDXPOISR07.LDB
NDATA�7IDXSCSR07.LFT
NDATA�7MAP2DCITY07.LFT
NDATA�7MAPPARCEL07.LFT
NDATA�8HN08.LFT
NDATA�8SHLDDC08.LFT
NDATA�8STPTDC08.LFT
NDATA�8STRTDC08.LFT
NDATA�8IDXINDEX08.LDB
NDATA�8IDXPOISR08.LDB
NDATA�8IDXSCSR08.LFT
NDATA�8MAPPARCEL08.LFT
NDATA�9HN09.LFT
NDATA�9SHLDDC09.LFT
NDATA�9STPTDC09.LFT
NDATA�9STRTDC09.LFT
NDATA�9IDXINDEX09.LDB
NDATA�9IDXPOISR09.LDB
NDATA�9IDXSCSR09.LFT
NDATA�9MAPPARCEL09.LFT
NDATA�AHN0A.LFT
NDATA�ASHLDDC0A.LFT
NDATA�ASTPTDC0A.LFT
NDATA�ASTRTDC0A.LFT
NDATA�AIDXINDEX0A.LDB
NDATA�AIDXPOISR0A.LDB
NDATA�AIDXSCSR0A.LFT
NDATA�AMAP2DCITY0A.LFT
NDATA�AMAPPARCEL0A.LFT
NDATA�BHN0B.LFT
NDATA�BSHLDDC0B.LFT
NDATA�BSTPTDC0B.LFT
NDATA�BSTRTDC0B.LFT
NDATA�BIDXINDEX0B.LDB
NDATA�BIDXPOISR0B.LDB
NDATA�BIDXSCSR0B.LFT
NDATA�BMAP2DCITY0B.LFT
NDATA�BMAPPARCEL0B.LFT
NDATA�CHN0C.LFT
NDATA�CSHLDDC0C.LFT
NDATA�CSTPTDC0C.LFT
NDATA�CSTRTDC0C.LFT
NDATA�CIDXINDEX0C.LDB
NDATA�CIDXPOISR0C.LDB
NDATA�CIDXSCSR0C.LFT
NDATA�CMAP2DCITY0C.LFT
NDATA�CMAPPARCEL0C.LFT
NDATA�DHN0D.LFT
NDATA�DSHLDDC0D.LFT
NDATA�DSTPTDC0D.LFT
NDATA�DSTRTDC0D.LFT
NDATA�DIDXINDEX0D.LDB
NDATA�DIDXPOISR0D.LDB
NDATA�DIDXSCSR0D.LFT
NDATA�DMAP2DCITY0D.LFT
NDATA�DMAPPARCEL0D.LFT
NDATA�EHN0E.LFT
NDATA�ESHLDDC0E.LFT
NDATA�ESTPTDC0E.LFT
NDATA�ESTRTDC0E.LFT
NDATA�EIDXINDEX0E.LDB
NDATA�EIDXPOISR0E.LDB
NDATA�EIDXSCSR0E.LFT
NDATA�EMAPPARCEL0E.LFT
NDATA�FHN0F.LFT
NDATA�FSHLDDC0F.LFT
NDATA�FSTPTDC0F.LFT
NDATA�FSTRTDC0F.LFT
NDATA�FIDXINDEX0F.LDB
NDATA�FIDXPOISR0F.LDB
NDATA�FIDXSCSR0F.LFT
NDATA�FMAP2DCITY0F.LFT
NDATA�FMAPPARCEL0F.LFT
NDATA10HN10.LFT
NDATA10SHLDDC10.LFT
NDATA10STPTDC10.LFT
NDATA10STRTDC10.LFT
NDATA10IDXINDEX10.LDB
NDATA10IDXPOISR10.LDB
NDATA10IDXSCSR10.LFT
NDATA10MAP2DCITY10.LFT
NDATA10MAPPARCEL10.LFT
NDATA11HN11.LFT
NDATA11SHLDDC11.LFT
NDATA11STPTDC11.LFT
NDATA11STRTDC11.LFT
NDATA11IDXINDEX11.LDB
NDATA11IDXPOISR11.LDB
NDATA11IDXSCSR11.LFT
NDATA11MAP2DCITY11.LFT
NDATA11MAPPARCEL11.LFT
NDATA12HN12.LFT
NDATA12SHLDDC12.LFT
NDATA12STPTDC12.LFT
NDATA12STRTDC12.LFT
NDATA12IDXINDEX12.LDB
NDATA12IDXPOISR12.LDB
NDATA12IDXSCSR12.LFT
NDATA12MAP2DCITY12.LFT
NDATA12MAPPARCEL12.LFT
NDATA13HN13.LFT
NDATA13SHLDDC13.LFT
NDATA13STPTDC13.LFT
NDATA13STRTDC13.LFT
NDATA13IDXINDEX13.LDB
NDATA13IDXPOISR13.LDB
NDATA13IDXSCSR13.LFT
NDATA13MAP2DCITY13.LFT
NDATA13MAPPARCEL13.LFT
NDATA14HN14.LFT
NDATA14SHLDDC14.LFT
NDATA14STPTDC14.LFT
NDATA14STRTDC14.LFT
NDATA14IDXINDEX14.LDB
NDATA14IDXPOISR14.LDB
NDATA14IDXSCSR14.LFT
NDATA14MAP2DCITY14.LFT
NDATA14MAPPARCEL14.LFT
NDATA15HN15.LFT
NDATA15SHLDDC15.LFT
NDATA15STPTDC15.LFT
NDATA15STRTDC15.LFT
NDATA15IDXINDEX15.LDB
NDATA15IDXPOISR15.LDB
NDATA15IDXSCSR15.LFT
NDATA15MAPPARCEL15.LFT
NDATA16HN16.LFT
NDATA16SHLDDC16.LFT
NDATA16STPTDC16.LFT
NDATA16STRTDC16.LFT
NDATA16IDXINDEX16.LDB
NDATA16IDXPOISR16.LDB
NDATA16IDXSCSR16.LFT
NDATA16MAP2DCITY16.LFT
NDATA16MAPPARCEL16.LFT
NDATA17HN17.LFT
NDATA17SHLDDC17.LFT
NDATA17STPTDC17.LFT
NDATA17STRTDC17.LFT
NDATA17IDXINDEX17.LDB
NDATA17IDXPOISR17.LDB
NDATA17IDXSCSR17.LFT
NDATA17MAP2DCITY17.LFT
NDATA17MAPPARCEL17.LFT
NDATA18HN18.LFT
NDATA18SHLDDC18.LFT
NDATA18STPTDC18.LFT
NDATA18STRTDC18.LFT
NDATA18IDXINDEX18.LDB
NDATA18IDXPOISR18.LDB
NDATA18IDXSCSR18.LFT
NDATA18MAP2DCITY18.LFT
NDATA18MAPPARCEL18.LFT
NDATA19HN19.LFT
NDATA19SHLDDC19.LFT
NDATA19STPTDC19.LFT
NDATA19STRTDC19.LFT
NDATA19IDXINDEX19.LDB
NDATA19IDXPOISR19.LDB
NDATA19IDXSCSR19.LFT
NDATA19MAP2DCITY19.LFT
NDATA19MAPPARCEL19.LFT
NDATA1AHN1A.LFT
NDATA1ASHLDDC1A.LFT
NDATA1ASTPTDC1A.LFT
NDATA1ASTRTDC1A.LFT
NDATA1AIDXINDEX1A.LDB
NDATA1AIDXPOISR1A.LDB
NDATA1AIDXSCSR1A.LFT
NDATA1AMAPPARCEL1A.LFT
NDATA1BHN1B.LFT
NDATA1BSHLDDC1B.LFT
NDATA1BSTPTDC1B.LFT
NDATA1BSTRTDC1B.LFT
NDATA1BIDXINDEX1B.LDB
NDATA1BIDXPOISR1B.LDB
NDATA1BIDXSCSR1B.LFT
NDATA1BMAP2DCITY1B.LFT
NDATA1BMAPPARCEL1B.LFT
NDATA1CHN1C.LFT
NDATA1CSHLDDC1C.LFT
NDATA1CSTPTDC1C.LFT
NDATA1CSTRTDC1C.LFT
NDATA1CIDXINDEX1C.LDB
NDATA1CIDXPOISR1C.LDB
NDATA1CIDXSCSR1C.LFT
NDATA1CMAPPARCEL1C.LFT
NDATA1DHN1D.LFT
NDATA1DSHLDDC1D.LFT
NDATA1DSTPTDC1D.LFT
NDATA1DSTRTDC1D.LFT
NDATA1DIDXINDEX1D.LDB
NDATA1DIDXPOISR1D.LDB
NDATA1DIDXSCSR1D.LFT
NDATA1DMAP2DCITY1D.LFT
NDATA1DMAPPARCEL1D.LFT
NDATA1EHN1E.LFT
NDATA1ESHLDDC1E.LFT
NDATA1ESTPTDC1E.LFT
NDATA1ESTRTDC1E.LFT
NDATA1EIDXINDEX1E.LDB
NDATA1EIDXPOISR1E.LDB
NDATA1EIDXSCSR1E.LFT
NDATA1EMAP2DCITY1E.LFT
NDATA1EMAPPARCEL1E.LFT
NDATA1FHN1F.LFT
NDATA1FSHLDDC1F.LFT
NDATA1FSTPTDC1F.LFT
NDATA1FSTRTDC1F.LFT
NDATA1FIDXINDEX1F.LDB
NDATA1FIDXPOISR1F.LDB
NDATA1FIDXSCSR1F.LFT
NDATA1FMAPPARCEL1F.LFT
NDATA20HN20.LFT
NDATA20SHLDDC20.LFT
NDATA20STPTDC20.LFT
NDATA20STRTDC20.LFT
NDATA20IDXINDEX20.LDB
NDATA20IDXPOISR20.LDB
NDATA20IDXSCSR20.LFT
NDATA20MAP2DCITY20.LFT
NDATA20MAPPARCEL20.LFT
NDATA21HN21.LFT
NDATA21SHLDDC21.LFT
NDATA21STPTDC21.LFT
NDATA21STRTDC21.LFT
NDATA21IDXINDEX21.LDB
NDATA21IDXPOISR21.LDB
NDATA21IDXSCSR21.LFT
NDATA21MAP2DCITY21.LFT
NDATA21MAPPARCEL21.LFT
NDATA22HN22.LFT
NDATA22SHLDDC22.LFT
NDATA22STPTDC22.LFT
NDATA22STRTDC22.LFT
NDATA22IDXINDEX22.LDB
NDATA22IDXPOISR22.LDB
NDATA22IDXSCSR22.LFT
NDATA22MAP2DCITY22.LFT
NDATA22MAPPARCEL22.LFT
NDATA23HN23.LFT
NDATA23SHLDDC23.LFT
NDATA23STPTDC23.LFT
NDATA23STRTDC23.LFT
NDATA23IDXINDEX23.LDB
NDATA23IDXPOISR23.LDB
NDATA23IDXSCSR23.LFT
NDATA23MAP2DCITY23.LFT
NDATA23MAPPARCEL23.LFT
NDATA24HN24.LFT
NDATA24SHLDDC24.LFT
NDATA24STPTDC24.LFT
NDATA24STRTDC24.LFT
NDATA24IDXINDEX24.LDB
NDATA24IDXPOISR24.LDB
NDATA24IDXSCSR24.LFT
NDATA24MAPPARCEL24.LFT
NDATA25HN25.LFT
NDATA25SHLDDC25.LFT
NDATA25STPTDC25.LFT
NDATA25STRTDC25.LFT
NDATA25IDXINDEX25.LDB
NDATA25IDXPOISR25.LDB
NDATA25IDXSCSR25.LFT
NDATA25MAP2DCITY25.LFT
NDATA25MAPPARCEL25.LFT
NDATA26HN26.LFT
NDATA26SHLDDC26.LFT
NDATA26STPTDC26.LFT
NDATA26STRTDC26.LFT
NDATA26IDXINDEX26.LDB
NDATA26IDXPOISR26.LDB
NDATA26IDXSCSR26.LFT
NDATA26MAP2DCITY26.LFT
NDATA26MAPPARCEL26.LFT
NDATA27HN27.LFT
NDATA27SHLDDC27.LFT
NDATA27STPTDC27.LFT
NDATA27STRTDC27.LFT
NDATA27IDXINDEX27.LDB
NDATA27IDXPOISR27.LDB
NDATA27IDXSCSR27.LFT
NDATA27MAP2DCITY27.LFT
NDATA27MAPPARCEL27.LFT
NDATA28HN28.LFT
NDATA28SHLDDC28.LFT
NDATA28STPTDC28.LFT
NDATA28STRTDC28.LFT
NDATA28IDXINDEX28.LDB
NDATA28IDXPOISR28.LDB
NDATA28IDXSCSR28.LFT
NDATA28MAP2DCITY28.LFT
NDATA28MAPPARCEL28.LFT
NDATA29HN29.LFT
NDATA29SHLDDC29.LFT
NDATA29STPTDC29.LFT
NDATA29STRTDC29.LFT
NDATA29IDXINDEX29.LDB
NDATA29IDXPOISR29.LDB
NDATA29IDXSCSR29.LFT
NDATA29MAPPARCEL29.LFT
NDATA2AHN2A.LFT
NDATA2ASHLDDC2A.LFT
NDATA2ASTPTDC2A.LFT
NDATA2ASTRTDC2A.LFT
NDATA2AIDXINDEX2A.LDB
NDATA2AIDXPOISR2A.LDB
NDATA2AIDXSCSR2A.LFT
NDATA2AMAPPARCEL2A.LFT
NDATA2BHN2B.LFT
NDATA2BSHLDDC2B.LFT
NDATA2BSTPTDC2B.LFT
NDATA2BSTRTDC2B.LFT
NDATA2BIDXINDEX2B.LDB
NDATA2BIDXPOISR2B.LDB
NDATA2BIDXSCSR2B.LFT
NDATA2BMAP2DCITY2B.LFT
NDATA2BMAPPARCEL2B.LFT
NDATA2CHN2C.LFT
NDATA2CSHLDDC2C.LFT
NDATA2CSTPTDC2C.LFT
NDATA2CSTRTDC2C.LFT
NDATA2CIDXINDEX2C.LDB
NDATA2CIDXPOISR2C.LDB
NDATA2CIDXSCSR2C.LFT
NDATA2CMAPPARCEL2C.LFT
NDATA2DHN2D.LFT
NDATA2DSHLDDC2D.LFT
NDATA2DSTPTDC2D.LFT
NDATA2DSTRTDC2D.LFT
NDATA2DIDXINDEX2D.LDB
NDATA2DIDXPOISR2D.LDB
NDATA2DIDXSCSR2D.LFT
NDATA2DMAP2DCITY2D.LFT
NDATA2DMAPPARCEL2D.LFT
NDATA2EHN2E.LFT
NDATA2ESHLDDC2E.LFT
NDATA2ESTPTDC2E.LFT
NDATA2ESTRTDC2E.LFT
NDATA2EIDXINDEX2E.LDB
NDATA2EIDXPOISR2E.LDB
NDATA2EIDXSCSR2E.LFT
NDATA2EMAP2DCITY2E.LFT
NDATA2EMAPPARCEL2E.LFT
NDATA2FHN2F.LFT
NDATA2FSHLDDC2F.LFT
NDATA2FSTPTDC2F.LFT
NDATA2FSTRTDC2F.LFT
NDATA2FIDXINDEX2F.LDB
NDATA2FIDXPOISR2F.LDB
NDATA2FIDXSCSR2F.LFT
NDATA2FMAP2DCITY2F.LFT
NDATA2FMAPPARCEL2F.LFT
NDATA30HN30.LFT
NDATA30SHLDDC30.LFT
NDATA30STPTDC30.LFT
NDATA30STRTDC30.LFT
NDATA30IDXINDEX30.LDB
NDATA30IDXPOISR30.LDB
NDATA30IDXSCSR30.LFT
NDATA30MAPPARCEL30.LFT
NDATA31HN31.LFT
NDATA31SHLDDC31.LFT
NDATA31STPTDC31.LFT
NDATA31STRTDC31.LFT
NDATA31IDXINDEX31.LDB
NDATA31IDXPOISR31.LDB
NDATA31IDXSCSR31.LFT
NDATA31MAP2DCITY31.LFT
NDATA31MAPPARCEL31.LFT
NDATA33HN33.LFT
NDATA33SHLDDC33.LFT
NDATA33STPTDC33.LFT
NDATA33STRTDC33.LFT
NDATA33IDXINDEX33.LDB
NDATA33IDXPOISR33.LDB
NDATA33IDXSCSR33.LFT
NDATA33MAP2DCITY33.LFT
NDATA33MAPPARCEL33.LFT
NDATA34HN34.LFT
NDATA34SHLDDC34.LFT
NDATA34STPTDC34.LFT
NDATA34STRTDC34.LFT
NDATA34IDXINDEX34.LDB
NDATA34IDXPOISR34.LDB
NDATA34IDXSCSR34.LFT
NDATA34MAPPARCEL34.LFT
NDATA35HN35.LFT
NDATA35SHLDDC35.LFT
NDATA35STPTDC35.LFT
NDATA35STRTDC35.LFT
NDATA35IDXINDEX35.LDB
NDATA35IDXPOISR35.LDB
NDATA35IDXSCSR35.LFT
NDATA35MAP2DCITY35.LFT
NDATA35MAPPARCEL35.LFT
NDATA36HN36.LFT
NDATA36SHLDDC36.LFT
NDATA36STPTDC36.LFT
NDATA36STRTDC36.LFT
NDATA36IDXINDEX36.LDB
NDATA36IDXPOISR36.LDB
NDATA36IDXSCSR36.LFT
NDATA36MAPPARCEL36.LFT
NDATA42HN42.LFT
NDATA42SHLDDC42.LFT
NDATA42STPTDC42.LFT
NDATA42STRTDC42.LFT
NDATA42IDXINDEX42.LDB
NDATA42IDXPOISR42.LDB
NDATA42IDXSCSR42.LFT
NDATA42MAP2DCITY42.LFT
NDATA42MAPPARCEL42.LFT
NDATA43HN43.LFT
NDATA43SHLDDC43.LFT
NDATA43STPTDC43.LFT
NDATA43STRTDC43.LFT
NDATA43IDXINDEX43.LDB
NDATA43IDXPOISR43.LDB
NDATA43IDXSCSR43.LFT
NDATA43MAP2DCITY43.LFT
NDATA43MAPPARCEL43.LFT
NDATA44HN44.LFT
NDATA44SHLDDC44.LFT
NDATA44STPTDC44.LFT
NDATA44STRTDC44.LFT
NDATA44IDXINDEX44.LDB
NDATA44IDXPOISR44.LDB
NDATA44IDXSCSR44.LFT
NDATA44MAPPARCEL44.LFT
NDATA45HN45.LFT
NDATA45SHLDDC45.LFT
NDATA45STPTDC45.LFT
NDATA45STRTDC45.LFT
NDATA45IDXINDEX45.LDB
NDATA45IDXPOISR45.LDB
NDATA45IDXSCSR45.LFT
NDATA45MAPPARCEL45.LFT
NDATA46HN46.LFT
NDATA46SHLDDC46.LFT
NDATA46STPTDC46.LFT
NDATA46STRTDC46.LFT
NDATA46IDXINDEX46.LDB
NDATA46IDXPOISR46.LDB
NDATA46IDXSCSR46.LFT
NDATA46MAPPARCEL46.LFT
NDATA47HN47.LFT
NDATA47SHLDDC47.LFT
NDATA47STPTDC47.LFT
NDATA47STRTDC47.LFT
NDATA47IDXINDEX47.LDB
NDATA47IDXPOISR47.LDB
NDATA47IDXSCSR47.LFT
NDATA47MAPPARCEL47.LFT
NDATA48HN48.LFT
NDATA48SHLDDC48.LFT
NDATA48STPTDC48.LFT
NDATA48STRTDC48.LFT
NDATA48IDXINDEX48.LDB
NDATA48IDXPOISR48.LDB
NDATA48IDXSCSR48.LFT
NDATA48MAPPARCEL48.LFT
NDATA49HN49.LFT
NDATA49STRTDC49.LFT
NDATA49IDXINDEX49.LDB
NDATA49IDXPOISR49.LDB
NDATA49IDXSCSR49.LFT
NDATA49MAPPARCEL49.LFT
NDATA4AHN4A.LFT
NDATA4ASHLDDC4A.LFT
NDATA4ASTPTDC4A.LFT
NDATA4ASTRTDC4A.LFT
NDATA4AIDXINDEX4A.LDB
NDATA4AIDXPOISR4A.LDB
NDATA4AIDXSCSR4A.LFT
NDATA4AMAP2DCITY4A.LFT
NDATA4AMAPPARCEL4A.LFT
NDATA4BHN4B.LFT
NDATA4BSHLDDC4B.LFT
NDATA4BSTPTDC4B.LFT
NDATA4BSTRTDC4B.LFT
NDATA4BIDXINDEX4B.LDB
NDATA4BIDXPOISR4B.LDB
NDATA4BIDXSCSR4B.LFT
NDATA4BMAPPARCEL4B.LFT
NDATA4CHN4C.LFT
NDATA4CSHLDDC4C.LFT
NDATA4CSTPTDC4C.LFT
NDATA4CSTRTDC4C.LFT
NDATA4CIDXINDEX4C.LDB
NDATA4CIDXPOISR4C.LDB
NDATA4CIDXSCSR4C.LFT
NDATA4CMAP2DCITY4C.LFT
NDATA4CMAPPARCEL4C.LFT
NDATA4DHN4D.LFT
NDATA4DSHLDDC4D.LFT
NDATA4DSTPTDC4D.LFT
NDATA4DSTRTDC4D.LFT
NDATA4DIDXINDEX4D.LDB
NDATA4DIDXPOISR4D.LDB
NDATA4DIDXSCSR4D.LFT
NDATA4DMAPPARCEL4D.LFT
NDATA4EHN4E.LFT
NDATA4ESHLDDC4E.LFT
NDATA4ESTPTDC4E.LFT
NDATA4ESTRTDC4E.LFT
NDATA4EIDXINDEX4E.LDB
NDATA4EIDXPOISR4E.LDB
NDATA4EIDXSCSR4E.LFT
NDATA4EMAPPARCEL4E.LFT
NDATAAVXMCATCAT01.GIF
NDATAAVXMCATCAT02.GIF
NDATAAVXMCATCAT03.GIF
NDATAAVXMCATCAT04.GIF
NDATAAVXMCATCAT05.GIF
NDATAAVXMCATCAT06.GIF
NDATAAVXMCATCAT07.GIF
NDATAAVXMCATCAT08.GIF
NDATAAVXMCATCAT09.GIF
NDATAAVXMCATCAT10.GIF
NDATAAVXMCATCAT11.GIF
NDATAAVXMCATCAT12.GIF
NDATAAVXMCATCAT13.GIF
NDATAAVXMCATCAT14.GIF
NDATAAVXMCATCAT15.GIF
NDATAAVXMCATCAT16.GIF
NDATAAVXMCATCAT17.GIF
NDATAAVXMCATCAT18.GIF
NDATAAVXMCATCAT19.GIF
NDATAAVXMCATCATNOT.BMP
NDATAAVXMDATIMAGETBL.DAT
NDATAAVXMDATVERSION.DAT
NDATAAVXMDPSDPS002.BMP
NDATAAVXMDPSDPS004.BMP
NDATAAVXMDPSDPS005.BMP
NDATAAVXMDPSDPS006.BMP
NDATAAVXMDPSDPS007.BMP
NDATAAVXMDPSDPS008.BMP
NDATAAVXMDPSDPS009.BMP
NDATAAVXMDPSDPS010.BMP
NDATAAVXMDPSDPS011.BMP
NDATAAVXMDPSDPS012.BMP
NDATAAVXMDPSDPS013.BMP
NDATAAVXMDPSDPS014.BMP
NDATAAVXMDPSDPS015.BMP
NDATAAVXMDPSDPS016.BMP
NDATAAVXMDPSDPS017.BMP
NDATAAVXMDPSDPS018.BMP
NDATAAVXMDPSDPS019.BMP
NDATAAVXMDPSDPS020.BMP
NDATAAVXMDPSDPS021.BMP
NDATAAVXMDPSDPS022.BMP
NDATAAVXMDPSDPS023.BMP
NDATAAVXMDPSDPS024.BMP
NDATAAVXMDPSDPS025.BMP
NDATAAVXMDPSDPS026.BMP
NDATAAVXMDPSDPS027.BMP
NDATAAVXMDPSDPS028.BMP
NDATAAVXMDPSDPS029.BMP
NDATAAVXMDPSDPS030.BMP
NDATAAVXMDPSDPS031.BMP
NDATAAVXMDPSDPS032.BMP
NDATAAVXMDPSDPS033.BMP
NDATAAVXMDPSDPS034.BMP
NDATAAVXMDPSDPS035.BMP
NDATAAVXMDPSDPS036.BMP
NDATAAVXMDPSDPS037.BMP
NDATAAVXMDPSDPS038.BMP
NDATAAVXMDPSDPS039.BMP
NDATAAVXMDPSDPS040.BMP
NDATAAVXMDPSDPS041.BMP
NDATAAVXMDPSDPS042.BMP
NDATAAVXMDPSDPS043.BMP
NDATAAVXMDPSDPS044.BMP
NDATAAVXMDPSDPS045.BMP
NDATAAVXMDPSDPS046.BMP
NDATAAVXMDPSDPS047.BMP
NDATAAVXMDPSDPS048.BMP
NDATAAVXMDPSDPS049.BMP
NDATAAVXMDPSDPS050.BMP
NDATAAVXMDPSDPS051.BMP
NDATAAVXMDPSDPS052.BMP
NDATAAVXMDPSDPS053.BMP
NDATAAVXMDPSDPS054.BMP
NDATAAVXMDPSDPS055.BMP
NDATAAVXMDPSDPS056.BMP
NDATAAVXMDPSDPS057.BMP
NDATAAVXMDPSDPS058.BMP
NDATAAVXMDPSDPS059.BMP
NDATAAVXMDPSDPS060.BMP
NDATAAVXMDPSDPS062.BMP
NDATAAVXMDPSDPS063.BMP
NDATAAVXMDPSDPS064.BMP
NDATAAVXMDPSDPS065.BMP
NDATAAVXMDPSDPS066.BMP
NDATAAVXMDPSDPS067.BMP
NDATAAVXMDPSDPS068.BMP
NDATAAVXMDPSDPS069.BMP
NDATAAVXMDPSDPS070.BMP
NDATAAVXMDPSDPS071.BMP
NDATAAVXMDPSDPS073.BMP
NDATAAVXMDPSDPS074.BMP
NDATAAVXMDPSDPS075.BMP
NDATAAVXMDPSDPS076.BMP
NDATAAVXMDPSDPS077.BMP
NDATAAVXMDPSDPS078.BMP
NDATAAVXMDPSDPS079.BMP
NDATAAVXMDPSDPS080.BMP
NDATAAVXMDPSDPS081.BMP
NDATAAVXMDPSDPS082.BMP
NDATAAVXMDPSDPS083.BMP
NDATAAVXMDPSDPS084.BMP
NDATAAVXMDPSDPS085.BMP
NDATAAVXMDPSDPS086.BMP
NDATAAVXMDPSDPS087.BMP
NDATAAVXMDPSDPS088.BMP
NDATAAVXMDPSDPS089.BMP
NDATAAVXMDPSDPS090.BMP
NDATAAVXMDPSDPS091.BMP
NDATAAVXMDPSDPS092.BMP
NDATAAVXMDPSDPS093.BMP
NDATAAVXMDPSDPS094.BMP
NDATAAVXMDPSDPS096.BMP
NDATAAVXMDPSDPS097.BMP
NDATAAVXMDPSDPS098.BMP
NDATAAVXMDPSDPS100.BMP
NDATAAVXMDPSDPS101.BMP
NDATAAVXMDPSDPS102.BMP
NDATAAVXMDPSDPS103.BMP
NDATAAVXMDPSDPS104.BMP
NDATAAVXMDPSDPS105.BMP
NDATAAVXMDPSDPS106.BMP
NDATAAVXMDPSDPS107.BMP
NDATAAVXMDPSDPS108.BMP
NDATAAVXMDPSDPS109.BMP
NDATAAVXMDPSDPS110.BMP
NDATAAVXMDPSDPS111.BMP
NDATAAVXMDPSDPS112.BMP
NDATAAVXMDPSDPS113.BMP
NDATAAVXMDPSDPS114.BMP
NDATAAVXMDPSDPS115.BMP
NDATAAVXMDPSDPS116.BMP
NDATAAVXMDPSDPS117.BMP
NDATAAVXMDPSDPS118.BMP
NDATAAVXMDPSDPS119.BMP
NDATAAVXMDPSDPS120.BMP
NDATAAVXMDPSDPS121.BMP
NDATAAVXMDPSDPS122.BMP
NDATAAVXMDPSDPS123.BMP
NDATAAVXMDPSDPS124.BMP
NDATAAVXMDPSDPS125.BMP
NDATAAVXMDPSDPS126.BMP
NDATAAVXMDPSDPS127.BMP
NDATAAVXMDPSDPS128.BMP
NDATAAVXMDPSDPS129.BMP
NDATAAVXMDPSDPS130.BMP
NDATAAVXMDPSDPS131.BMP
NDATAAVXMDPSDPS132.BMP
NDATAAVXMDPSDPS133.BMP
NDATAAVXMDPSDPS134.BMP
NDATAAVXMDPSDPS135.BMP
NDATAAVXMDPSDPS139.BMP
NDATAAVXMDPSDPS140.BMP
NDATAAVXMDPSDPS141.BMP
NDATAAVXMDPSDPS142.BMP
NDATAAVXMDPSDPS143.BMP
NDATAAVXMDPSDPS144.BMP
NDATAAVXMDPSDPS145.BMP
NDATAAVXMDPSDPS146.BMP
NDATAAVXMDPSDPS147.BMP
NDATAAVXMDPSDPS149.BMP
NDATAAVXMDPSDPS150.BMP
NDATAAVXMDPSDPS151.BMP
NDATAAVXMDPSDPS152.BMP
NDATAAVXMDPSDPS153.BMP
NDATAAVXMDPSDPS154.BMP
NDATAAVXMDPSDPS155.BMP
NDATAAVXMDPSDPS156.BMP
NDATAAVXMDPSDPS157.BMP
NDATAAVXMDPSDPS158.BMP
NDATAAVXMDPSDPS159.BMP
NDATAAVXMDPSDPS161.BMP
NDATAAVXMDPSDPS162.BMP
NDATAAVXMDPSDPS163.BMP
NDATAAVXMDPSDPS164.BMP
NDATAAVXMDPSDPS165.BMP
NDATAAVXMDPSDPS166.BMP
NDATAAVXMDPSDPS167.BMP
NDATAAVXMDPSDPS168.BMP
NDATAAVXMDPSDPS169.BMP
NDATAAVXMDPSDPS170.BMP
NDATAAVXMDPSDPS171.BMP
NDATAAVXMDPSDPS172.BMP
NDATAAVXMDPSDPS173.BMP
NDATAAVXMDPSDPS174.BMP
NDATAAVXMDPSDPS175.BMP
NDATAAVXMDPSDPS176.BMP
NDATAAVXMDPSDPS177.BMP
NDATAAVXMDPSDPS178.BMP
NDATAAVXMDPSDPS179.BMP
NDATAAVXMDPSDPS180.BMP
NDATAAVXMDPSDPS181.BMP
NDATAAVXMDPSDPS182.BMP
NDATAAVXMDPSDPS183.BMP
NDATAAVXMDPSDPS184.BMP
NDATAAVXMDPSDPS185.BMP
NDATAAVXMDPSDPS186.BMP
NDATAAVXMDPSDPS187.BMP
NDATAAVXMDPSDPS188.BMP
NDATAAVXMDPSDPS189.BMP
NDATAAVXMDPSDPS190.BMP
NDATAAVXMDPSDPS191.BMP
NDATAAVXMDPSDPS192.BMP
NDATAAVXMDPSDPS193.BMP
NDATAAVXMDPSDPS194.BMP
NDATAAVXMDPSDPS195.BMP
NDATAAVXMDPSDPS196.BMP
NDATAAVXMDPSDPS197.BMP
NDATAAVXMDPSDPS200.BMP
NDATAAVXMDPSDPS201.BMP
NDATAAVXMDPSDPS202.BMP
NDATAAVXMDPSDPS203.BMP
NDATAAVXMDPSDPS204.BMP
NDATAAVXMDPSDPS205.BMP
NDATAAVXMDPSDPS206.BMP
NDATAAVXMDPSDPS207.BMP
NDATAAVXMDPSDPS210.BMP
NDATAAVXMDPSDPS211.BMP
NDATAAVXMDPSDPS212.BMP
NDATAAVXMDPSDPS213.BMP
NDATAAVXMDPSDPS214.BMP
NDATAAVXMDPSDPS215.BMP
NDATAAVXMDPSDPS216.BMP
NDATAAVXMDPSDPS217.BMP
NDATAAVXMDPSDPS218.BMP
NDATAAVXMDPSDPS219.BMP
NDATAAVXMDPSDPS221.BMP
NDATAAVXMDPSDPS222.BMP
NDATAAVXMDPSDPS223.BMP
NDATAAVXMDPSDPS224.BMP
NDATAAVXMDPSDPS226.BMP
NDATAAVXMDPSDPS227.BMP
NDATAAVXMDPSDPS228.BMP
NDATAAVXMDPSDPS229.BMP
NDATAAVXMDPSDPS239.BMP
NDATAAVXMDPSDPS245.BMP
NDATAAVXMDPSDPS246.BMP
NDATAAVXMDPSDPSNOT.BMP
NDATAAVXMLPSLPS002.BMP
NDATAAVXMLPSLPS004.BMP
NDATAAVXMLPSLPS005.BMP
NDATAAVXMLPSLPS006.BMP
NDATAAVXMLPSLPS007.BMP
NDATAAVXMLPSLPS008.BMP
NDATAAVXMLPSLPS009.BMP
NDATAAVXMLPSLPS010.BMP
NDATAAVXMLPSLPS011.BMP
NDATAAVXMLPSLPS012.BMP
NDATAAVXMLPSLPS013.BMP
NDATAAVXMLPSLPS014.BMP
NDATAAVXMLPSLPS015.BMP
NDATAAVXMLPSLPS016.BMP
NDATAAVXMLPSLPS017.BMP
NDATAAVXMLPSLPS018.BMP
NDATAAVXMLPSLPS019.BMP
NDATAAVXMLPSLPS020.BMP
NDATAAVXMLPSLPS021.BMP
NDATAAVXMLPSLPS022.BMP
NDATAAVXMLPSLPS023.BMP
NDATAAVXMLPSLPS024.BMP
NDATAAVXMLPSLPS025.BMP
NDATAAVXMLPSLPS026.BMP
NDATAAVXMLPSLPS027.BMP
NDATAAVXMLPSLPS028.BMP
NDATAAVXMLPSLPS029.BMP
NDATAAVXMLPSLPS030.BMP
NDATAAVXMLPSLPS031.BMP
NDATAAVXMLPSLPS032.BMP
NDATAAVXMLPSLPS033.BMP
NDATAAVXMLPSLPS034.BMP
NDATAAVXMLPSLPS035.BMP
NDATAAVXMLPSLPS036.BMP
NDATAAVXMLPSLPS037.BMP
NDATAAVXMLPSLPS038.BMP
NDATAAVXMLPSLPS039.BMP
NDATAAVXMLPSLPS040.BMP
NDATAAVXMLPSLPS041.BMP
NDATAAVXMLPSLPS042.BMP
NDATAAVXMLPSLPS043.BMP
NDATAAVXMLPSLPS044.BMP
NDATAAVXMLPSLPS045.BMP
NDATAAVXMLPSLPS046.BMP
NDATAAVXMLPSLPS047.BMP
NDATAAVXMLPSLPS048.BMP
NDATAAVXMLPSLPS049.BMP
NDATAAVXMLPSLPS050.BMP
NDATAAVXMLPSLPS051.BMP
NDATAAVXMLPSLPS052.BMP
NDATAAVXMLPSLPS053.BMP
NDATAAVXMLPSLPS054.BMP
NDATAAVXMLPSLPS055.BMP
NDATAAVXMLPSLPS056.BMP
NDATAAVXMLPSLPS057.BMP
NDATAAVXMLPSLPS058.BMP
NDATAAVXMLPSLPS059.BMP
NDATAAVXMLPSLPS060.BMP
NDATAAVXMLPSLPS062.BMP
NDATAAVXMLPSLPS063.BMP
NDATAAVXMLPSLPS064.BMP
NDATAAVXMLPSLPS065.BMP
NDATAAVXMLPSLPS066.BMP
NDATAAVXMLPSLPS067.BMP
NDATAAVXMLPSLPS068.BMP
NDATAAVXMLPSLPS069.BMP
NDATAAVXMLPSLPS070.BMP
NDATAAVXMLPSLPS071.BMP
NDATAAVXMLPSLPS073.BMP
NDATAAVXMLPSLPS074.BMP
NDATAAVXMLPSLPS075.BMP
NDATAAVXMLPSLPS076.BMP
NDATAAVXMLPSLPS077.BMP
NDATAAVXMLPSLPS078.BMP
NDATAAVXMLPSLPS079.BMP
NDATAAVXMLPSLPS080.BMP
NDATAAVXMLPSLPS081.BMP
NDATAAVXMLPSLPS082.BMP
NDATAAVXMLPSLPS083.BMP
NDATAAVXMLPSLPS084.BMP
NDATAAVXMLPSLPS085.BMP
NDATAAVXMLPSLPS086.BMP
NDATAAVXMLPSLPS087.BMP
NDATAAVXMLPSLPS088.BMP
NDATAAVXMLPSLPS089.BMP
NDATAAVXMLPSLPS090.BMP
NDATAAVXMLPSLPS091.BMP
NDATAAVXMLPSLPS092.BMP
NDATAAVXMLPSLPS093.BMP
NDATAAVXMLPSLPS094.BMP
NDATAAVXMLPSLPS096.BMP
NDATAAVXMLPSLPS097.BMP
NDATAAVXMLPSLPS098.BMP
NDATAAVXMLPSLPS100.BMP
NDATAAVXMLPSLPS101.BMP
NDATAAVXMLPSLPS102.BMP
NDATAAVXMLPSLPS103.BMP
NDATAAVXMLPSLPS104.BMP
NDATAAVXMLPSLPS105.BMP
NDATAAVXMLPSLPS106.BMP
NDATAAVXMLPSLPS107.BMP
NDATAAVXMLPSLPS108.BMP
NDATAAVXMLPSLPS109.BMP
NDATAAVXMLPSLPS110.BMP
NDATAAVXMLPSLPS111.BMP
NDATAAVXMLPSLPS112.BMP
NDATAAVXMLPSLPS113.BMP
NDATAAVXMLPSLPS114.BMP
NDATAAVXMLPSLPS115.BMP
NDATAAVXMLPSLPS116.BMP
NDATAAVXMLPSLPS117.BMP
NDATAAVXMLPSLPS118.BMP
NDATAAVXMLPSLPS119.BMP
NDATAAVXMLPSLPS120.BMP
NDATAAVXMLPSLPS121.BMP
NDATAAVXMLPSLPS122.BMP
NDATAAVXMLPSLPS123.BMP
NDATAAVXMLPSLPS124.BMP
NDATAAVXMLPSLPS125.BMP
NDATAAVXMLPSLPS126.BMP
NDATAAVXMLPSLPS127.BMP
NDATAAVXMLPSLPS128.BMP
NDATAAVXMLPSLPS129.BMP
NDATAAVXMLPSLPS130.BMP
NDATAAVXMLPSLPS131.BMP
NDATAAVXMLPSLPS132.BMP
NDATAAVXMLPSLPS133.BMP
NDATAAVXMLPSLPS134.BMP
NDATAAVXMLPSLPS135.BMP
NDATAAVXMLPSLPS139.BMP
NDATAAVXMLPSLPS140.BMP
NDATAAVXMLPSLPS141.BMP
NDATAAVXMLPSLPS142.BMP
NDATAAVXMLPSLPS143.BMP
NDATAAVXMLPSLPS144.BMP
NDATAAVXMLPSLPS145.BMP
NDATAAVXMLPSLPS146.BMP
NDATAAVXMLPSLPS147.BMP
NDATAAVXMLPSLPS149.BMP
NDATAAVXMLPSLPS150.BMP
NDATAAVXMLPSLPS151.BMP
NDATAAVXMLPSLPS152.BMP
NDATAAVXMLPSLPS153.BMP
NDATAAVXMLPSLPS154.BMP
NDATAAVXMLPSLPS155.BMP
NDATAAVXMLPSLPS156.BMP
NDATAAVXMLPSLPS157.BMP
NDATAAVXMLPSLPS158.BMP
NDATAAVXMLPSLPS159.BMP
NDATAAVXMLPSLPS161.BMP
NDATAAVXMLPSLPS162.BMP
NDATAAVXMLPSLPS163.BMP
NDATAAVXMLPSLPS164.BMP
NDATAAVXMLPSLPS165.BMP
NDATAAVXMLPSLPS166.BMP
NDATAAVXMLPSLPS167.BMP
NDATAAVXMLPSLPS168.BMP
NDATAAVXMLPSLPS169.BMP
NDATAAVXMLPSLPS170.BMP
NDATAAVXMLPSLPS171.BMP
NDATAAVXMLPSLPS172.BMP
NDATAAVXMLPSLPS173.BMP
NDATAAVXMLPSLPS174.BMP
NDATAAVXMLPSLPS175.BMP
NDATAAVXMLPSLPS176.BMP
NDATAAVXMLPSLPS177.BMP
NDATAAVXMLPSLPS178.BMP
NDATAAVXMLPSLPS179.BMP
NDATAAVXMLPSLPS180.BMP
NDATAAVXMLPSLPS181.BMP
NDATAAVXMLPSLPS182.BMP
NDATAAVXMLPSLPS183.BMP
NDATAAVXMLPSLPS184.BMP
NDATAAVXMLPSLPS185.BMP
NDATAAVXMLPSLPS186.BMP
NDATAAVXMLPSLPS187.BMP
NDATAAVXMLPSLPS188.BMP
NDATAAVXMLPSLPS189.BMP
NDATAAVXMLPSLPS190.BMP
NDATAAVXMLPSLPS191.BMP
NDATAAVXMLPSLPS192.BMP
NDATAAVXMLPSLPS193.BMP
NDATAAVXMLPSLPS194.BMP
NDATAAVXMLPSLPS195.BMP
NDATAAVXMLPSLPS196.BMP
NDATAAVXMLPSLPS197.BMP
NDATAAVXMLPSLPS200.BMP
NDATAAVXMLPSLPS201.BMP
NDATAAVXMLPSLPS202.BMP
NDATAAVXMLPSLPS203.BMP
NDATAAVXMLPSLPS204.BMP
NDATAAVXMLPSLPS205.BMP
NDATAAVXMLPSLPS206.BMP
NDATAAVXMLPSLPS207.BMP
NDATAAVXMLPSLPS210.BMP
NDATAAVXMLPSLPS211.BMP
NDATAAVXMLPSLPS212.BMP
NDATAAVXMLPSLPS213.BMP
NDATAAVXMLPSLPS214.BMP
NDATAAVXMLPSLPS215.BMP
NDATAAVXMLPSLPS216.BMP
NDATAAVXMLPSLPS217.BMP
NDATAAVXMLPSLPS218.BMP
NDATAAVXMLPSLPS219.BMP
NDATAAVXMLPSLPS221.BMP
NDATAAVXMLPSLPS222.BMP
NDATAAVXMLPSLPS223.BMP
NDATAAVXMLPSLPS224.BMP
NDATAAVXMLPSLPS226.BMP
NDATAAVXMLPSLPS227.BMP
NDATAAVXMLPSLPS228.BMP
NDATAAVXMLPSLPS229.BMP
NDATAAVXMLPSLPS239.BMP
NDATAAVXMLPSLPS245.BMP
NDATAAVXMLPSLPS246.BMP
NDATAAVXMLPSLPSNOT.BMP
NDATABGPREINSTALLCurves Light Blue.bmp
NDATABGPREINSTALLDefault.bmp
NDATABGPREINSTALLIC Gold.bmp
NDATABGPREINSTALLRipple Blue.bmp
NDATABGPREINSTALLSpotlight Green.bmp
NDATABTBTDEFAULT.DAT
NDATAFEMAPPARCELFE.LFT
NDATAINITDATAUSERRWVBTVERSION.TXT
NDATAINITDATAUSERRWVBTENEN_USHFD_Dynamic.fsm
NDATAINITDATAUSERRWVBTENEN_USHFD_Dynamic.fsmb
NDATAINITDATAUSERRWVBTENEN_USMusicCatalog.db
NDATAINITDATAUSERRWVBTENEN_USMusic_Dynamic.fsm
NDATAINITDATAUSERRWVBTENEN_USMusic_Dynamic.fsmb
NDATAINITDATAUSERRWVBTENEN_USVBAgent.db
NDATAINITDATAUSERRWVBTENEN_USVBSystem.db
NDATAINITDATAUSERRWVBTENEN_USVBTLexDynamic.dsu
NDATAINITDATAUSERRWVBTENEN_USVBT_Grammar.fsm
NDATAINITDATAUSERRWVBTENEN_USVBT_Grammar.fsmb
NDATAL3DDAY.CTL
NDATAL3DDAY.L3D
NDATAL3DDAY.LST
NDATAL3DDRV.TBL
NDATAL3DDRV.TXT
NDATAL3DNIGHT.CTL
NDATAL3DNIGHT.L3D
NDATAL3DNIGHT.LST
NDATASDUSBFILTER.FLR
NDATASDUSBMMPCONF.DAT
NDATASKYGZ-NSKY_D-01.bmp
NDATASKYGZ-NSKY_D-02.bmp
NDATASKYGZ-NSKY_N-01.bmp
NDATASKYGZ-NSKY_N-02.bmp
NDATASOUNDLOPEDATA.DAT
NDATASOUNDUC090SND.ENU
NDATASOUNDUC090SND.FRE
NDATASOUNDUC090SND.SPA
NDATASOUNDUC090TTS.ENU
NDATASOUNDUC090TTS.FRE
NDATASOUNDUC090TTS.SPA
NDATAsymbolSL_GP_MAPOVER.symb
NDATAsymbolSL_GP_TEXBD.symb
NDATAsymbolSL_GP_TEXBN.symb
NDATAsymbolSL_GP_TEXRD.symb
NDATAsymbolSL_GP_TEXRN.symb
NDATATELGOOG411.DAT
NDATATTSDataPP.DAT
NDATATTSDataENUdepes_enu.dat
NDATATTSDataENUdepes_enu_samantha.dat
NDATATTSDataENUphonmap_enu_samantha.dat
NDATATTSDataENUsynth_samantha_dri40_155mrf22_270_06.dat
NDATATTSDataENUsysdct_enu_cfg2.dat
NDATATTSDataENUtokentn_enu.dat
NDATATTSDataENUuselect_samantha_dri40.dat
NDATATTSDataENUvauto_pipeline_enu_samantha_22_dri40_155mrf22.hdr
NDATATTSDataFRFdepes_frf.dat
NDATATTSDataFRFdepes_frf_virginie.dat
NDATATTSDataFRFphonmap_frf_virginie.dat
NDATATTSDataFRFsynth_virginie_dri40_155mrf22_270_06.dat
NDATATTSDataFRFsysdct_frf_cfg1.dat
NDATATTSDataFRFtokentn_frf.dat
NDATATTSDataFRFuselect_virginie_dri40.dat
NDATATTSDataFRFvauto_pipeline_frf_virginie_22_dri40_155mrf22.hdr
NDATATTSDataSPEdepes_spe.dat
NDATATTSDataSPEdepes_spe_monica.dat
NDATATTSDataSPEphonmap_spe_monica.dat
NDATATTSDataSPEsynth_monica_dri40_155mrf22_270_06.dat
NDATATTSDataSPEsysdct_spe_cfg1.dat
NDATATTSDataSPEtokentn_spe.dat
NDATATTSDataSPEuselect_monica_dri40.dat
NDATATTSDataSPEvauto_pipeline_spe_monica_22_dri40_155mrf22.hdr
NDATATTSDataTransDataENUapdb_tp_samantha_dri40_lrfix.apdb
NDATATTSDataTransDataENUTTS_DIC_ENU.bdc
NDATATTSDataTransDataENUTTS_PRON_ENU.bdc
NDATATTSDataTransDataENUTTS_TRANS_ENU.rul
NDATATTSDataTransDataFRFTTS_DIC_FRF.bdc
NDATATTSDataTransDataFRFTTS_PRON_FRF.bdc
NDATATTSDataTransDataFRFTTS_TRANS_FRF.rul
NDATATTSDataTransDataSPETTS_DIC_SPE.bdc
NDATATTSDataTransDataSPETTS_PRON_SPE.bdc
NDATATTSDataTransDataSPETTS_TRANS_SPE.rul
NDATAVBTPOILIST0.DB
NDATAVBTVERSION.TXT
NDATAVBTENEN_USAEGrammars.vba
NDATAVBTENEN_USState.fsm
NDATAVBTENEN_USVBTAsrModel.dat
NDATAVBTENEN_USVBTDDG2P.DAT
NDATAVBTENEN_USVBTLex.dsu
NDATAVBTENEN_USVBTMP3DDG2P.dat

NDATAINITDATAUSERSETUP is empty

Total image space:  3,802,103,808
Free image space:   668,868,808
Image cluster size: 8,192
Boot Sector OEM:    MSWIN4.1
Serial Number:      07F10006
Bytes/Sector:       512
Sectors/Cluster:    16
File System:        TFAT32
Disk Label:         DONT_DEL015

NDATASDUSBFILTER.FLR file contents:

SDMMCNDB
SDMMCPC
SDMMCVoice
SDMMCFirmware
SDMMCLT
SDMMCdebug
SDMMCUPDATE
SDMMCTypeManager
SDMMCVersion

NDATATELGOOG411.DAT file contents:

14252964544

• [*:1hfjomq9]The firmware update themselves have no executable code.
  [*:1hfjomq9]NDATAINITDATAUSERRWVBTENEN_USMusicCatalog is in SQLite Format 3
  [*:1hfjomq9]NDATAVBTPOILIST0 is in SQLite Format 3

Pioneer.Z110BT.Upgrade.Unlocker-ShortFuse.zip

Good luck.

Okay, I think the hack you guys really care about is the password hack.

It's stupid easy if you've ever cracked something before. I'm working on making a keygen. The code itself will be in the RenewalIFLib.dll under USER\PRG\APL. I'll play with modifying other stuff later.

It seems RenewalIFLib decodes AUTHINFO.DAT and VERINFO.DAT

I would just patch the dll and make it skip this but it seems to write a file as well. It might break something else later and then maybe you'll be permanently stuck. It's probably just safer to make a keygen.

What is your opinion on the possibility of UI hacks based on what you have seen so far?

Crack it

What is your opinion on the possibility of UI hacks based on what you have seen so far?

THE BMP files can be modified. A lot of graphic files are packed so I"ll have to see how to unpack them. I'm still running the stock Z110BT so I'll have to update first. The voices can seemingly be changed.

There are two NAND devices. They're called NAND and NAND2. NAND is where the application itself lives. I'm sure it's probably 64MB or 128MB. The second (NAND2) is a 4GB. That's where the NDATA writes to. We can modify that by changing the NDATA files and running the update. Flashing files to NAND1, I'm not sure yet. By the way, the Operating System being "Windows Automative 5.5" is not true. It's WinCE 5.0. I'm sure there's no check. You can probably replace navi.exe from APL with a WINCE app and it'll run. I'll look into play with all this but first, I'm going to try to decrypt the DAT files so I can actually use the new firmware.

Can somebody describe the firmware upgrade process to me? The steps?

Oh yeah, I'm sure you can also modify the voice. Pioneer uses Scansoft's Vocalizer for WinCE

You can grab a demo here: ftp://ftp.scansoft.com/pub/intel/

I'm pretty sure that's what the VBT files are

Ok can you please keep this thread updated and stick with it. Or at least let everyone know if you get to a point where you no longer want to continue. There have been so many that have claimed they could and would do what you are claiming only to never be seen again. Please don't be one of those people. Once this gets to a promising point I will gladly sticky this and any other topics that are promising.

Ok can you please keep this thread updated and stick with it. Or at least let everyone know if you get to a point where you no longer want to continue. There have been so many that have claimed they could and would do what you are claiming only to never be seen again. Please don't be one of those people. Once this gets to a promising point I will gladly sticky this and any other topics that are promising.

K, I'll try to post as much as I can. I'm not that great of a cracker. Regardless, I'll contribute as much as possible. If I can't, hopefully somebody can continue work.

Updated: Added Decrypt subroutine from RenewalIFLib.dll

The key file here is RenewalIFLib.dll from the APL directory.

Decompiled with Desquirr:

AL_AUTH_Operation::PassAttestation(ushort const *)

10002648 _PassAttestation_AL_AUTH_Operation__QAA_AW4AL_AUTH_PasswordResult__PBG_Z:
10002648   R12 = SP;
1000264c   /* push LR */
1000264c   /* push R12 */
1000264c   /* push R11 */
1000264c   /* push R8 */
1000264c   /* push R7 */
1000264c   /* push R6 */
1000264c   /* push R5 */
1000264c   /* push R4 */
10002650   R11 = & 0x20;
10002658   R6 = R1;
1000265c   R7 = R0;
10002668   var_24 = * unk_10010CCC;
1000266c   R8 = 0x20000000;
10002680   /* Low-level instruction of type 31 */
10002684   R5 = 3;
10002688   Cond = R6;
1000268c   if (Cond != 0) goto loc_100026B4;

10002690   R3 = _Output_AL_Log__SAXKPBDZZ;
10002694   R1 = "ERROR: NULL Password";
100026a0   /* Low-level instruction of type 31 */

100026a4 loc_100026A4:
100026a8   sub_1000600C(var_24, R1, R2, R3);
100026ac   R5 = 3;
100026b0   goto loc_100028CC;

100026b4 loc_100026B4:
100026bc   Cond = wcslen(R6) - 0x10;
100026c0   if (Cond == 0) goto loc_100026DC;

100026c4   R3 = _Output_AL_Log__SAXKPBDZZ;
100026c8   R1 = "ERROR: SIZE Password";
100026d4   /* Low-level instruction of type 31 */
100026d8   goto loc_100026A4;

100026dc loc_100026DC:
100026e8   memset(R11 - var_4C, 0, 0x11);
1000270c   Cond = * _NCharToChar__YAHPBGHPADH_Z(R6, 0x10, R11 - var_4C, 0x10) - 0x10;
10002710   if (Cond != 0) goto loc_100026A4;

10002718   var_A4 = 0;
1000271c   R3 = 0;
10002724   var_A0 = R3;
10002728   var_9C = R3;
1000272c   var_98 = R3;
10002738   var_A8 = strlen(R11 - var_4C);
10002750   Cond = ?ConvertHexStrToBin@AL_AUTH_Operation@@QAAJPAEKPBEK@Z(R7, R11 - var_A4, 0x10, R11 - var_4C);
10002754   if (Cond == 0) goto loc_10002774;

10002758   R3 = _Output_AL_Log__SAXKPBDZZ;
1000275c   R1 = "ERROR: CONVERT ERROR: Password:%s";
10002760   R2 = R11 - var_4C;
1000276c   /* Low-level instruction of type 31 */
10002770   goto loc_100026A4;

10002774 loc_10002774:
10002784   var_8C = 0;
10002788   memset(R11 - var_8B, 0, 7);
10002790   R6 = 0;
100027ac   var_84 = R6;
100027b0   var_80 = R6;
100027b4   var_7C = R6;
100027b8   var_78 = R6;
100027bc   var_94 = R11 - var_8C;
100027c0   var_90 = 0x18;
100027c4   R0 = ?Decrypt@AL_AUTH_Operation@@QAAJPBGAAUAL_AUTH_CryptoDataBuff@@PBK@Z(R7, * off_1001057C, R11 - var_94, R11 - var_A4);
100027c8   R6 = R0;
100027d4   ??0AL_AUTH_File@@QAA@ABUAL_AUTH_FileInfo@@@Z(R11 - var_74, R11 - var_8C, R2, R3);
100027d8   R2 = 0x14;
100027dc   R1 = 0;
100027e0   R0 = R11 - var_38;

100027e4 loc_100027E4:
100027e4   memset(R0, R1, R2);
100027f4   memset(R11 - var_58, 0, 10);
100027f8   R3 = 0xf0000002;
100027fc   R7 = R3 | 0x660000;
10002800   Cond = R6;
10002804   if (Cond != 0) goto loc_10002864;

1000280c   R0 = ?Check@AL_AUTH_File@@QBA_NXZ(R11 - var_74, R1, R2, R3);
10002810   Cond = R0 - 1;
10002814   if (Cond != 0) goto loc_10002860;

10002818   R0 = ?Instance@AL_VersionManagerIFBase@@SAPAV1@XZ(R0, R1, R2, R3);
1000281c   Cond = R0;
10002820   if (Cond == 0) goto loc_10002888;

10002834   /* Low-level instruction of type 31 */
1000283c   R6 = R0;
10002858   * _NCharToChar__YAHPBGHPADH_Z(R11 - var_38, 10, R11 - var_58, 10);
1000285c   goto loc_10002864;

10002860 loc_10002860:
10002860   R6 = R7;

10002864 loc_10002864:
10002864   Cond = R6 - R7;
10002868   if (Cond == 0) goto loc_100028B8;

1000286c   if (Cond <= 0) goto loc_100028BC;

10002870   R3 = 0xf0660004;
10002878   Cond = R6 - R3;
1000287c   if (Cond <= 0) goto loc_100028B0;

10002880   Cond = R6;
10002884   if (Cond != 0) goto loc_100028BC;

10002888 loc_10002888:
10002890   R1 = ?GetVersion@AL_AUTH_File@@QBAPBDXZ(R11 - var_74, R1, R2, R3);
100028a0   Cond = strncmp(R11 - var_58, R1, 10);
100028a4   if (Cond != 0) goto loc_100028B8;

100028a8   R5 = 0;
100028ac   goto loc_100028BC;

100028b0 loc_100028B0:
100028b0   R5 = 2;
100028b4   goto loc_100028BC;

100028b8 loc_100028B8:
100028b8   R5 = 1;

100028bc loc_100028BC:
100028bc   R0 = R11 - var_74;

100028c0 loc_100028C0:
100028c0   ??1AL_AUTH_File@@UAA@XZ(R0, R1, R2, R3);
100028c8   sub_1000600C(var_24, R1, R2, R3);

100028cc loc_100028CC:
100028cc   R0 = R5;
100028d4   /* pop  */
100028d4   /* pop  */
100028d4   /* pop  */
100028d4   /* pop  */
100028d4   /* pop  */
100028d4   /* pop  */
100028d4   /* pop  */
100028d4   return R0;

AL_AUTH_Operation::Decrypt(ushort const *,AL_AUTH_CryptoDataBuffer &,ulong const *)

var_28= -0x28
var_24= -0x24
var_20= -0x20
var_1C= -0x1C

10002244 _Decrypt_AL_AUTH_Operation__QAAJPBGAAUAL_AUTH_CryptoDataBuff__PBK_Z:
10002244   /* push LR */
10002244   /* push R8 */
10002244   /* push R7 */
10002244   /* push R6 */
10002244   /* push R5 */
10002244   /* push R4 */
1000224c   R7 = R3;
10002250   R4 = R2;
10002254   Cond = R1;
10002254   R5 = R1;
10002258   R8 = R0;
1000225c   if (Cond == 0) goto loc_100023BC;

10002264   Cond = * R4;
10002268   if (Cond == 0) goto loc_100023BC;

10002270   Cond = * (R4 + 4) & 7;
10002274   if (Cond != 0) goto loc_100023BC;

1000227c   R0 = ??2@YAPAXI@Z(0x400);
10002280   Cond = R0;
10002280   R6 = R0;
10002284   if (Cond != 0) goto loc_10002288;

10002284   R5 = 0xf06600ff;

10002288 loc_10002288:
10002288   if (Cond == 0) goto loc_100023E8;

10002298   memset(R6, 0, 0x400);
100022a0   R3 = * (R4 + 4) + 8;
100022a4   Cond = R3 - 0x400;
100022a8   if (Cond <= 0) goto loc_100022D8;

100022c8   * _Output_AL_Log__SAXKPBDZZ(0x20000000 | 0x80000, "DECRYPT ERROR: MemSize:%d, EncryptedSize:%d", 0x400, R3);
100022d0   R5 = 0xf0000000 | 0x660000;
100022d4   goto loc_10002330;

100022d8 loc_100022D8:
100022e4   var_28 = R6;
100022e8   var_24 = R3;
100022ec   R0 = ?ReadEncryptedFile@AL_AUTH_Operation@@AAAJPBGAAUAL_AUTH_CryptoDataBuff@@@Z(R8, R5, & var_28, R3);
100022f0   Cond = R0;
100022f0   R5 = R0;
100022f4   if (Cond == 0) goto loc_1000233C;

10002314   * _ErrorRec_AL_Error__SAXPBDKJK_Z("$Id: AL_AUTH_Operation.cpp 58126 2009-03-23 10:09:44Z yuliangde $", 0xc6, R5, -1);
1000232c   /* Low-level instruction of type 31 */

10002330 loc_10002330:
10002334   ??3@YAXPAX@Z(R6);
10002338   goto loc_100023E8;

1000233c loc_1000233C:
1000233c   R1 = var_28;
10002340   R5 = * (R4 + 4);
10002350   var_20 = * R1;
10002354   R3 = * (R1 + 4);
1000235c   var_1C = R3;
10002360   memcpy(* R4, R1 + 8, R5);
10002368   ??3@YAXPAX@Z(R6);
1000236c   Cond = R7;
10002370   R0 = & var_28;
10002374   if (Cond != 0) goto loc_10002398;

10002378   ?GetInternalAccessKey@AL_AUTH_KeyLib@@SAXPAK@Z(R0, R1, R2, R3);
1000238c   ?DecryptInternalAccessKey@AL_AUTH_CryptoLib@@SAXPAKPBK1K@Z(* R4, & var_28, & var_20, R5 >> 3);
10002390   R5 = 0;
10002394   goto loc_100023E8;

10002398 loc_10002398:
1000239c   ?GetExternalAccessKey@AL_AUTH_KeyLib@@SAXPAKPBK@Z(R0, R7, R2, R3);
100023b0   ?DecryptExternalAccessKey@AL_AUTH_CryptoLib@@SAXPAKPBK1K@Z(* R4, & var_28, & var_20, R5 >> 3);
100023b4   R5 = 0;
100023b8   goto loc_100023E8;

100023bc loc_100023BC:
100023dc   * _Output_AL_Log__SAXKPBDZZ(0x20080000, "DECRYPT ERROR: Buff:%08x, Size:%d", * R4, * (R4 + 4));
100023e4   R5 = 0xf0000000 | 0x660000;

100023e8 loc_100023E8:
100023e8   R0 = R5;
100023f0   /* pop  */
100023f0   /* pop  */
100023f0   /* pop  */
100023f0   /* pop  */
100023f0   /* pop  */
100023f0   return R0;

Okay, if you guys want a crack, it'll be done in AL_AUTH_Operation::PassAttestation(ushort const *) in the RenewalIFLib.dll

You can see a somewhat decompiling there in C but I'm also just looking at straight assembly code in IDA Pro. Basically, this function is the end-all checking function. It tests your password.

Here's how it works. The function returns R0, but before that, Ignoring the POPs, R0 is set to equal the value of R5. Here are all the function we care about:

loc_1000600C (UNKNOWN1):

(probably a message box or debugging log)

loc_100026A4 (FAILED):

GOTO UNKNOWN1

R5 = 3 (MOV R5, #3)

GOTO FINISH

loc_100028CC (FINISH):

R0 = R5

/POP/

Return R0

Here's how it works:

1. [*:1p0x1fp4]Check if you put a password. If you didn't:
   Respond: "ERROR: NULL password"
   GOTO FAILED (which goes to FINISH)
    
   [*:1p0x1fp4]Check the length of your password. If it's not the right length:
   Respond: "ERROR: SIZE password"
   GOTO FAILED
    
   [*:1p0x1fp4]Run your password through a character conversion function. If it fails:
   GOTO FAILED
   (interesting there's no error message)
    
   [*:1p0x1fp4]Convert your pass from string to binary (hex).If this fails:
   Respond: "ERROR: CONVERT ERROR: Password: %s" (%s being your password)
   GOTO FAILED
    
   [*:1p0x1fp4]Decrypts your password via AL_AUTH_Operation::Decrypt
   [*:1p0x1fp4]Probably looks for AUTHINFO.DAT since it calls AL_AUTH_File::AL_AUTH_File(AL_AUTH_FileInfo const &)
   [*:1p0x1fp4]At loc_100027E4, it checks some values, but I'm not entirely sure what's going on, but I know if it fails:
   Skip to step 12
    
   [*:1p0x1fp4]AL_AUTH_File::Check, If True:
   SET R6 = R7
   Skip to step 12
    
   [*:1p0x1fp4]Initialize VersionManager, if good
   Skip to step 15
    
   [*:1p0x1fp4]Another character conversion ???
   [*:1p0x1fp4]If R6 = R7
   Skip to 17
    
   [*:1p0x1fp4]If R6 < R7
   Skip to 18
    
   [*:1p0x1fp4]If R6 <= 0xF0660004 (This will run if R6 > R7)
   R5 = 2
   Skip to 18
    
   [*:1p0x1fp4]If R6 = 0
   Skip to 18
    
   [*:1p0x1fp4]Get VersionFile. It calls AL_AUTH_File::GetVersion(void)
   [*:1p0x1fp4]Compare Version. If False
   R5 = 0
   Skip to 18
    
   [*:1p0x1fp4]R5 = 1
   [*:1p0x1fp4]Do something... not sure
   [*:1p0x1fp4]Close AuthInfo files. It calls AL_AUTH_File::~AL_AUTH_File(void)
   [*:1p0x1fp4](FINISH) Return R5

Here's what I figure.

R5 Values

• [*:1p0x1fp4]0 = New version. Do Update.
  [*:1p0x1fp4]1 = Same version. Don't Update.
  [*:1p0x1fp4]2 = No authfile. I'm not sure what it'll do.
  [*:1p0x1fp4]3 = Failed. Don't update.

Here's my guess. I crack it by saying, if it goes to FAILED, set R5 = 0 instead of 3. So you can put a blank (or at least 1 character) for a password and it'll accept it as correct.

Now, you're asking. How do I crack it?

Easy.

TL;DR

Open RenewalIFLib.dll in a hex editor. Go to 0x1AAC. Change 03 to 00.

Let me know if that works for you guys.

After reading this thread, I think I just grew a set of buck teeth, and now I just keep saying duhhhhhhhh. LOL

Bad news. The SD upgrade doesn't run the cracked lib on the SD. It runs off the internal NAND. I have to make a fake update. If you haven't upgraded to 1001, there's a good chance it'll work for you. I'm going to see if I can find another way for us 1001s. If you still have 1000, post here.

Good news! i found out how to falsify updates! File mods, here we come!

Good news! i found out how to falsify updates! File mods, here we come!

Ok, what does this mean exactly.

WOAH!!!!!!! It worked!!!! I'm updating it now.

Stickied!

HOLY CRAP! Froze at 98% and said

INCORRECT SD CARD. PLEASE INSERT THE CORRECT ONE.

My heart jumped. I found out the issue. I fixed it and it installed now. I'm going to test it and play with it now.

Bluetooth AVRCP isn't working but I just remembered I haven't done the bluetooth upgrade. I'm doing that now...

Yeah, that was it. It's working now. This definitely not worth the $200. I'm making a file now.

Woah nice..

Crack is up! Check the first post!!!

So here's how I understand it..

U download the 1.001000 update from Pioneer, replace the 2 files and copy 1.001000 update (with the patched files) to an SD card. Insert that and update the radio.

Then after the AVIC is updated to 1.001000, you go ahead and insert the (1 of 2)120BT SD cards update? Inputting anything for a password?

How big do those cards have to be?

So here's how I understand it..

 

U download the 1.001000 update from Pioneer, replace the 2 files and copy 1.001000 update (with the patched files) to an SD card. Insert that and update the radio.

 

Then after the AVIC is updated to 1.001000, you go ahead and insert the (1 of 2)120BT SD cards update? Inputting anything for a password?

 

How big do those cards have to be?

Yes, this is a special 1.001000 update. It's actually marked as 1.002000 which is why it updates.

In reality, you can do it all with just one SD card. The updates can be found on torrents. SD1 is 4GB. SD2 is just 2 megabytes.

I felt a little brave enough to try this out.. Tried it right now and I can confirm that it WORKS. Now just need to get used the interface

I'm not going to do the mod, but just have to say thanks to shortfuse for doing what he did. It allows interesting things to be done with the hardware that many of the manufacturers themselves never thought about. Just goes to show that there are some really intelligent people out there. Congratulations!!!!!!

Well done on the mod!

Wanted to try this but needed to ask if this method will work the same with the AU version (f10bt) because I can't find any f10bt 1.001 on the AU/EU website. There is an update though for time-zone fix which contains pretty much the same files just a different size, would it still work if I swapped the 2 files on that update?

I'm not after the 2010 upgrade, but I am very interested in mods! I've got both an F90BT and Z110BT at the moment, and would love to see the map program hacked to do the speed trap cameras and other great stuff that's been unlocked on the F-series.

If I have to go with the Z120 interface to do so, I'll do it, (new maps a bonus).

Huge props to ShortFuse!

Perhaps we can get the master modders from the F series to take their efforts over here now, now that the master cracker has opened the door?