bonjour ,

many thanks to condiczek for sharing his experiences.

I tried on a F10BT, upgraded to F20BT (and updated for the maps);

first trial was not working....

the road to success, for me, was to apply the mods to PRG0 and to PRG1.

now, I can explore the filesystem and, at this time, I am making a copy of NAND2 to a big usbkey.

I think the external TMC modul communicates using USB...

I am using the stylus from an asus ep121; it works wonderfully with the touchscreen.

It is easy for me to test because the unit is on a table powered from a battery.

His successor is a Sony XNV, but I am very curious to follow what is possible with the F10BT...

1) UsbClientSwitch.exe - you can just change between ActiveSync and Mass Storage mode. There is registry for usb, maybe it works already - you've got to check

Im attaching working DiskRW, there is one problem to read data

Dear All

as mentioned before I closely followed discussion from the early beginning. These days I've got my F30BT and hacked it sucessfully . Many many thanks to condi (and all coworkers) ! Hack was very easy and worked as described. Really Well Done!!! The biggest challenge (as promised by condi) is navigating in the Pioneer Service Mode and in FILE MAINTENANCE.

The previous device I hacked was a Medion Navi P5430 win WINCE 5.0.

There I have installed on a SD card a programm collection called MioPocket 3.0. SD card was inserted to F30BT and I checked all .exe-files. Please find the details in the attachement.

As a short summary:

most of programs that started correctly can open the FileMenu, but can not continue with FileOpen or FileSave! Same situation for keyboard input. JOTKBD.exe started and menu actions work well, but no characters are written to an input line of any program!

Seems that something general is missing!

Any idea whats missing and how to overcome?

Nevertheless some lucky surprises occured:

TCPMP, open pictures, videos and music with his own browser and displays them, unfourtunally music is not submitted to speakers, but picture show works well

Calc98CE, works with integrated keyboard, therefore input and calculations are working well!

FoxitReader, registers himself during program start. After that any PDF will open with a doubleclick in Foxit and can be read easily

GQ Viewer, open pictures with his own browser and displays them, also zoom and scroll

Rotate.exe, rotates screen correctly (not really useful but it works!)

uBook, books are loaded with integrated browser, unfourtunally it starts up in the upright mode, not really comfortable for reading, but it works

Ppaint.exe, drawing mode is working fine, character input and Load/Store is missing (similar for other paint programs)

RegEdit, displays Registry correctly, but no Import or Export (similar for other RegEditors)

In general I found the results worth to report, maybe helpful for some and motivation for others to overcome remaining challanges!

Looking forward to your comments

Bernd

PS: is it normal that Pioneer Software supplied by condis hackmode is not starting ?

F30BT Programmstatus.xls

I wonder if any of this helps: http://hpcmonex.net/nec900/files/releases/romtoolpack.zip

Especially "Section 12. Advanced: The CE rom structure in full details" in the advanced tutorial

Lots of other information and tools (keyboard drivers) also at http://hpcmonex.net/izemize.htm

I havent tried any of it but it all sounds interesting and possibly relevant! Perhaps someone with more understanding than I can make use of it all.

Hi Guys,

My AVIC F310BT doesn't see the SD card.

What i do wrong??

Thanks!

Regards,

Jeff

Dear All

as mentioned before I closely followed discussion from the early beginning. These days I've got my F30BT and hacked it sucessfully . Many many thanks to condi (and all coworkers) ! Hack was very easy and worked as described. Really Well Done!!! The biggest challenge (as promised by condi) is navigating in the Pioneer Service Mode and in FILE MAINTENANCE.

 

The previous device I hacked was a Medion Navi P5430 win WINCE 5.0.

There I have installed on a SD card a programm collection called MioPocket 3.0. SD card was inserted to F30BT and I checked all .exe-files. Please find the details in the attachement.

 

As a short summary:

most of programs that started correctly can open the FileMenu, but can not continue with FileOpen or FileSave! Same situation for keyboard input. JOTKBD.exe started and menu actions work well, but no characters are written to an input line of any program!

Seems that something general is missing!

Any idea whats missing and how to overcome?

 

Nevertheless some lucky surprises occured:

TCPMP, open pictures, videos and music with his own browser and displays them, unfourtunally music is not submitted to speakers, but picture show works well

Calc98CE, works with integrated keyboard, therefore input and calculations are working well!

FoxitReader, registers himself during program start. After that any PDF will open with a doubleclick in Foxit and can be read easily

GQ Viewer, open pictures with his own browser and displays them, also zoom and scroll

Rotate.exe, rotates screen correctly (not really useful but it works!)

uBook, books are loaded with integrated browser, unfourtunally it starts up in the upright mode, not really comfortable for reading, but it works

Ppaint.exe, drawing mode is working fine, character input and Load/Store is missing (similar for other paint programs)

RegEdit, displays Registry correctly, but no Import or Export (similar for other RegEditors)

 

In general I found the results worth to report, maybe helpful for some and motivation for others to overcome remaining challanges!

 

Looking forward to your comments

Bernd

 

PS: is it normal that Pioneer Software supplied by condis hackmode is not starting ?

Hi Guys,

 

My AVIC F310BT doesn't see the SD card.

What i do wrong??

 

Thanks!

 

Regards,

Jeff

What format is your card in? I believe it needs to be in FAT32 format for it to be read at all by the unit

I wonder if any of this helps: http://hpcmonex.net/nec900/files/releases/romtoolpack.zip

Especially "Section 12. Advanced: The CE rom structure in full details" in the advanced tutorial

 

 

Lots of other information and tools (keyboard drivers) also at http://hpcmonex.net/izemize.htm

 

 

I havent tried any of it but it all sounds interesting and possibly relevant! Perhaps someone with more understanding than I can make use of it all.

I was able to use dumprom to dump default.hv (registry file) and then used rgucomp.exe to dump the registry to a .txt

Looks like this work has somewhat dried up, and after getting off to such a good start too...

Now I got USB-to-USB straight cable (without chip) how to connect it safely? I can conect it via USB hub. any advice how to do it?

As I mention above- DiskRW is not working on my X930... any Ideas why?

Take a look on the photos of DiskRW - the most important thing is about the unmounted partition. Some secret/hidden things? Or some useless things haha

The last photo is most important

On your device DiskRW is not working, hm... maybe you should try with other dlls, modify them like i did, and test?

Dear All

as mentioned before I closely followed discussion from the early beginning. These days I've got my F30BT and hacked it sucessfully . Many many thanks to condi (and all coworkers) ! Hack was very easy and worked as described. Really Well Done!!! The biggest challenge (as promised by condi) is navigating in the Pioneer Service Mode and in FILE MAINTENANCE.

 

The previous device I hacked was a Medion Navi P5430 win WINCE 5.0.

There I have installed on a SD card a programm collection called MioPocket 3.0. SD card was inserted to F30BT and I checked all .exe-files. Please find the details in the attachement.

 

As a short summary:

most of programs that started correctly can open the FileMenu, but can not continue with FileOpen or FileSave! Same situation for keyboard input. JOTKBD.exe started and menu actions work well, but no characters are written to an input line of any program!

Seems that something general is missing!

Any idea whats missing and how to overcome?

 

Nevertheless some lucky surprises occured:

TCPMP, open pictures, videos and music with his own browser and displays them, unfourtunally music is not submitted to speakers, but picture show works well

Calc98CE, works with integrated keyboard, therefore input and calculations are working well!

FoxitReader, registers himself during program start. After that any PDF will open with a doubleclick in Foxit and can be read easily

GQ Viewer, open pictures with his own browser and displays them, also zoom and scroll

Rotate.exe, rotates screen correctly (not really useful but it works!)

uBook, books are loaded with integrated browser, unfourtunally it starts up in the upright mode, not really comfortable for reading, but it works

Ppaint.exe, drawing mode is working fine, character input and Load/Store is missing (similar for other paint programs)

RegEdit, displays Registry correctly, but no Import or Export (similar for other RegEditors)

 

In general I found the results worth to report, maybe helpful for some and motivation for others to overcome remaining challanges!

 

Looking forward to your comments

Bernd

 

PS: is it normal that Pioneer Software supplied by condis hackmode is not starting ?

About Pioneers Software - its only incorrect shortcut I will fix it and release in next version, but for now we dont have nothing new to release

Condi

thanks for your reply

What is behind Pioneer Software?

Is there a chance to get a Softkeyboard running?

Any idea how to activate the menus (especially load / store) in alternate software?

Best Regards

Bernd

Condi

thanks for your reply

 

What is behind Pioneer Software?

Is there a chance to get a Softkeyboard running?

Any idea how to activate the menus (especially load / store) in alternate software?

 

Best Regards

Bernd

Pioneer Software shortcut simple runs original Av.exe from PRG1. Thats it.

Menus - load/save etc - its not working, its all related with explorer/windows - almost every app which uses coredll.dll and ceshell.dll (especially that) will not work or not fully work. I modified a lot of apps which refused to run, but still got problems with explorer and ceshell.dll. When I use modified ceshell, then in explorer/filemanager there are corrupted icons etc. When we will get working explorer/popup windows, then it will work in other software menus etc.

Original windows dlls are limited, or being limited because of some other software (AstProc/neventwatcher?)

What's in the unmounted partition? It looks pretty big.

Just bought a Pioneer X920BT at Best Buy today for $539.99 and stumbled across this site. In a nutshell what are the advantages to hacking/modding the stereo. I know me so I am sure i will be in deep into this stuff in a matter of days but was hoping for a brief overview or a link to what all has been done on these units. I was torn between the 920 and the 930 because I thought the aha radio would be cool but with this unit being so cheap I felt it was the right one to get.

Just bought a Pioneer X920BT at Best Buy today for $539.99 and stumbled across this site. In a nutshell what are the advantages to hacking/modding the stereo. I know me so I am sure i will be in deep into this stuff in a matter of days but was hoping for a brief overview or a link to what all has been done on these units. I was torn between the 920 and the 930 because I thought the aha radio would be cool but with this unit being so cheap I felt it was the right one to get.

I would highly recommend reading posts on this site - *THEN* ask questions in the correct forum...................

i remember read something,into a z110bt forum, about a user call to pioneer and ask for a 7zip update, and pioneer sent to this a CD with update. Once there a 7z.dll probably this update change files inside our EU090PLT.PRG. Can some admin contact this user to get a copy of CD?

Here's a link to my post with the contents of the CD provided by Pioneer:

http://avic411.com/index.php?/topic/26072-filesystem-access/page__view__findpost__p__199279

Here's a link to my post with the contents of the CD provided by Pioneer:

 

http://avic411.com/index.php?/topic/26072-filesystem-access/page__view__findpost__p__199279

Thanks Man, i will try mess with this!!

Pioneer Software shortcut simple runs original Av.exe from PRG1. Thats it.

Menus - load/save etc - its not working, its all related with explorer/windows - ...

When we will get working explorer/popup windows, then it will work in other software menus etc. ...

Condi

Thanks a lot for your explantions, that makes it much clearer to me!

Is softkeyboard on the same page or is it a different issue?

From your words I hear that you still see a chance to get explorer (and menus) working correctly! If I can be of any help for you, just a mention it!

So far your work helped me with my biggest concern regarding F30BT, the picture show works already with TCMP .

Thanks a lot and best regards

Bernd

PS: I have corrected the shortcut for Pioneer Software in the MSR-Script, works perfect!

What's in the unmounted partition? It looks pretty big.

We dont know that.. Control Panel and their applets are not working, tried some modifications without success. Thats why we cant use Storage Manager to mount it. Second option - registry - automount, unhide it - but after reboot it will back to factory state..

Here's a link to my post with the contents of the CD provided by Pioneer:

 

http://avic411.com/index.php?/topic/26072-filesystem-access/page__view__findpost__p__199279

Thats a great thing! The key to success is ScriptExec.ini - if we could modify it to point other files than 7zip.dll to be replaced, then we could replace files in ROM safely! Without fear that .img is incorrectly modified etc! So the testmode will always popup and we could replace back to stock EU080PLT.PRG!

I will check if the script works on my F30bt later this day..

BTW aero_eng16: Veeeery good move with LGPL!!!

Condi

Thanks a lot for your explantions, that makes it much clearer to me!

Is softkeyboard on the same page or is it a different issue?

 

From your words I hear that you still see a chance to get explorer (and menus) working correctly! If I can be of any help for you, just a mention it!

So far your work helped me with my biggest concern regarding F30BT, the picture show works already with TCMP .

 

Thanks a lot and best regards

Bernd

 

PS: I have corrected the shortcut for Pioneer Software in the MSR-Script, works perfect!

Yes, everything can be done. We've got to figure out method of safely-replacing rom files

Does anyone have experience with emulators? I tried a few with my EU090PLT.PRG (even removed the first 200 bytes to make it a .BIN and even tried to convert it to .nb0) with no luck... but I dont have any experience with emulators.

I tried googling, but how do I confirm the z120bt is running WinCE 5? Is the system ARMv4i? How do I confirm these things in order to find the right emulator? I think if we can get an emulator working, then we will be able to verify modded bins before putting them on our system.

BTW, you can viewbin on EU090RGD.PRG after deleting the first 199 bytes:

D:\>viewbin.exe -t EU090RGD.bin
ViewBin... EU090RGD.bin
Image Start = 0x9BD00000, length = 0x000B3000
               Start address = 0x9BD01000
Checking record #8 for potential TOC (ROMOFFSET = 0x00000000)
Found pTOC  = 0x9bd7fa2c
ROMOFFSET = 0x00000000

ROMHDR ----------------------------------------
   DLL First           : 0x01FF01FF
   DLL Last            : 0x02000000
   Physical First      : 0x9BD00000
   Physical Last       : 0x9BDB3000
   RAM Start           : 0x9BE00000
   RAM Free            : 0x9BE16000
   RAM End             : 0x9BF80000
   Kernel flags        : 0x00000002
   Prof Symbol Offset  : 0x00000000
   Num Copy Entries    :          1
   Copy Entries Offset : 0x9BD60FE8
   Num Modules         :          3
   Num Files           :          2
   MiscFlags           : 0x00000002
   CPU                 :     0x01c2 (Thumb)
   Extensions          : 0x9BD03950

ROMHDR Extensions -----------------------------
   PID[0] = 0x00000000
   PID[1] = 0x00000000
   PID[2] = 0x00000000
   PID[3] = 0x00000000
   PID[4] = 0x00000000
   PID[5] = 0x00000000
   PID[6] = 0x00000000
   PID[7] = 0x00000000
   PID[8] = 0x00000000
   PID[9] = 0x00000000
   Next: 00000000

COPY Sections ---------------------------------
   Src: 0x9BD5C20C   Dest: 0x9BE06000   CLen: 0xC91      DLen: 0xEE0C

MODULES ---------------------------------------
   11/05/2009  05:26:49      400896  nk.exe
   10/23/2009  08:17:40      142336  coredll.dll
   11/05/2009  05:26:36        4608  AstProc.exe

FILES ----------------------------------------
    10/23/2009  07:57:13  C_R_        264        521                ceconfig.h (ROM 0x9BD7F924)
    11/05/2009  05:29:17  _HRS          0     196608     snapshot_secureos.dat (ROM 0x9BD83000)
Done.

cvrtbin and dumprom work on it.

I can not get viewbin to work on EU090BOT.PRG even if I remove the first 199 bytes because it doesnt have B000FF, I tried adding B000FF too.

Does anyone have experience with emulators? I tried a few with my EU090PLT.PRG (even removed the first 200 bytes to make it a .BIN and even tried to convert it to .nb0) with no luck... but I dont have any experience with emulators.

 

I tried googling, but how do I confirm the z120bt is running WinCE 5? Is the system ARMv4i? How do I confirm these things in order to find the right emulator? I think if we can get an emulator working, then we will be able to verify modded bins before putting them on our system.

Try to run attached process manager and there will be system info about your device.

CEProcessV.zip

I've tested 7zip replacer - conclusions:

• TESTMODE.KEY file is different then the one we use to get pioneers service mode!,
  
• there are more than one different TESTMODE.KEY files which runs other service functions,
  
• our old TESTMODE.KEY runs service mode with many options to use, the TESTMODE.KEY from aero_eng16 runs pioneers file replacer module - on green background,
  
• the key to success is ScriptExec.ini and also correct TESTMODE.KEY!
  

Our target:

• modify ScriptExec.ini to replace other file than 7zip.dll!
  

Try to run attached process manager and there will be system info about your device.

Ah, Thank you! I will try that when I am able.

My truck is in the shop for a week or so!

I've tested 7zip replacer - conclusions:

• TESTMODE.KEY file is different then the one we use to get pioneers service mode!,
  
• there are more than one different TESTMODE.KEY files which runs other service functions,
  
• our old TESTMODE.KEY runs service mode with many options to use, the TESTMODE.KEY from aero_eng16 runs pioneers file replacer module - on green background,
  
• the key to success is ScriptExec.ini and also correct TESTMODE.KEY!
  

 

Our target:

• modify ScriptExec.ini to replace other file than 7zip.dll!
  

I dont know if this matters but I haven't been using the TESTMODE.KEY you provided or any other file lately. I just hold the Mode button and press left right a bunch of times (suppoed to be 3 times but I got into a reboot loop and frantically hit left right now to get in ) till the device reboots.

I dont know if this matters but I haven't been using the TESTMODE.KEY you provided or any other file lately. I just hold the Mode button and press left right a bunch of times (suppoed to be 3 times but I got into a reboot loop and frantically hit left right now to get in ) till the device reboots.

On your device you can do this combination of keys, its the same entrance to testmode But your keypress combination will not work to get into pioneer-file-replacer provided by aero_eng16

But on my f30bt and other devices also this key combination doesnt work

PS. In readme file of 7zip-replacer there is one sentence at the end:

"Do not rewrite or falsify any files other than 7z.dll."

This means that we definitely can replace other files!