Its times like these where it would be nice to know a pioneer engineer
So we can beat them up for developing horrible software 
Thanks for the hardwork so far. Its much appreciated!
I'm going to try this on my x920 soon. I also dabble into SW dev (usually for servers) but im going to take a look at this.
I cant attach files again, !!! Somebady can solve this,??? Vblue??? i make a Zip with a CE emulator in english, to share here!
Download Emulator at Attachments! Sorry i can´t attach this , there a error !
contact-me with PM and i send to you!
Just unzip and Click Run.bat
if u have a dump put it into My Dump folder and open in emulator
GPSMC.exe try open Com7 look at photo
Ah, I misunderstood you. The emulator you are referring to (Chuck88's AVIC Emulator for WinCE) uses an NK.bin from another system right (not z120bt)? I have been trying to load the .PRG files from my z120bt as bin (and even as .nb0) into the emulator.
Ah, I misunderstood you. The emulator you are referring to (Chuck88's AVIC Emulator for WinCE) uses an NK.bin from another system right (not z120bt)? I have been trying to load the .PRG files from my z120bt as bin (and even as .nb0) into the emulator.
Right man, but the chuck88´s have a russian language, i change the file with another copy of CE and heve a english version!
tomorow i try post again! i try a lot run the original nk.bin from pioneer and nb0, but none work!
About our mysterious unmonted partition:
I have it in separate file, but I have problem to upload it here.
so here a link to 4shared.
hidden partition files contain:
00000000-00100200-EU090RGD.bin (3rd copy of EU090RGD.PRG like in USER\PRG0(1)\PLATFORM)
00100200-03144600-EU090PLT.bin (3rd copy of windows image!!!)
03144600-03200000-EU092OPN.bin (welcome screen - 16 bit BMP without header)
03200000-03300200-EU090RGD.bin (4th copy of EU090RGD.PRG)
03300200-06344600-EU090PLT.bin (4th copy of windows image!!!!!!!!!!!!!!!!)
06344600-06400000-EU092OPN.bin (welcome screen - again!!!)
I have welcome screen customised so this welcome screen is exactly the one unit uses.
Bad thing we have no EU090BOT.PRG or/and configs of the unit.
May be it is another hidden patition somewhere?
Why this dump is less then entire 4GB chip volume?
Where is lost 143,130,624bytes?
ImDisk shows another unmounted patition at the end of the drive (check image before) Partition4! but it has 0 length. May be DiskRW didn't copied entire image...
Dumprom of:
EU090BOT.PRG > EU090BOT.bin > EU090BOT.nb0:
nk.exe
EU090RGD.PRG > EU090RGD.bin > EU090RGD.nb0:
AstProc.exe nk.exe coredll.dll ceconfig.h snapshot_secureos.dat
How can i dump the maps? I can't enter in testmode or something similar...
@condiczek: Any ideas?
I'm sorry friend, no other ideas how to help you.. Check all the versions of testmode available in the internet,
check that 4shared collection, for our devices GGS1080 work, maybe other version will work for you!
Condi, where do we stand on finding out the process that is capturing that port?
All guys here are doing great job, we all are working to find the solution!
So we can beat them up for developing horrible software
Thanks for the hardwork so far. Its much appreciated!
I'm going to try this on my x920 soon. I also dabble into SW dev (usually for servers) but im going to take a look at this.
Everyone is welcome to help! All the work/research is appreciated
I've got read.img file from memory and using ImDisk Virtual Driver can mount them to my PC but
it shows 2 unmounted partitions, and if I mount any of them it says that drive is not formated.
Fat32 partitions can be mount as normal drives.
We do not know which port is our GPS antenna uses.
We do not know which module keeps this port occupied.
About our mysterious unmonted partition:
I have it in separate file, but I have problem to upload it here.
so here a link to 4shared.
hidden partition files contain:
00000000-00100200-EU090RGD.bin (3rd copy of EU090RGD.PRG like in USER\PRG0(1)\PLATFORM)
00100200-03144600-EU090PLT.bin (3rd copy of windows image!!!)
03144600-03200000-EU092OPN.bin (welcome screen - 16 bit BMP without header)
03200000-03300200-EU090RGD.bin (4th copy of EU090RGD.PRG)
03300200-06344600-EU090PLT.bin (4th copy of windows image!!!!!!!!!!!!!!!!)
06344600-06400000-EU092OPN.bin (welcome screen - again!!!)
I have welcome screen customised so this welcome screen is exactly the one unit uses.
Bad thing we have no EU090BOT.PRG or/and configs of the unit.
May be it is another hidden patition somewhere?
Why this dump is less then entire 4GB chip volume?
Where is lost 143,130,624bytes?
ImDisk shows another unmounted patition at the end of the drive (check image before) Partition4! but it has 0 length. May be DiskRW didn't copied entire image...
Im almost sure that gps port is com7!
GREAT work friend We are getting closer day by day!
If there is no EU090BOT.PRG bootloader, then maybe after getting corrupted EU090PLT.PRG, or even deleted - it should still be repairable, maybe even testmode working?
We can still look into /NAND/PRG0/BOOT/EU090BOT.PRG 
About your list of partition content - .bin files are repeated, doubled, because of PRG0 and second PRG1 copy. One set of RGD+PLT+OPN in PRG0, and another one in PRG1. To get windows in full working condition we need to replace system resources, the most important is coredll.dll, commctrl.dll etc.
coredll.dll is in RGD part.
I've got another idea how to get fully working gps/audio etc.
RGD contains: AstProc.exe, nk.exe, coredll.dll, ceconfig.h and snapshot_secureos.dat.
We need to replace coredll.dll, and maybe edit ceconfig.h to get full working windows ce, and..
the main idea - make copy of AstProc.exe as AstProc1.exe, replace AstProc.exe with mortscript with some condition - for example: if hackmode.key exists on sd - then run explorer, else run AstProc1.exe. Similar as now with hackmode. We should take a look into AstProc.exe - maybe some IDA Pro analyze etc.
I will upload complete dumped AstProc.exe and NEventWatcher.exe (not corrupted/shortened like from dumpromx.exe) later, but now my sdcard-reader isnt working.
---edit:
attached interesting not corrupted - complete rom files like: coredll.dll (which is limited in our wince), NEventWatcher.exe, TestMode.exe, and device dlls NP....dll, NPCommonLib.dll, NEventBaseLib.dll etc.
I'm sorry friend, no other ideas how to help you.. Check all the versions of testmode available in the internet,
check that 4shared collection, for our devices GGS1080 work, maybe other version will work for you!
Thank you!
Nothing happens with the other files...
I downloaded F220 service manual and i found this:
How to Use Test ModeJig No : GGS1092
Startup procedures
1. Store the Test Mode folder on GGS1092 to the SD card root.
2. Download a ID file from the Service Site and copy it to the “Test Mode†folder on the SD card.
3. Insert the SD card in which the program is stored to the Navi unit and attach the Navi unit to the Cradle unit.
4. Turn ON the BUP and ACC of the main unit/AVH.
5. Press the Reset button on the Navi unit.
6. Press the Mode button on the AVH and go to the Navi source.
7. Test Mode will start up automatically.
* The touch panel may become inactive due to the state transition. Perform ACC_OFF/ON in that case.
Any ideas on where can i get GGS1092 and ID file?
Any ideas on where can i get GGS1092 and ID file?
@socci4: Have you tried to ask a Pioneer service point or the shop where you have bougth your Navi ?
@socci4: Have you tried to ask a Pioneer service point or the shop where you have bougth your Navi ?
I bought the Navi online. I asked and they said they aren't a service point, they only sell. I can try to ask a Pioneer Service Point... What else can i do?
I bought the Navi online. I asked and they said they aren't a service point, they only sell. I can try to ask a Pioneer Service Point... What else can i do?
Try attached testmode - it should be uncompressed to SD like:
/SDMMC/TestMode/..." - files in TestMode directory in root of sd.
Post results, pass like always - avic411
Try attached testmode - it should be uncompressed to SD like:
/SDMMC/TestMode/..." - files in TestMode directory in root of sd.
Post results, pass like always.
Thank you! It asks for a password (the ZIP file)... What is the pwd?
Thank you! It asks for a password (the ZIP file)... What is the pwd?
Post results, pass like always - avic411
Good afternoon.
I have an AVIC F20-BT and I can not install successfully HACKMODE. If installed according to instructions on the AVIC PRG0 start in normal mode even with the KEY file in the root of the SD. If I install it on and I have PRG1 KEY file in the root of the SD AVIC does not start in any way. And if I have the folder in PRG0 HACKMODE and other files PRG1 HACKMODE start mode if I have the KEY file in the root of the SD but the AVIC not start in any way.
How is it possible?, Anyone who can help me? I'm going crazy and no longer do.
Thank you very much for your time.
Try attached testmode - it should be uncompressed to SD like:
/SDMMC/TestMode/..." - files in TestMode directory in root of sd.
Post results, pass like always - avic411
IT WORKS!!!! 
:grin:
Man, you're great!
I think GPS Port is already unlocked (COM2), i can see data log with the tool included in your hack!
Now i'm trying to run iGo, but i have some problem. It appears and disappear instantly!
UPDATE:
iGo Primo 1.1 shows up a black screen. I can't fix this... I tried to change some parameters in sys.txt but it doesn't work.
iGo Primo 1.2 starts up and then disappear (memory problem?)
Garmin Navigator XT 5.0 doesn't start (if i double click on the exe, nothing happens)
TomTom 7 starts, but it says: "Your device is incompatible with TomTom NAVIGATOR" and i have to click "OK" to close the app
Here is iGo Primo 1.1 crash log:
------------------------------------------------------------------------------------------------------------
------------------ Crash Log Begin -------------------
Current System time: "2011-06-22 20:38:12"
Build version: 8.5.11.168090
Build configuration: Product--ARCHFAM
OS version: 5.0
Uptime: 0 h 0 m 0 sec 0 msec
Memory Stats:
FreeMemory: 99 MB, 936 KB, 0 B
TotalUseableMemory: 100 MB, 968 KB, 0 B
MaxMemory: 129 MB, 0 KB, 0 B
ReservedMemory: 1 MB, 0 KB, 0 B
ActualCacheSize: 0 MB, 0 KB, 0 B
GarbageSize: 0 MB, 0 KB, 0 B
Exception: 0xc0000005
At address: 0x0071803c
Access violation writing address: 0xeb0a4c97
0x0071803c (A)
WinCE CallStack snapshot (function names according to map file \Storage Card\Primo\NNGNAVI.map):
0x0c6d2328 (A)
0x0c6d1980 (A)
0x0c6d1b38 (A)
0x0c6d1c00 (A)
0x0c51a210 (A)
0x0df8c868 (A)
0x0df93850 (A)
0x8808818c (A)
0x880b1e7c (A)
0x8808bfb0 (A)
0x880880a4 (A)
Global status:
bInFocus: 0
bMouseDown: 0
bInLogic: 0
bInRender: 0
CurrentState[128]:
GPS Pos: (0.000000,0.000000)
Camera: pos:(0.000000,0.000000) rot:0 persp:0 zoom:0.000000 eng=0)
------------------- Crash Log End --------------------
------------------------------------------------------
------------------------------------------------------
Some notes:
- I can write on both partition
- I can access to COM2 GPS with the Sirf Tool in your hack pack
- There's explorer.exe
- It has 128MB of RAM
IT WORKS!!!!
Man, you're great!
I think GPS Port is already unlocked (COM2), i can see data log with the tool included in your hack!
Now i'm trying to run iGo, but i have some problem. It appears and disappear instantly!
....
Here is working IGO8.3 or here for your F220.
BTW I think F220 should be disscussed in separate special thread, am I right?
From memory, iGo is very temperamental regarding sys.txt and display setup. You need the correct display setup in the correct spots of the file.
Here's a great source for iGo sys.txt info.... http://forum.mobilism.org/viewtopic.php?f=694&t=113311
Also note - data.zip must have the correct display driver....
One last add - don't run TTS (text to speech) from sys.txt yet (memory/resource hog)
new firmware update to X930BT 3.001
I hope it will help us to make progress in hack!
From memory, iGo is very temperamental regarding sys.txt and display setup. You need the correct display setup in the correct spots of the file.Here's a great source for iGo sys.txt info.... http://forum.mobilism.org/viewtopic.php?f=694&t=113311Also note - data.zip must have the correct display driver....One last add - don't run TTS (text to speech) from sys.txt yet (memory/resource hog)
Thank you very much guys, i'll open a new thread on F220. I thought it was similar to F30BT, F920BT and so on... but it's not 
@Ralpharn: is the iGo you linked modified to run into F220? I already have iGo 8.3 running, but i've got sound problem (too low volume).
Yes. it is set for F220 from russian forum.@Ralpharn: is the iGo you linked modified to run into F220? I already have iGo 8.3 running, but i've got sound problem (too low volume).
Hey I know this probably isn't the right form to post in but the new Z130T update is out. Is there any harm in trying to update my Z120BT with this?
Hey I know this probably isn't the right form to post in but the new Z130T update is out. Is there any harm in trying to update my Z120BT with this?
Correct - post this in the Z forums...
BTW - the Z130 update is not what you think (READ the Z forum posts related). It is a specific update for Z130 - it does not change your Z120 into a Z130...
Dear Condi
i have buy X930BT from USA , But now using it on vietnam , So Can you show me the way to Delete US Maps data and Copy vietnamese Maps Data to Use ? So where can i downloads vietnamese maps data ? Thanks Sir
Hey guys no news? Condi o thinking about change the enter on hackmode Windows , u can put a time to press t
Yes , maybe 5 seconds ,if not press the default is original mode !
Hey guys no news? Condi o thinking about change the enter on hackmode Windows , u can put a time to press t
Yes , maybe 5 seconds ,if not press the default is original mode !
I've made already that kind of entrance into hackmode, but it was not working correctly.
SleepMessage is only delayed message, without possibility to make condition like yes/no etc.
We've got also thing like ChoiceDefault, and it would run pioneer soft by default for example after 3s,
but it was displayed ugly for me question window - like for now - much better i think.
And yes - no news for now. Anybody here can correctly replace .dll .exe files in wince img?
Especially .exe .dll files in modules? If yes - we would modify EU090RGD.PRG and it could work..
