No offence taken and im cool. It's just the matter of taking a generalized question and turning it technical. The handbrake ground is certainly not the issue. Its got the bypass applied and yes I can watch movies it a 130bt. Its not options being grey'd out. They are available but just wont execute
Any news on Web Browsing Via BT from mobile phone ?
Its not options being grey'd out. They are available but just wont execute
Can you please explain it further what particular function is not working, I can check it on my X930BT and if it is afterhack issue- we will try to resolve it.
Sorry not going to retype everything I already said
SInce my x930bt is broken I decided to look over the hardware. I confirmed it has a sirfprima tt442 chip.
Maybe these files will help the developers
Sorry not going to retype everything I already said
I've checked my X930BT with V1.4 of hackmode - it starts to play from same source and same spot where it was shut off (i've used SD and DVD full of mp3s.
I suggest you to put everything back from your backup and check it, then put v1.4 hack again- and check it again.
SInce my x930bt is broken I decided to look over the hardware. I confirmed it has a sirfprima tt442 chip.
Maybe these files will help the developers
If you have it open- can you please take few good pictures of circuit boards from your unit?
Sure I can. What would circuits you like a picture of?
Okay I've attached pictures of the sirf chip and of a spansion nor flash chip.
Those pics are off a x930bt. I've been looking at the copies of sirfflash and sirfsocmgr that I have. Neither one supports the spansion model in the x930bt but it looks easy to add from the sirfflash manual.
To support additional flash types:
1. Obtain the device code (ID), manufacturer code (ID), capacity, and sector map
information for the intended flash type. This information is typically available from
the flash data sheet.
2. Using a text editor, open the CHIPLIST.TXT file.
3. Using the same format that is already in the file, add the device name, manufacturer
name, device code, manufacturer code, capacity and sector map information, and
the driver file name at the bottom of the existing list.
The driver file name must be GENERIC.BIN.
4. Follow the steps detailed in “Downloading Software using SiRFflash” on page 5-1.
Hi guys,
I'm currently also looking for a solution to mod the PRG files without the risk of bricking. The coredll.dll has to be changed 
I bought a f930bt and when i came home I discovered that it was locked with a password. The first thing I did was dumping the following chip:
EEPROM
IC1303
S-93C56BD0I-I8
The dump is in the attachment. Maybe it could be usefull. It was an huge challenge to solder to that SMD chip.
After a search I found that I could retreive the password in testmode->file manager. So that problem is gone.
Now on the CC monitor unit PCB there is a jtag connector (CN4621). This has the following pinout:
1 TMS
2 TDI
3 TDO
4 TCK
5 GNDD
6 ?
7 NTRST (P-NTRST)
8 P-TDI
9 P-TMS
10 P-TCK
11 RTCK (P-RTCK)
12 P-TDO
13 NSRST (P-NSRST)
14 TEST4 (TESTMODE4)
15 JTGRST (JTG_RST)
Everything with a P- for it is from the CPU (tt4421).
An interresting thing is the TESTMODE4 pin. Maybe this is just to enter test mode I don't know.
If you have a look at http://forum.gps-club.ru/index.php?showtopic=19265 and translate it you will notice that they connect a gps with a simulair cpu to usb.
I found out that the tt4421 cpu has a usb OTG. This means that we can connect it to a computer instead of an peripheral device. This could be a way to flash/restore the nand.
I don't think pioneer will open an avic when it is bricked. There is a way without opening it.
On the russian page you will read that they connect it with a kind of usb to rs232 cable. On PRDM-0028-A4_HowToRepairHW_Nboot.pdf (russian page) I see for beeing able to choose something from the nboot debug message log you need to hold the power and reset buttons. We need to find a way to choose the option 8 so we can start SIRFSoCMgr and dump and update the NK Image.
You can also update the nboot and eboot from this.
If all that could not work than we have to look at the JTAG connector. This has TDI, TMS, TCK, TDO, NSRST, NTRST and JTGRST.
So I see the cn4001 pads on the board. According to the sirfprima developer manual the chip has builtin usb transceiver/controller. I wonder if I can connect usb directly to cn4001 ? Sirfsocmgr and sirfflash both have usb options. Now I need to practice soldering surface mount .5mm ribbon connectors.
I think you should connect the normal external usb connector (the cable that also has the audio jack input) to your computer. This usb connector is the USB1 controller on the tt4421 chip. This controller has a normal pin assignment (positive and negative data pins). See page 261 on the developer manual.
The cn4001 pads is the USB0 controller. This usb0 controller has ULPI interface to connect. I don't know what it is exactly but is has a totally different pin assignment. (see page 232 on the developer manual).
developer manual: http://www.4shared.com/get/ARDbpkFH/CSM-00364_RevC_SiRFprima_Devel.html
Sure I can. What would circuits you like a picture of?
Just good pictures of entire circuit boards, where letters on chips are readable.
ULPI is an industry standard interface for a chip to connect to an external USB PHY (the part of a chip that handles sending and receiving the bits over the cable). You'd have to build some sort of circuit with a transceiver chip, a USB connector and whatever other support circuits to provide required power/config to the transceiver to connect your stuff to USB0. Example: http://www.slscorp.com/products/santacruz-snap-on-board/usb-20-ulpi.html
The cn4001 pads is the USB0 controller. This usb0 controller has ULPI interface to connect. I don't know what it is exactly but is has a totally different pin assignment. (see page 232 on the developer manual).
developer manual: http://www.4shared.c...rima_Devel.html
Is anyone still interested in getting alternate nav software like Igo working alongside the standard Pioneer AV system ?I've managed to free up the GPS port whilst in hackmode and get Igo8 working fine (working GPS, TMC, full sound capability and Pioneer AV all at once) on my F230BT (F130BT in the US). I've seen no updates on freeing up the GPS port when in Condi's Hackmode recently so maybe you guys have already done this and its old news. Somniac
Already tried two port splitter apps... no success. You've got modified port splitter and gpsgate in latest version of hackmode. Its not that easy... unfortunatelly
Is anyone still interested in getting alternate nav software like Igo working alongside the standard Pioneer AV system ?
I am interested! official Navi is just a bad joke! It looks like it have been writen by "D" graded students as term project... 
yakkkkkk.....
I've managed to free up the GPS port whilst in hackmode and get Igo8 working fine (working GPS, TMC, full sound capability and Pioneer AV all at once) on my F230BT (F130BT in the US).
I am jealous... but google don't know nether F230BT nor F130BT... I hope you mean Z130bt- That would be awessome!
We are all interested in how you freed up the gps port. Can you explain the step that you took Somniac?
Yes, we're all interested. Please post how you did it.
Apoligies, I meant F320BT, which is the later version of the F310BT which is the European version of the US U310BT (it was past 2 o'clock in the morning - brain was slow).If it helps I'll explain the problem I had and the solution I eventually came up with.I used the F310BT testmode (see U310BT forum) on an SD card to get to the WinCE O/S and then use Condi's Hackmode concept to try to run IGO8 when the Pioneer Navi started up.I had the same problem as Condi and yourselves in that the GPS port was locked well before the rmimanager.exe (First of the Pioneer programs to start on bootup) started. I tried every port splitter available and even started them from the registry but the GPS port (com2) was always locked before the port splitters started and the port was in use by a program called clmapp.exe. Killing clmapp.exe first didn't free up com2.So I decided to come at it from another direction - make the com2 port unavailable to the pioneer program that was locking it before it started.So the solution is to change the FriendlyName and Index number of the GPS_HWCOM definition in the builtin drivers section of the registry so that port GPS_COM/COM2 becomes GPS_COM4/COM4 and do a warm boot. The pioneer software then doesn't find the GPS port (its looking for COM2) and does not lock the GPS port or start clmapp.exe.I then just configured IGO8 to use the COM4 port and it works. I used Condi's hack concept to replace the Tel.exe executable with a mortscript script pointing to the IGO8 executable when the pioneer software starts ( I think Condi used the av.exe). It means that the BT telephone functionality doesn't work but the AV (MP3 lists etc) still works and I can switch between it and IGO8 using the "mode" button. You can choose which exe to replace depending on what bit of functionality in teh original Pioneer software you are happy to loose.The regsitry entries I changed on the F320BT to stop the GPS port being locked are below. I'm sure you can find the equivilent on your Avics. The regsitry on the F320BT is in ROM so the changes disappear if you do a hard reset (handy if you get them wrong).I'm working on a mortscript that will make the registry changes and does a warm reboot if it finds the GPS_HWCOM has been set back to COM2 by a hard reset (so I don't have to do the reg changes manually). In HKEY_LOCAL_MACHINE\Drivers\Builtin\GPS_HWCOM - Change DWORD "FriendlyName" from GPS_COM to GPS_COM4 and DWORD Index from 2 to 4. All software (port splitters etc) then see the GPS port on COM4. You guys know Condi's hack better than I do so I'll leave that side to you but I thought you'd like to know how I unlocked the GPS port. Somniac.I am interested! official Navi is just a bad joke! It looks like it have been writen by "D" graded students as term project...
I am jealous... but google don't know nether F230BT nor F130BT... I hope you mean Z130bt- That would be awessome!
I forgot to say that you don't have to use COM4 as the replacement for COM2. It could be any free COM port (4-9) and if you want to use more than one Nav software (IGO and TomTom) together you can then run a port splitter on the (now) free GPS port to provide GPS ports for each.Somniac.Apoligies, I meant F320BT, which is the later version of the F310BT which is the European version of the US U310BT (it was past 2 o'clock in the morning - brain was slow).If it helps I'll explain the problem I had and the solution I eventually came up with.I used the F310BT testmode (see U310BT forum) on an SD card to get to the WinCE O/S and then use Condi's Hackmode concept to try to run IGO8 when the Pioneer Navi started up.I had the same problem as Condi and yourselves in that the GPS port was locked well before the rmimanager.exe (First of the Pioneer programs to start on bootup) started. I tried every port splitter available and even started them from the registry but the GPS port (com2) was always locked before the port splitters started and the port was in use by a program called clmapp.exe. Killing clmapp.exe first didn't free up com2.So I decided to come at it from another direction - make the com2 port unavailable to the pioneer program that was locking it before it started.So the solution is to change the FriendlyName and Index number of the GPS_HWCOM definition in the builtin drivers section of the registry so that port GPS_COM/COM2 becomes GPS_COM4/COM4 and do a warm boot. The pioneer software then doesn't find the GPS port (its looking for COM2) and does not lock the GPS port or start clmapp.exe.I then just configured IGO8 to use the COM4 port and it works. I used Condi's hack concept to replace the Tel.exe executable with a mortscript script pointing to the IGO8 executable when the pioneer software starts ( I think Condi used the av.exe). It means that the BT telephone functionality doesn't work but the AV (MP3 lists etc) still works and I can switch between it and IGO8 using the "mode" button. You can choose which exe to replace depending on what bit of functionality in teh original Pioneer software you are happy to loose.The regsitry entries I changed on the F320BT to stop the GPS port being locked are below. I'm sure you can find the equivilent on your Avics. The regsitry on the F320BT is in ROM so the changes disappear if you do a hard reset (handy if you get them wrong).I'm working on a mortscript that will make the registry changes and does a warm reboot if it finds the GPS_HWCOM has been set back to COM2 by a hard reset (so I don't have to do the reg changes manually). In HKEY_LOCAL_MACHINE\Drivers\Builtin\GPS_HWCOM - Change DWORD "FriendlyName" from GPS_COM to GPS_COM4 and DWORD Index from 2 to 4. All software (port splitters etc) then see the GPS port on COM4.      You guys know Condi's hack better than I do so I'll leave that side to you but I thought you'd like to know how I unlocked the GPS port.        Somniac.
What we have:
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\GPS]
"CurGpsWeekRollerNum"=dword:1
"DefaultGpsWeekNo"=dword:21D
"GRFTYPE"=dword:1
"MC_EveryStartUpdateTime"=dword:1
"NmeaSel3"=dword:1
"ParamFolder"="NAND\\SYSTEM\\GPS"
[HKEY_LOCAL_MACHINE\Drivers\BuiltIn]
"BusIoctl"=dword:2A0048
"BusName"="BuiltIn"
"Dll"="BusEnum.dll"
"Flags"=dword:8
[HKEY_LOCAL_MACHINE\Drivers\Launch\GPS]
"Dll"="GPS.Dll"
"Index"=dword:7
"Order"=dword:2
"Prefix"="COM"
[HKEY_LOCAL_MACHINE\Drivers\Launch\pbtctrl]
"DeviceArrayIndex"=dword:1
"Dll"="pbtctrl.dll"
"Order"=dword:3
"PortName"="COM4:"
"Prefix"="PBC"
[HKEY_LOCAL_MACHINE\Drivers\Launch\Serial0]
"DeviceArrayIndex"=dword:0
"Dll"="AtlasSerial.Dll"
"FriendlyName"="Serial Cable on UART0 Atlas Debugging Board"
"IClass"="{A32942B7-920C-486b-B0E6-92A702A99B35}"
"Index"=dword:6
"IoBase"=dword:AB000000
"Order"=dword:1
"Prefix"="COM"
"Priority256"=dword:41
"Tsp"="Unimodem.dll"
and a lots of HKEY_LOCAL_MACHINE\Drivers\PCCARD\PCMCIA that described as card for debugging.
[HKEY_LOCAL_MACHINE\Printers\Ports]
"Port1"="COM1: 9600"
"Port2"="COM1: 57600"
"Port3"="IRDA"
"Port4"="NET0:"
Ralpharn,
Wow, that IS different. What version of WinCe/WinMo is your unit running ?
If I had to hazard a guess then I would say the reg entry to target is the [HKEY_LOCAL_MACHINE\Drivers\Launch\GPS] one.
If you boot the unit into testmode so that the GPS port is not locked and run Portsplitter (http://www.gpsmeter.com/index.php?page=portsplitter) what port does it recognise as the GPS port ?
I would say from above it will be COM7.
In the "output" section it will also list in the pulldown any free ports available (maybe com8 or com9).
As long as you are happy that any registry changes are lost on a hard reset (I don't know if the registry is in ROM on a X930BT) I'd suggest changing the "Index" dword from 7 to the number of a free port on [HKEY_LOCAL_MACHINE\Drivers\Launch\GPS] and see if a warm reboot leading to a Condi hackmode style startup of explorer leaves you with an unlocked GPS port on the new COM number (you can check it with Portsplitter again)
If your not confident that you can easily reverse out any registry changes with a hard reset then you may decide not to take the risk.
Somniac.
If you boot the unit into testmode so that the GPS port is not locked and run Portsplitter
check this out so we have:
When we had hack in HMIManager we've got active processes:
So no pioneer software running and we still have GPS locked.
check this out so we have:
When we had hack in HMIManager we've got active processes:
- \Windows\AstProc.exe
- \Windows\device.exe
- \Windows\filesys.exe
- \Windows\GpsMc.exe
- \Windows\gwes.exe
- \NAND\PRG0\Apl\HMIManager.exe (hack file)
- \Windows\NEventWatcher
- \Windows\NK.EXE
So no pioneer software running and we still have GPS locked.
Its the same on my F320BT if you use Condi's hackmode, even if I replace hmimanager.exe with an explorer shell.The GPS port is locked.
Its not the Pioneer exes that lock the port its something in the early stages of the driver load. I can tell its locked because it starts a prog called clmapp.exe.
In your case it looks like its GpsMc.exe.
However if I use Testmode on an SD card the firmware runs the code on the card and doesn't lock the port (none of the original Pioneer drivers or code run).
You must have used testmode initially to unlock your unit to enable you to try Condi's hackmode. If you use testmode again the GPS port should be free and you can test out which COM port its on with Portsplitter (as per my previous post). You can then change the registry to avoid the GPS port being locked when you use hackmode.
Somniac
