Hi Condi, any news about ports? I'm trying to hack my Z130BT and for while, the only thing that is not working is the access to port using iGO.

We need a summary of the 42 pages of this LONG topic . I need to figure out what will we do next?

My questions are

1- Is the problem that we don't know the app or process which use the GPS port?

2- Is it confirmed the GPS port ? and what is it?

3- why we don't try to crush into the Pioneer OS it self . we may succeed in replacing the Navi part of the system with what we need

I am trying to find a tool like ( Network monitor ) on windows . it will help to find the process and application which use the GPS port .

Please help Us keep this topic alive!

ahmad

1. No. looks like it is blocked at OS level.

2. No. But com7 is suspected.

3. We have 4 copies of OS image. Two of them in hidden partition.

We can extract files from image, but do not know how to save changes in these images.

EU090PLT.PRG first 0x200 butes - header, there is CRC32 and size.

then 0xC0000 Unknown area. It has some info but we do not know such format.

Than image in nb0 format - use something like dumpromx to read it.

(do not forget -5 for dumprom/dumpromx ) (thanks ot Carver)

Ralpharn! how are u? tell me you have any news about the search for the GPS? or remains disabled as well? I just search for the iphone with the same ... so if you havesomething new to say ouch!

cheers

Rafael

Hi Rafael,

Search is not working on my transplanted map.

So I still hope that someone will crack this awful pioneer's GPS software and run something like IGO instead.

Cheers!

Ok My plan is to locate the eprom IC and read all its contents and check what is the structure of files and drives . I will check the service manual and get back

Ok My plan is to locate the eprom IC and read all its contents and check what is the structure of files and drives . I will check the service manual and get back

You almostly can't read the IC with a programmer. The ICs are BGA (Ball Grid Array) so soldering is almost impossible.

The chip is really small and the pcb has 3 layers so tracking traces is almostly impossible...

I'm sure that Pioneer can recover bricked AVIC's without soldering. The question is how.

e-nand (4gbyte):

IC4501

PEN002A

hynix H26m31001EFR

BGA

flash rom (8mbit):

IC4403

CXX3406

spansion al008j70bf102

BGA

You almostly can't read the IC with a programmer. The ICs are BGA (Ball Grid Array) so soldering is almost impossible.

The chip is really small and the pcb has 3 layers so tracking traces is almostly impossible...

 

I'm sure that Pioneer can recover bricked AVIC's without soldering. The question is how.

 

 

e-nand (4gbyte):

IC4501

PEN002A

hynix H26m31001EFR

BGA

 

flash rom (8mbit):

IC4403

CXX3406

spansion al008j70bf102

BGA

from service manual we have a controller that connects the 4 memory elements . I think this is the key to scan all addresses and find the file structure

can anybody agree with me and find a solution to sniff this data?

http://imageshack.us/photo/my-images/857/ramdv.jpg/

Please KEEP this thread alive . I hope we can do it . we are so close!!

Hi guys! I got a unit can acess the service mode using V1.4. But I couldn't find the copy and paste command.So I put the hack files into the img file\prg0 and flash the unit. But some files were not copied to the foder as a result I could access the ce desk with no explore no any software can be use.

Please help. Thanks.

Hi guys! I got a unit can acess the service mode using V1.4. But I couldn't find the copy and paste command.So I put the hack files into the img file\prg0 and flash the unit. But some files were not copied to the foder as a result I could access the ce desk with no explore no any software can be use.

Please help. Thanks.

In V1.4 it is not possible to copy or paste . only delete . you have to upgrade to 2.000 or higher to able to copy or paste using the stock TEST MODE . or using hack mode provided here .

from service manual we have a controller that connects the 4 memory elements . I think this is the key to scan all addresses and find the file structure

can anybody agree with me and find a solution to sniff this data?

http://imageshack.us.../857/ramdv.jpg/

That might be also a possibility! There are so many ways we only need to execute them.

I will try some things later. I already dissambled the unit once. Lot's of SMD components and I don't want to remove the radio from my dash at this time.

If I'm right we can modify all system files but there is a danger of bricking?

The PRG file we want to change (EU090PLT.PRG) has testmode.exe inside so a damaged EU090PLT.PRG will possibly cause a brick.

 

In V1.4 it is not possible to copy or paste . only delete . you have to upgrade to 2.000 or higher to able to copy or paste using the stock TEST MODE . or using hack mode provided here .

Take a look here. They made some progress in replacing images in image.img file.

Simply tring to get the password to an avicx930. I just saved the file to my sd card with nothing else on it. When I enter the sd card to the unit nothing happens. when I view the sd card I see the file named 1.4 base install via test mode. Am I doing something wrong.

I am a dealer that has a unit locked up by a customer, and pioneer even wants to charge us to unlock.

-Chris

Here is a scan of the pcb in the display unit.

You can see the connectors here, processor and nand.

Hi!

I need a help please,

I have a AVCX-930BT but i don't know like to put IGO but i not know to do this.

Thanks for you help

Hi!

 

I need a help please,

I have a AVCX-930BT but i don't know like to put IGO but i not know to do this.

Thanks for you help

It is not possible to put IGO on the x930bt or f930bt at this time...

The GPS com port is in use by pioneer

Hello everyone,

as far as you may know, is it possible to force U220 (F220 in Europe..) to launch something like a "resolution forced change" in registry at startup?

Igo primo 2.0 works like a charm through test mode but U220/F220 have different resolution from AVH8400 and it would be great to understand if it's a u220/f220 hardware limitation or just a WinCe configuration.

thanks!

Hi guys,

with all this hacking going on with the Pioneer unit, is it possible to hack the backed up binary to remove that stupid start up warning on the navi screen? That would be freaking awesome if someone can do it. It is so annoying to touch "OK" everytime the car is started.

Hi guys,

with all this hacking going on with the Pioneer unit, is it possible to hack the backed up binary to remove that stupid start up warning on the navi screen? That would be freaking awesome if someone can do it. It is so annoying to touch "OK" everytime the car is started.

That would be awesome, but the question has been asked many times and the popular answer has been "no"

this hack is actualy the onliy hack that works on my F920BT , al the other hacks and testmode's fail...

even the original pioneer card update (copy) CNSD-210FM does not start on my unit ?

since i'm on: 02.0000 firmware, is there a way to update the firmware on my device via this hackmode, ?

and since the new maps (i still have the old 2010 maps) are available in the CNSD-2010FM update from pioneer, is there a way

to copy those maps out the original sd to the unit , or does that not work? since the new units don't work with igo maps anymore?

Pioneer says my F920BT is compatible with this update sd, so why doesn't it work?

i just want to reset my password on my x930bt how do i do it?

Hi guys i have been playing around whit the new F-40bt or z140bt as some of you know it as.

the deal is that i have the f-10bt updatet to f30bt and now i want to update it to f40bt to get tha app mode as in thats software, my idear was to copy the whole Ndata folder and user folder from ont to another, but the problem is that the copy and paste butten is not there in testmode like in the f30bt, i post a youtube video showing you the problem, any suggestions are welcome

That is a BAD news.

1. Try to get into test mode via buttons - Hold home and switch device On, then prev, next, prev, next, prev, next and release Home button.

2. Where did you get this testmode file from? Does it work on F30?

3. Try Testmode from F220. (wild gess%))

4. What is under HELP option in Testmode.

Can you please make new video to show file structure or just post text with it?

I think main executables in USER folder.

NDATA contains maps and voices.