v.0.2 up!

PS. I can make version with shortcut on the desktop which will automatically 'make' pioneer testmode on SD which is inserted, restart unit and enter pioneer service mode, it would be simply 'ENTER SERVICEMODE'. Fast jump to service mode. Do you need something like this?

PS2. I was looking through registry, and found gps is connected with some files in NAND2 or NDATA... i dont remember exactly, but it was GPS folder with some gpspara files etc. We've got to look at this!

I tried to put iGO8.exe as Navi.exe - runs ok, NO GPS, fail;

I tried to use some SirfTech.exe util, to switch NMEA<>SIRF or change something concerned to gps port - fail;

@Tudor Z: GpsMC.exe is starting on boot, by default, no available gps in other apps - fail;

Keep on trying!

br

condi

Thanks for the reply Condi. Seems like it's a little more tricky to get the GPS working, hopefully it will be possible.

If you replace Navi.exe with iGO how does it interact with the Unit's interface? Can you still switch between navi and av source?

 

PS. I can make version with shortcut on the desktop which will automatically 'make' pioneer testmode on SD which is inserted, restart unit and enter pioneer service mode, it would be simply 'ENTER SERVICEMODE'. Fast jump to service mode. Do you need something like this?

Condi

While waiting for my F30BT, I'm following your post regarding hackmode.

Congratulations, real a great work and absolutely that what we need!

- Regarding question above, shortcuts to enter servicemode or bringing desktop to the front would be highly appreciated!

- Also acess to GPS-signal would be very nice.

Please check the GPS-port splitter SERILOT from GLOPUS, could be helpful.

http://www.glopus.de/

- What is the OS and OS version running on your F30BT?

- Is it mandatory to use SD-card for hackmode or is it also possible to install hackmode via USB-Stick ?

Unfourtunally I can not contribute anything at the moment, but will defenitely report after my F30BT is installed.

Best Regards

Bernd

Thanks guys for all 'good luck' words If you have any questions then just ask.

HACKMODE was checked only on my device, so please be careful in any actions,

Please check if it works with F10/F20 and other models!

I just tried your Hackmode 0.2 on AVIC-F20BT device, it works perfect!!

Later today I will give a try to run IGO8 navigation with this unit. Expectations are high...

Thanks for the reply Condi. Seems like it's a little more tricky to get the GPS working, hopefully it will be possible.

If you replace Navi.exe with iGO how does it interact with the Unit's interface? Can you still switch between navi and av source?

Replaced Navi.exe runs automatically, then after some seconds AV process comes to front, when you want to switch to nav it goes black

I've got all time long new ideas to get gps to work, just keep on trying

Condi

While waiting for my F30BT, I'm following your post regarding hackmode.

Congratulations, real a great work and absolutely that what we need!

 

- Regarding question above, shortcuts to enter servicemode or bringing desktop to the front would be highly appreciated!

 

- Also acess to GPS-signal would be very nice.

Please check the GPS-port splitter SERILOT from GLOPUS, could be helpful.

http://www.glopus.de/

 

- What is the OS and OS version running on your F30BT?

 

- Is it mandatory to use SD-card for hackmode or is it also possible to install hackmode via USB-Stick ?

 

Unfourtunally I can not contribute anything at the moment, but will defenitely report after my F30BT is installed.

 

Best Regards

Bernd

1) I will make shortcut to auto-make-testmode-sd and enter ,

2) tried already some other splitter-thing without success, ok, will try Glopos later

3) control panel is not working correctly, but for now i think its wince 5,

4) I will make version for USB later this weekend or maybe sd&usb, both in one

5) F30BT - my maaan i've got this unit

I just tried your Hackmode 0.2 on AVIC-F20BT device, it works perfect!!

Later today I will give a try to run IGO8 navigation with this unit. Expectations are high...

Thanks for feedback with v.0.2!

Try with iGO and other stuff, more of us the more chance to get gps working!

br

condi

Replaced Navi.exe runs automatically, then after some seconds AV process comes to front, when you want to switch to nav it goes black

I've got all time long new ideas to get gps to work, just keep on trying

 

 

 

1) I will make shortcut to auto-make-testmode-sd and enter ,

2) tried already some other splitter-thing without success, ok, will try Glopos later

3) control panel is not working correctly, but for now i think its wince 5,

4) I will make version for USB later this weekend or maybe sd&usb, both in one

5) F30BT - my maaan i've got this unit

 

 

 

Thanks for feedback with v.0.2!

Try with iGO and other stuff, more of us the more chance to get gps working!

 

br

condi

IGO8 works launches, thanks for the copy Condi, I just need to work on the GPS bit now.

So far I have failed to extract library files from the WINCE ROM, I have used FileManCe, TestDump, Total Commander, etc. I have even tried editing the registry but also no luck.

Anyone had any success with the wince rom?

I could only copy a few files from the WINCE ROM with FileMan.

While running autodetect on iGO i notice it skips ports 2-3-5-7. I'm guessing one of them (probably com7) is the gps but it's locked. I can't get PortSplitter to run (no interface shows up).

I could only copy a few files from the WINCE ROM with FileMan.

 

While running autodetect on iGO i notice it skips ports 2-3-5-7. I'm guessing one of them (probably com7) is the gps but it's locked. I can't get PortSplitter to run (no interface shows up).

I don't have experience with the portsplitter app, however if you can kill the navigation app then the gps will be free to be accessed by any other program. I have tried to kill navi.exe but the avic hangs I assumed that this was using the gps port.

I don't have experience with the portsplitter app, however if you can kill the navigation app then the gps will be free to be accessed by any other program. I have tried to kill navi.exe but the avic hangs I assumed that this was using the gps port.

As far as I remember Navi.exe was running after Av.exe, with hackmode it doesnt run! Also I've replaced Navi.exe with iGO exe and also it doesnt find gps.

Keep on searching for the solution guys

Tomorrow I will have free day, I shall use the time for avic!

As far as I remember Navi.exe was running after Av.exe, with hackmode it doesnt run! Also I've replaced Navi.exe with iGO exe and also it doesnt find gps.

Keep on searching for the solution guys

Tomorrow I will have free day, I shall use the time for avic!

Hi Condi,

I launched CEprocessV.exe (files from post #23). I see Navi.exe, HMImanager.exe, Voice.exe, Pserver.exe running. Try running CEprocess and let me know if you see something similar.

I have the following processes in CEProcessV:

astproc.exe

device.exe

filesys.exe

gpsmc.exe

gwes.exe

HMIManager.exe

Navi.exe

neventwatcher.exe

NK.exe

Pserver.exe

Voice.exe

So maybe Navi.exe does run in hackmode afterall.

I have the following processes in CEProcessV:

astproc.exe

device.exe

filesys.exe

gpsmc.exe

gwes.exe

HMIManager.exe

Navi.exe

neventwatcher.exe

NK.exe

Pserver.exe

Voice.exe

 

So maybe Navi.exe does run in hackmode after all.

Hi,i think the problem is the windows ce,

i seeked through the registry, there is reference about com 7 and gps port, but Windows does not have any driver to use the unit hardware. Pioneer uses Windows just to start up display and run av.exe, without any link to the hardware!

Maybe our first step must be unlocking windows ce to get the full system working, check the hardware connected or add some hardware.

Another option would be the gps is not working because it is already in use, but that´s just my guess.

Is there a Dos command.com, or linux-like terminal in Windows ce? if I could use a usb keyboard and something like a command terminal maybe I could try to unlock windows or copy all files to emulate in pc and work around this.

Patrick

Thanks for feedback with v.0.2!

Try with iGO and other stuff, more of us the more chance to get gps working!

br

condi

Hmm... Too bad. I didn`t manage to instal Igo8. Installation starts but after 2 sec. it stops. Maybe wrong version ( 8.3.4.117940 (Nov 3 2009)

Which version are you using, guys?

Wikke

@PatrickFernandes - The WinCE image on my unit seems to be NAND\PRG0\PLATFORM\EU090PLT.PRG . It looks like it should be a bin, bun I couldn't get it running in Device Emulator

v1.0 ready!

it will be 'base' version, i will release auto-updates/patches from now on

PS. about gps port - tried to run GpsGate, PortSplitter - with no success.. Keep on pushing further!!

---edit:

I've dumped full registry. Found interesting two DWords:

HKEY_LOCAL_MACHINE\AplSetup\Launch.exe (1)
HKEY_CURRENT_USER\Start\dummy (1)

Its the first time i saw 'start\dummy' dword.

Maybe it causes our windows to be such 'handicaped'?

And about 'AplSetup\Launch.exe' - i think that maybe this could give us working/free gps port?

I can change the values, but after reboot it goes back to previous state.

We've got to somehow edit permanently registry/rom/hv to check if it works.

br

condi

Hey Condi thanks for the update!

Windows boots from an image as i see it, editing stuff in it will not have any effect after restart as it loads windows from that image again. I've written what image file I think it is in my previous post. Unfortunately I haven't managed to decompress it. Damn Windows Automotive 5.5 Basic

--Update--

I managed to decompress the image file with the windows ROM: EU090PLT.PRG with NK.BIN toolset. HOWEVER, before you can use the tools you have to delete the custom header from the file:

ĄZZĄ ÚlŇ‚Ňq         EU090PLT˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙B000FF

The file must start with B000FF so delete the above header until B000FF.

After that use the NK.BIN toolset:

to dump the content of a nk.bin:

 

1) viewbin.exe nk.bin

 

write down start and length

 

2) cvrtbin -r -a START -w 32 -l LENGTH nk.bin

 

this command converts the nk.bin to a nk.nb0 (START and LENGTH from the command bevor)

 

3) dumprom.exe -d dump -v -5 nk.nb0

 

the content of the nk.bin will be written in the directory "dump". It must exists, otherwise an error occurs.

I'm not sure if a repacked version of the image file will work, because the bootloader knows the size of the rom, and I don't think it will like a different sized one, also it's a little risky because TestMode might not work afterwards. If anyone has any experience with these, please feel free to share your knowledge

EDIT - USE dumpromx instead. See newer post!

Nkbintools.zip

...I've dumped full registry...

BTW Gps build on SiRF chip. (GRF3i-0336S)

Hey Condi thanks for the update!

Windows boots from an image as i see it, editing stuff in it will not have any effect after restart as it loads windows from that image again. I've written what image file I think it is in my previous post. Unfortunately I haven't managed to decompress it. Damn Windows Automotive 5.5 Basic

 

--Update--

I managed to decompress the image file with the windows ROM: EU090PLT.PRG with NK.BIN toolset. HOWEVER, before you can use the tools you have to delete the custom header from the file:

ĄZZĄ ÚlŇ‚Ňq         EU090PLT˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙B000FF

The file must start with B000FF so delete the above header until B000FF.

After that use the NK.BIN toolset:

 

 

I'm not sure if a repacked version of the image file will work, because the bootloader knows the size of the rom, and I don't think it will like a different sized one, also it's a little risky because TestMode might not work afterwards. If anyone has any experience with these, please feel free to share your knowledge

 

I've attached the files from my dump. Passw is "avic411".

Hey man,

Great Job

Now we need try emulate nk.bin , compare with a full system , merge both

remove this dummy user and any autostart file. Then revert into EU090PLT.PRG

and test in unit!

Or Simply Download a Full CE.bin from Ms Download insert the header of EU090PLT.PRG and run in unit!

i will try this here but my car is far , becouse im not at home!

Good Luck

Let´s Hack!!

Duplicate post Sorry!!

i remember read something,into a z110bt forum, about a user call to pioneer and ask for a 7zip update, and pioneer sent to this a CD with update. Once there a 7z.dll probably this update change files inside our EU090PLT.PRG. Can some admin contact this user to get a copy of CD?

I have a problem. I followed the instructions, but now when I boot, I get the following loop: "Program update failed. Restarting".

Details:

Avic Z110BT upgraded to Z120BT (paid Pioneer update)

Downloaded v1.0 and extracted to root of SD.

Insert SD in Z110 and started auto started testmode.

Copy/Pasted USER and have the backup saved on PC.

My PRG0 and PRG1 were different, so I deleted PR1 from AVIC and copied PRG0 files to PRG1.

Deleted USER/PRG0/apl/Av.exe from z110.

Copied all files from SD/CONDIHACK (v1) to USER/PRG0/apl

Exited File Maintenance.

Turn off unit, and Turn on Unit.

Get "System update failed, restarting" loop.

Remove all SD from Z110, Get "Program Update Started, Program update failed, restarting" loop.

Insert Service Test Mode SD, Get "Program Update Started, Program update failed, restarting" loop.

Insert Condihack SD, Get "Program Update Started, Program update failed, restarting" loop.

Insert Pioneer's CNSD-110FM SD, Get "Program Update Started, Program update failed, restarting" loop.

Remove all SD from Z110, Get "Program Update Started, Program update failed, restarting" loop.

Got a brick on my hands... Any suggestions?

@garrettoomey - Try getting into test mode without sd card: turn on ignition, keep home button pressed and press previous, next, previous, next and so on while keeping home button pressed until the unit restarts, it should enter testmode now. Hope it works!

I will try to help when I get back home. Maybe you could try ShortFuse update crack?

On Z110toZ120 it was tested with few users, strange that it caused problems for you.

Try Tudor Z's method, and also Shortfuses dll!

Br

Condi

@garrettoomey - Try getting into test mode without sd card: turn on ignition, keep home button pressed and press previous, next, previous, next and so on while keeping home button pressed until the unit restarts, it should enter testmode now. Hope it works!

That worked! I was able to restore PRG0 and PRG1 with the backup files. It now boots stock again. Now I will try to figure out what went wrong...

Thank you for the quick response and help!

That worked! I was able to restore PRG0 and PRG1 with the backup files. It now boots stock again. Now I will try to figure out what went wrong...

Thank you for the quick response and help!

Ohh thats good news

Thats why backup is so important ..

Even if you had brick, now we know that you can easy get it back to work

Try again to install hackmode, try again without replacing PRG1 with PRG0!

Maybe stock genuine pioneer update doesnt need to replace PRG1, maybe only cracked update!

Figure out what went wrong with your unit, and post your thoughts!