Stop using this hackmode and delete it.  Search for the password reset thread instead.

Hopefully you haven't ruined your unit with hackmode as it does hack your system.  There is no need to do any hacking.

Wow. I think i just ruined my system. I have Avic-X930BT also, (was on latest firmware i believe 6.0) I tried to autoinstall condi Hackmode 2.21, it copied the hacked files, rebooted and said something like "Can not find valid application". I need to know how to Undo this now. To get my system working. All i need is to reset password.

EDIT:

I was able to fix it manually by running a SD card with this and only this in the ScriptExec.ini :

COPY -rc SD\UPDATE\USER\PRG\APL USER\PRG0\APL

where SD\UPDATE would be the update folder on your SD card, the one containing the latest Map update, in my case 2015 USA CANADA MAP UPDATE.zip

Now how Do i Get into Testmode, the 10 item menu ?

SUPERTESTMODE.ZIP

Hi I need some help I am trying to get to password on my stereo has I've lost it. I'm not sure what files to extract to a memory card

hi. i have avic-f40bt firmware 4.0. It does not have user folder at all, only Nand. I rename in script user at nand. also i make backup. but now device hangs on pioneer logo and cant enter test mode with Conndi`s hack.2.21 with  supertestmode its ok but i cant make select or copy files to return back it alive. any sugestions?  also with 1.4 hack it going at test mode but still cant copy or select files (options are grey).

FINALLY!!!  i got it to work on my AVIC X930BT,  

First I copied  Condi's HACKMODE v2.21 - AUTOINSTALL.zip to my SD card (of course making sure nothing on it)

Took that to my car, popped it in and let it load up.  Then it reboots and asks if I want to enter Hack mode - click yes - File tree comes up

I found the elusive PASWORD.DAT file here:  FILEMANAGER> NAND>  SYSTEM>  SECURITY

I tried to copy - it copied (I think) but them couldn't find it  Found it, copied to Desktop ---- that didn't work - Also woudn't let me go to SD card... I was able to go as high as the tree.

Finally discovered a common file folder that I could access from both my PC and while in the car - I copied the PASSWORD file there - brought it in the house and from my PC, opened that file with Notepad --

BAM, there was the password. 

whew- thanks to everyone

Stop it! Stop using Condi anything, any version, just stop.

You got lucky and didn't brick your system.

You can get the password.dat file using SuperTestMode and it doesn't brick your system.

 

 

Moderator Note: This has not been updated since 2012 and has a very high likelihood of bricking modern units. DO NOT install without a full backup. Testmode is currently recommended in place of hackmode.

how do I access the file

2017 and it still worked for my Avic930BT (i'm one off them who forgot their password)

Many thanks.

gr. from the Netherlands

I played a bit with my good old f30bt and have now igo 8.3 running with working GPS using Condi's hackmode 1.4.

I am using an external TTL-serial-GPS receiver (u-blox m8n) on the AVIC's com1: serial port which is accessible via pins 12 and 24 of the AV connector on the back of the HU. The GPS module can be connected directly without any level shifters as both the port and the module use 3.3V signal level. Its 5V supply voltage can be taken from the USB port of the AVIC.

I have even TMC working using an external GNS TMC module that is connected to the serial port which is normally used for the CAN bus adapter on some AVIC models. It is accessible via com6:. However, this port requires levelshifting because it uses 5V signal level and the GNS module uses 3.3V signal level.

I am even able to switch back to the original nav software. The only thing that is not working is voice navigation in igo. Does anyone have an idea how to get audio from igo?

btw.: It should even be possible to use the internal GPS. If GPS debug mode is turned on from the hidden debug menu (see pionara's posts about that and use "POSEIDONDBG ON") the full NMEA data is logged in a file on the SD card. I tried to write a virtual com port driver that contiuously reads from this file. However, it does not seem to be that easy because the file is written in non-shared mode. For now I will stick to the external m8n GPS module. The m8n's excellent reception makes up for the missing dead reckoning feature nicely. And these modules are very cheap on ebay.

Here is my working sys.txt for igo8:

[folders]
app="%SDCARD%/iGO8"

[interface]
skin="ui_igo8"
vga=0
mapfontscale=100
show_exit=1

[rawdisplay]
class="landscape"
highres=0
screen_x=800
screen_y=480

[tts]
tts_buffer=131072
tts_logics=3
priority="HIGH"
always_say_road_names=1
announce_street_name=1
expected_engine_delay=1400 

[debug]
skip_eula=1
enable_roadshadow=1

[map]
auto_nightmode=1

[msnd]
enabled=0
msnd.start=0

[sound]
auto_mute=0
mute_os_key=1
queue_length=200
sound_muted=0
sound_q_length=200
sound_volume=255
use_os_volume=0
voice_muted=0
voice_volume=255


[tmc]
port=6
baud=38400
source="gns"

[gps]
port=1
baud=9600
source="nmea"

that very interesting post we try to hack the Japanese unit mrz 09 to work in europe so far we have running igo on it by replace original navi exe with igo exe (rename the igo.exe for navi.exe) but the gps port its locked so maybe yours solution will work. Also you can try replace the navigation in yours unit and see. hope the voice gonna work

check last few posts on avic mrz-99 custome firmware for it

The GPS port (which is on com7:) is locked because it is not opened by navi.exe directly, but instead by a common DLL that is used by several processes. Navi.exe, av.exe, ... get the position information via a function call from this DLL. Unfortunately the port is opened at a very early stage of the boot process and registry mods do not survive a restart so a portsplitter cannot be injected. However, if I would know the function call to get the position information I could probably write a virtual com port driver that provides an NMEA stream to Igo. I think this is exactly what the PIONEERUS software does. But PIONEERUS is not free and it does not work anymore with newer software versions. Does anyone have PIONEERUS installed and could provide the files?

manio112, the mrzs seem to use the same AV-connector as the f30bt. So I am pretty sure that they will have the COM1 port available as well since it is used by the pioneer software developers as a debug port (debug output can be turned on with the "POSEIDONDBG ON" method as described by an old post of pionara here in the forum).

Here are instructions to get you going:

Connect the TX pin of the M8N to pin 24 (EXTOC) of the AV connector and the RX pin of the M8N to pin 12 (CTOEX). You can use the "KMODE" connection method for the handbrake signal detection override as described on youtube to make this connection despite missing leads on the AV connector plug. Alternatively, if you don't need any other signals from the AV connector, you can also remove the Plug and use so called "jumper cables" for breadborads to connect to the pins on the AV connector directly. That's how I did it.

GND and VCC for the M8N can be taken from the USB port of the AVIC. Just use a USB Y-adapter cable that are used to power mobile USB harddisk and cut off the secondary USB plug to tap off GND and VCC. GND is usually the black wire and VCC the red one, but I recommend to double check with a multimeter.

I am using a GY-GPSV3 M8N PCB-only module that I ordered from ebay, but you can also find M8N modules for drones that come complete with a housing and wires.

BTW., the method you suggested to get audio working does not seem to work for the f30bt, because as soon as av.exe starts it will occupy the screen. So I do have to start Igo instead of av.exe and can't start it instead of navi.exe. This seems to be also the rootcause for the missing audio, because av.exe seems to be needed in order to initialize the audio path from the codec to the speakers.

manio112, the mrzs seem to use the same AV-connector as the f30bt. So I am pretty sure that they will have the COM1 port available as well since it is used by the pioneer software developers as a debug port (debug output can be turned on with the "POSEIDONDBG ON" method as described by an old post of pionara here in the forum).

 

Here are instructions to get you going:

 

Connect the TX pin of the M8N to pin 24 (EXTOC) of the AV connector and the RX pin of the M8N to pin 12 (CTOEX). You can use the "KMODE" connection method for the handbrake signal detection override as described on youtube to make this connection despite missing leads on the AV connector plug. Alternatively, if you don't need any other signals from the AV connector, you can also remove the Plug and use so called "jumper cables" for breadborads to connect to the pins on the AV connector directly. That's how I did it.

 

GND and VCC for the M8N can be taken from the USB port of the AVIC. Just use a USB Y-adapter cable that are used to power mobile USB harddisk and cut off the secondary USB plug to tap off GND and VCC. GND is usually the black wire and VCC the red one, but I recommend to double check with a multimeter.

 

I am using a GY-GPSV3 M8N PCB-only module that I ordered from ebay, but you can also find M8N modules for drones that come complete with a housing and wires.

 

BTW., the method you suggested to get audio working does not seem to work for the f30bt, because as soon as av.exe starts it will occupy the screen. So I do have to start Igo instead of av.exe and can't start it instead of navi.exe. This seems to be also the rootcause for the missing audio, because av.exe seems to be needed in order to initialize the audio path from the codec to the speakers.

Hi morus,

May be I'm completely on a wrong track but I want to ask a question about GPS antenna. As far as I understand It's current antenna's port is locked by a DLL file so, if we don't want to use it's original navigation application this antenna is useless for us. Is it possible to detach this antenna from it's current connection and connect it as you explain to COM1? My unit came from Japan and it's navigation app. is totally useless for me. Thanks in advance.

Hi morus,

 

May be I'm completely on a wrong track but I want to ask a question about GPS antenna. As far as I understand It's current antenna's port is locked by a DLL file so, if we don't want to use it's original navigation application this antenna is useless for us. Is it possible to detach this antenna from it's current connection and connect it as you explain to COM1? My unit came from Japan and it's navigation app. is totally useless for me. Thanks in advance.

Hi morus,

 

May be I'm completely on a wrong track but I want to ask a question about GPS antenna. As far as I understand It's current antenna's port is locked by a DLL file so, if we don't want to use it's original navigation application this antenna is useless for us. Is it possible to detach this antenna from it's current connection and connect it as you explain to COM1? My unit came from Japan and it's navigation app. is totally useless for me. Thanks in advance.

No, not possible, because it's only an antenna. You need to connect a complete receiver. It does not need to be a M8N. You just need a GPS receiver that has a TTL UART output. M8N is attractive because it is highly sensitive, it supports GPS/GLONASS/BEIDOU/GALILEO, and it is relatively cheap because it is often used in chinese drones...

Hello,

I am Italian.. I am trying to retrieve password on my pioneer avic-f840bt with your guide... But it doesn't work... It says "test mode failed starting" please help me 

after run the Hackmode v2.1 ill see this screen:

what to do know?

thanks 

On 2-10-2013 at 6:43 PM, Carelse said:

Hello Condizek,

 

I realy hope you will get the gps running soon.

I have a Avic-940BT that was pre-installed in my new Kia Rio but the navigation software from pioneer is not half as good as TomTom, that i used before.

Do you think TomTom will ever run on this device?

The software "pioneerus" seems to have solved this issue, so maybe you can get some information from the developer of this software? Do you have any experiance with pioneerus?

 

Anyway, succes with the project!

I also have a Kia Rio with the pioneer F940BT. Have you got tomtom running? And if so, how did you do that. I really want TomTom is a better navigation. Thanks.

Доброго времени суток. Помогите найти testmode на avic-evz05. Или это настолько редкая балалайка? Заранее ОГРОМНОЕ СПС....

Hey guys im trying to download the program but when i try to unzip it with the password "avic411" it wont work.. if u have the solution or the right password that would be great, Thanks!

Hallo ich avic-f960dab und habe das Passwort vergessen kann mir jemand helfen danke im voraus 

Grüße Alfred

hello, I to have tried the password "avic411" and it didn't work !!

Hello together,

cann me someone helping with blocked AVIC f940 bt? Im removing the battery and avic needs password, but i forgotten him. Im reading this forum, but im not finding directly hepl for me. Im not sure, but it is possible, that radio is blocked. It function only test mode. It not function the navigation or settuping.

Thank you!!!