Ohh thats good news

Thats why backup is so important ..

Even if you had brick, now we know that you can easy get it back to work

Try again to install hackmode, try again without replacing PRG1 with PRG0!

Maybe stock genuine pioneer update doesnt need to replace PRG1, maybe only cracked update!

Figure out what went wrong with your unit, and post your thoughts!

When i delete pr1 and copy pr0 to pr1 folder i notice there 2 pages of files into pr0 folder when u select all files , it select only first page files, not second page, u need copy all and go to second page and copy the rest of files. look that maybe can be your problem.

my unit is a z110bt updated to z120.

Hey Condi thanks for the update!

Windows boots from an image as i see it, editing stuff in it will not have any effect after restart as it loads windows from that image again. I've written what image file I think it is in my previous post. Unfortunately I haven't managed to decompress it. Damn Windows Automotive 5.5 Basic

 

--Update--

I managed to decompress the image file with the windows ROM: EU090PLT.PRG with NK.BIN toolset. HOWEVER, before you can use the tools you have to delete the custom header from the file:

ĄZZĄ ÚlŇ‚Ňq         EU090PLT˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙˙B000FF

The file must start with B000FF so delete the above header until B000FF.

After that use the NK.BIN toolset:

 

 

I'm not sure if a repacked version of the image file will work, because the bootloader knows the size of the rom, and I don't think it will like a different sized one, also it's a little risky because TestMode might not work afterwards. If anyone has any experience with these, please feel free to share your knowledge

 

I've attached the files from my dump. Passw is "avic411".

Great work! I will see what we can do with this later when i get back home! We've got good progress

Can you please post it here?

 

BTW Gps build on SiRF chip. (GRF3i-0336S)

Yes no problem, later this day. We are getting closer to working gps

When i delete pr1 and copy pr0 to pr1 folder i notice there 2 pages of files into pr0 folder when u select all files , it select only first page files, not second page, u need copy all and go to second page and copy the rest of files. look that maybe can be your problem.

 

my unit is a z110bt updated to z120.

Thats very propably! Let see what garrettoomey will say

That worked! I was able to restore PRG0 and PRG1 with the backup files. It now boots stock again. Now I will try to figure out what went wrong...

Thank you for the quick response and help!

Glad I could help out man! Hope this will not stop you from helping out in hacking these units

Can anyone that is successfully using the hack (installed to PRG0) let me know if they have a file on their AVIC: USER/PRG.FLG

I can not get to hacked mode if I install to PRG0, it just boots normal. This is the same with and without copying PRG0 files to PRG1. I believe Pioneer is using another dummy/blank file called PRG.FLG to determine the current working PRG folder (0 or 1)... One would be current working, and the other would be the previous software version.

I am going to install CONDIHACK on PRG1 and see what happens.

Can anyone that is successfully using the hack (installed to PRG0) let me know if they have a file on their AVIC: USER/PRG.FLG

I can not get to hacked mode if I install to PRG0, it just boots normal. This is the same with and without copying PRG0 files to PRG1. I believe Pioneer is using another dummy/blank file called PRG.FLG to determine the current working PRG folder (0 or 1)... One would be current working, and the other would be the previous software version.

 

I am going to install CONDIHACK on PRG1 and see what happens.

I installed CONDIHACK on PRG1, and after the restart, it goes into an upgrade progress as I believe it is supposed to do. After it restarts, it hangs on the boot background. I assume this is because CONDI scripts are hard coded to look in PGR0, and my hacks are in PRG1.

This would also explain the problem that emerson.jared was having. He installed hacks on PRG0 (as instructed), yet it will only boot normal (not hacked mode). I would assume he has the PRG.FLG flag and is acutally booting from PRG1...

I am now going to move all files from PRG0 to PRG1 and all files from PRG1 to PRG0, then delete PRG.FLG. I think this will make the CONDIHACK work. I will update again shortly...

Glad I could help out man! Hope this will not stop you from helping out in hacking these units

NEVER

I installed CONDIHACK on PRG1, and after the restart, it goes into an upgrade progress as I believe it is supposed to do. After it restarts, it hangs on the boot background. I assume this is because CONDI scripts are hard coded to look in PGR0, and my hacks are in PRG1.

 

This would also explain the problem that emerson.jared was having. He installed hacks on PRG0 (as instructed), yet it will only boot normal (not hacked mode). I would assume he has the PRG.FLG flag and is acutally booting from PRG1...

 

I am now going to move all files from PRG0 to PRG1 and all files from PRG1 to PRG0, then delete PRG.FLG. I think this will make the CONDIHACK work. I will update again shortly...

have u tried update to z120bt from shortfuse crack before use condi hack?

is really simple and work perfect to me!

have u tried update to z120bt from shortfuse crack before use condi hack?

is really simple and work perfect to me!

Since I already had the 120 upgrade installed, it will not take shortfuses hack...

I installed CONDIHACK on PRG1, and after the restart, it goes into an upgrade progress as I believe it is supposed to do. After it restarts, it hangs on the boot background. I assume this is because CONDI scripts are hard coded to look in PGR0, and my hacks are in PRG1.

 

This would also explain the problem that emerson.jared was having. He installed hacks on PRG0 (as instructed), yet it will only boot normal (not hacked mode). I would assume he has the PRG.FLG flag and is acutally booting from PRG1...

 

I am now going to move all files from PRG0 to PRG1 and all files from PRG1 to PRG0, then delete PRG.FLG. I think this will make the CONDIHACK work. I will update again shortly...

This worked perfectly! I see 2 potential solutions for this.

1. If you have USER/PRG.FLG then copy all files from PRG1 to PRG0 and all files from PRG0 to PRG1 (from your backup). If there is a 2nd page of the file listing, be sure to copy of the 2nd page as well. Then delete USER/PRG.FLG and follow Condi's instructions. I created a complete backup of USER and copied to PC. Then I renamed PRG0 to PRG1 and PRG1 to PRG0 using my PC on the SD card of the backup. Then using test mode, I deleted USER/PRG1, USER/PRG0, and PRG.FLG. Then copied the entire renamed PRG0 and PRG1 from the SD to USER on AVIC.

2. Condi may choose to modify his install to look for PRG.FLG to determine which directory to use based on the PRG.FLG status. No PRG.FLG use PRG0, if PRG.FLG exists, then use PRG1...

Thank you to Condi and everyone else working on this project!

This worked perfectly! I see 2 potential solutions for this.

1. If you have USER/PRG.FLG then copy all files from PRG1 to PRG0 and all files from PRG0 to PRG1 (from your backup). If there is a 2nd page of the file listing, be sure to copy of the 2nd page as well. Then delete USER/PRG.FLG and follow Condi's instructions. I created a complete backup of USER and copied to PC. Then I renamed PRG0 to PRG1 and PRG1 to PRG0 using my PC on the SD card of the backup. Then using test mode, I deleted USER/PRG1, USER/PRG0, and PRG.FLG. Then copied the entire renamed PRG0 and PRG1 from the SD to USER on AVIC.

 

2. Condi may choose to modify his install to look for PRG.FLG to determine which directory to use based on the PRG.FLG status. No PRG.FLG use PRG0, if PRG.FLG exists, then use PRG1...

 

Thank you to Condi and everyone else working on this project!

PRG.FLG flag-file occurs only when device was updated with official pioneer update, am I right?

I can modify script to check if PRG.FLG is on the device, but user will have to copy hackfiles to correct path (PRG1 in this situation)

Hmm... maybe easier way would be look on PRG.FLG content, and maybe automatically modify that file? Change PRG1 to PRG0?

Can you post that PRG.FLG?

Since I already had the 120 upgrade installed, it will not take shortfuses hack...

As far as Im concerned it was hack with only one .dll file?

You could just copy now that file via testmode/hackmode to get working all the fw updates

Am I right?

PS. Nice to see that our group of hacked avics is increasing !

br

condi

----edit:

I can read value of default app directory with registry:

HKEY_LOCAL_MACHINE\SOFTWARE\Information\ProgramDir0 = PRG0

HKEY_LOCAL_MACHINE\SOFTWARE\Information\ProgramDir1 = PRG1

Could you please check your values, if they are different/reversed?

Attached full registry backup of f30bt! pass like always

registry-f30bt.zip

I am not sure how to access the registry in wince. Let me know and I can check it tomorrow morning. Attached is PRG.FLG

BTW, it would be nice if there was a way to tell which version on CONDIHACK is currently installed. I am not sure if v1.1 installed or not... It just flashed the boot screen a couple of times, and then loaded wince.

I am not sure if PRG.FLG only shows up on Pioneer updated unit or not. My understanding on Shortfuse's upgrade hack is that he increments the version number so the unit 'thinks' it's a new update so it will install. then his DLL bypasses the authentication.

prgflg.zip

I am not sure how to access the registry in wince. Let me know and I can check it tomorrow morning. Attached is PRG.FLG

 

BTW, it would be nice if there was a way to tell which version on CONDIHACK is currently installed. I am not sure if v1.1 installed or not... It just flashed the boot screen a couple of times, and then loaded wince.

 

I am not sure if PRG.FLG only shows up on Pioneer updated unit or not. My understanding on Shortfuse's upgrade hack is that he increments the version number so the unit 'thinks' it's a new update so it will install. then his DLL bypasses the authentication.

Hmm... your PRG.FLG looks for me empty maybe its just dummy file like our hackmode.key

In attachment there is some app with script I made to make full backup of registry

Just run BackupRegistry.exe via file explorer, and wait some minute to get data - fullbackup.reg.

br

condi

PS. Update works the way you described after the update you have new file manager instead of the old-blueone,

and 'CONDIUPDATE' directory will be deleted. I will think how to give some info about current version.

---edit:

I've attached the files from my dump

In your unpacked dump of wince, there are three files with registry:

boot.hv, user.hv, default.hv.

Now just edit it, repack it, write it to device and... brick? or success? :D

Registry editor with HV support: http://www.ceregeditor.mdsoft.pl/files/CeRegEdit_Setup_0.0.5.2.exe

---edit:

RegistryBackup tool fixed!

Just unpack directory to SD/USB to root like:

'\SDMMC\RegistryBackup\BackupRegistry.exe' or

'\USB\RegistryBackup\BackupRegistry.exe'

and run it

RegistryBackup_ok.zip

Hey Condi.

I am thinking about a patch on the fly ,like a script to run on startup to both apply some registry hack and copy

files like explorer.exe to windows folder. in every startup the system will run the patch and goes to full work, without need

to change original EU090plt.prg. this will be safer than messing with that.

So i also tried to run Nk.bin extracted from EU090plt.prg into device emulator from microsoft v1 (v3 dont work in my PC) using cpucore armv5 and i get error,

i also tried to convert nk.bin to nk.nb0 and i got a normal start with blank screen , no error. Do u have some experience with creating images .bin to CE? i could not find CE SDK or Microsoft® Platform Builder for Windows CE 5.0

Hey Condi.

 

I am thinking about a patch on the fly ,like a script to run on startup to both apply some registry hack and copy

files like explorer.exe to windows folder. in every startup the system will run the patch and goes to full work, without need

to change original EU090plt.prg. this will be safer than messing with that.

 

So i also tried to run Nk.bin extracted from EU090plt.prg into device emulator from microsoft v1 (v3 dont work in my PC) using cpucore armv5 and i get error,

i also tried to convert nk.bin to nk.nb0 and i got a normal start with blank screen , no error. Do u have some experience with creating images .bin to CE? i could not find CE SDK or Microsoft® Platform Builder for Windows CE 5.0

I've also tried to run emulator with one of bin images, of course without luck.

I'm not an expert, its just my hobby ;) We would need that kind of expert

As you noticed many of applications just doesnt run, maybe this would be solution for this problem:

http://www.t-hack.com/wiki/index.php/Disable_TrustModel

---edit: it will not be related to 'trustmodel' >> there is no certmod.dll forget about it

Hmm... your PRG.FLG looks for me empty maybe its just dummy file like our hackmode.key

In attachment there is some app with script I made to make full backup of registry

Just run BackupRegistry.exe via file explorer, and wait some minute to get data - fullbackup.reg.

 

br

condi

 

Yes, the PRG.FLG is just a dummy file to indicate the active PRG folder...

I extracted the 5 files in your zip, installed on SD, started hack mode, started file manager, navigated to SDMMC, and double clicked backupregistry.exe but nothing happens... Suggestions? Do I need to move it to another location than the SD to run? SD is NOT locked (write protected).

I extracted the 5 files in your zip, installed on SD, started hack mode, started file manager, navigated to SDMMC, and double clicked backupregistry.exe but nothing happens...

will check it later guys when i get back to home!

I extracted the 5 files in your zip, installed on SD, started hack mode, started file manager, navigated to SDMMC, and double clicked backupregistry.exe but nothing happens... Suggestions?

Same...

Fixed! Check it now guys, and let me know if it worked for you!!

Fixed! Check it now guys, and let me know if it worked for you!!

Downloaded new files from above and does nothing... Am I doing it correct based on my description above?

Downloaded new files from above and does nothing... Am I doing it correct based on my description above?

Hi again, it should make backup to fullbackup.reg, about 0.5mb, silently without any message. Your file is still empty?

Registry Dump worked fine on my F920BT.

Here is some entry regarding GPS:

[HKEY_LOCAL_MACHINE\Drivers\BuiltIn\GPS]

"GRFTYPE"=dword:00000001

"ParamFolder"="NAND\\SYSTEM\\GPS"

"CurGpsWeekRollerNum"=dword:00000001

"DefaultGpsWeekNo"=dword:000001d5

"MC_EveryStartUpdateTime"=dword:00000001

"NmeaSel3"=dword:00000001

Other interesting news: USB Mouse is working!!!...no pointer though but I can click an navigate menues.

Regards.....

Hi again, it should make backup to fullbackup.reg, about 0.5mb, silently without any message. Your file is still empty?

I will try again. How long does it take?

Be sure to put all the files into folfer 'RegistryBackup' on your sd-card and double-click the 'BackupRegistry.mscr' script.

Then simply wait a few minutes. You will notice the change of the filesize of the file 'fullbackup.reg'

Regards.....

This worked perfectly! I see 2 potential solutions for this.

1. If you have USER/PRG.FLG then copy all files from PRG1 to PRG0 and all files from PRG0 to PRG1 (from your backup). If there is a 2nd page of the file listing, be sure to copy of the 2nd page as well. Then delete USER/PRG.FLG and follow Condi's instructions. I created a complete backup of USER and copied to PC. Then I renamed PRG0 to PRG1 and PRG1 to PRG0 using my PC on the SD card of the backup. Then using test mode, I deleted USER/PRG1, USER/PRG0, and PRG.FLG. Then copied the entire renamed PRG0 and PRG1 from the SD to USER on AVIC.

 

2. Condi may choose to modify his install to look for PRG.FLG to determine which directory to use based on the PRG.FLG status. No PRG.FLG use PRG0, if PRG.FLG exists, then use PRG1...

 

Thank you to Condi and everyone else working on this project!

Confirmed that is exactly what was wrong!!! I have a z110 with the shortfuse upgrade and i had the PRG.FLG file did exactly what garrettoomey did and works like a champ now! Thanks man! Now where is everyone getting the igo8 software from?? Where can i get a copy?

Be sure to put all the files into folfer 'RegistryBackup' on your sd-card and double-click the 'BackupRegistry.mscr' script.

Then simply wait a few minutes. You will notice the change of the filesize of the file 'fullbackup.reg'

 

Regards.....

That's my problem. I put the files in the root. Will try again now.