look this pic, there a jtag conection in CC CPU and a Order to Testmode Stages, maybe can help us

https://rs516l32.rapidshare.com/#!download|516dt|281150261|Pioneer_Avic-z110bt_Avic-f10bt_Service_Manual_Repair_Guide.pdf|26106

Here is a very detailed service manual - schematics, block diagrams et al. Its for the Z110 - but they clearly all share the same architecture. Note commands etc.

It does look like there are 2 pieces working here...

Enjoy!

This relevant to my interests. I'll check it out tomorrow. The nice thing is we can launch executables without bricking (I think). I might have to dust off my WinCE dev tools, but this is genuinely exciting

 

So as you can see, we just had got rid of pioneer processes

One strange process left, AstProc.exe - anybody knows what it is?

 

br

condi

Well I don't know what it is, but I can tell you where it's from: EU090RGD.PRG . This is also a rom bin, which contains the following files:

AstProc.exe, ceconfig.h, coredll.dll, nk.exe, snapshot_secureos.dat

The bin can be unpacked with the same method I described, but I noticed "dumprom" screws with the exe's (and dll's probably), because they are not runnable on other WinCE's.

I think I have found the reason that some people have the PRG.FLG file...

If you just did the upgrade from Z110 to Z120 (official or Shortfuze), you should not have the flag, and will be using PRG0. If you upgraded (either method) and then installed the additional pioneer firmware update (Version 2.003), then you will have PRG.FLG and PRG1 will be used.

http://www.pioneerelectronics.com/PUSA/Car/GPS-Navigation/AVIC-Z120BT

finishing v1.2 with auto-migrate HACKMODE to HMIManager ..

--edit:

DONE. Please post results. Update only from v1.1! I used some trick to replace HMIManager - which process can't be killed (unit freeze), and can't be deleted/overwrited! Unit will temporary use PRG1 with autoscript for one reboot, replace HMI and back to normal state, everything will be nice and clean with stock exe's in PRG1

Now we've got no processes from PRG\Apl directory.

br

condi

---edit: unpacked EU090RGD - in AstProc.exe I see something like:

C:\WINCE500\platform\PF09Light\target\ARMV4I\retail\ASTPROC.pdb

and

OSSwitch_ServiceThread

OS Switch? More and more I think that like rrolff said, its 2-units device, 1-navi with wince and software, 2-audio/hw/fw - with control of audio, gps signal, hw buttons etc.

But If pioneers Navi.exe has access to gps port/signal, then we could gain that access! ...but how?

dump-EU090RGD.zip

Condi, can you also keep an updated list of all files that are changed or replaced as you create the updates? This would provide an easy 'back to stock' path. Just need to replace the changed/updated files with the stock files from our backup. I created a FULL backup of USER and NDATA today. NDATA took forever...

Condi, can you also keep an updated list of all files that are changed or replaced as you create the updates? This would provide an easy 'back to stock' path. Just need to replace the changed/updated files with the stock files from our backup. I created a FULL backup of USER and NDATA today. NDATA took forever...

Only one which was replaced till now was Av.exe.

Now instead of it hackmode 'is in' HMIManager.exe file.

If you want to revert it back, then just delete it, copy original .exe.

Also in Apl directory there are added:

explorer.exe, explorer2.exe, MortScript.exe, and HMIManager.mscr.

Thats it.

Only one which was replaced till now was Av.exe.

Now instead of it hackmode 'is in' HMIManager.exe file.

Does v1.2 replace the hacked av.exe with the original Av.exe?

Does v1.2 replace the hacked av.exe with the original Av.exe?

Yes, automatically from PRG1. Everything is automated

All you need to do is to have 1.1 already, have unmodified PRG1,

and put 1.2 update on SD/USB

I've made some scripts to auto change HMIManager,

not to do this manually from TestMode.

Now its easy as hell going sleep now, will be back in morning! good night!

Yes, automatically from PRG1. Everything is automated

All you need to do is to have 1.1 already, have unmodified PRG1,

and put 1.2 update on SD/USB

I've made some scripts to auto change HMIManager,

not to do this manually from TestMode.

Now its easy as hell going sleep now, will be back in morning! good night!

What about the few of us that had to rename prg0 to prg1 and prg1 to prg0 and delete the prg.flg file? will the 1.2 update still work right?

What about the few of us that had to rename prg0 to prg1 and prg1 to prg0 and delete the prg.flg file? will the 1.2 update still work right?

I checked the Av.exe files from both PRG1 and PRG0, and they are the same. It should work fine. I will update mine to v1.2 tomorrow and post results.

finishing v1.2 with auto-migrate HACKMODE to HMIManager ..

 

--edit:

 

DONE. Please post results. Update only from v1.1! I used some trick to replace HMIManager - which process can't be killed (unit freeze), and can't be deleted/overwrited! Unit will temporary use PRG1 with autoscript for one reboot, replace HMI and back to normal state, everything will be nice and clean with stock exe's in PRG1

Now we've got no processes from PRG\Apl directory.

 

br

condi

 

---edit: unpacked EU090RGD - in AstProc.exe I see something like:

 

C:\WINCE500\platform\PF09Light\target\ARMV4I\retail\ASTPROC.pdb

and

OSSwitch_ServiceThread

 

OS Switch? More and more I think that like rrolff said, its 2-units device, 1-navi with wince and software, 2-audio/hw/fw - with control of audio, gps signal, hw buttons etc.

But If pioneers Navi.exe has access to gps port/signal, then we could gain that access! ...but how?

I agree, if u check service manual , u can see there is a cc unit and all parts is pluged into monitor , dvd , gps board, there are a ac97 audio chip, like onboard pc motherboard, into CC board but i think its work only receive nav and digital audio, the tuner is other unit!

Try Google for SiRFprima probably the CPU of our Avic units, there a lot of info about GPS and Multimedia units using this Chipset ,maybe a info about bootloader or a unbrick method! we can know how our system work!

http://www.windowsfordevices.com/c/a/News/CSR-SiRFprimaAuto/

Holy sh*t you guys are taking the ball and running with it. If I didn't have an iPad in the dash right now, I would so be all over this. Keep up the awesome work guys. And Garrett, its nice to see you active here.

Indeed!!! This is some awesome stuff!!!

Special thanks to Garret, as I believe I'll fall into that category with the .flg file.... I've yet to play with this stuff, but at least, I have a somewhat decent idea of what to look out for.... Thanks again...

I'm not so much on getting a 3rd party Navi going as much as everyone else.... But the more mods the better....

I'm jumping in to try to figure out how I can make "daytime" map background black like "nighttime".... yet leaving the dimmer function functional....(daytime map is hard to see street names...looks better..etc)

I'm also curious to know if there is any way to write a script to automatically hit the "OK" button for you..<-- that one will be last, as I seriously doubt that it's possible...

Regardless...

Good job fellas... I speak for many, that I appreciate the efforts... this is good stuff...

I'm also curious to know if there is any way to write a script to automatically hit the "OK" button for you..<-- that one will be last, as I seriously doubt that it's possible...

I will check autoclick on OK nice idea I've made some script with autoclicks on sony nv-u73/93 units to autounlock gps port on boot. It should work I will post info later/evening!

PS. Please confirm is v1.2 update working for you guys! I tested it twice, so it should work perfectly

Please confirm is v1.2 update working for you guys! I tested it twice, so it should work perfectly

V1.2 Test Results

The installation worked flawless. After installing v1.2, I lost bluetooth. I tried to pair my phone again, and it just locked up the system. I rebooted and went to the service information screen and it showed Bluetooth Firmware version as "-----------". I went into test mode and deleted HMIManager.exe and replaced with the original. Rebooted again and my Bluetooth was paired to my phone and Service Information showed Bluetooth firmware version as "3.22". Thoughts? Any other test you would like me to perform?

V1.2 Test Results

The installation worked flawless. After installing v1.2, I lost bluetooth. I tried to pair my phone again, and it just locked up the system. I rebooted and went to the service information screen and it showed Bluetooth Firmware version as "-----------". I went into test mode and deleted HMIManager.exe and replaced with the original. Rebooted again and my Bluetooth was paired to my phone and Service Information showed Bluetooth firmware version as "3.22". Thoughts? Any other test you would like me to perform?

Thanks for testing friend! I have to check it with my device. Its strange, because it uses HMIManager original exe when booting stock pioneer software.. Today I will make some more tests.

----edit:

Just tried on my unit. No bluetooth issues. Bluetooth works, paired with my phone, in system settings I see bluetooth firmware version - also 3.22. Please check if your PRG1 files are the same as in PRG0? Maybe different HMIManager.exe or other files?

PS. testing autoclicker ..

PS. Please confirm is v1.2 update working for you guys! I tested it twice, so it should work perfectly

Result of comparison between X930BT and F30BT registry:

X930BT has none but F30BT has: [HKEY_CURRENT_USER\Software\GNS]

[HKEY_CURRENT_USER\Software\GNS\GpsRdsApi]

Line 2212 in X930BT: 00,00,00,00,00,bc,94,88,90,e0,77,62,90,40,ea,94,90,8c,6a,bf,9b,0f,00,00,00,\

Line 2216 in F30BT: 00,00,00,00,00,b0,ad,88,90,e0,77,62,90,40,ea,94,90,8c,6a,bf,9b,0f,00,00,00,\

Line 2434 in X930BT: "TimeZoneInformation"=hex:e0,01,00,00,43,00,65,00,6e,00,74,00,72,00,61,00,6c,00,\

Line 2438 in F30BT: "TimeZoneInformation"=hex:c4,ff,ff,ff,43,00,65,00,6e,00,74,00,72,00,61,00,6c,00,\

Line 2958 in X930BT: [HKEY_LOCAL_MACHINE\Drivers\Active\53]

"Hnd"=dword:00e4f8a0

Line 2962 in F30BT: [HKEY_LOCAL_MACHINE\Drivers\Active\53]

"Hnd"=dword:00e60550

Line 2966 in X930BT: [HKEY_LOCAL_MACHINE\Drivers\Active\52]

"Hnd"=dword:00e4fa30

...

"ClientInfo"=dword:00e4bc50

Line 2970 in F30BT: [HKEY_LOCAL_MACHINE\Drivers\Active\52]

"Hnd"=dword:00e4f520

...

"ClientInfo"=dword:00e4b790

Line 5292 in X930BT:

20,00,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,5d,3f,ca,a4,1e,09,e1,3f,\

d0,d6,78,ff,1f,1e,44,61,00,00,00,00,04,80,00,00,10,00,00,00,10,00,00,00,c3,\

7d,ab,3b,84,33,d8,08,2c,a1,96,0a,d0,89,0c,7c,52,00,00,00,5d,32,04,de,55,81,\

54,e8,3f,ba,3e,39,c0,29,a5,b1,11,c0,e1,da,b7,1b,83,1c,51,1b,35,6c,8f,95,cd,\

a8,21,ea,23,9a,8f,41,5c,2d,fb,c1,42,aa,22,24,39,6c,69,0d,a8,f1,9c,36,24,b8,\

9e,2f,65,99,e0,c8,8b,aa,4d,b3,e3,c3,59,f0,ce,ae,42,1b,d1,c9,ea,10,55,64,82,\

26,14,00,00,00,1e,85,56,48,30,0e,35,0e,69,99,05,40,23,86,25,26,e8,9d,f0,4f

Line 5309 in F30BT:

20,00,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,dd,b6,ca,a4,9e,80,e1,3f,\

d0,d6,78,ff,9f,97,44,61,00,00,00,00,04,80,00,00,10,00,00,00,10,00,00,00,c3,\

7d,ab,3b,84,33,d8,08,2c,a1,96,0a,d0,89,0c,7c,52,00,00,00,3a,7f,bd,85,0d,b3,\

67,c1,8d,60,96,84,84,4d,8b,dd,d7,c7,ed,95,4d,69,a3,0b,3f,6d,81,9c,94,9e,80,\

28,7d,73,22,2f,fb,1b,df,26,24,9a,d9,68,af,12,4c,18,43,7a,75,2b,c1,04,72,bc,\

6d,24,43,54,af,3d,1f,96,07,5d,29,8f,73,30,3a,a3,b2,7d,c8,f9,f1,1b,d2,03,d9,\

ba,14,00,00,00,7d,1b,39,c9,e7,80,79,54,16,da,0b,88,d2,71,66,13,56,ee,77,3d

Thanks for testing friend! I have to check it with my device. Its strange, because it uses HMIManager original exe when booting stock pioneer software.. Today I will make some more tests.

 

----edit:

Just tried on my unit. No bluetooth issues. Bluetooth works, paired with my phone, in system settings I see bluetooth firmware version - also 3.22. Please check if your PRG1 files are the same as in PRG0? Maybe different HMIManager.exe or other files?

My PRG0 and PRG1 have different files prior to hacking (pioneer ap ver 2.002 on PRG0 and 2.003 on PRG1). I started over with this procedure:

Deleted PRG.FLG

Deleted PRG0, and copied all files from PRG1 to PRG0 (now they are both the same with newest firmware 2.003)

Installed condihack v1

Updated with condihack v1.1

updated with condihack v1.2

Bluetooth is now working fine. The only difference was that I replaced have the same files in PRG1 and PRG0.

My MSNDirect is still showing as 'inactive', but that could be a seperate issue unless others have the same problem... MSN Direct also showed as 'inactive after I restored everything from backup...

Yes, it does. It works on my X930BT and after this update I manage to get registry backup using your script. Before that (on Ver1.1) it wasn't successful.

 

Result of comparison between X930BT and F30BT registry:

X930BT has none but F30BT has: [HKEY_CURRENT_USER\Software\GNS]

[HKEY_CURRENT_USER\Software\GNS\GpsRdsApi]

 

Line 2212 in X930BT: 00,00,00,00,00,bc,94,88,90,e0,77,62,90,40,ea,94,90,8c,6a,bf,9b,0f,00,00,00,\

Line 2216 in F30BT: 00,00,00,00,00,b0,ad,88,90,e0,77,62,90,40,ea,94,90,8c,6a,bf,9b,0f,00,00,00,\

 

Line 2434 in X930BT: "TimeZoneInformation"=hex:e0,01,00,00,43,00,65,00,6e,00,74,00,72,00,61,00,6c,00,\

Line 2438 in F30BT: "TimeZoneInformation"=hex:c4,ff,ff,ff,43,00,65,00,6e,00,74,00,72,00,61,00,6c,00,\

 

Line 2958 in X930BT: [HKEY_LOCAL_MACHINE\Drivers\Active\53]

"Hnd"=dword:00e4f8a0

Line 2962 in F30BT: [HKEY_LOCAL_MACHINE\Drivers\Active\53]

"Hnd"=dword:00e60550

 

Line 2966 in X930BT: [HKEY_LOCAL_MACHINE\Drivers\Active\52]

"Hnd"=dword:00e4fa30

...

"ClientInfo"=dword:00e4bc50

Line 2970 in F30BT: [HKEY_LOCAL_MACHINE\Drivers\Active\52]

"Hnd"=dword:00e4f520

...

"ClientInfo"=dword:00e4b790

 

Line 5292 in X930BT:

20,00,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,5d,3f,ca,a4,1e,09,e1,3f,\

d0,d6,78,ff,1f,1e,44,61,00,00,00,00,04,80,00,00,10,00,00,00,10,00,00,00,c3,\

7d,ab,3b,84,33,d8,08,2c,a1,96,0a,d0,89,0c,7c,52,00,00,00,5d,32,04,de,55,81,\

54,e8,3f,ba,3e,39,c0,29,a5,b1,11,c0,e1,da,b7,1b,83,1c,51,1b,35,6c,8f,95,cd,\

a8,21,ea,23,9a,8f,41,5c,2d,fb,c1,42,aa,22,24,39,6c,69,0d,a8,f1,9c,36,24,b8,\

9e,2f,65,99,e0,c8,8b,aa,4d,b3,e3,c3,59,f0,ce,ae,42,1b,d1,c9,ea,10,55,64,82,\

26,14,00,00,00,1e,85,56,48,30,0e,35,0e,69,99,05,40,23,86,25,26,e8,9d,f0,4f

Line 5309 in F30BT:

20,00,00,00,00,01,68,00,00,10,00,00,00,10,00,00,00,dd,b6,ca,a4,9e,80,e1,3f,\

d0,d6,78,ff,9f,97,44,61,00,00,00,00,04,80,00,00,10,00,00,00,10,00,00,00,c3,\

7d,ab,3b,84,33,d8,08,2c,a1,96,0a,d0,89,0c,7c,52,00,00,00,3a,7f,bd,85,0d,b3,\

67,c1,8d,60,96,84,84,4d,8b,dd,d7,c7,ed,95,4d,69,a3,0b,3f,6d,81,9c,94,9e,80,\

28,7d,73,22,2f,fb,1b,df,26,24,9a,d9,68,af,12,4c,18,43,7a,75,2b,c1,04,72,bc,\

6d,24,43,54,af,3d,1f,96,07,5d,29,8f,73,30,3a,a3,b2,7d,c8,f9,f1,1b,d2,03,d9,\

ba,14,00,00,00,7d,1b,39,c9,e7,80,79,54,16,da,0b,88,d2,71,66,13,56,ee,77,3d

Nice comparison! We've got to analyze that differences, gps values etc.

Also great to hear that v1.2 is working for you and registry backup also!!

My PRG0 and PRG1 have different files prior to hacking (pioneer ap ver 2.002 on PRG0 and 2.003 on PRG1). I started over with this procedure:

Deleted PRG.FLG

Deleted PRG0, and copied all files from PRG1 to PRG0 (now they are both the same with newest firmware 2.003)

Installed condihack v1

Updated with condihack v1.1

updated with condihack v1.2

 

Bluetooth is now working fine. The only difference was that I replaced have the same files in PRG1 and PRG0.

 

My MSNDirect is still showing as 'inactive', but that could be a seperate issue unless others have the same problem... MSN Direct also showed as 'inactive after I restored everything from backup...

Happy to read that it works now! Good that you installed all versions ascending, in next updates there will be check if installed version is the previous one, if any other then it will not update.

I have a problem. I followed the instructions, but now when I boot, I get the following loop: "Program update failed. Restarting".

 

Details:

Avic Z110BT upgraded to Z120BT (paid Pioneer update)

 

Downloaded v1.0 and extracted to root of SD.

Insert SD in Z110 and started auto started testmode.

Copy/Pasted USER and have the backup saved on PC.

My PRG0 and PRG1 were different, so I deleted PR1 from AVIC and copied PRG0 files to PRG1.

Deleted USER/PRG0/apl/Av.exe from z110.

Copied all files from SD/CONDIHACK (v1) to USER/PRG0/apl

Exited File Maintenance.

Turn off unit, and Turn on Unit.

Get "System update failed, restarting" loop.

Remove all SD from Z110, Get "Program Update Started, Program update failed, restarting" loop.

Insert Service Test Mode SD, Get "Program Update Started, Program update failed, restarting" loop.

Insert Condihack SD, Get "Program Update Started, Program update failed, restarting" loop.

Insert Pioneer's CNSD-110FM SD, Get "Program Update Started, Program update failed, restarting" loop.

Remove all SD from Z110, Get "Program Update Started, Program update failed, restarting" loop.

 

Got a brick on my hands... Any suggestions?

I was able to get updated to v1.2, but like you, my BT was hokey, and the version read ------

Then I somehow managed to get myself in the above situation, luckily after several attempts, I was finally able to get to file manager and restore the USER directory from backup....whhhewwww!!!!

Now I'm starting over... There has got to be something with our scenario (Pioneer 110-120 update(legit) and having the 2.0.0.3 update)

Odd enough, mine does NOT have the PRG.flg file????

I was able to get updated to v1.2, but like you, my BT was hokey, and the version read ------

 

Then I somehow managed to get myself in the above situation, luckily after several attempts, I was finally able to get to file manager and restore the USER directory from backup....whhhewwww!!!!

 

Now I'm starting over... There has got to be something with our scenario (Pioneer 110-120 update(legit) and having the 2.0.0.3 update)

Odd enough, mine does NOT have the PRG.flg file????

OK so I assume that you have backup of USER content.

Get PRG0 from copy, make another one, rename it to PRG1.

Delete PRG1 from device, copy renamed directory - PRG1 (with PRG0 content).

Install HACKMODE v1., update to v1.1, update to v1.2.

And post results

Thanks Condiczek

-Everything works fine up until 1.1>1.2 update... just like my first attempt, the unit just continually reboots...I let it reboot 15 times then I turned it off/on... Regardless, it'll continue to reboot until, I remove the SD...

-This time, BT is working with version 3.11

-After the update, HACKMODE.key is the only thing left on the SD card... yet it doesn't boot into WinCE<--just get's to the OK screen and reboots

Should I try to grab a HACKMODE.key from the 1.1 update? To see if it'll boot to WinCE?

Thanks Condiczek

 

-Everything works fine up until 1.1>1.2 update... just like my first attempt, the unit just continually reboots...I let it reboot 15 times then I turned it off/on... Regardless, it'll continue to reboot until, I remove the SD...

-This time, BT is working with version 3.11

-After the update, HACKMODE.key is the only thing left on the SD card... yet it doesn't boot into WinCE<--just get's to the OK screen and reboots

 

Should I try to grab a HACKMODE.key from the 1.1 update? To see if it'll boot to WinCE?

Wait a minute, I think I know what's wrong... just give me five min..

--edit: PM