I'm currently working on uncrippling the software so that VR works on x930bt (and maybe a few others).

Looking through the code in various places on 4.001 software, I see some attempts to prevent VR (by not initializing it) for certain "device types"

AL_HardwareInfo::GetDeviceType is called in a few places in Av.exe, Voice.exe, AvVr.dll, and very frequently in Navi.exe

It looks like my unit might be type: 2c, and seems like there are various types from 01 up to about 39 right now.

It seems there are a few types that pioneer has intentionally crippled: 2a, 2c, 35, 37, 39.

I suspect that x940bt might by type 37, and I suspect that 2a, 35, and 39 might be one of the euro units (like ?, F930, F940 ?)

I say this because there is some logic that is usually coupled with GetDeviceType, AL_HardwareInfo::GetRegion that returns a code based on geo region? I would think this is same as DVD region code (like US/CAN = 1), but it seems to be 2 for US/CAN.

Anyhow, thats not so important - what I did was patch the crap out of everywhere it appeared to be discriminating against the device types it doesnt like (it has a distinct pattern).

Anyhow, I was able to get VR button (the dial) working - almost! The screen comes up, I hear a ding, however, when I say anything it wont register. The ladies voice says excuse me, i dont understand etc. It just did not seem to recognize my voice.

So now I want to try to verify which device types "should" be working, vs are "crippled", and start investigating from there.

Can you folks tell me which models that VR does work ok on with latest software?

whoops sorry - i meant to post this in X forum, but it is applicable to Z series, as there is some reason VR is enabled on Z series, but disable on newer X series (it's not because it wont work ....)

ok, i think i was off.. i have found the place where the device type is obtained, along with several other functions that handle similar functionality, all deriving from "AL_HardwareInfo::GetModel" @ 1af94 in AplLib.dll. I can change this to XX 00 a0 e3, where XX is the model number (as an enum unfortunately):

From what I can tell, there is:

22 = z120 ??

28 = x920 ??

2c = x930

33 = z140 ?

37 = x940 ?

I am trying a few different values, and some intersting results, for example:

29 = UK/EU? strange tuner settings

2b = russian?

2d = UK/EU?

2e = UK/EU?

30 = UK/EU?

31 = UK/EU?

32 = UK/EU? + VR, but VR never finishes starting up. Guessing it's cause I dont have UK/EU language files for VR.

33 = US + VR, but voice doesnt recognize anything I say. This seems to be most functional model for me, as everything seems to be working - guessing this is z140

UPDATE: See later post for proper ids/models...

A few interesting things:

1. on most of the UK/EU models, there are a few different menu items in places. Most interesting may be "Safe Mode" on/off in the settings menu.

There is another function ::isUC which my guess determines if unit is "US/CAN" which derives from GetModel, and returns 1/true if model is one of 2, c, f, 12, 1d, 22, 28, 2c, 33, 37

I see isUC called in a few places, interestingly around some parking brake functionality in HMIManager.exe. Need to find more about this. May be a good candidate for soft PKB mod!!

2. tuner settings display a bit differently on some of the UK/EU models. The tuning step is like .05 khz instead of .20, however dont get your hopes up. This appears to just be for display calculation - the actual tuner/presets may be stored in ucom or hw, and the tuner itself may be hw locked to the region. (There was another greyed out menu item, FM tuning step [50 khz] in a/v settings menu which may be of further testing value.)

region code for device types (hex) return fromRegion():

0 = 0,A,E,10,1E,23,25,26,2A,32,35,39 (Europe)

1 = 1,B,11,1F,27,2B,36 (Russia)

2 = 2,C,F,12,1D,22,28,2C,33,37 (US/CAN)AL_HardwareInfo::Get

3 = 3,D,13,20,24,29,2D,34,38,3A (Australia)

4 = 4-8,14-1C,2E-31 (Japan)

5 = 9 (?)

6 = 21 (?)

note, this is some sort of internal enum used for determining system capabilites along with device type and NOT the same thing as DVD region code..

more trivia:

---

AL_HardwareInfo::GetGeneration

0 = 2009

1 = 2010

2 = 2011

3 = 2012

(not exactly sure about this - but might have something to do with judging upgrade from Cardinfo.cif....)

Just trying to document some info here...

ok, so for x930bt (device type = 2c), I verified that if I change my device type to 33, my VR button & prompt now works but still doesnt recognize any voice commands - I must be missing some files since x930 never had voice capabilities.

Everything else seems to work fine.

Maybe somebody with z130bt or x920bt can give me a directory tree dump of NDATA/NDATA/VBT

2 pionara

yes, you code - is first byte in unit SN number.

stored ...im my F90 - in flash, in first KB. near BT MAC, screen calibration and other.

it used only for customise shell. no FM step or DVD region change.

nice find pionara! hope you can get it working

While poking around on CARDINFO.CIF code in HMIManager.exe, I found the enum that links the internal product/type id to the code:

X07EUR (F10BT ?)

0

X07UWR

1

X07UNC (Z110BT ?)

2

X07AUS

3

X05EUR (F310BT ?)

A

X05UNC (U310BT ?)

C

X05AUS

D

X09NJP

4

E69JPN

5

JD06JP

6

5J5JPN

7

E01JPN

8

G500SH

9

X27EUR (F920BT ?)

E

X27UNC (X920BT ?)

F

X30EUR (F20BT ?)

10

X30UWR

11

X30UNC (Z120BT ?)

12

X30AUS

13

X23UNC

1D

X02E3U

1E

X02UW3

1F

X23AUS

20

X02BR3

21

X3UN6C

22

X03E6U

23

X03AU6

24

X03EU4

25

E26JPN

14

JD15JP

15

5J08JP

16

E04JPJ

17

E8JP4N

18

X46NJP

19

X53NJP

1A

X54NJP

1B

X77NJP

1C

X71EUR (F30BT ?)

26

X71UWR

27

X71UNC (Z130BT ?)

28

X71AUS

29

X72EUR (F930BT ?)

2A

X72UWR

2B

X72UNC (X930BT ?)

2C

X72AUS

2D

X88NJP

2E

X90NJP

2F

X89NJP

30

X89MJP

31

X14EU0 (F40BT ?)

32

X14UC0 (Z140BH ?)

33

X14AU0

34

X15EU0 (F940BT ?)

35

X15UW0

36

X15UC0 (X940BT ?)

37

X15AU0

38

X15EUD

39

X15AUD

3A

For example, X930BT = 2C = "X72UNC"

(I'm not totally sure about the model number mappings above - put question mark beside it. Would be great if folks can help me confirm.)

So I'm seeing that these have to be present (but intentionally obfuscated) in CARDINFO.CIF in order for your device to recognize that there is an update ready.

I suspect there is also something else checking version in there (Like current version < new version). I think these control/version bytes are somewhere after 120h in the file. Trying to find a way to generate our own CARDINFO.CIF triggers.

WRT VR crippling, it seems to be disabled for 2C, 2A, 35, 37, & 39 model ids.

Very interested in this

This sounds very interesting. I bought an EU F930bt but I live in Australia and was hoping to "convert" it for use here in Australia. I managed to load Australian maps on it, and it works but it won't let me search for address or enter GPS coordinates because it says "not allowed for this region" as it is still configured for EU. I wonder if by changing the settings you mention above, whether that would allow me to use GPS with Australian maps..

jock, I suspect F930BT AU = NX072/AU = X72AUS or 2D

Can you verify the version info of your current system?

This can be done by going into testmode, Version Information, and all the stuff from that screen like Product Number, Navi Information, Nand Data Parts Code, etc.

But "managed to load Australian maps on it" - can you elaborate how you did that?

I followed the instructions given here by Ralpharn http://avic411.com/index.php?/topic/31561-avic-x930bt/&do=findComment&comment=244473

Essentially just replacing the map folders in NDATA with those from an AU unit. Ralpharn didn't have a copy of the entire NDATA folder from an AU unit unfortunately, so I'm not sure how much of an impact that is having on me not being able to search for address.

Here are the screenshots of testmode version information pages:

Bit hard to read,

NAND Version: PLE1-3-B

so the offset for changing model type (as described above) in AplLib.dll on 3.001 is 1ae84

You can try 2D and let us know if that works. If you have a backup and are comfortable with copying files in testmode, then it should not be a problem to try it out. There may be real hardware differences (such as FM tuner offsets, etc) that could cause certain things (like fm frequency display, menu items, etc) to appear strange.

If that doesnt work, it could also have something to do with NDATA\PARTCODE.TXT and NDATA\RELEASE.TXT not matching. (Yours are CWW3225- and PLE-1-3-B, respectively. which are for EU region/map) Somebody with 3.x AU unit should be able to provide these two files.

I'm keen to try it, still not exactly sure how to though, is there another thread which explains how to do it? I gather you are editing AplLib.dll with a hex editor? Will I need to install Condis hackmode? I should really get reading through more of these threads, but it takes forever!

Ok so from looking at the AplLib.dll that was already on my PC from my backup of NDATA, it looks like my current model code is 05:

Which seems to match up with E69JPN from your list above does that sound right?

I haven't edited anything yet or tried changing this value to 2D yet. Just thought it was interesting as I was expecting it to maybe be 2A or something...

Also, AplLib.dll is in both PRG0 and PRG1. You mentioned in the x930bt-x940bt upgrade thread that if USER\PRG.FLG is not present (which in my case, it is not), then it is using software in PRG0. Does that mean I only need to edit AplLib.dll in that folder, or both?

I just compared this to the AplLib.dll from an X930BT NDATA tree dump that someone had uploaded, and it also is 05 at 1ae84. I've got a feeling I'm not looking in the right spot or I'm doing something wrong here..

no you have to change actually two bytes. 05 isnt the model code - it's the register that your mode code is stored in, which is determined dynamically in the code by checking things (serial number? partnumbers?) stored elsewhere on the unit. There is one AplLib.dll for each APL version that works on all the models.

you change that 05 00 a0 e1 to XX 00 a0 e3.

what you are doing is overriding the detection logic (telling it exactly which model it thinks is.)

You can use regular testmode filemanager to replace the file on your unit.

I just tried it out, by changing to 2D. Here are my observations:

• Search function still doesn't work, but now it shows an option to change state (which has a list of states in Australia) which I can select my state. There is no longer a grayed out 'postcode' option, which used to be in place of the now 'state' option. But still when I press either 'street' or 'city', it reverts to the nav map screen. I think this is because I don't have a complete NDATA and USER files from an AU unit.
  
• Now, my TMC traffic tuner successfully connects to my local traffic station. Before, it wouldn't show any service providers. So this works now.
  
• I still can't enter GPS coordinates manually. It says "Coordinates prohibited or not in this map zone" just like before. Must still be something that thinks it's in EU.
  
• Turn-by-turn voice prompts no longer work. Before it was an English accented voice. This is probably because it's trying to play the Australian voice data file...which is not present.
  

So it's evident that changing to 2D has made the device think its an AU version to some degree. But because I don't have a complete copy of files from an AU unit, it still doesn't quite work. I wonder if by renaming the appropriate voice data files to the equivalent Australian version, whether that would allow me to still have voice prompts for navi. I notice in the NDATA/VBT folder, there is an 'EN' folder (english) and then inside this folder there is one folder called 'EN_GB' (great britain most likely). I wonder if my unit is now expecting to find something like 'EN_AU' by some chance.

I think you will need a complete copy of NDATA from real AU unit of same software revision (i.e, 2012 version). NDATA has the "zones", tts voices, etc for a given region.

Anything new with this?

ok, so for x930bt (device type = 2c), I verified that if I change my device type to 33, my VR button & prompt now works but still doesnt recognize any voice commands - I must be missing some files since x930 never had voice capabilities.

I have not tried it, but I'm thinking that the right devicetype for x930bt should be one of x920bt (0F hex instead of 33) in order to test VR capabilities of x930/x940.

If anyone wants to give it a go?

Anything new with this?

Several topics discussed randomly here - which one are you referring to?

 

digeimomo,

you might want to try the devicetype hack to make it look like an F920BT euro:

http://avic411.com/i...bt-and-friends/

 

You will want DeviceType 0E hex for X27EUR (F920BT)

It should then have euro language choices (including VR).

(Note that it wont change dvd region or fm tuner step. However, looking at the insides of these things along with service manual schematics, it may be possible to change regions in hardware by rearranging several resistor configuration banks).

You are so right. It seems I don't even have access to select EU languages although in update there are 21 of them, but it seems I am missing smth becaues I don't get it. What should I change and where. I would also really like to reward you somehow for your precious time.

for application version 4.010, at offset 1af94 in AplLib.dll, you can change 05 00 a0 e1 to XX 00 a0 e3 where XX is the DeviceType code you are trying to fake

for application version 4.010, at offset 1af94 in AplLib.dll, you can change 05 00 a0 e1 to XX 00 a0 e3 where XX is the DeviceType code you are trying to fake

Do you ever sleep? I'll try that later and give feedback

After some adventures meaning going through "Thereis no applicable program" I brought it to life again but still don't have EU languages. Only US English, French and Spanish. I replaced modified apllib.dll (05 00 a0 e1 to 0E 00 a0 e3 @1af94) in all PRG folders but still same three languages. Any ideas? What am I doing wrong? Or what am I not doing? Or maybe smth must be changed before updating... Stuck

25.11.2012

Finally everything works, except romanian voice but it seems that is missing some data that is perhaps on the "1 CD for additional voice data" that comes from NAVTEQ together with "1 micro SD 8GB and 1 micro SD 2GB"

I can select romanian voice only through PC app NAVGATE Feeds in "clone settings" but only beep comes out.

Does anyone have that extra CD with additional voice data?

Many thanks PIONARA!

Switched the X940 > something european. (test mode still thinks its an X940BT)

But heres a question regarding the change to AplLib.dll.

codes 2A ,35, 37, 39 do not show significant differences except for the Handbrake nag warning and I believe traffic sources.

However its the change from E1 > E3 affects the tuner, E1 seems to give better stepping, but the US freq FM range, yet E3 gives a much more UK freq range but US stepping.

Also with E1 set, you cannot search postcodes or addresses

Does anyone have any further info in these codes ?