Thats what i was workin on, until i realized that that code is probably in the flash memory on the unit, not on the HD. If anybody has a way to get into the flash, them that would help A LOT!! I tried to copy explorer.exe from my PC the the HD and rename it to NAVI.EXE or AV.EXE and see if it might run, HEHE, no luck with that. Maybe in the bootscreen there is a copy utility or something.

Looking at the "Z" manual... Page 177 looks VERY INTERESTING

Thats what i was workin on, until i realized that that code is probably in the flash memory on the unit, not on the HD. If anybody has a way to get into the flash, them that would help A LOT!! I tried to copy explorer.exe from my PC the the HD and rename it to NAVI.EXE or AV.EXE and see if it might run, HEHE, no luck with that. Maybe in the bootscreen there is a copy utility or something.

Are you talking about windows XP explorer.exe? If so, then there is no way it will work. You may want to try some of windows CE applications.

are we even sure that the cpu driving this monster is definitely a x86 type cpu? if not, we could be dissambling garbage

Big floppy you might be onto something, the only difference in parts between the Z1 and Z2 is the CC unit.

Ignoring that all the transistors for the Z2 have an A after it. I have a Z1 and Z2 I am going to try swapping the CC units.. assuming I can open this without ripping any VOID stickers...

man u ppl got balls tering units apart

looking at the schematics from the Z1/Z2 manual, it would appear that the main cpu is a PE5511A which appears to have a0-a20 and d0-d15 which woul definitely place it as an X86.. BUT could also be Apple/Motorola based scenario at which time big and little-endian scenario's start coming into play

looking at the schematics from the Z1/Z2 manual, it would appear that the main cpu is a PE5511A which appears to have a0-a20 and d0-d15 which woul definitely place it as an X86..

I don't think so... It just means that PE5511A is a microprocessor with 20 bit address bus and 16 bit data bus. I don't remember any x86 processor that had a 20 bit address bus. And it is made by Pioneer. And it's used in the DVD core unit - so it's a DVD controller/CPU, not the "system" processor we are looking for. So far I could not find it, looks like it resides on CC board for which there are no schematics provided. Not even a block diagram!

Hey... Just something interesting I saw in the service manual... Don't have the z2 yet, but trying to help out!

(Attention)

• Test mode starting procedure

ACC ON while pressing the BAND and ESC keys together.

• Test mode stopping procedure

ACC and Backup OFF.

You know somebody at Pioneer is sitting back laughing at us for going though all this work, just so we don't have to park and pushing parking brake to use a $2,000+ radio!

Guys here are ripping this thing apart and searching every corner. When some insider is thinking alll you have to do is... Its probably something real simple like all the other bypasses.

I'm being to dislike those guys at Pioneer. lol

Guys here are ripping this thing apart and searching every corner. When some insider is thinking alll you have to do is... Its probably something real simple like all the other bypasses.

 

I'm being to dislike those guys at Pioneer. lol

We have a reasonably good approach for doing it, it is just that nobody has found it yet.

A synopsys:

1. European version of Z2 is bypassable by grounding the brake

2. U.S. version is not.

The hardware is the same, and it is reasonable to believe the software is the same. Both units have the same service manual.

We are looking for a setting in the "service mode" to change the region or something similar. We might also find a setting to change something like a region in a user text file on the hard drive that will make the unit think it is the euopean model.

If you look back a few pages, there are a few users that temporarily got it to bypass when going into the service mode.

It doesn't sound very difficult to do, it is just that nobody has found the permanent fix yet.

I've been following this thread for what seems like months. Finally lost hope and bought the Z-1 since I knew it could be bypassed. However the Z-1 ended up having some issues, and the seller is offering to replace it. However, I spoke with an installer here in Houston, and he and his colleague swear that they have bypassed several Z-2's. His boss said it would cost me $50 to do it. When he left, the installer whispered to me that it was the exact same 2-wire bypass that I currently had on my Z-1. He said every Z-2 they have installed has been bypassed, and that they have not had any issues. They drove the vehicles around until they were calibrated, they drove at different speeds, etc and the bypass still worked. One of the vehicles even belonged to a realtor who has put a lot of miles on the car since the bypass, and it still works. They said they have been to this website and don't understand what the big deal is.... They swear the 2-wire bypass works on the Z-2. Any thoughts on this?

well I took the CC unit out of the Z1 and put it in the Z2 and I cant even get the screen to come on. So I put it back in the Z1 and the screen wont come on now for that!!

So I put the Z2 cc unit back in the Z2 and the screen wont come on that! So now I have a dead Z1 and Z2. HELP!

BTW I am electronic savy and checked all of the connections. I checked the seating of the CC units (It's the processor it seems) and everything is good... I am really lost now

nevermind I put it completely back together and it turned on. I think it was because I did not have the hard drive cover on the unit.... I am going to try swapping the CC units again..

Hey Rander1

As you've got your CC unit out, what if you can see it is the cpu identifier?

They said they have been to this website and don't understand what the big deal is.... They swear the 2-wire bypass works on the Z-2. Any thoughts on this?

My thought: they're lying.

They said they have been to this website and don't understand what the big deal is.... They swear the 2-wire bypass works on the Z-2. Any thoughts on this?

My thought: they're lying.

Or they have a Z1 image and are loading the hard drive with a Z1 image and bypassing it that way. I don't think most people would be able to notice the difference in the software, it doesn't say Z1 in the software anywhere.

Well swaping the control units was unsuccessful. In fact if you take a hard drive out of the Z1 and place it in a Z2 it says the HD is un-usable. If you take the Z2 drive and put it in a Z1 it says it's unusable.

Also if you take the control unit out of a Z1 and install it in the Z2 and use the Z2 drive is not usable. If you use a Z1 drive and Z1 control unit in a Z2 case it works fine, bypassable and all.

Basically, all of the software is contained between the Control Unit and the Hard Drive. You cannot mix and match them. They must be together.

The reason I got a Z2 is because my backup camera signal was scrambled on my Z1 so crutchfield sent me a replacement Z2. I still have to send back my old Z1.

However, when I put the Z1 control unit and Z1 drive in the Z2 the backup camera signal was still scrambled which tells me the tuning for all video channels are done on the control unit.

Or they have a Z1 image and are loading the hard drive with a Z1 image and bypassing it that way. I don't think most people would be able to notice the difference in the software, it doesn't say Z1 in the software anywhere.

In fact if you take a hard drive out of the Z1 and place it in a Z2 it says the HD is un-usable. If you take the Z2 drive and put it in a Z1 it says it's unusable.

That's not true, a few of us have been using both Z1 and Z2 images on our Z1 and Z2 units.... but they've been unlocked and prevented from relocking. Perhaps they don't accept locked drives from the other units, I'd buy that.

That's not true, a few of us have been using both Z1 and Z2 images on our Z1 and Z2 units.... but they've been unlocked and prevented from relocking. Perhaps they don't accept locked drives from the other units, I'd buy that.

It is true because I did it. And it may be the fact that the drive is locked, but without hacking and unlocking the drive just a simple remove and replace it will not read the drive.

I have all of my music on my Z1 drive and do not care about the backup camera that much to lose the bypassability of it. I am just going to put up with it...

So right now I am running a Z2 case with Z1 control unit and Z1 drive.

All,

I work with a group of talented GPS software engineers that would be able to manipulate the AVIC’s code in order to bypass Pioneer’s overly cautious restrictions. The key to the problem seems to be gathering the raw data (ASCII/Binary) and converting it into C or C+. Two software engineers at my current place of employment used to work for Alpine. They have confirmed that the code is definitely stored on the flash memory. The hard drive simply holds the software database. Please let me know if you guys have any suggestions.

Please let me know if you guys have any suggestions.

It is true because I did it. And it may be the fact that the drive is locked, but without hacking and unlocking the drive just a simple remove and replace it will not read the drive.

Yeah, that sounds right, I'd even believe that remove and replace drives from a like-model might not work.

I’m sure that they’d figure it out if given enough time. Unfortunately (for all of us), there is really no incentive for them to dedicate that much time towards finding a solution =/

Unfortunately (for all of us), there is really no incentive for them to dedicate that much time towards finding a solution =/

Is cash enough of an incentive?

Let me be the first to offer a bounty of $100 for a working bypass for the Z2 that is as easy or easier to implement than what is available for the Z1. The bounty is payable via my PayPal account. I would encourage everyone else to pledge whatever they can. A working bypass is the only thing stopping me purchasing a Z2 right now.