FYI to added onto ducattiboy.

The unit actually reads the internal gyroscope and the GPS antenna. Any speed in excess of 5 MPH causes a lock out. With the parking brake always grounded it will allow you to return to watching video on the screen itself once the vehicle has slowed below 5 MPH for approximately 3-5 seconds. The moment your MPH is increased above 5 MPH it goes ahead and locks you out once again.

But just like everyone else has said there DEFINATELY IS a procedure for bypassing this. It's only a matter of time. If anyone whose been wanting a Z2 but doesnt have one yet, contact us we will offer an excellent deal AT OUR COST for a unit this way it can be tested and the problem solved.

Yah, 5mph, 15mph, I knew it was something slow. But you could move, but not very fast. I couldn't remember how fast you could go.

So if I decided to upgrade my Z1 with a Z2 upgrade CD, all I would need to do is cut the first mod wire, and leave the parking brake bypass wire connected to ground.

And then when I wanted to program a Nav setting, would need to slow down to <5MPH? Is that correct?

apparently this ebay person says he has the hack for 10 bucks a pop.

Not going to buy it because I do not have my z2 yet

but for those who are interested, here's the link

http://cgi.ebay.com/AVIC-Z2-Video-Locko ... dZViewItem

i think this is just reverse cam trick there is nothing about navi in that auction

I don't have a bypass but perhaps a clue. After installing the unit as if it were a later gen Z1 I went for a test drive. It was playing video at speeds well above 15 mph for about 4 minutes with access to all menus in the unit. I was switching between map view and DVD to see that both were working, with the DVD being fine and the MAP arrow not tracking and still showing the factory default LA area. Like I said the DVD lasted about 4 minutes, what I noticed is that after the Nav initialized and locked on to my area and arrow tracking I lost DVD. I don't think that Pioneer would make it so the GPS antenna has anything to do with it. I'm throwing that theroy that someone mentioned out the window. I'm leaning on the idea of the speed sense wire. I also completely disassembled the unit, removing all PC boards from the chassis in hopes of finding a switch similar to that of the N3's with no success. Well at least the unit still works after that mission.

according to this ebay auction the avic-z2 bypass has been figured out!?

 

http://cgi.ebay.com/AVIC-Z2-Video-Lockout-Bypass_W0QQitemZ150111201309QQihZ005QQcategoryZ47103QQssPageNameZWDVWQQrdZ1QQcmdZViewItem

 

anyone know if this is true?

Maybe we should just all chip in and have someone try it. Ok, everybody pony up .05!

On a side note: 5 people have already bought it, maybe we could contact one of them.

Another note, this guy also sells Z1 bypasses ($1.99). Sounds like it's just the "Flash your headlights" method: "It did work but has to be done every time u start the vehicle" (feedback)

From the feedback coming in, this really doesn't look good.

In fact, it looks like The Z2 doing things based on almsot everything it can use.

tunez, why do you think it was the vss signal? The vss signal is an input from the car, it doesn't take four minutes to initialize that signal. It looks like it locked the video out when GPS started calculating positions.

GPS, on the other hand can easily take four minutes if it is doing a "cold start" when it has no time, no last known location, no ephemeris, no almanac data from the satellites. It has to search all of the prn codes, and it has to search all of the doppler bins, and frequency bins (because the local oscillator drifts). Then it has to download ephemeris at least, that takes 30 seconds from time of satellite acquistion into PLL (you can't decode data in frequency lock mode). You have to get a z-count for all of the satellites to be able to resolve bit transition time, then you have to validate your pseudo ranges as you converge on a solution and they all have a bias of up to 10ms on them.

It very much looks like it is doing it based on the GPS signal. What is interesting about tunez' experience is that it didn't use the gyros as movement indicators while it hadn't yet produced a position fix. That is an important detail. It tells me that the Nav unit might not have direct access to the gyroscope output. A lot of times the GPS is stand alone, and it feeds an NMEA stream, or equivalent, to the Navigation software. If the GPS unit doesn't have at least 3 satellites with good geometry (a low PDOP value) to do a 2D fix, it won't give indications to the Navigation software based on gyro signals. In addition, it will take another 12 minutes to download the almanac because those are only come on data subframes four and five. At that point, the GPS unit is fully initialized.

It looks to me like this may require a software hack of some sort in addition to using a pull-up resistor or something like it for the brake signal.

In the history of these mods/hacks, has anyone ever done a software modification to the unit??

I don't think that Pioneer would make it so the GPS antenna has anything to do with it. I'm throwing that theroy that someone mentioned out the window.

tunez, why do you think that? You need to give some supporting argument for your reason to give it credibility. I'm curious why you think what you do? Above, I mentioned the reasons why I think you should reconsider. Why not try your same experiment with the antenna not connected and see what happens.

Why not try your same experiment with the antenna not connected and see what happens.

When I get my Z2 next week I'm going to try just that, ground the parking brake and just connect the necessary connections for dvd and audio.

I'll worry about navigation and other features after experimenting the test above.

I have something I want to verify.

 

I don't know if this works, I don't have a Z2 at my disposal at this moment to try it, but I'm asking people to see if they could test something for me.

 

I haven't tried this but I just got this message. It's from a friend of a friend of a friend, who is an insider at Pioneer. Long story but I have gotten some good stuff from him in the past. Anyway, I have been poking him for bypass information and he just sent me:

 

ground the empty pin in the RCA harness (connector 1) and the parking brake

 

I don't even know if there is an empty slot on connector 1. If so, then measure the voltage on that pin inside there when it's powered on, if it's 5V, sounds like it's worth a try.

I'm no expert by any means. But, just a thought, I know that the connector 1 is not empty and the wire that is there is a mute wire. Has anybody tired to ground the mute wire? I believe that the way the D3 is bypassed.

I have something I want to verify.

 

I don't know if this works, I don't have a Z2 at my disposal at this moment to try it, but I'm asking people to see if they could test something for me.

 

I haven't tried this but I just got this message. It's from a friend of a friend of a friend, who is an insider at Pioneer. Long story but I have gotten some good stuff from him in the past. Anyway, I have been poking him for bypass information and he just sent me:

 

ground the empty pin in the RCA harness (connector 1) and the parking brake

 

I don't even know if there is an empty slot on connector 1. If so, then measure the voltage on that pin inside there when it's powered on, if it's 5V, sounds like it's worth a try.

I'm no expert by any means. But, just a thought, I know that the connector 1 is not empty and the wire that is there is a mute wire. Has anybody tired to ground the mute wire? I believe that the way the D3 is bypassed.

it is empty and it has been tried. that is the z1 bypass.

I don't think that it is the GPS antenna because if it were that would make the Z2 unbypassable because you can't interrupt it, shy of disconnecting the antenna. This is the same unit being shipped all over the world, to places where watching video while driving is not illegal, are they supposed to have the unit hanging out so they can disconnect and reconnect the antenna? That alone tells me it can't be the antenna. I think that our fix may be going back to the N1 where we completed a circut by solidering on the bottom. There are two solider joints that are labled but for the life of me can't remember if they're labled the same as the N1 and for fear of frying one of these I'm reluctant to try it. I'm on the fence about it being a software bypass. That would be a simple fix if you were able to get your hands on some sort of upgrade disk but I don't see that hapening. The bypass has to be something that virtually any shop can do. We don't want to leave any topic unadressed but at the same time I think that we may be reading too deep into this. Its got to be almost a duh answer.

it is empty and it has been tried. that is the z1 bypass.

I'm confused. There is a couple posts on page 3 that said the #1 slot is not empty.

I don't think that it is the GPS antenna because if it were that would make the Z2 unbypassable because you can't interrupt it, shy of disconnecting the antenna. This is the same unit being shipped all over the world, to places where watching video while driving is not illegal, are they supposed to have the unit hanging out so they can disconnect and reconnect the antenna? That alone tells me it can't be the antenna. I think that our fix may be going back to the N1 where we completed a circut by solidering on the bottom. There are two solider joints that are labled but for the life of me can't remember if they're labled the same as the N1 and for fear of frying one of these I'm reluctant to try it. I'm on the fence about it being a software bypass. That would be a simple fix if you were able to get your hands on some sort of upgrade disk but I don't see that hapening. The bypass has to be something that virtually any shop can do. We don't want to leave any topic unadressed but at the same time I think that we may be reading too deep into this. Its got to be almost a duh answer.

I'm quite certain that the GPS antenna plays a part in it. You used to be able to bypass other units temporarily by disrupting the GPS signal. That is until the internal gyros figured out the unit was moving. The antenna plays a role in it.

Its definately a software issue. When the update disc came out for the Z1, it changed the bypass on the Z1 from the light flashing method to grounding two wires. All the upgrade was was a CD, I'm pretty sure it didn't start changing any hardware Its also been said that if you upgrade a Z1 to a Z2 using the new upgrade disc, it'll disable your bypass. The bypass is written into the Z1/2s software.

I don't know if it is connector 1 or 2. where the cell phone mute wire is now there are no empty pins on that connector, if you ground that wire where it is at you will mute the sound. on the other connector there are 4 empty pins just like the z1 and grounding any of them has no effect.

I don't think that it is the GPS antenna because if it were that would make the Z2 unbypassable because you can't interrupt it, shy of disconnecting the antenna.

That sounds like a someone going to the doctor and saying, "I don't think I have brain cancer, because that would be really hard to treat."

This is the same unit being shipped all over the world, to places where watching video while driving is not illegal, are they supposed to have the unit hanging out so they can disconnect and reconnect the antenna? That alone tells me it can't be the antenna.

That is why software is such a great thing. You can produce the exact same hardware without any retooling of the production lines, and then load in different software depending on its shipping destination.

Right now, the evidence you presented suggests that the hack requires some software modification. It is far easier to engange and disengage the parking brake to see what happens then it is to assume it is the parking brake and then try pull-up resistors on that wire. That is why I have been asking these questions.

You can resolve this issue very easily by trying your experiment again with the gps antenna either disconnected, or covered with tin foil or some sort of metal enclosure. You can also try and disconnect the vss wire and see what happens with that. However, it is best to try only one thing at a time as this allows for better isolation of the solution.

It still stands that the vss wire does not take 4 minutes to initialize. It works the moment the car moves. GPS can easily take 4 minutes to do a cold start, which is what you described (It was set to the factory default location in L.A.). How do you resolve that from the tests you made and come to the conclusion that it is the vss signal?

If you left your GPS running longer than 12 minutes, and you left it off for less than two hours (so the ephemeris didn't expire, ephemeris gives a curve fit for location in space of the satellite given UTC time), it can do a warm start and come up much quicker. If you want to try that scenario, that would be useful too. Under those circumstances, are you able to watch the DVD for up to four minutes while driving slowly? Why not try some of those things and let us know what you find out?

Just came back from another test drive. The results are as follows, tried disconnected either the VSS and GPS antenna at different times. Left with the GPS antenna disconnected - speed sense connected and had video all the time, pluged it back in and it kills the video shortly thereafter. Tried it the other way around and it just didn't work. It will also lock out with no GPS antenna connected, by connecting and disconnecting the VSS. Not too sure what to make of this. My head hurts, is it 4:20 yet?

according to this ebay auction the avic-z2 bypass has been figured out!?

 

http://cgi.ebay.com/AVIC-Z2-Video-Lockout-Bypass_W0QQitemZ150111201309QQihZ005QQcategoryZ47103QQssPageNameZWDVWQQrdZ1QQcmdZViewItem

 

anyone know if this is true?

Maybe we should just all chip in and have someone try it. Ok, everybody pony up .05!

 

On a side note: 5 people have already bought it, maybe we could contact one of them.

 

Another note, this guy also sells Z1 bypasses ($1.99). Sounds like it's just the "Flash your headlights" method: "It did work but has to be done every time u start the vehicle" (feedback)

this is just the cut the gps antenna wire and install a switch method.

When the update disc came out for the Z1, it changed the bypass on the Z1 from the light flashing method to grounding two wires. All the upgrade was was a CD, I'm pretty sure it didn't start changing any hardware Its also been said that if you upgrade a Z1 to a Z2 using the new upgrade disc, it'll disable your bypass. The bypass is written into the Z1/2s software.

Knowing some of the history of other modifications this is great. Do we have a list of what they all were? Is it possible that it could just be a combination of other things?

For instance, if you have two wires that were grounded, there are three other combinations.

ground, ground

ground, pull-up

pull-up, ground

pull-up, pull-up

Are there any other wires that could be tried?

The VSS wire on the pioneer Avic Units is primarily used for "Vehicle Dynamics" and then for more precise speed calculations when calculating distance. The unit may also utilize VSS in times where there aren't sufficient satellite coverage.

So, the 'solution' has nothing to do with VSS wire. Nor does discounting the GPS antenna offer a solution or a bypass. It's more like 'ghetto engineering'......

It will be an issue of varying voltage and or pulsing a wire on the unit more than likely during boot up, itself. The Unit itself does not have any connections to simply jumper out. So yes, like the engineer type person said, The lockout is PURELY a software driven feature, very similiar to how they did the Z1.

Just trying to answer alot of the 'myths' and 'guesses' going on hoping to focus attention more so. Sorry can't be of more help!

So, the 'solution' has nothing to do with VSS wire. Nor does discounting the GPS antenna offer a solution or a bypass. It's more like 'ghetto engineering'......

Sorry to give the impression that disconnecting the antenna was a solution. I was asking people to disconnect the antenna, and the brake wire, and the vss wire to find out what happens, to see how the Z2 reacts. I wanted to see what happened when they did those things. By how the unit reacted when the antenna was disconnected showed that it was a software issue.

Because it is a software issue, the hack will only work when a certain condition is met at a certain time that opens a pre-programmed back door that unlocks the unit during motion.

This back door could be grounding pins, or using pull-up resistors. It might be sending a pulse on a wire. It could even be modulating the dimmer controls three times in a row during the boot sequence. The point is that it is whatever the navigation software is programmed to look at.

One thing is constant though, there are a limited number of inputs going into the unit. Those inputs are wires like the brake signal, or the vss signal. Other inputs could be pressing a sequence with the touch screen. So far, it appears that all of the historical hacks have not come from pressing the screen, that leaves hard inputs on the back of the unit. Someone mentioned a previous hack was grounding two lines. If there are only two lines, then there are four possibilities if you are looking at a binary system. If it is going to be a pulse train, then it will probably be too hard to guess what it is. Be mindful that looking at a pulse train on a port pin is a lot more work for the software to recognize. A back door is more likely to not be too difficult to open because the programmers didn't have a lot of time to spend implementing it.

So, the question for those that have one of these units is, "how many inputs can one modulate a signal on?" Is it just two lines, or are there more?

The results are as follows, tried disconnected either the VSS and GPS antenna at different times. Left with the GPS antenna disconnected - speed sense connected and had video all the time, pluged it back in and it kills the video shortly thereafter. Tried it the other way around and it just didn't work. It will also lock out with no GPS antenna connected, by connecting and disconnecting the VSS. Not too sure what to make of this.

Thanks for trying that stuff, the behavior is useful to know. Looks like it is definetly a software issue. We just have to figure out, or wait for the leak, as to what hoops to go through to get the software to unlock the system when in motiion.

according to this ebay auction the avic-z2 bypass has been figured out!?

 

http://cgi.ebay.com/AVIC-Z2-Video-Lockout-...

 

anyone know if this is true?

 

Most likely it's just a switch to disconnect the nav antenna and VSS wire and ground the parking brake. Anything else, I would believe it when I see it.

Paid the 10 bucks, yes nav antenna switch.

according to this ebay auction the avic-z2 bypass has been figured out!?

 

http://cgi.ebay.com/AVIC-Z2-Video-Lockout-...

 

anyone know if this is true?

 

Most likely it's just a switch to disconnect the nav antenna and VSS wire and ground the parking brake. Anything else, I would believe it when I see it.

 

Paid the 10 bucks, yes nav antenna switch.

Yea thats what we figured.

It also explains why when I emailed him to confirm it was a real bypass and not something that you hurt my navi accuracy like a switch on the antenna he never wrote back.