YzRacer, did you try replacing the HMIManager dll along with the HMIManager exe, the dlls from z1 to z2 although the same size appear to be different. They may need to be matched?
Yes, I replaced all the associated files and no help. I can replace just about any file or files and it will work, but whenever the HMIManager.exe is involved, you get constant reboots.
I read a little on this model, seems like the one we are looking for :
http://www.pioneer.eu/eur/products/10/2 ... index.html
However it shows that bluetooth comes standard with this unit, but since bluetooth is much more common in Europe I suspect they just included the adapter in the box. I emailed a shop in London for a price quote, but I am sure it won't be cheap. Maybe I could just go to europe, purchase one, unlock the HDD and make an image, then return the unit to the store and fly home? Truthfully I think a round trip ticket and one night hotel stay would be cheaper than buying the unit lol.
I emailed a shop in London for a price quote, but I am sure it won't be cheap. Maybe I could just go to europe, purchase one, unlock the HDD and make an image, then return the unit to the store and fly home? Truthfully I think a round trip ticket and one night hotel stay would be cheaper than buying the unit lol.
London is the last place you want to try to buy one. The dollar is at a 26 year low against the pound, and the exchange rate was over $2 per pound. In addition, their sales tax (VAT) is something like 17.5% right now. They don't believe in taxation without representation. I think you might do better against the Euro.
If you bought one in Europe, they might be looking to see if those warranty void seals have been broken when you returned it. It is an expensive gamble.
If the cost of the Eurpean Z2 minus the cost of the domestic Z2 is less than the cost of a plane flight and hotel, then it is cheaper to just spend a little more and buy the european Z2. Just make sure you put domestic maps on it.
I agree with everything that 8AxleEd said. Decompiling and recompiling is a pain in the major ass. This is like hacking a satelite card. You really don't know the processor and it's built in codes so getting something to work that way is the wrong appoach.
Even the guys that are swapping out files like the HMIManager.exe and dll are having problems because the HMIManager.exe uses more than just that dll. It probably calls to another exe which calls another set of dlls etc. It is a daisy chain affect. Having some code writing experience would help you guys a long ways.
I was looking into ways that windows automotive uses a registry and the name of the registry repository. I think that if we can find that, we will be closer to a solution.
I think that the registry is getting updated based off of some initialization file on the hdd upon boot. Which is why you see that "Updating file 1 of 1' message.
Basically, you aren't setup to do any changing of the code.
Right now, it looks like the easiest way to bypassthe Z2 to try to get the european version.
I disagree, at least two of us are using the tools used to decompile, recompile, and patch executables and DLLs.
And the european version is probably quite different, which you should've mentioned in your rant about GPS memory address references, since the whole GPS system is different over there. Looking at the file structure differences would probably give us some interesting information, but as-is, i think we're going down a pretty good path. You willing to help?
I disagree, at least two of us are using the tools used to decompile, recompile, and patch executables and DLLs.
Okay, great. Why not let them address the issues I posted and see if they can offer a satisfactory answer as to what they are doing. If you happen to be one of them, then your opinion has far more weight if you can address those issues.
And the european version is probably quite different, which you should've mentioned in your rant about GPS memory address references, since the whole GPS system is different over there.
You don't seem to know what you are talking about. GPS stands for *GLOBAL* Positioning system. There are 24 positioning satellites on six orbital planes that circle the earth every 12 hours. The orbital planes are inclined about 55 degrees from the equator and don't go over the poles. There are a handful of WAAS (Wide Area Augmentation Satellites) that provide atmospheric corrections to the positioning satellites. It works all over the world. The european system, Galileo is not in operation (it has 1 satellite that isn't broadcasting the final pseudo random code), and is in beurocratic trouble right now. The Russian System, Glonass has been around for a long time, and it works all over the world, even here. They uses frequency division instead of code divisiion and their orbital curve fits aren't as accurate (because their inertial guidance systems aren't as good), but it is free. The Chinese satellite system is just *barely* operational, and it only works in China (currently) with three satellites in orbit, although not all of them are being used.
As for what you call a "rant about GPS memory address references", I was very specific about how to find a solution. It doesn't sound like you understood what I wrote, because I didn't mention a GPS memory address. If you can address those specific issues I brought up, then your opinion will carry more weight.
Looking at the file structure differences would probably give us some interesting information, but as-is, i think we're going down a pretty good path. You willing to help?
It is far more adventageous to learn as much about the system before you try to find your bypass than it is to start groping around to find a solution.
I do not have an AVIC-Z2 in my posession to work with. This is mainly because I purchase a double-din face plate for my 2006 Volvo V70. Scosche said they might start shipping them some time in June.
I can, however, at least try to direct you all towards the right direction.
well i am the guy on ebay, kb5ysc yea the one who posted on here and my post was killed. well lets see yes i am using the 3 switches, i had it installed for almost 1 month. no problems
here some of the messages i got from the users of avic411
it is going to crash after 3500 miles, well 6000 miles so far. still works.
will have to reset uint everyday. nope not yet. still working
look i would love to have a mod that lets me drive and watch video and nav at the same time, but so far no go.
but for now the 3 switches works, hack mod works. but if someone will come out with a better mod, i take my hat off to you. I used to be a computer programer a long time ago, and I think the rewriting the code might be the best way. good luck, i have not pulled the HDD yet, You guys keep working on it.
oh yea my newest mod is how to backup a new 07 dodge with the door open and the horn starts blowing. stupied dodge, put a cable crimp on the seat belt wire, now i can backup with door open, and no horn going off.
well i am the guy on ebay.....
which raises the question. What about those guys on ebay? Goto ebay and search using "Z2 Bypass" and you will find at least 3 guys selling an unlock scheme. has any one tried any of these?
D
i am one of the guys selling the mod on ebay. i had 19 people buy it, no complants...
well i am the guy on ebay, kb5ysc yea the one who posted on here and my post was killed. well lets see yes i am using the 3 switches, i had it installed for almost 1 month. no problems
I don't think it was killed. It was just edited. And it's not a bypass, it's just a hack to make the unit think it's stationary.
And I have seen those fail within a couple miles to a couple hundred. I have never seen those actually function correctly for very long. Not on the Z1 or the Z2.
And it depends on how much you use it or don't. If you have it flipped on and use the video in motion all the time and never use the nav, it will work MUCH longer. Why some fail real quick and some last longer, I don't know why. I think it has something to do with the calibration of the system.
I wish I could pin down why those are unreliable, but I haven't figured it out. But I have not seen any of those last. I'm glad you have someone which has had luck with it.
Okay, great. Why not let them address the issues I posted and see if they can offer a satisfactory answer as to what they are doing. If you happen to be one of them, then your opinion has far more weight if you can address those issues.
I AM one of them... what is my opinion and why do I need to weigh it against anybody else's?
You don't seem to know what you are talking about. GPS stands for *GLOBAL* Positioning system.
Just because it uses the word "global" doesn't mean it works the same anywhere on the globe, it just means it's used to find your relative position ON the globe. If I walk from point A to point B, I've just become a global traveler, even if they're 20 feet apart.
As for what you call a "rant about GPS memory address references", I was very specific about how to find a solution. It doesn't sound like you understood what I wrote, because I didn't mention a GPS memory address. If you can address those specific issues I brought up, then your opinion will carry more weight.
I was referring to this:
The GPS is most likely an NMEA stream on a serial port. What address is that port? Is it on the chip, or is it on an external chip? What is the chip select for it? What is the address range for the memory? How do you set those chip selects? How do you access the hard drive, or the file system? What variant of the intel processor is there? What ports does it have built in? Are there any differences in instruction set?
All valid questions, but not ones that we require answers to for this project, but again, if i'm working on it and you're not, my "opinion" automatically carries more "weight".
I can, however, at least try to direct you all towards the right direction.
And what's that? What steps would you take if you had one in front of you that you can't do right now? I'm open to suggestions, and if there's something you'd like me to try, feel free to say it.
Okay, great. Why not let them address the issues I posted and see if they can offer a satisfactory answer as to what they are doing. If you happen to be one of them, then your opinion has far more weight if you can address those issues.I AM one of them... what is my opinion and why do I need to weigh it against anybody else's?
If you have a good idea, then it should stand on its own merits with full disclosure and complete transparency. If you can address the problems I mentioned with regard to recompiling, then you might be capable of changing the software. If you can't, or don't understand what I was talking about, then you will not succeed. So far, I haven't seen you give any reasons for your objections, I have only read the objections. That doesn't carry much weight.
Just because it uses the word "global" doesn't mean it works the same anywhere on the globe, it just means it's used to find your relative position ON the globe. If I walk from point A to point B, I've just become a global traveler, even if they're 20 feet apart.
You really don't know what you are talking about. Don't look at just one word. Look at the entire acronym. What part of "*Global* *Positioning* *System*" don't you understand? It gives you positions globally. GPS does not natively calculate positions from some other relative position. Where would it start? What do you do before you travlled the 20 feet? According to you, it won't give you a position because you haven't moved. Who would buy a product like that?? GPS takes range measurements from satellites in space that are three earth radius high in space, the distance is between 67 to 87 milliseconds in time. Based on these range measurements, it triangulates a position in ECEF coordinates (Earth Centered Earth Fixed), it then translates that into Latitude, Longitude, and Altitude coordinates in radians, then it converts those units to degrees. A relative coordinate system, that used by surveyors, called East North Up puts an imaginary tangental plane on the earth. That sort of coordinate system breaks down when a great circle distance starts to diverge from the coordinate plane.
Why are you arguing this with me? Why do you think you know how GPS works? I do know how it works, and it is very clear to me that you have no understanding of how it works. Are you trying to push my buttons or something??
I was referring to this:
The GPS is most likely an NMEA stream on a serial port. What address is that port? Is it on the chip, or is it on an external chip? What is the chip select for it? What is the address range for the memory? How do you set those chip selects? How do you access the hard drive, or the file system? What variant of the intel processor is there? What ports does it have built in? Are there any differences in instruction set?
Yes, I knew what you were referring to. However, if you read it more carefully, I was referring to the address of a serial port, not the address of a GPS system. The GPS system will not be on the same address and data bus as the rest of the system.
All valid questions, but not ones that we require answers to for this project, but again, if i'm working on it and you're not, my "opinion" automatically carries more "weight".
Sophistry. Does the opinion of the coach of a team in sports have less weight than the player? The players are on the field, the coach isn't playing - yet his opinion is valued. The opinion that matters is the one that stands on its own merit. As it turns out, I know a lot more about GPS than you ever will. It appears that you don't understand why you need to know more about the system before you can recompile your code in the manner being tried. I'm not telling you that you can't try to dissassemble the code and recompile it. I'm saying that there are easier things to try first. I'm saying that if you must try that route after the other routes have come to dead ends, that you need to do more investigation before you can start recompiling the code. I even outlined the safest way to hack this code with a hex editor because it avoids the need to tell the linker where all of the static variables are and it avoids the need to tell the linker something about the memory map of the system. Do you know what .dlls you need to link against? You need to tell that to the linker too. Do you understand?
And what's that? What steps would you take if you had one in front of you that you can't do right now? I'm open to suggestions, and if there's something you'd like me to try, feel free to say it.
Just read this thread, I've outlined a few things to try first. I don't need to repackage it for you. I don't think you are too lazy to look back.
First if I want to listen to this I can just go to a meeting at work. Second, Hyperite you’re a perfect example of the old adage, “ Remain silent and be thought of as ignorant least you speak and prove itâ€. Third, 8AxleEd you have proven you have experience and education, you really don’t need to keep expanding on it. It really doesn’t matter which one of you have the PHD, what matters is getting the bypass. Now since I have been doing hardware and software for more years than I like to remember, 8AxleEd is correct. Unless you’re a Pioneer programmer with all their SW tools, since I doubt they write their code in C++ for IA32®, you will have almost no shot at recompiling working code. The HEX option is the best and easiest. But even this counts on the Pioneer SW Engineers being too lazy to change the augment names between Z1, Z2, or the European versions of SW. If by chance they were that kind, then you should be able to find match the augment names. Then try replacing the HEX values. Of course you are still banking on them not changing what the value means. But if your lucky and the object is only 8 bits wide, you only need to try it for 0x00 through 0xFF. If it’s 16 bits like everything else now you have 0x0000 through 0xFFFF, to make it easy for you that’s 65535 combinations. So unless the Pioneer SW engineers didn’t get the “make it hard to bypass†memo, you’re a crack code reverse engineering professional, just get lucky, they way your going about it most likely not prove fruitful. I’m not suggesting stop trying, there are just too many If, Then, Else, statements to be hopeful. Maybe like one entry in one of these threads had it, Pioneer made the Z2 un-by-passable. Which means my wife gets the new Z2 and I’ll live with the Z1 as is or SW updated if it doesn’t mess up the current bypass.
Ok, then you've proved you know what to do and I don't, so...do it? I guess I'll stop working on it and wait for you to post the solution, since i now see that i'm wasting my time.
i agree if this guy knows so much why dont he figure it out all we are trying to do is put our heads together to try to figure this thing out so if your going to be negetive stay out PLEASE!!!!!!!!!!
i agree if this guy knows so much why dont he figure it out all we are trying to do is put our heads together to try to figure this thing out so if your going to be negetive stay out PLEASE!!!!!!!!!!
You two are both taking what 8AxleEd said waaaaaaay too personally. Obviously hes got quite a bit of knowledge on the subject. Yes he came across kind of abrasive and a little "holier than thou," but he is giving his experience and knowledge and helping by turning you away from avenues that will lead nowhere. Or, that will lead to more headaches that are not needed.
I will say that between you guys bickering at each other it looks more like a "whos cock is bigger" contest, or in this case "whos brain is bigger," and less like people working together towards a common goal.
After spending over 20 cumulative hours installing my AVIC-Z2 in my 04 Escalade, the most anti-climatic event was finding that the Z2 doesn't have a bypass (yet). Reading through this site and and scattering of other sites, it feels like something that will just take time to figure out. Hopefully, it won't be the end of the line for bypasses...
So, in lieu of a solution surfacing and allowing the real technical guru's (or those with extraordinary amounts of time available to decompile / reverse engineer the entire system, I offer some detective work...
Being new to all this, I wanted to understand some basics from anyone who would know better. Here are a few questions:
1. Why do previous generation units have a bypass capability? For example, is bypass intended for demonstration, testing, non-automotive use, or foreign / legal use flexibility. Understanding this I believe will at least help determine IF and HOW a bypass exists in the Z2.
2. Has Pioneer ever officially communicated through dealer and/or consumer channels that a bypass exists? Curious to see if such a communication existed, there would likely be a stated purpose.
3. Does Pioneer do all of it's warranty work in-house or do they outsource? If so, to who? If they outsource any repair work there's more opportunity for information leaks, schematics, publications, etc..
4. If there's strong belief it is software, and there is a legitimate internal need for bypass recognized by Pioneer (per question 1), then there must be a mechanism to enable the bypass. Somewhere I read (forget - too much reading) that the Z2 still accepts a single toggle of illumination lead during initial boot to disable - is this true still? (have not tested it myself, yet). Also, if Pioneer truly went the route of software - most systems I know have diagnostic / low level configuration screens built in and accessible by some combination of events (i.e. holding X down while booting, easter egg on menu's, etc..). Has anyone seen a Pioneer with the equivalent of a BIOS changes screen? Per question 3 above, that would clearly be a part of their arsenal of diagnostics. Somewhere in there maybe is the new soft switch for bypass...
5. For those who have pulled and viewed the contents of the files in the flash memory / HDD, any text found of interest (not internal object information, text for output) that does not match with known text? For example "advanced settings" or "bench" etc..
For kicks I have called their installation support line trying to squeak some hints out of them - cold fish. My last call I explained how this is in rear of RV etc etc... Semi-Programmed response: lawsuits. Please protect me from myself.
Oh well, just another anxious Z2 owner looking to get the shackles off...
Cheers,
Atreides
what is the # to the install support line
800-421-1404
Bunch of prompts to get to the Navigation support unit... Pretty much they are programmed to be absolutely mumm on anything bypass related. It was kind of funny actually, cause at one point he was like "Bypass? There are no such things." lol..
Cheers,
Atreides
After much searching I am still not able to find a AVIC-Z2 service manual... (anyone know where one can be found?). I did get my hands on a AVIC-N3 service manual though - need some coffee now having skimmed through all 350 pages. The N3 does have test and technician screens available - so the Z2 MUST I have no doubt. Some functionality includes flashing RAM, wiping drives, calibrating DVD etc etc etc.. Some minor information on EPROM edits, but it seemed only in relation to LCD config. Unfortunately, i've seen nothing in there in my quick glance that speaks to "bypass" or similar language.
Ever diligent...
Atreides
hey guys, if any of you can try this to see if I'm not crazy. One of my installers here called me and said that they GROUNDED the illumination wire and the unit is working in the bypass mode.. I have not seen this or can confirm, but was wondering if one of you can try this.. thanks and take care..
Hyperite, brandon is right about my motivation. I'm not trying to offend you, I was trying to prevent going down a dead end. We don't have infinite resources on this forum, and we can reach our goal more quickly if we avoid dead ends.
I do not have a Z2 in my posession because there is no face plate yet available for my 2006 Volvo v70. It should be available in another month or so.
I was not trying to be too pretentious, or "holier than thou" as Brandon put it. If I came across that way, I am sorry. Actually, I was trying to be more of the opposite. I don't care for it when people feel a need to post their credentials to prove that they are an authority. I figured it would be better to demonstrate that I knew what I was talking about. In my situation, maybe it is better that I do tell you what my experinece is, because it could be helpful to the group. I work for a GPS company. I have ten years experience specifically designing GPS receivers as embedded systems. Before that, I was an engineer at Apple, I worked on the OS for the first PowerPC Mac. My experience could be helpful, and I was trying to direct everyone towards a more fruitful path. I'm sorry if I ruffled anyone's feathers.
I think we are getting some good ideas now.
rjedlich, I think your point #5 is what we havne't done, and one thing that might prove useful to do. For those that have a Z2 it is useful to try and do things that will trigger the lockout, and then look at any existing log files. It is also useful to look through any preference files. Anything ending in .txt.
rjedlich, I think you have a terrific idea with finding a service manual. I was thinking about that this morning too.
Here is something to add to the service manual idea.
So far, we know that the European model is bypassable. Think about what the differences between here and Europe are. The DVD region! NTSC and PAL. While computer displays don't really care about 24Hz vs 30Hz refresh rates, it may well be something that the Nav Unit is looking at. My guess is that if someone got a service manual, the DVD region and signal setting (NTSC or PAL) may well determine a different path for bypass on the Z2. There may also be a preference file (.txt hopefully) that specifies the DVD format. That might be enough to trick the unit to think it is a European model. The question is whether NTSC DVDs will still play if the region is switched. Maybe there is a regionless mode. It could be that doing this type of trick may work but be useless. It is worth a try though.
ltl2007, you are an installer, right? Can you get hold of a AVIC-Z1/Z2 service manual? There is usually something called "service man mode" that can be entered by entering a certain key sequence at startup.
From reading the N3 service manual, region code is set via the DVD service screens (accessed via input combination of cursor key - gotta be some equivalent in the Z1/Z2)... Just a rough guess, these items will be stored on the flash ram / eprom as opposed to file data on the hard drive. Anyways, will be testing ideas out over weekend. Tonight I will test that illumination grounding idea - worth a shot... (have to open things up anyways to integrate my factory rear dvd into head unit..).
Cheers
Please guys don't give up working on this bypass. If I could help I would, however I'm just a average joe who is a enduser, with a Z2 having to pull over on the side of the road whenever I need input new address information, what a PITA.
A lot of the information exchanged goes over my head anyway.
I've been following this thread since it originated and my hat goes off to you guys who are determined to get this unit bypassed.
I know there are other things that you guys could be doing with your time, thats why I appreciate you guys dedicating the time and effort and hope your perseverance results in achieving a bypass.
Thanks again!