I'm doubtful that its a file that is written to disk, I suspect that what ever that EDDC driver is using to determine operational vs. non-operational state of the vehicle may not be as fully binary as Pioneer might of hoped.

Again, that EDDC driver is contantly monitoring the state of something, what that something is I can't tell you. Once that something reaches a certain threshold, the driver sets a variable from a binary 0 to a 1. Any other software that monitors the EDDC state will then change its operation accordingly.

Now is it possible that some shim is monitoring several physical/analog components and reporting the back to the EDDC driver which then announces to all other applications the state of the vehicle in binary? Sure its possible and could explain some of the variability in the implementation of the backdoor. Converting Analog inuts to a single Binary input can be a tricky thing and subject to error...

But we won't know until we get a good look at that flash and the HD and can analyze the OS in excrutiaing detail...

I'm still willing to donate my image or vice versa to anyone interested. Someone with a Z2 would be the best comparison.

Hmmm... I wonder if there isn't something to all this?

It seems to me that the Z1 EDDC driver must have had some logic like:

"If ( gyros say vehicle is moving OR gps says vehicle is moving OR parking brake is off ) AND bypass wire isn't grounded THEN send out a "We're moving" signal to the listening applications.

The new EDDC likely has the same logic minus the bypass wire part.

If you could pull the EDDC driver off the Z1 and replace the Z2's with it, maybe the old bypass would work again since it would be looking for the bypass wire.

I'm just not sure if you can simply change a driver without reinstalling it.

Food for thought...

Edit: Whoops, I said parking brake "on" instead of "off"

OK that's possible but there's probably more to it, maybe. Then again it could be just that simple...

Here's some more links based on what I shared previously...

http://msdn2.microsoft.com/en-us/library/ms858650.aspx

The OEM is solely responsible for designating the EDDC hardware interface. This provides the OEM with the flexibility to decide which types of situations should represent an In Operation state.

 

In general, the hardware interface should be tied to some system component that would signify that the vehicle is being operated. For example, the interface may be tied to the parking brake, transmission, or other vehicle system. The OEM should select one specific vehicle system component to determine EDDC state for the hardware device. EDDC state can be expressed as a binary value (i.e. In Operation/Not In Operation).

Although the MSDN article suggests and OEM should select one specific system to monitor, it does not categorically state that the OEM is limited to one and only one vehicle system component to monitor.

As far as the code for the driver or simply writing over the Z2 driver component with the Z1 driver component,

http://msdn2.microsoft.com/en-us/library/ms858654.aspx

An OEM can build an EDDC driver that interfaces to platform-specific hardware and enables an automotive platform to detect EDDC state changes and to provide notifications to applications.

 

The EDDC driver must include both a model device driver (MDD) layer and a platform dependent driver (PDD) layer. For additional information on this, see Driver Code Structure in the Windows CE .NET documentation.

 

NOTE Code samples in this topic are targeted to a specific device and will vary depending on the type of hardware that your platform is based on.

From what I've been reading, and as far as I've been able to fathom based on what I've read. It appears that the Z1 and Z2 are based on similar if not the identical hardware platform. If that is the case then it could be as simple as overwriting one .DLL with another, but then again that could just be the tip of the iceberg.

Time and some ingenuity will eventually work this bypass out...

Yeah, I was basing my theory that the Z1 and Z2 are, internally, identical. Again, I'm not sure what the effects of simply overwriting the .DLL would be. I don't have much experience (read: any experience) writing .DLLs and haven't even written in low-level code since high school (never mind how long ago! ).

Hopefully someone with the right skill set and the capability will pick up this ball and run with it... Any takers?

Quite honestly this bypass or more accurately the lack of a bypass is what is driving me toward the Kenwood DNX7100... (much to the surprise of my local retailer who tried to temp me with a AVIC D3 - Javier you listening?)

Well that and the ability to play video off of a USB HD, without an iPod...

well evey dll file i tried to replace on the z2 harddrive wit the z1 prevents the z2 from booting so i gotta find exactly what dll file is responsible for the bypass then play with the script on that 1 file to get it to work but i have been working by myself on this and theres alot of files that look to be the bypass but still cant get ti to work but we will find it one way or another and also on a side note i am a local shop owner and let me tell you the kenwood your looking at suck compared to the z2 just be patient and the bypass will come

If you look over some of the Microsoft Automotive links I shared I think you'll quickly come to the conclusion that you are probably not dealing with just one DLL but an entire messaging and monitoring subsystem of the OS.

I doubt its going to be as simple as replacing one file. If I were a betting man I'd bet on one of two scenarios.

1) A group of files representing the entire EDDC subsystem.

2) Something similar to a registry setting that provides the bypass.

Now from one of the posts I read it appears that the European Z2 units do not implement EDDC. If that is the case I would expend some effort on getting a copy of that image as a baseline and begin looking at differences. While I expect they'll be a whole bunch, it'll at least be a start. Otherwise we'll be playing around with this for a good long time and more than likely without too much success....

If I were a betting man.... Then again there is always the brute force approach.

Quite honestly if only Pioneer Legal would write up a disclaimer absolving the company of any responsibility, shifting the responsibility of a potential distraction to the owner then as a result providing the software bypass. We'd be done with this nonsense and everybody would be happy.

Doubt that would happen anytine soon...

well evey dll file i tried to replace on the z2 harddrive wit the z1 prevents the z2 from booting so i gotta find exactly what dll file is responsible for the bypass then play with the script on that 1 file to get it to work but i have been working by myself on this and theres alot of files that look to be the bypass but still cant get ti to work but we will find it one way or another and also on a side note i am a local shop owner and let me tell you the kenwood your looking at suck compared to the z2 just be patient and the bypass will come

Did you try to swap whole prg0 folder?

ok i got a good one.

while driving and parking break grounded i reset unit.it came back on and had vid with no error message all vid ok and all controls open to use.the map was in the wrong place and it took about 10 min. for it to find itself.when it did vid still worked and functions still open i drove for about 10 more min. and map was accurate and still had vid,which says it may be something else telling it to sut down.the nav knew the car was moving and my unit told me i was moving at 48mph with no vss wire in the hardware screen

ok i got a good one.

while driving and parking break grounded i reset unit.it came back on and had vid with no error message all vid ok and all controls open to use.the map was in the wrong place and it took about 10 min. for it to find itself.when it did vid still worked and functions still open i drove for about 10 more min. and map was accurate and still had vid,which says it may be something else telling it to sut down.the nav knew the car was moving and my unit told me i was moving at 48mph with no vss wire in the hardware screen.

That's how mine callibrated too. It took a bit for the NAV to get accurate but once it did all functions, dynamics, and stuff work without the VSS. I think if you can get to that point, it wont fail on you then on. There is a secret or method to this backdoor. Yeah, I know, it's far from the perfect solution.

I just reset my unit with both the button reset and the calibration while driving with the e brake on...vss off...

the unit is still in "initialising sensor" mode..and has been for about 15 miles..

I am picking up 3-5 sat signal..

How long until the unit will begin learning?

I think you need to turn off the vehicle and restart keeping the e-brake off unit it changes to simple hybrid. At that point you can try the switch and see how long it lasts

I am starting to loose hope. I tried a couple more times today and I can't get over 20 miles before getting the error. I will say that this has been stop and go, but each time I shut off the radio and then shut off the switch. I turn it back on after the unit is fully rebooted. Initially I have been waiting until I get simple hybrid on the cablibration screen before flipping the switch the first time. I don't know what else to try.

ok im out again got about 30 miles,i thought i had it.

beachdoc i dont know whats keeping yours going is anyone elses working without any problems.it seems we are all having problems.beachdoc how many miles are you driving continueos without shutting down car

I know I have a total of over 200 miles intermittently without interruption. I'm quite positive I've gone more than 20-30 miles at one time. Perhaps it's just a matter of time before mine goes out too. Nissan07 says he's gone that far too without problems. It would be nice for someone else to post who has been successful on a long interrupted journey. I plan next Monday driving 60 miles one way, I can try it again then.....If someone lived close, they could examine my unit for any noted changes but it seems everyone is far away. Maybe I got an early or lucky unit....perhaps it just likes my Dave Matthews DVD...or accessories like my PAC steering wheel controls...it could be anything. One things for sure...this unit is so highly variable and picky it makes it hard to narrow down what it's looking for. We'll just have to wait for a software/OS fix because I seriously doubt it's electrical. Who ever designed it certainly can bypass it, let's hope that info leaks sometime soon.

Like I said, analog to digital can be tricky. Mix in a few other monitoring points and some logic and, well let's just say I agree... It could be anything. Could be the car, the components the electrical system anything.

Of course when someone does figure this out we may all be kicking ourselves for not seeing the simplicity of it... Then again with all of the people involved in working on a physical/electrical/analog bypass I doubt it...

Beachdoc,

I'm in Charlotte (semi-close to wilmington) and just installed a Z2 in my maxima. I have yet to connect a switch to my setup but plan on doing so this weekend. I have the ND-BT1, the ipod adapter, the xm with navtraffic and the PAC steering wheel adapter so I have a feeling my outcome will be similar to yours. I connected the ebrake wire to ground temporarily and didn't connect the VSS.

I'll let you know how things work out sometime this weekend!

I think the key is to not engage the parking brake lead after a reset until the units learning status is simple hybird...

every time I have reset and flipped the switch during sensors initialising and no luck...

just tried it this morning after the status is simple hybird and the dvd seems to play a lot longer...I only drove it 10 miles but not one emergency brake warning or dvd cut out during that time

Maybe??

Timvan I hope it works. And Vastmax, we're only 3-4 hours away....cool. If you're really into solving this issue, we both might be able to work on it. I think I have the newer camera, but that shouldn't matter. You also might try hooking up some RCA cables as outputs from the Z2, then are setups would be pretty equal. (with the RCA's you can go under AV settings and turn AUX out on.)

It was nice while it lasted..maybe 20 miles?

Timvan, same results for me, it lasted longest when I would wait for simple hybrid before flipping the switch. 20 miles was my best go, I don't know what else to try with this trick.

If you're still wanting to try to get this to work, I'm running out of ideas. However, i've taken several screen shots of my diags and info screens that you can compare to if you think that might help. Just PM me if you want them.

I drove today again without any problems, but my longest trip was only 12 miles. I need a bigger city to waste gas.... I'll have to wait until this weekend and Monday for a longer test although. If it fails, no solution. If it doesn't, I'm not sure if that will help either. I wonder if someone hasn't ran with the idea, figured a solution, and might be saving it for their ebay secret or shop. We'll have to see if further advertisements come up.

Until then, back to the HDD images we go!

Guess what mine finally went out after way more than 150 miles...I didn't forget to flip the switch so I have no idea what happened and my vss is not hooked up...I think I'm gonna try switching when its fully calibrated. Hope it works! Any ideas?