These are 2 large chips on the processor board. They are numbered:
Samsung 607
K4H511638C-UCB3
H5116 CML574HHC

These appear to be 512meg DDR SRAM


Smaller sqare TSOP on center edge of board.
lc82360
yj2 6ak2g
This appears to be the ATRAC3 hardware encoder/decoder.
http://www.sanyo.com/semiconductors/catalogs/SystemChipsetEP85J.pdf search PDF for lc82360
What sucks is that this chip can encode at 24x yet we can only rip at 4x. Must it be the CD/DVD drive then???



Sqare TSOP on corner of board:
Pioneer
pe5414a
84719011
0604lu614


These are all the main chips from the bottom of the processor board.

From the Processor (top) side of the board:
2 of these:
Samsung 607
K4H511638C-UCB3
H5116 CML612HBC

More memory. My guess is video memory.


2 SQARE TSOP'S in the corner
Spansion
S99GL128NFB1
0603ABD M

These are the Flash Memory chips. Here is the datasheet for the S29, I think they are the same. S99 is likely OEM or something.
http://www.spansion.com/datasheets/s29glxxxn_00_a6_e.pdf

Here is the Processor board top.

To the left of the 2 square flash ram chips you can see 3 smaller square chips and then a rectangular "thing". This thing is an 18 pin connector. I am guessing it is used to do the initial programming on the flash chips.

Ok guys i know i'm new here and you guys are definatly way beyond me on hardware tech, but i have been browsing through some of the exe's and i found more than a few referances to usb support.... not just the os, but a hardware adress ???possibly??? that is the point where i start to get over my head.
Also, maybe someone w/navtraffic can confirm that the data connector that is only used for the traffic updates and data portion of xm looks a whole lot like it could be a usb interface in some sort of obscure connector. Side note to that thought, if memory serves me correctly the special plug for bluetooth was labled bluetooth on the back panel or instructions, while the data cable for xm was refered to in the manual in a more generic way...no spacific referance to xm...
maybe nothing, maybe something

XessReality said:

Ok guys i know i'm new here and you guys are definatly way beyond me on hardware tech, but i have been browsing through some of the exe's and i found more than a few referances to usb support.... not just the os, but a hardware adress ???possibly??? that is the point where i start to get over my head.
Also, maybe someone w/navtraffic can confirm that the data connector that is only used for the traffic updates and data portion of xm looks a whole lot like it could be a usb interface in some sort of obscure connector. Side note to that thought, if memory serves me correctly the special plug for bluetooth was labled bluetooth on the back panel or instructions, while the data cable for xm was refered to in the manual in a more generic way...no spacific referance to xm...
maybe nothing, maybe something

The search for USB is why I took the whole thing apart. I too think if they have USB it will be inside one of the connectors.
If you look at the lines of code you found with USB in the pathname you might notice that some of these reference files I think we are using. This also leads me to believe that some of the flash memory is seen as a usb drive or all the flash is referenced as USB and it is set to boot from USB.

You will also find references in the exe files to HTTP addresses and where items get downloaded for updates. From this I think the code can or has lived outside the Z1 as I don't believe they wanted to build web access in it.

What about the plug that just says "extension"? What is that used for?

Pulp... yea i got that that is why you took it apart, just trying to help....i saw those referances and drew the same conclusions. not sure you got my main point though....
The Data Cable that is exclusive to xm nav traffic may be the lead you are looking for. Think about it this way, it cant be a totally propriatary cable type or transmission protocall, as that would hinder interopporability with nav traffic recievers made by other vendors and would require an extra step for pioneer in integrating the nav unit with the avic series.

sorry if i'm being redundant, just wanted to express my thought clearly...

XessReality said:

Pulp... yea i got that that is why you took it apart, just trying to help....i saw those referances and drew the same conclusions. not sure you got my main point though....
The Data Cable that is exclusive to xm nav traffic may be the lead you are looking for. Think about it this way, it cant be a totally propriatary cable type or transmission protocall, as that would hinder interopporability with nav traffic recievers made by other vendors and would require an extra step for pioneer in integrating the nav unit with the avic series.

sorry if i'm being redundant, just wanted to express my thought clearly...

Well since I do have the nav traffic maybe I'll just take it apart next. :lol:

I can't seem to find a data sheet using normal web searches. I'll have to look at work where I can access some more proprietary databases. It looks like Pioneer is using some version of this processor though: Hitachi HD6417750BP200 . It looks like it does support the JTAG standard, so that's a definite plus for us.

Pulp, when you refer to the TSOP flash devices in that picture, do you mean the two BGA chips in the upper right corner? If so, that's a bummer. I was hoping for something in TSOP or TQFP package that I could remove, read, and reinstall easily. I HATE BGA. LOL

tech10002 said:

I can't seem to find a data sheet using normal web searches. I'll have to look at work where I can access some more proprietary databases. It looks like Pioneer is using some version of this processor though: Hitachi HD6417750BP200 . It looks like it does support the JTAG standard, so that's a definite plus for us.

Pulp, when you refer to the TSOP flash devices in that picture, do you mean the two BGA chips in the upper right corner? If so, that's a bummer. I was hoping for something in TSOP or TQFP package that I could remove, read, and reinstall easily. I HATE BGA. LOL

Yes those are what I'm referring to. I use the term TSOP too liberally I think. I see thin chip I call it a TSOP. LOL

Pulp_Fiction said:

Processor: It is about 1 and 1/4" square. No brand name on the processor but the following writing:
R8A73820A
HA01BGV might be HA01BCV
BB09165
0609 JAPAN

I'm betting one of these is a serial number.

Google was unable to help with these numbers.

I don't know if Samsung makes processors but most of the chips are samsung's.

Large pics at these links. 1-2 meg each.


Check out all the crazy writing on the top of my DVD drive. Looks like it went through a lot of hands or something.
http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/dvdtop.jpg

Here is the bottom of the DVD drive:
http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/dvdbottom.jpg

Here is the processor module. The lid was soldered on and I already put it back before I found the pics were a little blurry. Sorry. I didn't see enough information to make opening it back up worth the effort.
http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/processormodule.jpg

Thanks for the pics.
Can we get a high res and clear shot of all boards both front and back?
I am looking to see if they use the same processor for navi as in all the other DVD nav units and if it has IMODEON labeled on the board somewhere like in the AVIC-9,90,80,88,N1, N2, N3, and EU models. That is the key to those units being bypassed. "Interlock Mode"
I'll also see if I can get my hands on a service manual. My guess it is completly different since it runs on a different OS.

Anonymous said:

Pulp_Fiction said:

Processor: It is about 1 and 1/4" square. No brand name on the processor but the following writing:
R8A73820A
HA01BGV might be HA01BCV
BB09165
0609 JAPAN

I'm betting one of these is a serial number.

Google was unable to help with these numbers.

I don't know if Samsung makes processors but most of the chips are samsung's.

Large pics at these links. 1-2 meg each.


Check out all the crazy writing on the top of my DVD drive. Looks like it went through a lot of hands or something.
http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/dvdtop.jpg

Here is the bottom of the DVD drive:
http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/dvdbottom.jpg

Here is the processor module. The lid was soldered on and I already put it back before I found the pics were a little blurry. Sorry. I didn't see enough information to make opening it back up worth the effort.
http://www.bigfloppydonkeyballs.com/~leech/z1hddcopy/processormodule.jpg

Thanks for the pics.
Can we get a high res and clear shot of all boards both front and back?
I am looking to see if they use the same processor for navi as in all the other DVD nav units and if it has IMODEON labeled on the board somewhere like in the AVIC-9,90,80,88,N1, N2, N3, and EU models. That is the key to those units being bypassed. "Interlock Mode"
I'll also see if I can get my hands on a service manual. My guess it is completly different since it runs on a different OS.

I think I posted the best I had but I'll check later. "Interlock Mode" sounds familiar. I think I read something about that on one of the chip white papers I read.

Anyone still playing around with the Z1/Z2/Z3 inner workings?

I don't have a Z yet... just looking for one that's a good price first, but I thought I'd play around with the firmware update and see what I could figure out.

I've attached the registry I extracted from it. It appears the main control program is NEventWatcher.exe. There are definitely USB as well as serial port drivers. Video/navi lockout are most likely software-controlled. If someone could reverse-engineer NEventWatcher.exe and its libraries, many AVIC-Z* secrets could be exposed.

We were only concerned with the secrets as they pertained to a bypass. Now that it's all cleared up, everybody kinda gave up on messing with the software. Probably for the best, as it was quite frustrating.

A software-based bypass would still be nice as it would have virtually no cost involved (firmware can be updated via CD-R).

Plus, you could get rid of that horribly annoying warning screen, or does the Z1 not have that? My D1 has it and I really hate that screen.

Being able to add in IE, ability to use either Wifi or a cell phone as a modem, adding in Explorer, people writing custom apps, the possibilities are unlimited. It's a shame Windows Automotive isn't as well hacked as Windows Mobile.

BTW, if anyone knows where I can get Platform Builder, PM me!