[deleted post]

[deleted post]

Use the old kernel and the old BT partitions.  They would need to be resigned.  If you can resign a kernel, I can work on some things that will allow us to log to the SDCard.  After you remove the header from the kernel you can use a tool to separate the kernel, ramdisk, and kernel parameters.  Then the ramdisk can be mounted and we can see what's going on.   I'd like to add in a "dmesg>/extsdcard/log.txt or something to the /init.rc file .  I don't know what the partitions look like just yet but we could get a better idea from the recovery's /etc/recovery.fstab, or the normal fstab on the boot partition.    The easyrecovery appears to be a boot.img format as well.   Either way we need logs and this is how we get it.  I'd know a lot more about how to attack this if I had the full SDCard image. 

Happy to try that but I am unsure which PRG contains the kernel and ramdisk partitions.

Happy to try that but I am unsure which PRG contains the kernel and ramdisk partitions.

#remove headers and create standard boot.img files
dd if=AVICE5100NEX/BOOT/PJ150BOT.PRG skip=1  of=/home/adamoutler/Desktop/boot.img
dd if=AVICE5100NEX/RECOVERY/PJ150REC.PRG skip=1  of=/home/adamoutler/Desktop/recovery.img
cd /home/adamoutler/Desktop
abootimg -x boot.img

Now lets get into the image. You'll need the mkbootimg tools from here https://builds.casual-dev.com/index.php?dir=random%2FAVIC%2F

adamoutler@adamoutler-desktop:~/Desktop$ kernelwork/mkbootimg_tools/mkboot ./boot.img ./newUnpack & decompress ./boot.img to ./new  kernel         : /home/adamoutler/Desktop/new/zImage  ramdisk        : /home/adamoutler/Desktop/new/ramdisk.gz  page size      : 2048  kernel size    : 4095984  ramdisk size   : 187481  base           : 0x10800000  kernel addr    : 0x10808000  ramdisk addr   : 0x11800000  second_addr    : 0x11700000  tags addr      : 0x10800100  cmd line       : console=ttymxc0,115200 init=/init video=mxcfb0:dev=ldb,bpp=32 video=mxcfb1:off video=mxcfb2:off fbmem=10M vmalloc=400M androidboot.console=ttymxc0 androidboot.hardware=freescaleramdisk is gzip format.Unpack completed.adamoutler@adamoutler-desktop:~/Desktop$ cd newadamoutler@adamoutler-desktop:~/Desktop/new$ lsimg_info  ramdisk  ramdisk.gz  zImageadamoutler@adamoutler-desktop:~/Desktop/new$ cd ramdisk/adamoutler@adamoutler-desktop:~/Desktop/new/ramdisk$ lsdata             init.freescale.rc      init.trace.rc  systemdefault.prop     init.freescale.usb.rc  init.usb.rc    ueventd.freescale.rcdev              init.goldfish.rc       proc           ueventd.goldfish.rcfstab.freescale  init.km500.rc          sbin           ueventd.rcinit             init.rc                sysadamoutler@adamoutler-desktop:~/Desktop/new/ramdisk$

Link to this image is in your PM, I think that this image will greatly help.

Happy to try that but I am unsure which PRG contains the kernel and ramdisk partitions.

btw... external SD is /storage/sdcard0

I am considering about ordering 5000NEX.

Here are things that I would approach to achieve everything that people want.

1. Find a way to install custom app to any NEX.

This will bring us the power to run shell script and more over, rooting the device.

With root access, we should be able to bring partition map really easily so we can compare x0xx and x1xx devices.

2. If we achieve Number1, we may seek a way to dump NOR flash.

As fail0verflow mentioned, the SD password is stored on flash. With power of dumping NOR flash, we should be able to dump

password for any device including x1xx devices.

Furthermore, I believe flash will store much more info. Not just SD password, but also some device specific strings, such as S/N or Model number.

3. Raspberry Pi that can send CMD42 command.

I am not even sure we need this but it is required in order to dump initial x1xx device SD image.

But good to have it for dumping x1xx SD card.

Has anybody tried to inserting x1xx SD card into x0xx device yet?

so i was wondering and i am sure this has already been thought of, but if you have have gotten x1xx running on x0xx with the exception of bluetooth, what about the update bluetooth option in the head unit? like could you flash the modded firmware then use the factory firmware and run the update bluetooth option and pull in the original bluetooth files?

This man has fixed, and helped fix SO many things.  So glad to see your name in here working on this.  It shouldn't be long now.  

Also just tried a cross-upgrade with the old GPS prg and the GPS ver file. It upgraded but still no bluetooth audio.

If that doesn't work we will need to get debugging info. After decompressing the ramdisk, in the init.rc, somewhere late in the boot, place this..

sleep 60 && dmesg>> /storage/sdcard0/log.txt &

Which will cause the system to wait 60 seconds on a background process, then write the kernel log to the external sd. You can paste it on http://code.casual-dev.com

You will have to recompress the kernel using the same tool, then sign it and flash it.

The kernel is the layer where the drivers are initialized. Try changing the boot.img as well.

 

If that doesn't work we will need to get debugging info. After decompressing the ramdisk, in the init.rc, somewhere late in the boot, place this..

sleep 60 && dmesg>> /storage/sdcard0/log.txt &

 

Which will cause the system to wait 60 seconds on a background process, then write the kernel log to the external sd. You can paste it on http://code.casual-dev.com

 

You will have to recompress the kernel using the same tool, then sign it and flash it.

Just tried a cross upgrade with the old GPS, Bluetooth and Boot prgs. It still had the same issue with no Bluetooth audio, carplay audio, or android audio. 

I have been unable to get the mkboot tools to work on OS X so I have been unable atm to rebuild a new kernel.

so i was wondering and i am sure this has already been thought of, but if you have have gotten x1xx running on x0xx with the exception of bluetooth, what about the update bluetooth option in the head unit? like could you flash the modded firmware then use the factory firmware and run the update bluetooth option and pull in the original bluetooth files?

I tried that. Unfortunately, it's a no go. BT is updated, but doesn't fix the problem.

Just tried a cross upgrade with the old GPS, Bluetooth and Boot prgs. It still had the same issue with no Bluetooth audio, carplay audio, or android audio.

 

I have been unable to get the mkboot tools to work on OS X so I have been unable atm to rebuild a new kernel.

Got VirtualBox, or MacPorts? Either one should be able to do it. VirtualBox would be preferable to run Ubuntu in a VM and you can share a folder between the computer and the VM.

I won't ever be able to get x0xx logs on my device. This weekend I'm going to make a full SD from the x0xx upgraded to x1xx. I hope to restore my bricked device back to operations.

Is there a trick to get mkbootimg to work?

I am using a Ubuntu 14 virtual box but keep getting a no such file or directory with mkboot, when I try to repack.  If I can get past this I think I can get the script together to recompile the boot.prg

Is there a trick to get mkbootimg to work?

 

I am using a Ubuntu 14 virtual box but keep getting a no such file or directory with mkboot, when I try to repack.  If I can get past this I think I can get the script together to recompile the boot.prg

use tab auto-complete, be outside of the ramdisk dir, make sure all tools are chmodded +x (executable), and specify full paths.

/path/to/mkbootimg_tools/mkboot  /path/to/original_boot.img  /path/to/root/of/unpacked/ramdisk_folder/  /path/to/new_boot.img

heads up if you didn't notice but there was a firmware update for the x0xx yesterday. doesn't look like anything major

This thread is really a bit like an unhealthy relationship... you get your hopes up that everything will be great, and then it doesn't work out. Then you wait, rinse and repeat...

This thread is really a bit like an unhealthy relationship... you get your hopes up that everything will be great, and then it doesn't work out. Then you wait, rinse and repeat...

Just needs more time and effort. I spent all weekend analyzing firmware and trying to get my bricked deck working. Once I'm able to get my device working again, custom firmwares should be simple.

@AdamOutler, definitely!

I am working on trying to get the kernel logs for us to analyze, however I still cannot get mkboot to repackage the kernel kernel and modified ramdisk. I have tried absolute paths, but it is always a error with a no such file or directory.

 

@AdamOutler, definitely!

 

I am working on trying to get the kernel logs for us to analyze, however I still cannot get mkboot to repackage the kernel kernel and modified ramdisk. I have tried absolute paths, but it is always a error with a no such file or directory.

 

 

 

Ok. never mind. Turns out mkboot had an error in it.

I appreciate both of your efforts! 

Ok so update here. I was able to modify the script to break apart and resign the android boot.img. I used this to modify the init.rc to add the sdcard0 logging that AdamOutler recommended. However, that logging never shows up on the sdcard, although it does seem on boot that it is waiting for something.

It is good to note that the script below should only be used to modify the 8100 Firmware for now, as it contains the headers for such. Eventually we can make the script more compatible, but we need it to help us fix one deck first.

Also to be clear, I used the script to modify the 1.03 8100 firmware, then renamed it to load on the 8000 NEX, where no logging showed up on the sdcard when it should have.

#! /bin/bash 
# AVIC.sh - Unpacks SYSTEM.img from the AVIC firmware for modification, waits for an input, then repackages.

# THIS FILE AND DERRIVITIVE WORKS ARE SUBJECT TO ALL TERMS OF LICENSING BELOW!
# License: 
# Term 0: If you modify this file, you must share any changes with the file creators and/or publicly on AVIC411.com
# Term 1: If you find a new use, share changes on AVIC411.com
# Term 2: If it worked say thanks.
# Term 3: IF anyone claims this is black magic, I'm going to flip.

# By bass_rock http://avic411.com/index.php?/user/116652-bass-rock/
# Heavily modified by AdamOutler [email protected]
# http://avic411.com/index.php?/topic/80945-upgrading-nex4000-to-nex4100-work-in-progress/page-19#entry332704
# Modified by bass_rock to edit the kernel and only to be used on the 8100 for now

#this function is called when system is not Linux, user is not root, or user did not specify a file
usage() {
  echo "usage:"
  echo "  AVIC.sh /path_to/firmware.zip [AVIC Model] [AVIC firmware version]"
  echo "where AVIC Model = 5000, or 8100"
  echo "where AVIC firmware version = 140 or 150" 
  echo "make sure that mkbootimg is in a folder mkbootimg_tools next to this script"
  exit
}

#exit on any error
set -e

#verify system is Linux and user is root and specifed a file
test "$(uname)" = "Linux" || $(echo "this only works on linux" && usage)
test $(id -u) -eq "0" || $(echo "you must run as root" && usage)
test -z "$1" && $(echo "you must specify a file" && usage)

#set variables for use (default AVIC-5000NEX, Version 140)
AVICZIP="$1" 
m=$2
model=${m:="5000"}
v=$3 
version=${v:="140"}

#create absolute paths for reference
workdir=$(pwd)"/work"
imageDir="$workdir/AVIC${model}NEX/PLATFORM"
SYSTEMmount="$workdir/AVIC${model}NEX/PLATFORM/SYSTEM"

#set up file and extract properly
mkdir -p $workdir/
unzip -o "$AVICZIP" -d $workdir/
cd "$imageDir"

#remove header from image
dd if=PJ${version}PLT.PRG of=PJ${version}PLT.IMG bs=512 skip=1
dd if=PJ${version}PLT.PRG of=PJ${version}PLT.HEADER bs=512 count=1

#ignore errors while we create a new folder for working with image
set +e
umount "$SYSTEMmount" 2>&1
test -e "$SYSTEMmount" && rm -rf "$SYSTEMmount"
mkdir $SYSTEMmount
set -e

#mount the image
mount PJ${version}PLT.IMG "$SYSTEMmount"

echo "You can now modify the img located in"
echo "$SYSTEMmount"
read -n 1 -p "Press any key to continue" isdone

sync #ensure all changes are written to disk
defaultheader="00060301010000000100000000000000504A313530504C5402100000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"

#get image size
# for mac
# SIZE="$(stat -f%z PJ${version}PLT.IMG)"
#for linux
SIZE="$(stat -c%s PJ${version}PLT.IMG)"
echo "IMG size is: $SIZE"

#We have to swap the hex values from big endian to little endian cause the NEX is arm.
UNSWAPPEDHEXSIZE="$(printf '%x\n' $SIZE)"
vSIZE="$UNSWAPPEDHEXSIZE"
SWAPPEDHEXSIZE="${vSIZE:6:2}${vSIZE:4:2}${vSIZE:2:2}${vSIZE:0:2}"
UNSWAPPEDHEXCRC="$(crc32 PJ${version}PLT.IMG)"
vCRC="$UNSWAPPEDHEXCRC"
SWAPPEDHEXCRC="${vCRC:6:2}${vCRC:4:2}${vCRC:2:2}${vCRC:0:2}"

echo "Unswapped size hex is: $UNSWAPPEDHEXSIZE"
echo "Swapped size hex is: $SWAPPEDHEXSIZE"
echo "Unswapped crc hex is: $UNSWAPPEDHEXCRC"
echo "Swapped crc hex is: $SWAPPEDHEXCRC"

#create new header
perl -e "print pack 'H*', 'A55A5AA5${SWAPPEDHEXSIZE}${SWAPPEDHEXCRC}${defaultheader}'" > PJ${version}PLT.HEADERNEW
cat PJ${version}PLT.HEADERNEW PJ${version}PLT.IMG > PJ${version}PLT.PRG
rm -rf PJ${version}PLT.IMG
rm -rf PJ${version}PLT.HEADERNEW
defaultheaderver="A55A5AA5C00000000006030101000000010000002C000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF010000000100000050004C004100540046004F0052004D000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000050004A0031003500300050004C0054002E005000520047000000000000000000000000000000000000000000000000000000000000000000"
SIZE="$(stat -c%s PJ${version}PLT.PRG)"
echo "PRG size is: $SIZE"
UNSWAPPEDHEXSIZE="$(printf '%x\n' $SIZE)"
vSIZE="$UNSWAPPEDHEXSIZE"
SWAPPEDHEXSIZE="${vSIZE:6:2}${vSIZE:4:2}${vSIZE:2:2}${vSIZE:0:2}"
UNSWAPPEDHEXCRC="$(crc32 PJ${version}PLT.PRG)"
vCRC="$UNSWAPPEDHEXCRC"
SWAPPEDHEXCRC="${vCRC:6:2}${vCRC:4:2}${vCRC:2:2}${vCRC:0:2}"

echo "Unswapped prg size hex is: $UNSWAPPEDHEXSIZE"
echo "Swapped prg size hex is: $SWAPPEDHEXSIZE"
echo "Unswapped prg crc hex is: $UNSWAPPEDHEXCRC"
echo "Swapped prg crc hex is: $SWAPPEDHEXCRC"


perl -e "print pack 'H*', '${defaultheaderver}${SWAPPEDHEXSIZE}${SWAPPEDHEXCRC}A55A5AA5'" > PJ${version}PLT.VERSTART

UNSWAPPEDHEXCRC="$(crc32 PJ${version}PLT.VERSTART)"
vCRC="$UNSWAPPEDHEXCRC"
SWAPPEDHEXCRC="${vCRC:6:2}${vCRC:4:2}${vCRC:2:2}${vCRC:0:2}"
echo "Unswapped verstart crc hex is: $UNSWAPPEDHEXCRC"
echo "Swapped verstart crc hex is: $SWAPPEDHEXCRC"

perl -e "print pack 'H*', '${SWAPPEDHEXCRC}'" > PJ${version}PLT.VERSTART1

cat PJ${version}PLT.VERSTART PJ${version}PLT.VERSTART1 > PJ${version}PLT.VER
rm -rf PJ${version}PLT.VERSTART
rm -rf PJ${version}PLT.VERSTART1
rm -rf PJ${version}PLT.HEADER
rm -rf ../PJ150PLT.VER
mv ./PJ150PLT.VER ../PJ150PLT.VER

cd "$workdir"
umount "$SYSTEMmount"
test -e "$SYSTEMmount" && rm -rf "$SYSTEMmount"


#Lets modify the kernel now
dd if="$workdir/AVIC${model}NEX/BOOT/PJ${version}BOT.PRG" bs=512 skip=1  of="$workdir/AVIC${model}NEX/BOOT/boot.img"
#dd if="$workdir/AVIC${model}NEX/RECOVERY/PJ${version}REC.PRG" bs=512 skip=1  of="$workdir/AVIC${model}NEX/RECOVERY/recovery.img"

cd "$workdir/AVIC${model}NEX/BOOT"

abootimg -x boot.img

echo "Renmove the boot size in bootimg.cfg"
read -n 1 -p "Press any key to continue" isdone

"$workdir/../mkbootimg_tools/mkboot" ./boot.img ./newUnpack

echo "You can now modify the ramdisk in"
echo "$workdir/AVIC${model}NEX/BOOT/newUnpack"
read -n 1 -p "Press any key to continue" isdone

sync #ensure all changes are written to disk

"$workdir/../mkbootimg_tools/mkboot" ./newUnpack ./newBootImage.img

#Lets work with the boot one first.
rm -rf "$workdir/AVIC${model}NEX/BOOT/PJ${version}BOT.PRG"

mv newBootImage.img "PJ${version}BOT.IMG"


defaultheader="00060301010000000100000000000000504A313530424F5402100000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF"
#get image size
# for mac
# SIZE="$(stat -f%z PJ${version}BOT.IMG)"
#for linux
SIZE="$(stat -c%s PJ${version}BOT.IMG)"
echo "IMG size is: $SIZE"

#We have to swap the hex values from big endian to little endian cause the NEX is arm.
UNSWAPPEDHEXSIZE="$(printf '%x\n' $SIZE)"
vSIZE="$UNSWAPPEDHEXSIZE"
SWAPPEDHEXSIZE="${vSIZE:6:2}${vSIZE:4:2}${vSIZE:2:2}${vSIZE:0:2}00"
UNSWAPPEDHEXCRC="$(crc32 PJ${version}BOT.IMG)"
vCRC="$UNSWAPPEDHEXCRC"
SWAPPEDHEXCRC="${vCRC:6:2}${vCRC:4:2}${vCRC:2:2}${vCRC:0:2}"

echo "Unswapped size hex is: $UNSWAPPEDHEXSIZE"
echo "Swapped size hex is: $SWAPPEDHEXSIZE"
echo "Unswapped crc hex is: $UNSWAPPEDHEXCRC"
echo "Swapped crc hex is: $SWAPPEDHEXCRC"

#create new header
perl -e "print pack 'H*', 'A55A5AA5${SWAPPEDHEXSIZE}${SWAPPEDHEXCRC}${defaultheader}'" > PJ${version}BOT.HEADERNEW
cat PJ${version}BOT.HEADERNEW PJ${version}BOT.IMG > PJ${version}BOT.PRG
rm -rf PJ${version}BOT.HEADERNEW
rm -rf PJ${version}BOT.IMG
rm -rf boot.img
rm -rf bootimg.cfg
rm -rf initrd.img
rm -rf zImage
rm -rf newUnpack





#lets work on the ver file

defaultheaderver="A55A5AA5C00000000006030101000000010000002C000000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF010000000100000042004F004F00540000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000050004A0031003500300042004F0054002E005000520047000000000000000000000000000000000000000000000000000000000000000000"

SIZE="$(stat -c%s PJ${version}BOT.PRG)"
echo "PRG size is: $SIZE"
UNSWAPPEDHEXSIZE="$(printf '%x\n' $SIZE)"
vSIZE="$UNSWAPPEDHEXSIZE"
SWAPPEDHEXSIZE="${vSIZE:6:2}${vSIZE:4:2}${vSIZE:2:2}${vSIZE:0:2}00"
UNSWAPPEDHEXCRC="$(crc32 PJ${version}BOT.PRG)"
vCRC="$UNSWAPPEDHEXCRC"
SWAPPEDHEXCRC="${vCRC:6:2}${vCRC:4:2}${vCRC:2:2}${vCRC:0:2}"

echo "Unswapped prg size hex is: $UNSWAPPEDHEXSIZE"
echo "Swapped prg size hex is: $SWAPPEDHEXSIZE"
echo "Unswapped prg crc hex is: $UNSWAPPEDHEXCRC"
echo "Swapped prg crc hex is: $SWAPPEDHEXCRC"


perl -e "print pack 'H*', '${defaultheaderver}${SWAPPEDHEXSIZE}${SWAPPEDHEXCRC}A55A5AA5'" > PJ${version}BOT.VERSTART

UNSWAPPEDHEXCRC="$(crc32 PJ${version}BOT.VERSTART)"
vCRC="$UNSWAPPEDHEXCRC"
SWAPPEDHEXCRC="${vCRC:6:2}${vCRC:4:2}${vCRC:2:2}${vCRC:0:2}"
echo "Unswapped verstart crc hex is: $UNSWAPPEDHEXCRC"
echo "Swapped verstart crc hex is: $SWAPPEDHEXCRC"

perl -e "print pack 'H*', '${SWAPPEDHEXCRC}'" > PJ${version}BOT.VERSTART1

cat PJ${version}BOT.VERSTART PJ${version}BOT.VERSTART1 > PJ${version}BOT.VER
rm -rf PJ${version}BOT.VERSTART
rm -rf PJ${version}BOT.VERSTART1

rm -rf ../PJ150BOT.VER
mv ./PJ150BOT.VER ../PJ150BOT.VER

Also so that work is not duplicated. I am working on simplifying this script and allowing more modifications to the recovery partition as well. I think that it is possible the recovery overwrites the boot partition on each boot.

I can't get my device working without an 8100 SDCard and it's just not proper to RMA the device. I'm really hoping an employee with access to the raw SD Image is reading this and can help. I can keep things anonymous.

I'm also exploring JTAG but I've really screwed with the firmware on my unit so JTAGing a broken firmware will only get us so far and won't allow me to restore my device.  

If it comes to JTAG, does someone have an x1xx unit or SDCard I can use to pull a pristine 8gb image?

@AdamOutler here is an SDCard part on Pioneer's site that is supposed to the the 8100. http://parts.pioneerelectronics.com/part.asp?productNum=CXX7606

If we can get the sdcard password, I could then get image my sdcard (from an 8000 but should work since they can update each other) and hand off.

Did the SDCard from the 5000 not work?