I have a thread over at reddit (attached, comments have the meat) that covers my attempts to bring my w4500nex back to life after the internal SDCard toasted itself. Thus far I've installed an SD Extension cable so I can mess with the SDCard until my replacement arrives from Russia. Since then I've been able to get touchscreen working with the 4400 image posted on the development thread and have been deconstructing the updates to figure out if the sdcard password is somewhere in the updates (it's not on the SDCard but likley in the NOR flash that update does). Since messing around with the system I've locked about 5 of my SDcards (I picked up a bunch just incase). 

So many dead-ends, but here's what I've been able to do so far

• Boot the 4400 image - this lead to the touchscreen not working
• Modified the 4400 image to support the 4500, mostly works. here's what I did;
  • used dd to write the image to sdcard
  • copied build0.prop to build.prop and deleted all the other buildX.prop files - note, not sure if this or the next change is the one that ultimately took effect
  • modified /etc/sysd.conf, updated the 8400nex config (sysdconf.com.TouchType) from "capacitator" to "resistence"
  • Booted the w4500nex with the updated card
• Noticed that when the SDCard changes, the warp cache gets refreshed. This means I can change the files without the system changing them back. Either that or maybe WARP is only relevant after the cache gets built on the sdcard. Not sure. 

Unfortunately while the radio mostly works (if not a bit buggy), I'm unable to login to the developer menu due to the password change from "DEVELOPDBG ON" - I'm digging through to see if I can find where they might have changed the password or bypass the password in general. I'm using binwalk to walk through the various files and updates to see what I can find. My hope is to be able to unlock my original SDcard, it appears to work but is locked which leads me to suspect that it's an issue with a corrupted file or bad block not affecting the whole SDCard. This will allow me to see the changes between it and the 4400 image I downloaded. 

One interesting thing is that it looks like for the most part there's an overall image and each build just has config file changes. If that's the case, I'm really curious with the w8500nex 1.03 image as it might contained updated code while still holding driver support for the w4500. I'm also going to go down the path of looking how to create my own bsp files, I can't seem to figure out how to get this into testmode (the scripts don't seem to work anymore) to turn off the sdcard lock and unlock existing cards. If I can enable OpenSSH or adb over network (found the config files, need to learn more about adb) then I can mess with it while it's running. I hasn't haven't ran scans against it while wifi is running, that's how I gained access into my dashcam. I'm open to any suggestions, but if not with any hope this will help someone else trying to solve their w4500nex woes. 

Please note: I'm not sharing proprietary code/i.e. sdcard images. I'll gladly answer questions and help guide but from the looks of it part of the reason other image files have been taken down are because of DMCA requests. Don't need that kind of noise. 

SD Password should be:

LKPFeD4BcVzESR2Y

EDIT: Crap, I just went and read your very detailed update on reddit.  This is like the same password you had already tried?

Also, there is another password I saw mentioned somewhere on here for the debug menu, but I cannot find it now.  It begins and ends with brackets, like:

[DebugBlahblahblah][Off]

This is what I was meaning.  Probably wouldn't work in this instance:

nobody knows the password to access the Debug Menu
it is encrypted
the only way is to patch one of the system libraries.

Been trying a few things with no luck but failure helps bring success, right? 

Here's where I'm at now; I'm able to unpack the updates thanks to some general android information I found and the help of Bass_Rock's AVIC-NEX scripts. Its been probably a good 8 or 9 years since I dived this deep android but it's starting to come back to me. 

To extract PLATFORM;

1. Unzip the W8500NEX 1.03 update and go into the PLATFORM directory
2. Create a new image using dd without the file header
   1. "dd if=./PJ190PLT.PRG of=./PJ190PLT.aimg bs=512 skip=1"
3. Convert the image from android to standard using simg2img at https://github.com/anestisb/android-simg2img
   1. "simg2img ./PJ190PLT.aimg ./PJ190PLT.img"
4. Mount the image PJ190PLT.img, you can now access it's files. 

To extract USER - note: there are 4 images, _0 for the X000 series, _1 for the X100 series, _4 for the X400 series and _5 for the X500 series. I have a W4500 so I'm going with the _5

1. Create a new image using dd without the file header
   1. "dd if=./PJ190DAT_5.PRG of=./PJ190DAT_5.aimg bs=512 skip=1"
2. Convert the image from android to standard using simg2img 
   1. "simg2img ./PJ190DAT_5.aimg ./PJ190DAT_5.img"
3. Mount the image PJ190DAT_5.img, you can now access it's files. 

Boot partition is a little more involved, I'll update those instructions later. I tried straight copies (mounting the AVIC 4400 image then overwriting the partition data from the update) which booted but bombed the launcher. Could be something I did or could be some sort of checking internally. It wasn't WARP as that data is clear on the SDCard so not sure what the issue is - like I said, probably something I did but it's a good sign it booted. Hell, maybe even the launcher crash will come in useful.

Walking through the various files with binwalk and strings, found the MODECHANGE and COPYDEVICE testmode keys in libNPSysCtrlHandler.so which match the TestMode keys at https://github.com/bassrock/AVIC-NEX so I think they're likley commented out or the process to load them has changed. I'll start deconstructing libNPSysCtrlHandler to see what I can find. Another thought is launching a custom apk or invoking via config. I've found a ton of interesting things in the /app and /lib directories and a few potential things in config files but haven't gotten around to testing them yet. I've locked about 8 SDcards so I need to order some more that should be here this afternoon. I love Amazon Same Day delivery!

Another things like @asd255 said would be to modify the file that holds the dev password. That might might be libchromium_net.so or libandroid_runtime.so, since it holds those strings but I haven't dug into them as deep. Btw @asd255, I've been reading your posts on the russian forum and they've been really informative, also of note google translate has gotten much better. lol

libNPSysCtrlHandler.so   - 

this is the main library
there are many interesting things

But checking the password for Debug Menu in the library
libdebugmodeproxy_jni.so

there are several more Debug menus
no password is required to access

1 - app test
2 - debug 1
3 - debug 2

app test menu also works on x200

here are screenshots of my article in Russian from 4pda forum

@asd255 Thanks for the lib, what changes were made to it? I did a diff and noticed a few byte changes, I added it to my latest flash but haven't tested anything yet. Those posts you made on 4pda have been very helpful, I came across those earlier in the week and have gotten to the menus you referenced. That's why I went ahead and bought your sdcard off ebay, it actually arrived a week early this afternoon. It works perfectly! I tried to make a backup (Florida weather can be brutal on electronics) but it's locked as I kind of expected. Just testing it to make sure it works for QA purposes would lock it. It runs good with all the original functions, igo is a little buggy (crashed a couple of times) but I've noticed new firmwares on old android frameworks (this is android 4.2.2 automotive) tend to take a bit to settle down. I do need to reflash my idatalink rr maestro though, steering wheel controls and status to the EVIC (2018 Jeep Wrangler JKU) aren't working but I can live with that. 

Couple of quick observations with your SDCard;

• Noticed firmware was 1.03 - is that dumped firmware or did you manage to force an upgrade with the W8500nex firmware? I only ask because I suspect that'll work if I can get my w4400 SDcard to run the update. I extracted the 8500 update and it has everything the 4500 needs to run, which I expected since the 4400 and 4500 hardware seem to be the same other than maybe some minor revisions. 
• When I put in the new SDcard you sent me, the headunit rebooted a couple of times. Not like it was doing when I was testing my sdcards, a pretty clean reboot (no screen frizz) like some sort of quick firmware update. I suspect this was a BSP flashing process, have you noticed that too? 

I plan to keep hacking away at the 4500, this has been a fun learning experience. I've managed devs for 20 years and rarely get to dig into embedded systems anymore.

For anyone on the fence on whether or not to purchase the sdcard from ebay - do it if you don't want to tinker other than the install process. It just works. No muss, no fuss. Yes the shipping is slow (comes from Russia) but it beats spending another $700USD on a new stereo. 

Im glad to see people finally getting somewhere on the 4500. I have mine apart with the SD out and Im trying to decide if I want to bother with it. We sell Kenwoods also at my shop and they seem so much faster than Pioneers flagships. The excelons really just work well. The only Pioneer as fast IMHO is the 4660 but just to get it installed and updated in a customers car is an extra 30 min over Excelons. I love the capacitive face response, so smooth. We have tried updating the 4660 over phone app and with USB and almost always have to use USB. Tried Apple and Android for the new CarAVAssist app, and it is still buggy and too involved for a customer, as they might brick it. After the amount of 4500s we are now dealing with due to bricked SD cards I am glad they switched to flash memory like Kenwood, but it sure takes away from the fun of playing with the files. Im sure someone will crack that at some point soon. 

1 minute ago, Hackowell said:

Im glad to see people finally getting somewhere on the 4500. I have mine apart with the SD out and Im trying to decide if I want to bother with it. We sell Kenwoods also at my shop and they seem so much faster than Pioneers flagships. The excelons really just work well. The only Pioneer as fast IMHO is the 4660 but just to get it installed and updated in a customers car is an extra 30 min over Excelons. I love the capacitive face response, so smooth. We have tried updating the 4660 over phone app and with USB and almost always have to use USB. Tried Apple and Android for the new CarAVAssist app, and it is still buggy and too involved for a customer, as they might brick it. After the amount of 4500s we are now dealing with due to bricked SD cards I am glad they switched to flash memory like Kenwood, but it sure takes away from the fun of playing with the files. Im sure someone will crack that at some point soon. 

I actually went from a DMX7706 to this because the DMX was too buggy with carplay and didn't play with my Jeep well (steering controls would drop like mad). Ended up returning it and picking up the pioneer. The higher-end one were much better quality though, I snagged this pioneer because I didn't want to pay the price of an Alpine which is the typical go-to for the Jeeps. Other than the SDCard failing they're pretty solid units, I'd like to think it was just a bonehead decision since I've worked with plenty of mid-range SDcards that don't have these kinds of failure rates under hard conditions. But I've also worked with quite a few Six Sigma process improvement types that'd jump at an opportunity to cut costs and cheap out in the midrange. That or it's a bug that led to a full partition, my other theory. If that's the case they gotta know by now and if they were consumer friendly would publish an update. I just notice that the 8400/8500s are on the same platform with much less complaints, I suspect they use more expensive SDcards in those since they're high end vs mid - that's how they delineate them in the config files; AVH_MID and AVN_HIGH. lol

You can bring them back, but it's not super pretty right now. I'm about to post the instructions. Takes few min of work but it'll boot them with all the original functions working. iGo/NAV icon will show up but doesn't work - not sure the best way to hide that yet. I've burned through 10 sdcards with test images, i've gotta find a better/cheaper supply or figure out how to get the unit to unlock those SDCards for me. If I was better at soldering and had an extra unit, I'd see if I could pull the firmware and sniff out the password. 

Well the soldering thing isnt a problem, I have a smd rework machine and various solder stations. If you can explain the software stuff you need, I can handle the hardware part of it. I have rooted all my android phones and played with roms in the past but Im not a software guy, by any means. I may have another 4500 at work, Im not sure..we sent so many back to United Radio which is the repair center Pioneer tells us to use. I am willing to sacrifice this one, and I have a ton of SD cards if you want me to try something, let me know.

Off topic but the DMX706S is what I chose to put in the wifeys new SUV for Xmas. Its hard to beat for the price/features. The Kenwood 47/4707 series has short chassis with capacitive touch but is being built really cheaply by somewhere in China for kenwood.  It has the euro power plug and even the packaging is not the standard kenwood stuff. Covid affected our ability to get many models we normally sell so we were grabbing anything we could from Pioneer/Kenwood. We do sell a lot of Alpine for jeeps, I remember when everyone wanted a Halo, but now we do the Stinger Heigh10 often for GM/Jeep and since we almost exclusively use PAC RADIO PRO products, the integration with any headunit works great. What we did find on Kenwoods was the USB cable length mattered so try not to use the extension, or the factory console USB. We put a USBDMA1 where the right side 12v outlet goes and no matter the brand no dropouts. On dual USB models we also tie into the factory USB and it works fine for usb drives, etc.

Some quick updates since... well.. my last updates.. 

Quick notes on getting the ACH-W4500nex running with the W4400 image

You don't need to edit any of the .prop files to make the 4400 image work with the W4500NEX, just edit the sysd.conf file in the etc directory on partition 7 (the "Platform or System partition). The hardware is pretty identical between the W4400 and W4500 - the core of the x400 and x500 series is the same actually, only differences are the various modules tacked on. For me the process basically goes like this; Write image to SDCARD > Update SD Card > Install in radio. I installed an SDCard Extension Cable in mine to make the process easier incase the next sdcard fails but I have the room for an external SDcard slot, you might not. 

Couple of warnings;

• You might damage your unit - you probably don't care since it's not working anyways but unless you know what you're doing don't try this on a working unit. 
• Your SDCard is permanently dedicated to this - as soon as you put in the hidden slot and boot the unit the card will be locked with a password nobody knows yet. This means it can't be read by windows/linux/macos/etc and it can't be reformatted or wiped. It's toast to all but the headunit. Buy a few extra just incase and don't use SDcards you can't afford to lose. You probably know this but it's a good reminder. 
• First day or so might be buggy, rebuilding cache and indexing everything seems to really impact performance with older android frameworks. 

Here's the process;

1. Write the 4400 image to an "SDHC" specific SDcard, 16gb is fine. Needs to be SDHC for it to work properly, does not support SDXC cards very well. It's also picky even with the SDHC cards. If your unit won't boot, is extremely slow or reboots multiple times before it boots up then you might need a different SDcard. I have 4 SDHC cards that simply don't boot right, possibly because they don't support the CMD42 locking process the head unit does. 
   • I use dd in linux with ubuntu but you can do this with a few different windows tools too. 
2. Edit the file at /etc/sysd.conf and find the entries for the W8400nex (product model="NX450,UC") then make the following changes under this profile;
   • Change sysdconf.com.hasDetach from FALSE to TRUE (for the detachable face)
   • Change sysdconf.tm.tmc from FALSE to TRUE (TMC doesn't exist in this model, leaving this enabled slowed down my unit) 
   • Change sysdconf.com.TouchType from "capacitor" to "resistence" (important for the touch screen to work) 
3. Install the SDcard back into the headunit (for those new to the program, it's internal so the you need to take it part to access) and boot it up. One of a few things will happen;
   • you'll get to the home screen and it works - awesome! 
   • it'll act up but eventually make it to the homescreen and/or be really slow
     • Most likely it's going to be the SD, especially if it boots with distorted graphics or reboots multiple times. Try another SDHC (8gb to 16gb) from a different manufacturer. Quicker SDs (i.e. 100mb/s Class 10) seem to make it more responsive but Class 4 work just as well. SDXC cards usually 64gb or higher generally causes a huge 1+m lag in boot and very spotty interface. 
     • Check to make sure you saved the file in the right place, or that you didn't accidently delete a quotation mark.
   • it won't work and just keeps boot looping eventually to an error. 
     • SD card is not supported or the image isn't being read. Try putting the Sdcard back into a machine, if it reads fine then something is wrong with the headunit. When it's working, it'll running a command called CMD42 that locks the SDCard with a password. It will do this even for blank SD cards (ask me how I know). If your SDcard isn't write protected your unit is probably either bricked or hardware has failed. 

Once it boots everything should work except for maybe idatalink maestro so my steering wheel controls are down. When I pull my dash again and reflash I'll report back. For me HD Radio, SiriusXM, Carplay, Android Auto, Bluetooth, Wifi and backup camera all worked. I haven't tried all the other features yet but I suspect they work too. iGo navigation icon shows up but won't load. Also now my radio self-identifies as a W8400nex instead of a W4400nex so there's that. That's why we I to edit those entries in sysd.conf instead of the W4400 entries. I suspect there's a config file somewhere on the image that I haven't found that sets the model. 

There's a lot more to be done, I'd like to map out what some of the options are in sysd.conf and how to unlock the cards. Debug and all that would be nice but I'm focusing on trying to root Android Automotive. It's a really old version of android (4.2.2) so it shouldn't be all that difficult. 

At some point I'll update the first post in this thread with a much better set of instructions. This can help get people going as more waves of W4500s start to fail. 

Thanks for all your hard work with the 4500NEX.  I've posted a few posts in the forum about the 4500NEX.  So i have a newer 4500NEX I purchased in November.  So I have warranty until November 2021.  However after hearing all the boot loops, I'm concerned with my unit failing after the warranty period is over. So me being proactive, I'd like to have a SD ready for the day when (not if) my 4500 fails.  In the meantime, i'd like to help the cause.  Because I have my 4500Nex running with factory SD, is there anyway I can back up my factory SD so we have an actual 4500 image not a 4400?  I've tried a testmode using USB1 and searching for the proper way to backup my internal SD but it seems like no one says it for the 4500 unit?  Anyways, if you can help that would be appreciate.  Thanks again.

On 2/5/2021 at 8:33 AM, GettinOld said:

Thanks for all your hard work with the 4500NEX.  I've posted a few posts in the forum about the 4500NEX.  So i have a newer 4500NEX I purchased in November.  So I have warranty until November 2021.  However after hearing all the boot loops, I'm concerned with my unit failing after the warranty period is over. So me being proactive, I'd like to have a SD ready for the day when (not if) my 4500 fails.  In the meantime, i'd like to help the cause.  Because I have my 4500Nex running with factory SD, is there anyway I can back up my factory SD so we have an actual 4500 image not a 4400?  I've tried a testmode using USB1 and searching for the proper way to backup my internal SD but it seems like no one says it for the 4500 unit?  Anyways, if you can help that would be appreciate.  Thanks again.

This is the guide for making a backup of the internal SD Card my friend I would be very interested in a copy of the backup. My unit is fried hoping you can rescue me so that I won't have to send it to pioneer!

http://avic411.com/index.php?/topic/81469-avic-development-mod-device-backup/

In the event that my unit gets repaired by pioneer I will fill everyone in after I make a backup myself But please still reach out and provide a factory img of the 4500nex if you can and save us all from the RMA process!!!

Hi,

Im from Argentina. 

Any news here? I have the same issue (bootloop) in my 4500nex. And I dont want to go with the Russian guy in ebay option.  

If someone has the img please tell me.

Regards

Russian guy will be your best bet.

3 hours ago, bonee said:

Russian guy will be your best bet.

hahahaha, I know...

Pioneer AVH-W4500NEX - Boot screen loop: So I was having the same issues as many other people have mentioned with the boot screen looping.  After a lot of research and reading several posts I have finally brought my 4500 back to life.  As a recap I did the following:

1. Pulled entire stereo out of car and took a part to get to the the SD card behind the front cover.  You don't need to do that.  After a little bit of back and forth I did figure out if you can get a screw driver under the bottom of the screen you can pop the release and pull the screen out.  From there I was able to use a pair of pliers and pull on the tray (don't pull too hard, if it is unlocked it should begin to slide out otherwise it may be locked.  It may take a couple of times powering the system on and off to get the mechanical lock to release).  If you can pull the tray out then remove the screws on each side of the tray, this will allow you to pop the front plastic off and undo the cable on the back.  
2. Once I had the cover off I went ahead and cut the slot in the plastic to allow me access directly to the SD card without having to remove the cover.  In my case I knew I would be trying a few things to get it working so it was well worth the effort.
3. Next I purchased a couple of SD HC1 (16 GB) cards from amazon (Micro Center brand).  I had also used a 32GB card which worked.
4. Downloaded the AVIC.zip from https://mega.nz/file/SdJCgKCJ#13zrFlogMCWNohCvuFsDFcC1uniHgufVZJxZlQPHUag
5. Installed win32imagerhttps://win32diskimager.org/.  For some reason couldn't get it to work on all computers, would click run and nothing would happen after install.
6. Extract AVIC.img file from zip and use win32disk imager to write to SD Card.  Windows will no longer recoginize the card after you do this.  Don't worry it is just in an android format that windows doesn't recognize.  If you have a 4400nex you can just install the card in your stereo and it should work.  If you have a 4500 continue on reading.
7. Now here is where it gets more complicate for the 4500.  To get the touchscreen to work you will need to modify the files that you wrote to the card.  But, as I mentioned Windows won't be able to read the card so you will need either a linux machine or install a virtual machine on your windows pc.  Let's assume you need a vm machine.  
8. Download virtualbox from oracle https://www.virtualbox.org/.  If you want a good tutorial on virtual machines I would recommend Network Chuck on youtube. 
9. Download linux (is used kali).  https://www.kali.org/
10. Install virtualbox and then import kali linux once you have virtualbox running.  Login for kali once it is imported is user: kali, pwd: kali
11. Once you are logged in you will see a device menu option at the top, make sure the SD card is in the card reader and click devices, connect to the card reader that should hopefully be listed.  Give it a minute or so to recognize and connect to the card.
12. Open the file explorer on the Kali desktop and you should see the SD card broken out by a couple of partitions.  Find the partition with the etc folder and open that.  Right click on the sysd.config file and choose open terminal at this location.
13. on the command line type sudo vim sysd.config
14. VIM is a notepad/editor.  I tried using the GUI editors but they wouldn't allow me to save the file.  I found vim would.  Now scroll down till you find the section for the 8500.  In there change the setting from "capacitator" to "resistence".  In VIM you type "I" to begin editing, ESC to stop editing and x: to save and exit.
15. Once that is done you should be able to insert the SD card into your 4500 and everything will work.  At least it did for me.
16. On a side note I would recommend putting a CD into your stereo if you took the time to cut the SD slot in.  If for some reason you aren't able to get the touchscreen to work you can press and hold eject button down and the screen will slide down and out of your way to get to the card slot.  If you don't have the CD I wasn't able to get to the slot without popping the cover plate off and prying like mentioned earlier.

Good luck and hope this helps.

I appreciate Potterg’s detailed information on how to get this thing taken care of but I cannot seem to get the file sysd.conf to edit and save because it is read only. I’m not an expert in Linux but I can follow directions and no matter what I do, force a save, change the file to not read only, etc. I just cannot edit the file and save it. I can edit it, just not save it.  I am just at a loss. 

Update:

I forgot that I had an old Acer laptop that I had Linux Mint 17.3 installed on it. I broke it out, did the updates, installed VIM on it. Fortunately I had an old Kingston usb sd card reader that I had to find. Plugged it into the Acer, put the sd card in it. BAM, all the sections showed up on the desktop. I found the sysd.conf file, opened it with VIM, edited the file and :w, and on the screen it said something to effect of “file written”. I about crapped myself, after at least a dozen attempts using Kali on a virtual machine and getting no where, trying anything could think of or find online. Now after while I will head out to my truck and see if it works. 

Update #2 - Final Update

Follow up, the sd card worked but defaulted to a 8400, it worked but it loaded real slow, couldn’t adjust the clock, etc. Few things not quite right.

So, it started over. 
I purchased a couple of SD HC1 (16 GB) cards from amazon (Micro Center brand).

Installed win32imager

https://win32diskimager.org/.

Extracted AVIC.img file from zip and used win32disk imager to write to SD Card.

Moved to my Linux Mint machine, used VIM to add the w4500 config info to the sysd.conf file, removed all the other info so it had to pick that info. 
So far it seems to work fine with minimal testing. The Wi-Fi connection seems a little squirrelly, but not sure. 

I just want to thank everyone who did what they did and put all that info on this website. I would have never fixed this without all that help. 

Does anyone have a 4500 image I can get?  My 4500 no longer will remember my iPhone and so my wireless CarPlay will not work except to re-set it up every time I turn in my car. And now it isn’t storing settings and I get the Sirius XM your favorite bands are updated message. Even when I turn it off in settings it comes back upon turning the car on again. 

@Potterg

@slackwaredragon

Question for you. I have created a replacement SD card for my AVH-W4500 and all works except for the integration of my Maestro RR. I have programmed the Maestro RR with the correct serial number from my AVH-W4500 but no matter what I have tried the Maestro RR continues to state I have provided it with the wrong serial number. 

Listed below is what I have done so far:

I was able to download the AVIC4500only.img file from this old link (https://mega.nz/folder/AI9RxZjZ#jAXMB8e-8tPlBF5s5VUvBQ) before it was removed. I have since posted this file to the following Google Drive location.

https://drive.google.com/file/d/1FhhDuE2QdXU0mvF_G7n_8hURPUZ0Jb7R/view?usp=sharing

I was able to paste the image to a new SD card and install it into my AVH-W4500NEX and it worked like a charm. 

I used a Sandisk Extreme SDHC UHS-I/U3 16GB SD card (~$15CAD from Amazon), used "balenaEtcher" on my MAC MINI M1 to get the image flashed onto the SD card, and followed the following Youtube video to take the head unit apart and reassemble it.

https://www.youtube.com/watch?v=2cHp6jxD5R8

The firmware is showing as version 1.02 with this image (my old firmware was listed as 1.00). After the SD card replacement/ firmware upgrade I confirmed that the serial number that shows up in the System Information screen of my AVH-W4500NEX still matches the serial number that is on the sticker on the bottom of the unit.

Apple CarPlay (both USB and Wifi) works fine.

The only thing that I still cannot get to work is the Maestro RR. I continually get the double red flashing light on the Maestro RR even after I have successfully re-flashed the Maestro RR (multiple times), and have factory reset the AVH-W4500NEX.

I reached out to Auto Motive Data Solutions (ADS) tech support and got the following response:

I have seen this is a few times now and while you were able to swap the SD card that is only one part of the fixing your original issue, the other step requires Pioneer sync the embedded information from that SD card to the radio. The only way I have seen this done successfully is by sending the unit into Pioneer Warranty or an authorized Pioneer service center to complete this side.  Once done you should be able to pull the new serial number on the radio flash the RR.

I have also discovered that when I copied the above image file to a USB drive I can read some of the files on it as I have installed extFS for Mac on my Mac Mini M1. I was wondering if I should copy the above image to a new SD card and then see if I can make the required modifications before I install the SD card into my AVH-W4500NEX. I did notice that there are dome DB files in the DataManager folder that I could edit. The screen shots below show the DataManager folder I was able to access along with the Other Info.db file where I found the device MAC address. 

Any insight you could provide would be appreciated.