BChin324

Has anyone tried to mess with their Navi DVD disc to see whether you can create and put personal screen savers for background or startup pic like the boys on the TSX forum? If unknown to this, check this forum out.

https://acurazine.com/forums/showthr...4&page=1&pp=25

lead_sled_dog

The TSX thread started another on the Honda AV6 forums. Lots of people are already modding their screens. Check it out at http://www.v6performance.net/forums/...ad.php?t=51626

goldmemberer

This hack doesn't seem to work w/ the 2nd gen CL navi... or am I being dumb? There's no "Version" button at the Map/Guide + Menu + Cancel screen. I figured out how to load the modified BIN file but how can I find out what BIN to modify?

leroix

The hardware in the newer generation navi's is considerably different than what is in the 2nd gen CL's... The current model TSX has a Hitachi SH-4 microcontroller, but our 2nd gen's use a completely different (and incompatible) architecture.

I have pulled the rom files off of my navi DVD and tried to analyze them using an interactive disassembler-- This program spits out that the file I'm feeding it is in fact a valid executable file, and that it is most likely for an NEC V800 series 32bit RISC microcontroller--

... This is from NEC's website for the V832...
...

This microcontroller only had a limited success, and has since been superceded by newer designs, so I think its unlikely that we'll be able to find tools to help reverse engineer this design...


_Larry

BChin324

Thanks Larry

leroix

I cracked open my navi unit today, just to verify what kinda processor is in there... Turns out as I thought, its an NEC V800 series processor. Specifically, it is a V831 32bit RISC processor operating at 100MHz. I've labelled the interesting features of the board for anyone who's interested...

but again, we're pretty much SOL as far as easily modifying things as the people with the newer gen navi's have....

_Larry

03_CLS_6sp

I wonder if one could find an NEC V800 series emulator, and get the Navi DVD to boot up in an XP window...this will be a tough nut to crack, but it can probably be done, just need to find a genious teenage hacker/reverse engineering expert.

Allout

Impressive command of knowledge on the subject. Good info.

leroix

being a phd EE student comes in handy for a few things.

I took a look at the files on the new 2.30A disc, and they're basically the same as 2.11C and 2.20... The only thing that's been updated is the data file...

The file dates on the 2.30A DVD make it seem like this databse isnt all that new....

In any event... they only hope for changing things around is finding a dissassembler for the V830 series (not likely, the closest available is for a V805/810 which is much more primitive...) or getting a copy of the Metrowerks tools that Alpine uses (not likely as the software is listed as discontinued by MW and was never popular enough to be available from *other* sources...)

SiGGy

IDA pro will disassemble the binarys.

And the boot image is in a EEPROM file on the disc (i forgot which, Ill check my notes). I was able to disassemble and decode most of the units executables and the EEPROM flash (from the file).

I was looking into changing the flash but I didn't finish analyzing the EEPROM data.

have fun.

My ride boots up to a totally customized XBOX on the dash anyway, so I didn't finish my work. Maybe I will one day...

I rarely use my NAVI anymore, my system boots up and plays MP3's automatically from my playlists with GFX representation of the music. I control the unit with a mini wireless controller. Setup works great... (yes it also plays divx/dvd and just about any media format for that matter) If anyone wants a video of bootup or the menu system I'll make one.

Here's some video files of my car playing mp3's. Sorry the mic couldn't take my 3 10' subs And the video is shitty...

http://24.221.29.241/xbox_navi/

leroix

I tried with IDA pro and I couldnt get it to work-- the IDA page doesn't show support for the NEC V8xx series processors...

http://www.datarescue.com/idabase/idaproc.htm

What it will do is *guess* what the different segments of the ROM file are, but since it doesn't know how to decode the instruction set you don't really get anything useful.

Unfortunately, the V831 does not have a MIPS core like the later versions, its an NEC custom design. If you've got a custom setup for file for IDA to decode V831 instructions, please share.

Thanks,
Larry

SiGGy

Yes, it comes with the newest release of IDA pro.

What version are you using?

Also if your a linux guy there are a few SDK's available for the X800 series processors and GCC will compile/disassemble the binarys as well.

A lame google search even brough this up...
http://www.ee.nec.de/_pdf/U10782EJBV0PF00.PDF

and if that's not enough for you...

Another obligitory google search...
http://www.necel.com/micro/english/v...third_com.html

Let me know if you need help with IDA pro. Although the free tools are much harder to use that the development stuff available from the manufacturer. I was able to analyze a large portion of the code on my own. For the EEPROM flash anyway... although I was specifically looking to jump around the press "OK" and replace the splash GFX.

hmm... now that I'm thinking about it maybe it was a debugger in linux I was using... this was so long ago I don't recall. Ya, I bet I was using IDA for the xscale work I was doing... hmm... I'm not positive though...

Anyway, if you need any help let me know... I'll see if I have some of my notes and crap still on my boxes here at home. Doubtful though...