Hack Your Navi Summarized! (Change pics and remove nag screen)
Has anyone been able to figure out how to trick the newer units (Software V 4.x) into loading other vehicle’s applications?
The older units (Software V 3.x) chose a specific BIN file according to the DVD Hardware. Tricking those units was rather simple as renaming the BIN file and reloading the software would do the trick.
The newer units (Software V 4.x / 6.x) uses a common BIN file which now bundles all the applications together. The hardware now all open a similar BIN file and the logic to match Hardware with Software is done after loading. i.e. there must be a config file within the BIN that the newer units read or something… I’ve been poking around but haven’t come up with anything…
It would be interesting to see if we could trick these units into loading the RL applications and activate the XM Live Traffic control or the Ridgeline application to allow the Rearview camera operation.
The older units (Software V 3.x) chose a specific BIN file according to the DVD Hardware. Tricking those units was rather simple as renaming the BIN file and reloading the software would do the trick.
The newer units (Software V 4.x / 6.x) uses a common BIN file which now bundles all the applications together. The hardware now all open a similar BIN file and the logic to match Hardware with Software is done after loading. i.e. there must be a config file within the BIN that the newer units read or something… I’ve been poking around but haven’t come up with anything…
It would be interesting to see if we could trick these units into loading the RL applications and activate the XM Live Traffic control or the Ridgeline application to allow the Rearview camera operation.
I'm thinking the car model identity is not read from the BIN file because the same BIN file is used for multiple models. For example, white disc version 4.55,which comes with 07 Accords, has only two sets of BIN loader files - 07Touch.BIN, 07Touch2.BIN, 07Jog.BIN, and 07Jog2.BIN, and can be used on any Honda or Acura that uses white discs.
The car model identity may be a registry value set at the factory.
Some other details.
Some of the code that was in the executables appears to have been moved to associated DLL's. For example - TripProcess.exe, TripFunction.dll. There are TripFunction.dll, TripFunctionOH.dll, TripFunctionPS.dll, TripFunctionSDAX.dll, and TripFunctionSDRX.dll. The different dll's are probably called depending on the model identity - SDAX for example is the model identity of Accord.
HMIManager.exe appears to have been superseded by HMIManager.dll (and possibly HMICommonFW.dll and HMICommonFWPS.dll). I'm not sure what calls these DLL's.
For white disc-using Hondas, file substitution for replacing the startup screen is more complicated. Opening1.bmp has been superseded by a combination of OpeningBase.bmp and Honda_emblem.bmp layered over it, so replacing OpeningBase.bmp with your own file probably won't prevent Honda_emblem.bmp overlaying it. Might have to remove the image from Honda_emblem.bmp.
For white disc-using Acuras, file subsitution for replacing the startup screen may still work because it seems that Opening1.bmp is the only file used.
The car model identity may be a registry value set at the factory.
Some other details.
Some of the code that was in the executables appears to have been moved to associated DLL's. For example - TripProcess.exe, TripFunction.dll. There are TripFunction.dll, TripFunctionOH.dll, TripFunctionPS.dll, TripFunctionSDAX.dll, and TripFunctionSDRX.dll. The different dll's are probably called depending on the model identity - SDAX for example is the model identity of Accord.
HMIManager.exe appears to have been superseded by HMIManager.dll (and possibly HMICommonFW.dll and HMICommonFWPS.dll). I'm not sure what calls these DLL's.
For white disc-using Hondas, file substitution for replacing the startup screen is more complicated. Opening1.bmp has been superseded by a combination of OpeningBase.bmp and Honda_emblem.bmp layered over it, so replacing OpeningBase.bmp with your own file probably won't prevent Honda_emblem.bmp overlaying it. Might have to remove the image from Honda_emblem.bmp.
For white disc-using Acuras, file subsitution for replacing the startup screen may still work because it seems that Opening1.bmp is the only file used.
This is great info sejong.
I agree with your general assessment. I'm seeing that the BIN files change names from version to version so I believe that the OS reads a common config file that points to the BINs which allow it to be named differently. Definitely a more complicated system...
BUT... I'd like to note that the nag screen shows up MUCH faster than the old system. In fact, it shows up so quickly, by the time I start the car and put my seatbelt on, I can hit the OK. Before, I'd still have to wait several seconds. The nag screen isn't much of an annoyance anymore. I'll have to time the difference.
I agree with your general assessment. I'm seeing that the BIN files change names from version to version so I believe that the OS reads a common config file that points to the BINs which allow it to be named differently. Definitely a more complicated system...
BUT... I'd like to note that the nag screen shows up MUCH faster than the old system. In fact, it shows up so quickly, by the time I start the car and put my seatbelt on, I can hit the OK. Before, I'd still have to wait several seconds. The nag screen isn't much of an annoyance anymore. I'll have to time the difference.
Just to let you guys know that "AngryDad" has claimed to have cracked the OK button and is presently working on finalizing the patch for the Navi system on TLs... You can find his thread here: https://acurazine.com/forums/showthread.php?p=1554285
Originally Posted by convenientstore
What is the size of the resulting image? Also when you do 'File'->'Save As' after converting it to Indexed color mode. Remember to select 'File Format->Windows', 'Depth->8 bit' and not to select 'Compress RLE' or 'Flip row order'.
??
I am using photoshop 9 CS2 and when I do file save as, I do not get windows as one of the option for file format........ grrrrrrrrrr someone help meeeee
??
I am using photoshop 9 CS2 and when I do file save as, I do not get windows as one of the option for file format........ grrrrrrrrrr someone help meeeee
In Photoshop CS2, after you are done modifying your image and have specified the color index, 173 colors, etc., go to File -> Save As. Select BMP on the drop down menu. Click Save. Then you will be presented with a dialog box asking you for additional options including Color Depth and whether to use RLE (don't).
For the 4.x software, it looks like the PRG_INFO.MNG file is the common file that tells the hardware which BIN files to use.
I have 2 versions of the 4.x software (4.13B and 4.31C). The PRG_INFO.MNG lists all of the BIN files depending on version... i.e. 05jog.bin, 05touch2.bin, etc for version 4.31C and shja2.bin, sjca2.bin, etc for version 4.13B
If I've got time, I'll muck around with the newer 4.x software and see if we can load specific application modules... XM traffic, HFL, Rearview camera, Trip computer, etc...
I have 2 versions of the 4.x software (4.13B and 4.31C). The PRG_INFO.MNG lists all of the BIN files depending on version... i.e. 05jog.bin, 05touch2.bin, etc for version 4.31C and shja2.bin, sjca2.bin, etc for version 4.13B
If I've got time, I'll muck around with the newer 4.x software and see if we can load specific application modules... XM traffic, HFL, Rearview camera, Trip computer, etc...
Changed pic and nag screen text, no problems here
I just got done changing the load pic and the nag screen text without any problems on my 06 TL.
General info:
Version 3.5 orange disc
Image was made in Photoshop CS2, 478x232, 173 colors, 8-bit BMP (on CS2, maybe also with other versions of Photoshop, it won't prompt you for the color depth and compression settings until after you've clicked "Save" in the "Save as..." dialog). Image size was 109k (112,108 bytes). The pic loads just as quickly as the factory pic. If your pic is loading slowly, reduce the resolution, reduce the number of colors in the color palette, or use a fresh copy of your .BIN file.
To change the nag screen text, I used xvi32 to edit the navi.exe file. Just search "traffic laws" text string and it will show you two locations where the text for the nag screen is stored. I'm not certain which location the navi actually pulls the text from, although I have very good reason to believe it's the second (later) location (around dec. 4494296 in BNHH401A). But, just to be certain, I changed the text in both locations anyway. Note that you must replace the nag screen text with the same number of characters as the original text. For example, the first line is "This system provides route information", which is 38 characters long. The text you want displayed on the first line can be 38 characters long at the most. If your first line text is less than 38 characters, use white spaces to pad your text until you reach 38 characters. This applies to all of the lines. Note that (at least on BNHH401A) the last sentence, "See your owner's Manual for complete instructions." is entered as one line in the first nag text location, but two lines in the second nag text location. If you make a mistake, don't try to "fix" the file. Just close it without saving changes and start over.
The command I used to update navi.exe in the bin file was:
dumpnavi BNHH401A.bin update navi.exe
I used an Imation CD-RW and Roxio. In roxio, select "Data", then "Data Disc". Then go to Tools -> Options. Under "Data", select "Disc at Once" under the "Type" menu, "Mode 1" under the Mode menu, and "ISO+Joliet (106 character file names)" under the file system menu. Click on the "I only need to use discs for one recording..." radio button. Add the bin files and burn.
When trying to load the burned disc into the navi system, I got the message saying the disc was no good. As instructed, pressing Map+Menu+Cancel, then version, then load disc again caused the disc to be loaded normally.
Everything worked like a charm on the first try. Just be very careful and detail oriented when entering dumpnavi commands, reading instructions, or editing the hex in navi.exe (when editing navi.exe, it took me 4 tries before I was able to type the nag screen text in without any mistakes or accidentally deleting a character that wasn't part of the original text). If anyone has any questions or problems, feel free to ask here or shoot me a PM.
General info:
Version 3.5 orange disc
Image was made in Photoshop CS2, 478x232, 173 colors, 8-bit BMP (on CS2, maybe also with other versions of Photoshop, it won't prompt you for the color depth and compression settings until after you've clicked "Save" in the "Save as..." dialog). Image size was 109k (112,108 bytes). The pic loads just as quickly as the factory pic. If your pic is loading slowly, reduce the resolution, reduce the number of colors in the color palette, or use a fresh copy of your .BIN file.
To change the nag screen text, I used xvi32 to edit the navi.exe file. Just search "traffic laws" text string and it will show you two locations where the text for the nag screen is stored. I'm not certain which location the navi actually pulls the text from, although I have very good reason to believe it's the second (later) location (around dec. 4494296 in BNHH401A). But, just to be certain, I changed the text in both locations anyway. Note that you must replace the nag screen text with the same number of characters as the original text. For example, the first line is "This system provides route information", which is 38 characters long. The text you want displayed on the first line can be 38 characters long at the most. If your first line text is less than 38 characters, use white spaces to pad your text until you reach 38 characters. This applies to all of the lines. Note that (at least on BNHH401A) the last sentence, "See your owner's Manual for complete instructions." is entered as one line in the first nag text location, but two lines in the second nag text location. If you make a mistake, don't try to "fix" the file. Just close it without saving changes and start over.
The command I used to update navi.exe in the bin file was:
dumpnavi BNHH401A.bin update navi.exe
I used an Imation CD-RW and Roxio. In roxio, select "Data", then "Data Disc". Then go to Tools -> Options. Under "Data", select "Disc at Once" under the "Type" menu, "Mode 1" under the Mode menu, and "ISO+Joliet (106 character file names)" under the file system menu. Click on the "I only need to use discs for one recording..." radio button. Add the bin files and burn.
When trying to load the burned disc into the navi system, I got the message saying the disc was no good. As instructed, pressing Map+Menu+Cancel, then version, then load disc again caused the disc to be loaded normally.
Everything worked like a charm on the first try. Just be very careful and detail oriented when entering dumpnavi commands, reading instructions, or editing the hex in navi.exe (when editing navi.exe, it took me 4 tries before I was able to type the nag screen text in without any mistakes or accidentally deleting a character that wasn't part of the original text). If anyone has any questions or problems, feel free to ask here or shoot me a PM.
Originally Posted by Warren803
4 tries is pretty damn good. If i remember correctly, took me probably 6 or 7 tries before I got the text correct. What did you end up changing your text to say? Any pics?
Eventually I'll change it to something else when I'm feeling more creative. For today I just wanted to change the text and pic to whatever so that I could at least verify I could do it.
kennyc has created a great new thread that contains all new updated hacks (trip computer and nag screen removal). It is located here: Everything you want to know on how to hack your Navigation System
Please continue all further discussion there. This thread is now retired.
Please continue all further discussion there. This thread is now retired.

Thread
Thread Starter
Forum
Replies
Last Post
Gianni Formica
3G TL Audio, Bluetooth, Electronics & Navigation
1
Sep 7, 2015 08:28 PM
yahelou
3G TL Audio, Bluetooth, Electronics & Navigation
1
Sep 6, 2015 09:12 PM
SUPRMN84
3G TL Audio, Bluetooth, Electronics & Navigation
0
Sep 2, 2015 11:50 PM


I've replied to your PM.

