Hacking Navi (continue)
#1
Hacking Navi (continue)
I see that threads about hacking Navi DVD are dead. So I try to resurrect this discussion.
I found an utility (dumprom - http://www.xs4all.nl/~itsme/projects/xda/dumprom.html) that can extract files from ROM images. But unfortunately it does not work for our ROM image. So I have written my own utility. It extracts files and modules from *.bin file from Navi DVD. Extracting files works fine. Extracting modules works too, at least IDA(interactive disassembler that supports SH4 among with other CPU) accept them.
So now you can do reverse engineering if you want.
http://home.earthlink.net/~akonshin/...unpackNavi.zip
Just unpack it in some directory, put *.bin file to that directory then run unpack.bat
It should create subdirectories "Files" and "Modules".
Sorry for my terrible English.
I found an utility (dumprom - http://www.xs4all.nl/~itsme/projects/xda/dumprom.html) that can extract files from ROM images. But unfortunately it does not work for our ROM image. So I have written my own utility. It extracts files and modules from *.bin file from Navi DVD. Extracting files works fine. Extracting modules works too, at least IDA(interactive disassembler that supports SH4 among with other CPU) accept them.
So now you can do reverse engineering if you want.
http://home.earthlink.net/~akonshin/...unpackNavi.zip
Just unpack it in some directory, put *.bin file to that directory then run unpack.bat
It should create subdirectories "Files" and "Modules".
Sorry for my terrible English.
The following users liked this post:
abcman (01-20-2015)
#3
Originally Posted by e_lectro
Now you just need to write something that puts them back after I modify them
#7
Originally Posted by savage
is there a way you can make a image of what you retrieve and make a duplicate without modifing the data?
My goal is to do all tricks without changing existing DVD. I think it is possible. During booting WinCE initializes devices and PCMCIA slot is one of them. I see that storage PC Cards are supported (BTW, it looks like it also supports some modems and network cards). Another way is to use COM-port to connect to navi from notebook or PDA via any terminal program. It looks like we can send commands to shell.exe (that always runs), for example, we can start processes that we can place on PCMCIA storage PC Card. If it is possible then we can do with navi whatever we want.
I also thought that we might get access via console driver but I found out that console.dll is missing in navi ROM.
BTW, I think my program extracts some modules incorrectly (at least nk.exe). I will try to fix it. But it works fine for other modules that I've tried to investigate and, of course for all files. Of course we have some sources for kernel in Windows CE SDK but I want to know which features are included in kernel of navi OS.
Trending Topics
#8
Originally Posted by khannie112
damn you hackers....I requested this before...Please hack into the Navi with a screen saver of Anna Kournikova. I will gladly pay $$$ for that version!!!
Why Anna? You are behind of life - now Masha Sharapova should be your favourite .
BTW, I am russian too.
BTW, replacing of this "screen saver" is relatively easy and can be done if we find the way to replace flash ROM image.
#9
Originally Posted by biker
Do you ever worry that the Acura software :cop: might be onto you?
Anyway we bought this unit legally and we definitely will not use this unit and navi database outside our car .
#10
Well, you might be right with the +/-R thing, but with bitsetting the readter will think it's -ROM.... so there is a good chance it will work. MY old Sony will not play +R, but it will play the bitset ones.
e_lectro
e_lectro
#11
Originally Posted by e_lectro
Well, you might be right with the +/-R thing, but with bitsetting the readter will think it's -ROM.... so there is a good chance it will work. MY old Sony will not play +R, but it will play the bitset ones.
#12
Originally Posted by ak217
Why Anna? You are behind of life - now Masha Sharapova should be your favourite .
BTW, I am russian too.
BTW, replacing of this "screen saver" is relatively easy and can be done if we find the way to replace flash ROM image.
Yeah, I'll definitely be following these posts and see if I can get Anna to boot up on my Navi everyday
#13
Originally Posted by ak217
Hm. What do you mean by "bitset"? I have never heard about this. I have Lite-On DL DVD writer. Do you think it may work? I don't want to spend $10-$15 for a blank DL DVD disk while we are not sure that it works.
As far as bitsetting and what you can do with your burner, check out this forum:
http://club.cdfreaks.com/forumdisplay.php?f=44
Lot's of good information there
#14
I can't speak for the TSX one (becuase I have not bothered trying), but the 00 TL one will not work properly with a +DL. It will load, but it seems that it can't propperly read the 2nd layer of the disk so the maps don't really work. (I was trying to hack some of the files as well, which is why I was trying this).
I think a TSX might read a +DL, but I don't want to spend the $15 to figure it out since the older TL looks like I might be able to do some more interesting stuff with it.
W
I think a TSX might read a +DL, but I don't want to spend the $15 to figure it out since the older TL looks like I might be able to do some more interesting stuff with it.
W
#15
http://www.meritline.com/dl-dvd-r-du...ek-ridata.html
1 Pack Ritek Ridata DL DVD+R (Dual Layer, Double Layer) Blank Media 8.5GB 2.4X in Jewel Case, $9.99 Each
5 Pack Ritek Ridata DL DVD+R (Dual Layer, Double Layer) Blank Media 8.5GB 2.4X in Jewel Case, $9.50 Each
I think it is possible to load ROM from PC Storage card. Maybe we don't even need to write our image on DVD.
I'm trying to to undertand how initialization of kernel works and where it is looking for the image.
1 Pack Ritek Ridata DL DVD+R (Dual Layer, Double Layer) Blank Media 8.5GB 2.4X in Jewel Case, $9.99 Each
5 Pack Ritek Ridata DL DVD+R (Dual Layer, Double Layer) Blank Media 8.5GB 2.4X in Jewel Case, $9.50 Each
I think it is possible to load ROM from PC Storage card. Maybe we don't even need to write our image on DVD.
I'm trying to to undertand how initialization of kernel works and where it is looking for the image.
#16
I beleive that we CAN replace flashROM using Storage(ATA) PC Card.
On some of diagnostic screens there are buttons "Load Disk" and "Load Card".
So I will try to use the second button. Unfortunately I have no any PC Card and even have no notebook to write it. But I have an idea. There are several PCMCIA<->flashCard adapters on the market and they are relatively cheap (about $15-$25). I have several flash card (for cameras) and two of mine home computers have slots for such cards. So I hope I can use adapter+flashCard instead of ordinal storage PC Card.
BTW, if you have never heard about "diagnostic sreens" then:
Simultaneously press the MENU, MAP GUIDE and CANCEL buttons and hold it for about 5 seconds to go to the "diagnostic screen".
While on the "diagnostic screen", press the MENU, MAP GUIDE and CANCEL buttons again and hold it for about 5 seconds to go to the "developer's screen".
On some of diagnostic screens there are buttons "Load Disk" and "Load Card".
So I will try to use the second button. Unfortunately I have no any PC Card and even have no notebook to write it. But I have an idea. There are several PCMCIA<->flashCard adapters on the market and they are relatively cheap (about $15-$25). I have several flash card (for cameras) and two of mine home computers have slots for such cards. So I hope I can use adapter+flashCard instead of ordinal storage PC Card.
BTW, if you have never heard about "diagnostic sreens" then:
Simultaneously press the MENU, MAP GUIDE and CANCEL buttons and hold it for about 5 seconds to go to the "diagnostic screen".
While on the "diagnostic screen", press the MENU, MAP GUIDE and CANCEL buttons again and hold it for about 5 seconds to go to the "developer's screen".
#17
Originally Posted by ak217
I am not going to change anything. I am just looking for some undocumented capabilities.
Anyway we bought this unit legally and we definitely will not use this unit and navi database outside our car .
Anyway we bought this unit legally and we definitely will not use this unit and navi database outside our car .
#18
So if we can crack the main functions of the navi, can we change the voice protocols that the system follows??
eg: I say "what time is it" the navi responds "Look at the dash, you lazy asshole!"
eg: I say "what time is it" the navi responds "Look at the dash, you lazy asshole!"
#20
Originally Posted by jonnerd154
So if we can crack the main functions of the navi, can we change the voice protocols that the system follows??
eg: I say "what time is it" the navi responds "Look at the dash, you lazy asshole!"
eg: I say "what time is it" the navi responds "Look at the dash, you lazy asshole!"
#21
I am more interested in the following:
Changing the OSD for when the SHOND3 adapter is active (getting rid of the Sony 10-disc info and replacing it with something more effective)
Enhancing XM Radio and iPod functionality.
Changing the OSD for when the SHOND3 adapter is active (getting rid of the Sony 10-disc info and replacing it with something more effective)
Enhancing XM Radio and iPod functionality.
#22
Originally Posted by elduderino
I am more interested in the following:
Changing the OSD for when the SHOND3 adapter is active (getting rid of the Sony 10-disc info and replacing it with something more effective)
Enhancing XM Radio and iPod functionality.
Changing the OSD for when the SHOND3 adapter is active (getting rid of the Sony 10-disc info and replacing it with something more effective)
Enhancing XM Radio and iPod functionality.
#23
Originally Posted by elduderino
I am more interested in the following:
Changing the OSD for when the SHOND3 adapter is active (getting rid of the Sony 10-disc info and replacing it with something more effective)
Enhancing XM Radio and iPod functionality.
Changing the OSD for when the SHOND3 adapter is active (getting rid of the Sony 10-disc info and replacing it with something more effective)
Enhancing XM Radio and iPod functionality.
What is OSD and SHOND3?
About OEM mp3player:
I think it is impossible to read anything from OEM DVD player. Maybe I'm wrong.
My idea is to use compact flashes or external harddrives to store mp3 files and decode and play them directly on navi's processor. I believe it is powerful enough and can handle this load especially when navigation is off.
Actually I'm expirienced software developer but I am a novice in embeded systems, especially car systems. Even Windows CE and SuperH processor are new for me but as you see I learn them quikly. So maybe something is obvious for somebody but it does not for me.
I propose to cooperate.
I already bought CompactFlash<->PCMCIA adapter and I will test my idea about loading ROM image form PC Card maybe tomorrow.
Once again sorry for my English.
#24
Originally Posted by ak217
Sorry, I really don't understand what are you talking about.
What is OSD and SHOND3?
What is OSD and SHOND3?
#25
[QUOTE=ak217]About OEM mp3player:
I think it is impossible to read anything from OEM DVD player. Maybe I'm wrong.
My idea is to use compact flashes or external harddrives to store mp3 files and decode and play them directly on navi's processor. I believe it is powerful enough and can handle this load especially when navigation is off.
QUOTE]
Damnit, I figured that. The MP3 player connects to the car with an inline bus, data comm must be rather restricted.
I think it is impossible to read anything from OEM DVD player. Maybe I'm wrong.
My idea is to use compact flashes or external harddrives to store mp3 files and decode and play them directly on navi's processor. I believe it is powerful enough and can handle this load especially when navigation is off.
QUOTE]
Damnit, I figured that. The MP3 player connects to the car with an inline bus, data comm must be rather restricted.
#26
[QUOTE=jonnerd154]
Uh, the OE MP3 player connects with an FM fricking Modulator.
Originally Posted by ak217
About OEM mp3player:
I think it is impossible to read anything from OEM DVD player. Maybe I'm wrong.
My idea is to use compact flashes or external harddrives to store mp3 files and decode and play them directly on navi's processor. I believe it is powerful enough and can handle this load especially when navigation is off.
QUOTE]
Damnit, I figured that. The MP3 player connects to the car with an inline bus, data comm must be rather restricted.
I think it is impossible to read anything from OEM DVD player. Maybe I'm wrong.
My idea is to use compact flashes or external harddrives to store mp3 files and decode and play them directly on navi's processor. I believe it is powerful enough and can handle this load especially when navigation is off.
QUOTE]
Damnit, I figured that. The MP3 player connects to the car with an inline bus, data comm must be rather restricted.
#27
Originally Posted by elduderino
Uh, the OE MP3 player connects with an FM fricking Modulator.
Now if you want to talk about the OE XM unit... I think that might be FM modulated.
#28
Originally Posted by elduderino
Uh, the OE MP3 player connects with an FM fricking Modulator.
#30
Originally Posted by ak217
I already bought CompactFlash<->PCMCIA adapter and I will test my idea about loading ROM image form PC Card maybe tomorrow.
Once again sorry for my English.
Once again sorry for my English.
I've got an 04 TL Navi. I wanted the Acura logo to be a Honda logo instead. All you have to do to load an image is copy all the BIN files to a CDR. Boot up with the CDR. Once you get a message, hit the Map + Menu + Cancel. Go into Version and select Load from Disc. That will force a software download.
Just make sure you have all the BIN files on the CDR. There should be 5 large 13mb BIN files and one small 78k BIN file. Give that a try.
#31
Hey guys, I don't have a navi, but a co-worker in the US does and I have a question on his behalf.
Is there anyway to hack it to speak in a mans voice? He would prefer something very deep and raspy.
Thanks.
Is there anyway to hack it to speak in a mans voice? He would prefer something very deep and raspy.
Thanks.
#33
Originally Posted by lithiumus
I believe that the TL version has both Male and Female option. Not sure about the TSX or Accord versions...
#34
Originally Posted by lithiumus
Hey ak217,
I've got an 04 TL Navi. I wanted the Acura logo to be a Honda logo instead. All you have to do to load an image is copy all the BIN files to a CDR. Boot up with the CDR. Once you get a message, hit the Map + Menu + Cancel. Go into Version and select Load from Disc. That will force a software download.
Just make sure you have all the BIN files on the CDR. There should be 5 large 13mb BIN files and one small 78k BIN file. Give that a try.
I've got an 04 TL Navi. I wanted the Acura logo to be a Honda logo instead. All you have to do to load an image is copy all the BIN files to a CDR. Boot up with the CDR. Once you get a message, hit the Map + Menu + Cancel. Go into Version and select Load from Disc. That will force a software download.
Just make sure you have all the BIN files on the CDR. There should be 5 large 13mb BIN files and one small 78k BIN file. Give that a try.
Yes, I think it will work. At least I have not found anithing that could prevent it. Now I know how WinCE loader works.
I did not tried my new flash card yet because yesterday I was busy - I bought a new car for my wife - Toyota Prius, of course with navi, seaside blue, but I will get it this Monday. So I will have yet another toy
I hope I will try to load new image this weekend.
I am writing an utility that can add/replace files (and in the future - patch modules) on Windows CE rom image.
What size of navi flash? I mean what is the maximum size of image that we can write to it?
It looks like it is 16M. So we have about 3M for our stuff. Not too bad.
So, khannie112, which picture of Anna Kournikova are you prefer?
#35
Originally Posted by lithiumus
Hey ak217,
I've got an 04 TL Navi. I wanted the Acura logo to be a Honda logo instead. All you have to do to load an image is copy all the BIN files to a CDR. Boot up with the CDR. Once you get a message, hit the Map + Menu + Cancel. Go into Version and select Load from Disc. That will force a software download.
Just make sure you have all the BIN files on the CDR. There should be 5 large 13mb BIN files and one small 78k BIN file. Give that a try.
I've got an 04 TL Navi. I wanted the Acura logo to be a Honda logo instead. All you have to do to load an image is copy all the BIN files to a CDR. Boot up with the CDR. Once you get a message, hit the Map + Menu + Cancel. Go into Version and select Load from Disc. That will force a software download.
Just make sure you have all the BIN files on the CDR. There should be 5 large 13mb BIN files and one small 78k BIN file. Give that a try.
#38
Originally Posted by humperdood
I would love to have Homer Simpson's voice on the navi if I make a wrong turn! That would be awesome!
HAHAHAHA...
DOH! Mash the navi screen with your fat finger to recalculate the route.
#40
Can't you just modify the voice commands by taking the navigation DVD out of the trunk player, putting it into your computer, finding the voice files, recording another voice with the same file name, and saving it on a disc?
I would like to have Homer's voice on the navigation prompts. How awesome would that be?
I would like to have Homer's voice on the navigation prompts. How awesome would that be?