CarHack Community Forums
September 08, 2010, 03:27:15 PM *
Welcome, Guest. Please login or register.
Did you miss your activation email?

Login with username, password and session length
News: Nav is on its knees, begging for mercy.  We're not giving any.
 
   Home   Help Search Login Register  
Pages: [1] 2 3 ... 15
  Print  
Author Topic: Nav In-Motion Disable Completed, Patch Available!  (Read 52827 times)
Vindes
Administrator
Full Member
*****
Posts: 206



View Profile
« on: October 10, 2006, 09:27:37 PM »

We believe we have a working hack to completely disable the in-motion limitations.  This has been tested on four vehicles and has worked without any apparent problems. No more in-motion limitations, and no more annoying popups.

For the impatient, here are the step by step update instructions:
1) Insert your NAVTEQ version AE DVD into your computer
2) Create a new folder, and copy the entire contents of the DVD to that folder.  Call it anything you want, but for this example lets call it NewDVD.
3) Run this patch program.
4) When prompted, point the patching utility to the ZH2FF folder inside the directory to which you copied the DVD contents
5) This produces the modified navigation program, MAIN.APN
6) Copy the MAIN.APN program from the ZH2FF folder to the ZH200 folder.  Your system will ask if you want to overwrite the file in that directory, and you should do it.  Be sure to copy it, not move it. You must have the modified MAIN.APN program in both the ZH2FF and ZH200 folders
7) Delete the PatchWise.log file and backup directory if you opted to have the patcher make a backup of the original MAIN.APN.  You don't want those on the burned DVD
8 ) Burn the entire contents of the NewDVD folder to a new double layer DVD.  It should have 6 folders and 14 files in the top level directory
8a) The Nav unit is picky about DVD format.  Read the details in the following message(s) to make sure you get it right.  We have collectively wasted many discs on improper formats.
9) Really read the detailed message below before using the DVD in your Nav, unless you don't mind taking a chance on ruining your unis.

More detailed explanations and disclaimers are provided below, and again, we highly recommend reading them before attempting the process.

I'll also follow up with details of exactly what the patch is modifying in the code.

Note - the patch file patches the version number to 2.04.01.  This is the minimum increment over the stock 2.04.00.

Extend your thanks and offers of free beer to (in no special order): colletjr, flexion, lxloon, DeepSix, HaTax, SgtStank and BillyDSL.  Apologies to anyone I missed.
« Last Edit: October 10, 2006, 09:29:42 PM by Vindes » Logged
Vindes
Administrator
Full Member
*****
Posts: 206



View Profile
« Reply #1 on: October 10, 2006, 09:28:39 PM »

IN-MOTION DISABLE PATCH FOR REC MODEL NAVIGATION UNITS

The purpose of this patch is to reprogram your REC model Navigation unit to disable the In-Motion limitations.

Please be aware that it is dangerous to attempt to input parameters into your Navigation unit while driving. We actively discourage drivers from attempting Navigation programming while the vehicle is in motion.  For the safety of yourself, your passengers and your fellow motorists, please resist the temptation to attempt this.

The intended purpose of this modification is to allow passengers to access Navigation programming features from the passsenger seat.  Please do not even look at them or attempt conversing with them while they are doing so.  This can also serve as a distraction to both you and the passenger.  Such distraction may result in erroneous destination entry and/or fiery death crashes.  Neither of these benefit anybody.  Please act and drive responsibly.

This patch must be used in conjunction with a functioning NAVTEQ DVD version AE.  It will not work with prior DVD versions.  Version AE was released in September of 2006 and is available for purchase from NAVTEQ.  If you have a prior version this patch will not work.

Once patched, your navigation unit can not easily be un-patched.  Simply re-inserting the factory disc will NOT restore your navigation unit to its prior, safe, functionality.  If you are of weak will or questionable moral character we implore you to walk away from the keyboard and forget this patch exists.

If you are still reading, and still determined to go through the update please read the following:

HOW THIS PATCH WORKS
Your navigation DVD contains both the maps database and the software that runs on the navigation unit.  The software is only loaded from DVD if a new version is detected on the disc.  Otherwise the unit runs the software it has stored in flash memory.  There is no easy way to erase that memory, and as a result no easy way to undo the changes that result once the modified program is loaded.

In order to get the modified program to your unit you must burn a new DVD.  The DVD must be a nearly identical copy of your NAVTEQ DVD.  In order to accomplish this you must copy the contents of your NAVTEQ DVD to your computer, apply this patch program to one of the files from that disc, and then burn a new DVD.  It must be a dual layer (8.5GB) DVD.  If your DVD burner is not dual layer capable it will not produce working DVDs for this exercise.

The navigation program is copyrighted software, and thus there is no legal way to distributed the modified version. But it is legal to distribute this patch for that purpose, because the patch is simply instructions on how you can modify the software you already own.  By running this program you will be modifying your software.

BURNING A NEW DVD
1) Insert your NAVTEQ version AE DVD into your computer
2) Create a new folder, and copy the entire contents of the DVD to that folder.  Call it anything you want, but for this example lets call it NewDVD.
3) Run this patch program
4) When prompted, point the patching utility to the ZH2FF folder inside the directory to which you copied the DVD contents
5) This produces the modified navigation program, MAIN.APN
6) Copy the MAIN.APN program from the ZH2FF folder to the ZH200 folder.  Your system will ask if you want to overwrite the file in that directory, and you should do it.  Be sure to copy it, not move it. You must have the modified MAIN.APN program in both the ZH2FF and ZH200 folders
7) Delete the PatchWise.log file and backup directory if you opted to have the patcher make a backup of the original MAIN.APN.  You don't want those on the burned DVD
8 ) Burn the entire contents of the NewDVD folder to a new double layer DVD.  It should have 6 folders and 14 files in the top level directory


There are many ways to do step 8.  Personally, I use UltraISO to create an ISO image first, then use Nero to burn that image to disc.  You may have other burning software you prefer.  I use the two-step process because I could not get Nero to burn a properly formatted DVD otherwise.  The REC nav units, or at least mine, is picky about the DVD format.

When burning the DVD or ISO make sure to have:
a) Joliet turned OFF
b) Filename format as Windows/Unix
c) ISO 9660 version number ON (Note, in UltraISO this requires turning the "Omit 9660 version number" OFF.  Note the double negative.  Omit is off, thus version number is on.  If you struggle with this concept then I again implore you not to attempt operating both a vehicle and navigation unit at the same time.)

Using UltraISO the options show below work well for DVD burning for me.


A couple people have reported problems using Memorex DVDs.  Because we're all fairly new to this process with these units we're not sure if this is a Memorex issue, or just coincidece and both times the formats were just done incorrectly.


UPDATING YOUR NAV UNIT
When you insert the DVD in your Nav unit, the unit will detect that the version on the DVD is an update over what is currently installed.  It will prompt you to press ENTER to install the update.  If you choose to install the update the screen will go blank for several seconds, then a progress bar and warning message will come up.

Before you attempt this, please pay very close attention to the following:
ONCE THE UPDATE PROCESS BEGINS, DO NOT TOUCH YOUR IGNITION KEY UNTIL THE PROCESS COMPLETES!
ONCE THE UPDATE PROCESS BEGINS, DO NOT TOUCH YOUR IGNITION KEY UNTIL THE PROCESS COMPLETES!

If the Nav unit loses power partway through the software update you could permanently disable the unit.  (Well, technically it wont be damaged at all.  Just rendered useless because you've partially erased and re-written the memory.  It will need to be returned to the factory to be reprogrammed.  There is no way we are aware of to force the unit to load from the DVD after a botched load attempt.  So just don't mess with the key while it's doing its thing.)

PLEASE NOTE, TURNING THE KEY FROM ACCESSORY MODE TO START MODE INTERRUPTS THE POWER TO THE NAVIGATION UNIT.  SO DON'T DECIDE YOU WANT THE ENGINE RUNNING WHILE YOU'RE IN THE UPDATE PROCESS UNLESS YOU WANT TO REPLACE THE NAV.

If somehow this isn't clear, it's probably in everyones best interests that you fry your Nav unit in the process and thus avoid killing yourself and others while attempting to program your nav while driving.

Go forth and enjoy the freedom of programming your nav from the passenger seat of a moving vehicle.  And if you break the thing in the process of reprogramming, and if your unit is still under warranty, don't tell the service guy what happened.  You've surely voided the warranty.  Just play dumb.

www.carhack.org
« Last Edit: October 10, 2006, 09:40:10 PM by Vindes » Logged
Vindes
Administrator
Full Member
*****
Posts: 206



View Profile
« Reply #2 on: October 10, 2006, 09:32:04 PM »

Here are the details of what the patch actually does. You can use a simple binary editor to make these changes to the MAIN.APN file instead of using the patch program. These are edits to version 2.04 of MAIN.APN. They will not be correct for any other version.

At offset 24:3280h in MAIN.APN file
- change [41 c1 ca 0f] to [40 41 40 41]
- The assembly code changes from [ld.b 4042[r1],r10] to [mov 0, r10 ; mov 0, r10 ]
- This is at address 0x78e01a0 in the compiled code, if you want to follow along in a decompiled version
- This is in function <_INM_getInMotionZoneFlag>
- It forces the return value to 0, which tells a number of other routines that the car is not moving.
- Result is several menu commands are enabled that would otherwise be disabled

At offset 31:29aeh in file
- change [41 b5 ff 00 ] to [40 41 40 41]
- The assembly code changes from [andi 255, r1, r10] to [mov 0, r10 ; mov 0, r10]
- At 0x79af8ce in code, function <_MOP_GetNaviMenuStat>
- This is one of two edits required to disable the popups when the car reaches the trigger speed
- A side effect of this plus the next edit is also enabling many menu items that would otherwise be disabled
- As above, this just forces the function to return 0

At offset 31:2A16 in file
- change [41 b5 ff 00] to [40 41 40 41]
- The assembly code changes [andi 255, r1, r10] to [mov 0, r10 ; mov 0, r10]
- 0x79af936 in code, function <_MOP_GetIsInMotion>
- The second edit, along with above, to disable popups when the car reaches the trigger speed

At offset 43:1B2E in file
- changed [4a 49] to [41 41]
- Note, this is a 16 bit instruction, vs. the prior three which converted a 32bit instruction to two 16 bit opcodes
- code change is [setf nz, r10] to [mov 1, r10]
- address 0x7acea4e in code, <US_MOP_IsInMotionSetting> function
- This function normally returns flags for which menu options to enable under different conditions.
- Always returning 1 will generally enable everything.
- This edit appears to be unessessary with above mods in place, but because I didn't read all 40MB of the
decompiled code I figured better safe than sorry.

Once these adjustments are made to MAIN.APN the checksums at the end of the file must also be corrected to reflect the changes. The C source program to produce new checksums can be picked up from this link.

My binary editor of choice is 010 Editor.

If you choose to do these manually, be sure you know what you're doing. If you corrupt the MAIN.APN file and manage to load it into your Nav you could end up with a disabled unit. Make sure your editor is in overwrite mode, not insert mode. And when you adjust the checksums there should only be one that changes. (#8) If you see several or all of them reported as changed then you did something bad to the file. Or you edited the wrong version.

For those that would like to actually peruse the disassembled machine code, see the other threads on this forum for code disassembly tools.
Logged
loon
Hacker
Newbie
*****
Posts: 31


With a name like UNIX, it has to be good....

cfsloon
View Profile WWW
« Reply #3 on: October 10, 2006, 09:50:57 PM »

nice work and all that jazz... umm, here is a bean thing


(())

hehehe

woo 1 down, 100 to go!
Logged

<BUS> iBus_DVDDiskReadStatus( ) - DVD_DISK_UPDATE_NEED
RobAGD
Newbie
*
Posts: 1


View Profile
« Reply #4 on: October 10, 2006, 09:55:31 PM »

WOW, you all buckeled down and got this knockd out quick.

I do have a question though.

Now that the system is reporting the speed to 0, has the disabled the systems ability to dead reckon location ?

The system see to keep up well while in tunnels and the like, and after reading what was being modified I thought this would be a good question.

-Robert
Logged
PaCharger
Newbie
*
Posts: 1


View Profile
« Reply #5 on: October 10, 2006, 10:18:06 PM »

Okay, newb here, Pretty comfortable with the process as you've layed it out.  I've downloaded the torrent file, but don't have a torrent downloader so I'm not sure the file is worth squat.

Any suggestions on Torrent downloaders I can go download so I can access the AE version disc?

Thanks...this is outstandin!!

Logged
nick_danger
Newbie
*
Posts: 3


View Profile
« Reply #6 on: October 10, 2006, 10:36:50 PM »

There aren't enough beans in the world...  At least I know HaTax, I can buy him a beer.
Logged
dodgeboy
Newbie
*
Posts: 4


View Profile Email
« Reply #7 on: October 10, 2006, 11:49:11 PM »

WOW, you all buckeled down and got this knockd out quick.

I do have a question though.

Now that the system is reporting the speed to 0, has the disabled the systems ability to dead reckon location ?

The system see to keep up well while in tunnels and the like, and after reading what was being modified I thought this would be a good question.

-Robert

I would also like to know the answer to this question.  I suspect that the NAV unit is still paying attention to the VSS for these types of things, but I'd like to know for sure.

Dave
Logged
HaTaX
Hacker
Jr. Member
*****
Posts: 69



View Profile Email
« Reply #8 on: October 11, 2006, 12:33:57 AM »

If you look at the opcode he didn't change the actual speed being reported, he bypassed the line of code that checks the speed.  The speed itself isn't modified and I don't think this will affect dead reckoning.  However, there aren't any tunnels long enough to give a decisive answer in my city (Only one that's about 1/2 mile long)

BTW, this works and I have verified it.  Lots of hard work and hours went into this project, huge applause for the people that made this happen.

PaCharger, give uTorrent a shot, I use it and like it alot, small and simple and it just works without needing Java or .NET to make it tick. .... http://www.utorrent.com/

And Danger.... you owe me a beer... Smiley
Logged
flexion
Hacker
Newbie
*****
Posts: 40



View Profile
« Reply #9 on: October 11, 2006, 01:43:44 AM »

thanks again, vindes! now we can look into the bitmap stuff Smiley
Logged
fred
Newbie
*
Posts: 2


View Profile Email
« Reply #10 on: October 11, 2006, 07:00:21 AM »

no luck on the startup screen being bypassed yet?
Logged
Vindes
Administrator
Full Member
*****
Posts: 206



View Profile
« Reply #11 on: October 11, 2006, 10:08:20 AM »

Now that the system is reporting the speed to 0, has the disabled the systems ability to dead reckon location ?

The system see to keep up well while in tunnels and the like, and after reading what was being modified I thought this would be a good question.


That's a good question.  When playing around with the modifications I was worried about that, and whether it would still sense heading correctly when reporting the direction POI's are relative to current heading in lists.  I know that the list arrow pointers still work properly.

I don't have anywhere to test the dead reckon ability, but as HaTaX said, it doesn't appear that it should have any impact.  The functions we've modified really only get called when building up menus deciding whether to generate a popup.

That said, I haven't attempted to look for or inspect the reckoning code so it's entirely possible there's something we've missed.
Logged
Vindes
Administrator
Full Member
*****
Posts: 206



View Profile
« Reply #12 on: October 11, 2006, 10:10:15 AM »

no luck on the startup screen being bypassed yet?

I don't think any of us have attempted to do anything with it yet.  That one didn't bother me nearly as much as the in-motion stuff.
Logged
DeepSIX
Hacker
Newbie
*****
Posts: 12



View Profile Email
« Reply #13 on: October 11, 2006, 11:03:36 AM »

I would love to see this go Bye Bye.
Start the car and have the nav screen there up and running would almost be as good as the no in-motion pop up hack Cool Cool Cool Cool Cool
Logged

Whack, Hack & Stack
flexion
Hacker
Newbie
*****
Posts: 40



View Profile
« Reply #14 on: October 11, 2006, 11:47:24 AM »

I learned to live with the OK screen, I always leave it in mp3 mode, but I'm sure many people would like to have it removed..

btw that's something we could use over here as well :-) for the euro REJ

...but then we really need to write a nice patcher with version check to support several different main.apn releases and with selectable options and stuff. I'm still stuck at 1.70.00 here :-(


Logged
Pages: [1] 2 3 ... 15
  Print  
 
Jump to:  

Powered by MySQL Powered by PHP Powered by SMF 1.1.11 | SMF © 2006-2009, Simple Machines LLC Valid XHTML 1.0! Valid CSS!