xs650

Ein Tier and Buffy, I'm reading this thread with great interest even though it might as well be in Greek. I'll bet others are too, just salivating at the prospect of you unraveling the mystery.

Keep up the good work.

Buffy

Well, they couldn't be using 666 - I think Microsoft owns the copyright on that one

Seriously, I sent the stuff, and by all means pass it on to SonarTech or whoever's interested; the more input the better.

Right now I'm dealing with information overload - looks like Denso has an OS of sorts for the Super-H type CPUs, and has done a joint venture with Toshiba and Sony to develop an OS for the Toshi x49 SOC, which uses MIPS architecture. And of course VxWorks is a possiblity, but that usally uses ELF formats so I'm betting on the proprietary OS and a Super-H. Most likely something related to TRON, a pretty common Japanese RTOS. Many articles about TRON, but I haven't found a lot of documentation so far.

I do find a fair amount of stuff labelled "callback" in the code, which implys some sort of windowing system most likely derived from X-Windows, and path strings using POSIX-style notation so I think we can let out Microsoft Windows CE.

Not Greek, just Geek. Ask any 733t |-|4XoR to translate.

ein Tier

I don't know if it's cool or sad that all of that post made sense to me. 1337 indeed.

mikeyc6

I know reverse engineering can be fun, but doesn't anyone think it would be easier to find someone in the industry who knows enough about the GM nav to know: (a) whether it actually can use a diag PIN and (b) if so, what the PIN is? Finding "Enter diag PIN" in the code doesn't really mean anything. You could be chasing something that isn't even hooked up. It could simply be a leftover from another model and the diag PIN might not even work on our nav units.

On the reverse engineering side, would it be possible to get the code/disc for one of the similar units where you know the PIN (1791 for example), see if you can find the 1791 in that code, and then try to use that information to get an idea where the PIN might be in ours?

Mike

ein Tier

In an ideal world, yes.

In this world, I've been sending out emails and posting here asking ANYONE who might have access to these codes to send them to me and I don't know one person who works at GM in any capacity.

In all that time, no one's sent me one code despite the fact that I'm promising anonyminity and will take full responsibility for distributing the codes. It wouldn't be hard; disposable, untrackable email addresses are easy to find.

With no contacts at GM and no serious ties to the automotive industry, the social engineering route is pretty much a locked door. Finding out who I need to talk to and lying my way into obtaining the codes from them feels like an even more futile effort than this -- and I can't really talk on the phone for extended periods during the times when those people would normally be available. I do a lot of this while I'm stuck in meetings and don't have anything to contribute.

So, I'm doing the best I can -- picking at the KIWI files and hoping for the best. Why don't you try calling them and getting the codes?


Also, if you read the thread and look at the linked pages, you'll see where we've managed to find two seperate keypad entry screens, and someone has actually seen an engineer at the Corvette factory enter a pin and access a hidden menu -- that's how we knew where to look for the hidden button in the first place. However, I know this discussion takes place over about 15 pages on three different threads, so I understand how you'd miss something.

Perhaps if I'm feeling bored on the plane tonight, I'll type up a "master document" of all that we currently know about the navigation unit.

vette-oholic

Ill try these #s if you repost the instructions for getting to the pin screens

ein Tier

From our the thread that gave us the clue that the menus even existed.
Then, then how to get there:
On page seven of this thread, someone found another keypad:
I missed it when it was first posted, but it seems to be the catalyst for kicking off this new round of 'research'.

jweek

we have 2 codes so far:

9448 and 295660

9448 has 2 additional menus: Software Update and Auto Demo

I did not see anyplace to disable the "agree" button or allow the unit to play DVD's.

Thanks much to all who have contributed to this so far!!

VamPY

Are you saying that those two codes actually work ? OH MY GOD please tell me it is so PLEASE?

ein Tier actually posted those numbers
Where is everybody ?!?! I am going nuts here

PHANTOMC6

yes they work, I tried them right now, and im also wondering where everyone is at, I really dont know what you can do with the options we have, where are the experts on this,right now im just surfing threw the web see if theres different types of denso software we can up load into the navigation,

VamPY

Thanks PHANTOMC6, I am so excited about this and I don't even have a C6 lol, thanks to every1 who contributed and especially ein Tier and Buffy. Althought It might not do much but hey! you've unlocked pundoora's box

wewing

Yeah, those two diagnostic numbers 9448, and 295660 work on my Nav too. About the only interesting menu back there to me though is the gps info where it lists all of the satellites it is receiving. Hooray, the secret codes are found.

It is too bad though the really important stuff isn't back there like turning off the i agree button or enabling the destination input while moving... rats...

I have been poking around in the loading.kwi file with a hex editor and I see that the following codes are close together in plain text in the file, 660, 295660, 9448, and 1791. Interesting that the 1791 code is in there, this is the one that the Cadillac folks say allows them to play dvd's, but so far ours won't do it.

The 660 code works for me too, but the diag menu under 660 doesn't have an exit button, you have to cut power to get out of it. At first I thought it made the I agree page not show up, but I found out that after you turn accessory mode off in the car, if you turn it back on within a few seconds the I agree page doesn't come up, you have to wait a while, same with the corvette banner page.

VamPY

Thats exactly what I read on the Rangerover forums. Does 660 take you to an option page at all ? and did you try inputting data into your NAV while in motion after using 660 ? A guy in the other forum said that there is a code that he is using that will allow NAV input while in motion and you cannot get out of it until you turn the car off and wait like 5 mins or so. If you turn the car back on very quickly the NAV screen will still be that of the 660 code. The Rangerovers use a Denso unit too. Just try using the NAV while in motion with code 660, worth a try.

And yes, someone has to throw a party or something. Where is ein Tier and Buffy ? they should be crowned

So what we know so far is that three codes work: 660, 9448, and 295660 and they were found in the loading.kwi that is available on the FIRMWARE UPDATE CD

please correct me if I am wrong

humvet

Wow, I had given this topic up for dead, I love this forum!

ein Tier

HELL YES!!

Sorry.... I'm just really excited. I'm sitting in the airport in Vegas and grinning like a big stupid idiot. Now, if I can just get back to Austin... I'm on standby.

I gotta play!

mark1107

All three codes work, but they all do the same thing. Bring you to submenu diagnostics. What I dont see them doing is allowing ou to make any changes to your system. (Besides resetting your satellites and changing the brightness.)

But there are a bunch of codes and gobblegook that Ein Tier may find interesting.

Funny that we are on the verge of cracking this, and I am taking my Xterra on a an off roading trip to Moab, Utah for a week with my friends...

ein Tier

Remember, these are the most "obvious" of codes. Many codes that work for other systems are only found to work when someone discovers that a previously unavailable feature is suddenly available. It is possible the other numbers do things as well, we just haven't found the right "test case" or screen to enter them into.

Buffy's also working on decompilers. If we can get those to work, we may uncover even more functionality -- including stuff that might be "not so obvious".

Miaugi

To "ein Tier" and all the others who have contributed to this effort.....You Guys Rock!!

ein Tier

SonarTech from CadillacForums needs much of the credit for guiding me down the right path. There are others here who should be remembered for finding the initial keypads. Buffy needs to be recognized, because his work in decoding the KIWI format and writing a decompiler may prove to be the most useful method for extracting codes and enabling functionality. Last, all of those who spent hours trying codes that ultimately didn't work, your work wasn't in vain either, because it helped drive us in the direction we needed to go.

While I'm the one who posted those codes, and I technically found them, my work wouldn't have been possible without the help of literally dozens of people all over the net --it is impossible for me to remember everyone. I'm sure that as we move forward (I know I'm not done!) there will be even more people to thank.

vette-oholic

just kidding, but at least it's Friday!