Pioneer AVIC-F930BT code
 

Hello,

I have an pioneer avic-f930bt where I lost my password :(
I already opened the radio and have read the 93c56 smd chip.
The password in this radio can be changed in the menu. It can have letters, numbers and a space. I though it should be in the serial CMOS 93c56 chip but I'm not sure. This are the chips in the pioneer:
CMOS serial E2PROM (256):
IC1303
S-93C56BD0I-I8

e-nand (4gbyte):
IC4501
PEN002A
hynix H26m31001EFR

flash rom (8mbit):
IC4403
CXX3406
spansion al008j70bf102

sram (4mbit):
IC4406
CY62147EV30LL45BVA

I readed the 93c56 chip and here is the zip file. Inside the zip file there is an e2p and bin file. I hope that someone of you guys can find the code there :)

Hotfile.com: One click file hosting: pioneer.zip

There was pretty difficult to solder such smd chip.

welcome good post!!! THX for it
so it is a new model , you say pass can be letters and numbers let we see how long it is 4 or 5 letters ,and it is not probably in 93c56 cause i think it will act same if you remove it and power it to work
try to read nand flash
regards

You can enter a password up to 20 characters. In the manual it says it can be 5 to 16 characters. If I disable the power to the 93c56 the radio gives no display anymore. I tried to enter a password. After that I readed the 93c56 again and there is no difference with me previous dump. Maybe the counter is stored somewhere else or maybe there is no counter.
I don't know how to read the nand. It is BGA. It is really difficult to trace because I think the PCB is triple sided.
Here is an service manual with all the traces and every chip :) AVIC-X930BT Service Manual (EN).pdf - 4shared.com - document sharing - download
It is for the X930BT but is exactly the same for the F930BT every trace is the same.
If someone can find how to read this chip I would be very happy. I have an Olimex LPC-H2148 to read some nand chips.
There is also an test mode in this radio. For that I need this: "Download GGS1098 from the Service Site". Maybe someone can access the pioneer service site and provide that zip/rar?

I found some traces to get to these pins of the nand:
CLK
CMD
DAT0-7
NAND3 (VCC)
CCD3_IOON (VCC?)
A lot of grounds

This nand chip is an e-mmc. How do I read that chip? :S
I really think the password is in there. Also all the sofware is in there :)

Maybe it could also be in the flash rom? If I look at the user manual I don't think it is in the flash rom. All other data is there that you can reset from the system menu. The flash rom has also an reset pin. I don't really think the password is in there but maybe someone can tell me that?

pioneer
 

code in flash package:BGA

i will decode it on my table in 5 minutes.



wbr

So do I need to read the nand and send the 4gb?
http://rere.qmqm.pl/~mirq/JESD84-A44.pdf
It seems the password is really in the nand.
How do I wire up the nand to the lpc-h2148? And what software do I need?

I searched my self blind. The radio didn't even had to open. And yes the key is in the nand. Al I had to do is find this page Condi's HACKMODE v1.4 - DiskRW, GpsGate, TextFiller, RegEditor with .reg files associated! [updated: 13.06.2011] - AVIC411.com

On user/system/security/password there is a plain text file with your password :cool:

Hey man thank you, i tried but can't find a file inside the maps.

pioneer AVIC-F930BT aeurre password

Hi, read flash and post here for you help. And remember complete your profile . Regards

Avic f930bt
 

Dear, I lost my SD card with maps of the Pioneer Avic f930bt.
Where to buy a new SD card with new maps. Thanks
Milanovic

F930bt
 

Hi
How to clear "City History List" on Avic f930bt thank you

code for pioneer avic f930 bt
 

Hi! Can someone to give me the code for my pioneer avic f930 bt? I was changed my car battery and now audio wanted code. My serial number is KITM035400EU.

Need to post dump for code

wbr