Pioneer AVIC-F930BT code

[melvin v/d berg]

Hello,

I have an pioneer avic-f930bt where I lost my password
I already opened the radio and have read the 93c56 smd chip.
The password in this radio can be changed in the menu. It can have letters, numbers and a space. I though it should be in the serial CMOS 93c56 chip but I'm not sure. This are the chips in the pioneer:
CMOS serial E2PROM (256):
IC1303
S-93C56BD0I-I8

e-nand (4gbyte):
IC4501
PEN002A
hynix H26m31001EFR

flash rom (8mbit):
IC4403
CXX3406
spansion al008j70bf102

sram (4mbit):
IC4406
CY62147EV30LL45BVA

I readed the 93c56 chip and here is the zip file. Inside the zip file there is an e2p and bin file. I hope that someone of you guys can find the code there

Hotfile.com: One click file hosting: pioneer.zip

There was pretty difficult to solder such smd chip.

[zlix]

welcome good post!!! THX for it
so it is a new model , you say pass can be letters and numbers let we see how long it is 4 or 5 letters ,and it is not probably in 93c56 cause i think it will act same if you remove it and power it to work
try to read nand flash
regards

[melvin v/d berg]

You can enter a password up to 20 characters. In the manual it says it can be 5 to 16 characters. If I disable the power to the 93c56 the radio gives no display anymore. I tried to enter a password. After that I readed the 93c56 again and there is no difference with me previous dump. Maybe the counter is stored somewhere else or maybe there is no counter.
I don't know how to read the nand. It is BGA. It is really difficult to trace because I think the PCB is triple sided.
Here is an service manual with all the traces and every chip AVIC-X930BT Service Manual (EN).pdf - 4shared.com - document sharing - download
It is for the X930BT but is exactly the same for the F930BT every trace is the same.
If someone can find how to read this chip I would be very happy. I have an Olimex LPC-H2148 to read some nand chips.
There is also an test mode in this radio. For that I need this: "Download GGS1098 from the Service Site". Maybe someone can access the pioneer service site and provide that zip/rar?

[melvin v/d berg]

I found some traces to get to these pins of the nand:
CLK
CMD
DAT0-7
NAND3 (VCC)
CCD3_IOON (VCC?)
A lot of grounds

This nand chip is an e-mmc. How do I read that chip? :S
I really think the password is in there. Also all the sofware is in there

Maybe it could also be in the flash rom? If I look at the user manual I don't think it is in the flash rom. All other data is there that you can reset from the system menu. The flash rom has also an reset pin. I don't really think the password is in there but maybe someone can tell me that?

[oemrepair]

Originally Posted by melvin v/d berg

I found some traces to get to these pins of the nand:
CLK
CMD
DAT0-7
NAND3 (VCC)
CCD3_IOON (VCC?)
A lot of grounds

This nand chip is an e-mmc. How do I read that chip? :S
I really think the password is in there. Also all the sofware is in there

Maybe it could also be in the flash rom? If I look at the user manual I don't think it is in the flash rom. All other data is there that you can reset from the system menu. The flash rom has also an reset pin. I don't really think the password is in there but maybe someone can tell me that?

code in flash package:BGA

i will decode it on my table in 5 minutes.



wbr

[melvin v/d berg]

So do I need to read the nand and send the 4gb?
http://rere.qmqm.pl/~mirq/JESD84-A44.pdf
It seems the password is really in the nand.
How do I wire up the nand to the lpc-h2148? And what software do I need?

[melvin v/d berg]

I searched my self blind. The radio didn't even had to open. And yes the key is in the nand. Al I had to do is find this page Condi's HACKMODE v1.4 - DiskRW, GpsGate, TextFiller, RegEditor with .reg files associated! [updated: 13.06.2011] - AVIC411.com

On user/system/security/password there is a plain text file with your password

[play7]

Originally Posted by melvin v/d berg

I searched my self blind. The radio didn't even had to open. And yes the key is in the nand. Al I had to do is find this page Condi's HACKMODE v1.4 - DiskRW, GpsGate, TextFiller, RegEditor with .reg files associated! [updated: 13.06.2011] - AVIC411.com

On user/system/security/password there is a plain text file with your password

Hey man thank you, i tried but can't find a file inside the maps.

[fatme]

pioneer AVIC-F930BT aeurre password

[juisro]

Originally Posted by fatme

pioneer AVIC-F930BT aeurre password

Hi, read flash and post here for you help. And remember complete your profile . Regards

[Milanovic]

Dear, I lost my SD card with maps of the Pioneer Avic f930bt.
Where to buy a new SD card with new maps. Thanks
Milanovic

[Milanovic]

Hi
How to clear "City History List" on Avic f930bt thank you

[dilamed]

Hi! Can someone to give me the code for my pioneer avic f930 bt? I was changed my car battery and now audio wanted code. My serial number is KITM035400EU.

[shooting@orange]

Originally Posted by dilamed

Hi! Can someone to give me the code for my pioneer avic f930 bt? I was changed my car battery and now audio wanted code. My serial number is KITM035400EU.

Need to post dump for code

wbr