wait4me

iTrader: (10)

I found the secret menu entry point in the Navigation radio while dissasembling the os via Ida pro, So i went out and pressed the button sequence and sure enough if brings up a menu that says Password check. At this screen it makes you enter a 0000-9999 value with reset and backspace... Soooooo all we have to do now is find the right password "or passwords" to enter and then it will take us to more goodies. possibly a full unlock for full navigation functions while driving for the passenger... As well as other things.. Like rear camera turn on and TV tuner..

The rear camera stuff is in the code it looks like, just have to figure out how to make it work...

I can flash things back into the unit via the jtag port and have been just trying to jump past the password screen but no luck.....


We can do it the hard way though if people want to help. You can enter unlimited passwords very quickly as it does not reset between each one like the older cts radios did... So i was able to go thru 200 codes pretty quick.. like 0001, 0002, 0003, 0004, i made it up to 0000-0100 and then did 0600-0700 And a few random ones in between... But im going to just make this post with what i HAVE tried and didnt work and others can do the same in this thread so we can figure it out and everyone can have fun...

Please HAVE EXACT starting-stopping points so no number gets skipped and we have to do it all over again...

to enter the menu, press the FAV button and the info and config button all at the same time.. ON THE CONSOLE not the touch screen.

wait4me

iTrader: (10)

0000-0400
0600-0700

DoctorNick

Sounds like you need someone to write a simple brute force script to over-ride that PW. Or slip one of the engineers a C note

trukk

iTrader: (1)

LOL, I work with a lot of so called computer forensics guys that don't even know what IDA Pro is. Quite a surprise hearing this from a perveryor of bulk PCM's/Tunes. Kudos to you. My respect level for you just went up +5

-Chris