Tips, Tricks, DIY's, & How-To's
11-03-06, 12:38 PM
#211
Driver School Candidate
Join Date: Nov 2006
Location: tx
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
Not having this car, I can't tell you how it hooks up to a GS350 with any certainty. I can tell you what's on the pins that most likely correspond to the other modification:
K46 on your Multi-Display (Signal, Connector & PIN #, Wire Color):
That's what I'd try - but you're on your own for this one.... unless, of course, you want to give me your GS350 so that I can have yet another Lexus in my driveway... "Lexii?"
SonarTech
K46 on your Multi-Display (Signal, Connector & PIN #, Wire Color):
- GROUND = K46 PIN 10 = W-B
- PKB = K46 PIN 23 = Y - W-B
- SPD = K46 PIN 14 = V - W-B
- (Provided FYI only): REV = K46 PIN 13 = R - W-B
- Nothing interesting here. This connector contains signals from the voice guidance, the backup camera, DVD image signal and Microphone stuff.
- GND = h1 PIN 6 = G
- SPD = h1 PIN 16 = W-B
- (Provided FYI only): REV = h1 PIN 15 = GR-B
- Note: There is no PKB signal present on connector h1
That's what I'd try - but you're on your own for this one.... unless, of course, you want to give me your GS350 so that I can have yet another Lexus in my driveway... "Lexii?"
SonarTech
I have just purchased an 06 GS300 with No Nav and No ML. Do I understand correctly that all I do to enable bluetooth features while driving is to remove pin 14 from the k46. Is that all I do. Has onyone else tried it with a similar vehicle.
Thanks in advance
11-04-06, 12:38 PM
#213
Driver School Candidate
Join Date: Sep 2003
Location: NV
Posts: 20
Likes: 0
Received 0 Likes
on
0 Posts
I've been reading this post with great interest after I was infuriated to discover that my beautiful brand-new GS350 does NOT have override capability. So far, I've managed to copy my nav disc, get the loading.kwi file from a friend's 2007 RX350 gen5 ver 5.1 nav that does have override capability, and made a DVD with all the ver 6.1 files, substituting the older loading.kwi file. I followed your instructions to the letter.
My result? A beautiful, perfectly working copy of nav 6.1 without override capability. What did I do wrong? Does anyone have any ideas?
My result? A beautiful, perfectly working copy of nav 6.1 without override capability. What did I do wrong? Does anyone have any ideas?
11-04-06, 12:44 PM
#214
Lead Lap
Join Date: Apr 2006
Location: CA
Posts: 673
Likes: 0
Received 0 Likes
on
0 Posts
Sounds like you need to force your NAV to reboot... either find the menu where it allows you to force the NAV to "upgrade" firmware... which in your case really is downgrade. or disconnect the NAV so it loses the firmware and so it reboots using your new mutant NAV DVD kwi file or pull the fuse of the NAV.
11-06-06, 01:39 AM
#215
Driver School Candidate
Join Date: Nov 2006
Location: ca
Posts: 1
Likes: 0
Received 0 Likes
on
0 Posts
Hello,
I was wondering if you know anybody in LA area who could do this for me? Perhaps phone number or location.my car is 07 ES350.I don't mind paying $150 at all,better safe then sorry.
Thank you in advance
I was wondering if you know anybody in LA area who could do this for me? Perhaps phone number or location.my car is 07 ES350.I don't mind paying $150 at all,better safe then sorry.
Thank you in advance
11-07-06, 08:30 AM
#216
Pole Position
Join Date: Jul 2005
Location: ga
Posts: 217
Likes: 0
Received 0 Likes
on
0 Posts
How to change motor oil in 2006 GS300
Step 1: park on solid, level ground, set parking brake.
Step 2: If you are using ramps, drive onto them now, if not, you can jack the car up later.
Step 3: open the hood and remove the wide black plastic piece over the area of the radiator/fan (manual tells you how to remove clips).
Step 4: remove 1 bolt to remove air box inlet tube under the plastic piece you removed in previous step.
Step 5: look straight down between radiator/fan and the engine and you will see the silver oil filter housing.
Step 6: you will need to place something below this housing that will catch about 1 qt. of oil that will be released when you remove oil filter canister. You can either remove the plastic panels below the oil housing (from under the car) and catch the oil with a pan placed on the ground, or you can use a small shallow pan placed in the engine compartment, under the housing and on top of the plastic panel (quicker/easier, but possibly dirtier if oil spills as you remove the pan).
Step 7: If you're strong, you'll probably be able to twist the oil canister loose by hand (2 tabs sticking out from the canister help in this regard), if not you'll need a small diameter "oil filter wrench".
Step 8: Once the canister is out and all the oil stops dripping, now would be the time to remove the small oil pan you placed under the oil housing inside the engine compartment.
Step 9: Remove and replace filter and O ring on the canister you removed and twist the cansiter back onto the housing, tightening it as tight as possible by hand.
Step 10: replace air box inlet tube and plastic piece above it.
Step 11: If the car isn't already on ramps, jack up the front per instructions in the manual.
Step 12: If you crouch down behind the front passenger side wheel and place your head very close to the ground and look toward the center/bottom of the engine, you will see the small, narrow oil pan and the plug/bolt on the passenger side of the pan that you will need to remove.
Step 13: place oil catch pan under the plug/bolt and remove bolt.
Step 14: once oil stops dripping, replace plastic washer and re-insert plug/bolt and tighten
Step 15: Fill engine with 5w30 (I used Mobil 1 synthetic), measure oil level with dipstick to verify fill quantity. Lower car and you're done
Step 2: If you are using ramps, drive onto them now, if not, you can jack the car up later.
Step 3: open the hood and remove the wide black plastic piece over the area of the radiator/fan (manual tells you how to remove clips).
Step 4: remove 1 bolt to remove air box inlet tube under the plastic piece you removed in previous step.
Step 5: look straight down between radiator/fan and the engine and you will see the silver oil filter housing.
Step 6: you will need to place something below this housing that will catch about 1 qt. of oil that will be released when you remove oil filter canister. You can either remove the plastic panels below the oil housing (from under the car) and catch the oil with a pan placed on the ground, or you can use a small shallow pan placed in the engine compartment, under the housing and on top of the plastic panel (quicker/easier, but possibly dirtier if oil spills as you remove the pan).
Step 7: If you're strong, you'll probably be able to twist the oil canister loose by hand (2 tabs sticking out from the canister help in this regard), if not you'll need a small diameter "oil filter wrench".
Step 8: Once the canister is out and all the oil stops dripping, now would be the time to remove the small oil pan you placed under the oil housing inside the engine compartment.
Step 9: Remove and replace filter and O ring on the canister you removed and twist the cansiter back onto the housing, tightening it as tight as possible by hand.
Step 10: replace air box inlet tube and plastic piece above it.
Step 11: If the car isn't already on ramps, jack up the front per instructions in the manual.
Step 12: If you crouch down behind the front passenger side wheel and place your head very close to the ground and look toward the center/bottom of the engine, you will see the small, narrow oil pan and the plug/bolt on the passenger side of the pan that you will need to remove.
Step 13: place oil catch pan under the plug/bolt and remove bolt.
Step 14: once oil stops dripping, replace plastic washer and re-insert plug/bolt and tighten
Step 15: Fill engine with 5w30 (I used Mobil 1 synthetic), measure oil level with dipstick to verify fill quantity. Lower car and you're done
Last edited by costanza; 11-07-06 at 08:37 AM.
11-07-06, 03:19 PM
#217
Lexus Test Driver
Thread Starter
How to reset "Oil Maintenance Required"
1) Open mirror adjustment flap on driver's left
2) Hold both "Odo" & "Reset" buttons down
3) While holding buttons down, Double press the engine start button w/out pressing brake pedal (do not start motor basically)
4) The Odo screen should reed "Maintanance Reset". DO NOT release buttons.
5) After holding for 5-10 seconds, the reset should be completed.
2) Hold both "Odo" & "Reset" buttons down
3) While holding buttons down, Double press the engine start button w/out pressing brake pedal (do not start motor basically)
4) The Odo screen should reed "Maintanance Reset". DO NOT release buttons.
5) After holding for 5-10 seconds, the reset should be completed.
Step 1: park on solid, level ground, set parking brake.
Step 2: If you are using ramps, drive onto them now, if not, you can jack the car up later.
Step 3: open the hood and remove the wide black plastic piece over the area of the radiator/fan (manual tells you how to remove clips).
Step 4: remove 1 bolt to remove air box inlet tube under the plastic piece you removed in previous step.
Step 5: look straight down between radiator/fan and the engine and you will see the silver oil filter housing.
Step 6: you will need to place something below this housing that will catch about 1 qt. of oil that will be released when you remove oil filter canister. You can either remove the plastic panels below the oil housing (from under the car) and catch the oil with a pan placed on the ground, or you can use a small shallow pan placed in the engine compartment, under the housing and on top of the plastic panel (quicker/easier, but possibly dirtier if oil spills as you remove the pan).
Step 7: If you're strong, you'll probably be able to twist the oil canister loose by hand (2 tabs sticking out from the canister help in this regard), if not you'll need a small diameter "oil filter wrench".
Step 8: Once the canister is out and all the oil stops dripping, now would be the time to remove the small oil pan you placed under the oil housing inside the engine compartment.
Step 9: Remove and replace filter and O ring on the canister you removed and twist the cansiter back onto the housing, tightening it as tight as possible by hand.
Step 10: replace air box inlet tube and plastic piece above it.
Step 11: If the car isn't already on ramps, jack up the front per instructions in the manual.
Step 12: If you crouch down behind the front passenger side wheel and place your head very close to the ground and look toward the center/bottom of the engine, you will see the small, narrow oil pan and the plug/bolt on the passenger side of the pan that you will need to remove.
Step 13: place oil catch pan under the plug/bolt and remove bolt.
Step 14: once oil stops dripping, replace plastic washer and re-insert plug/bolt and tighten
Step 15: Fill engine with 5w30 (I used Mobil 1 synthetic), measure oil level with dipstick to verify fill quantity. Lower car and you're done
Step 2: If you are using ramps, drive onto them now, if not, you can jack the car up later.
Step 3: open the hood and remove the wide black plastic piece over the area of the radiator/fan (manual tells you how to remove clips).
Step 4: remove 1 bolt to remove air box inlet tube under the plastic piece you removed in previous step.
Step 5: look straight down between radiator/fan and the engine and you will see the silver oil filter housing.
Step 6: you will need to place something below this housing that will catch about 1 qt. of oil that will be released when you remove oil filter canister. You can either remove the plastic panels below the oil housing (from under the car) and catch the oil with a pan placed on the ground, or you can use a small shallow pan placed in the engine compartment, under the housing and on top of the plastic panel (quicker/easier, but possibly dirtier if oil spills as you remove the pan).
Step 7: If you're strong, you'll probably be able to twist the oil canister loose by hand (2 tabs sticking out from the canister help in this regard), if not you'll need a small diameter "oil filter wrench".
Step 8: Once the canister is out and all the oil stops dripping, now would be the time to remove the small oil pan you placed under the oil housing inside the engine compartment.
Step 9: Remove and replace filter and O ring on the canister you removed and twist the cansiter back onto the housing, tightening it as tight as possible by hand.
Step 10: replace air box inlet tube and plastic piece above it.
Step 11: If the car isn't already on ramps, jack up the front per instructions in the manual.
Step 12: If you crouch down behind the front passenger side wheel and place your head very close to the ground and look toward the center/bottom of the engine, you will see the small, narrow oil pan and the plug/bolt on the passenger side of the pan that you will need to remove.
Step 13: place oil catch pan under the plug/bolt and remove bolt.
Step 14: once oil stops dripping, replace plastic washer and re-insert plug/bolt and tighten
Step 15: Fill engine with 5w30 (I used Mobil 1 synthetic), measure oil level with dipstick to verify fill quantity. Lower car and you're done
11-17-06, 10:50 PM
#218
Driver School Candidate
Join Date: Nov 2006
Location: PA
Posts: 14
Likes: 0
Received 0 Likes
on
0 Posts
This is an interesting new additional factor. Unfortunately, it's largely unknown and I can't begin to guesstimate what the differences are between all these "U" versions since the ***** at Denso don't have the Engrish skills necessary to tell us what we're actually paying for. However, I'm still very much inclined to believe there's not a lot of difference in structure or data format for the actual POI & MAP data - just the firmware. Of course, I could be talking out my ***, but in the absence of more reliable data, I'm going to suggest this may be the case. U20, though... Hmmm. That IS quite a step for just 1 years' worth of updates - ASSuming the U20, U30, U31 actually mean anything at all.
My wife's ES-350 was purchased about 3 months after my RX-350. The ES-350 came with U31 (D) v06.1 p/n 86271-53021 / 464210-0790. My RX-350 came with U30 (D) v05.1 p/n 86271-53020 / 464210-0629. The combo DVD I made is her entire v06.1 DVD with my v05.1 LOADING.KWI file. That is absolutely the only difference.
I have assisted someone else who couldn't make a DVD after multiple attempts, and the DVD I made for them worked fine. Have you been able to just make a successful 1:1 backup of either of your original NavDVD's and have them work? If NOT, then your problem's likely associated with your burning process. If you HAVE made a working backup, then there's something more sinister at work here... but I'll be damned if I know how to troubleshoot it not having access to the materials.
If the contents of your U20D match your new v6.1 DVD (mostly, I mean, not 1:1), then I still think you should be able to make a combo-DVD (U20D firmware w/ v6.1 MapDATA).
There is one other small factor that might be worth trying... A couple of people now have mentioned that they have only been able to make working 1:1 backup copies of their NavDVD's by "ripping" it first with one of the multiple DVD Rippers available. Normally, these rippers are used to remove CSS protection from movie DVD's, but they will also work on data (even though it's not typically protected). The software puts the DVD reader in a unique mode to combat the problems associated with trying to read structure protection and CSS from a movie DVD. It is possible that the IDIOTS at Denso tried applying their "Drain-Bramaged pinheads" to copy protection and dorked-up the ISO-9660 structure with their stupidity in the process. That would be my guess --- that these idiots are so busy touching themselves over this KIWI format they designed that they forgot how to actually author a data DVD and screwed it up... ($200 per update DVD buys a lot of hand lotion, socks and towels).
As such, I'm going to recommend that you use such a program to read your original DVD's to your HD before making your mutant DVD. I prefer Slysoft's AnyDVD myself because it sits in the system tray and silently removes CSS, Sony's structure protection and any other dog crap from any DVD that get placed in the drive. It may have cleansed my NavDVD's of some Denso-Dorko protection they added without my knowledge, since it IS loaded on my system and was active when I ripped my NavDVD's. The only way to verify that that did indeed affect the files would be to take a CRC of the original files FROM THE DVD DIRECTLY, copy them down to your system normally, then re-shoot CRC's for the files you copied. Compare the two. They SHOULD be the same, but if they aren't, then there is something unseen pootching the data as it peels off the DVD. Next, try AnyDVD or some other ripper and re-do the copy process and re-check the CRC's.
That would be my approach. Like I said - I really think the ALLDATA.KWI and other map data structure is the same between U20, U30 and U31. I refuse to give Denso any credit for being ingenious enough to actually make different versions of the NavDVD for each and every Nav unit they squirt out to Toyota. They just aren't that intelligent or they'd stop playing these stupid games with us in the first place.
Of course, that's just my opinion - and I could be wrong.
SonarTech
My wife's ES-350 was purchased about 3 months after my RX-350. The ES-350 came with U31 (D) v06.1 p/n 86271-53021 / 464210-0790. My RX-350 came with U30 (D) v05.1 p/n 86271-53020 / 464210-0629. The combo DVD I made is her entire v06.1 DVD with my v05.1 LOADING.KWI file. That is absolutely the only difference.
I have assisted someone else who couldn't make a DVD after multiple attempts, and the DVD I made for them worked fine. Have you been able to just make a successful 1:1 backup of either of your original NavDVD's and have them work? If NOT, then your problem's likely associated with your burning process. If you HAVE made a working backup, then there's something more sinister at work here... but I'll be damned if I know how to troubleshoot it not having access to the materials.
If the contents of your U20D match your new v6.1 DVD (mostly, I mean, not 1:1), then I still think you should be able to make a combo-DVD (U20D firmware w/ v6.1 MapDATA).
There is one other small factor that might be worth trying... A couple of people now have mentioned that they have only been able to make working 1:1 backup copies of their NavDVD's by "ripping" it first with one of the multiple DVD Rippers available. Normally, these rippers are used to remove CSS protection from movie DVD's, but they will also work on data (even though it's not typically protected). The software puts the DVD reader in a unique mode to combat the problems associated with trying to read structure protection and CSS from a movie DVD. It is possible that the IDIOTS at Denso tried applying their "Drain-Bramaged pinheads" to copy protection and dorked-up the ISO-9660 structure with their stupidity in the process. That would be my guess --- that these idiots are so busy touching themselves over this KIWI format they designed that they forgot how to actually author a data DVD and screwed it up... ($200 per update DVD buys a lot of hand lotion, socks and towels).
As such, I'm going to recommend that you use such a program to read your original DVD's to your HD before making your mutant DVD. I prefer Slysoft's AnyDVD myself because it sits in the system tray and silently removes CSS, Sony's structure protection and any other dog crap from any DVD that get placed in the drive. It may have cleansed my NavDVD's of some Denso-Dorko protection they added without my knowledge, since it IS loaded on my system and was active when I ripped my NavDVD's. The only way to verify that that did indeed affect the files would be to take a CRC of the original files FROM THE DVD DIRECTLY, copy them down to your system normally, then re-shoot CRC's for the files you copied. Compare the two. They SHOULD be the same, but if they aren't, then there is something unseen pootching the data as it peels off the DVD. Next, try AnyDVD or some other ripper and re-do the copy process and re-check the CRC's.
That would be my approach. Like I said - I really think the ALLDATA.KWI and other map data structure is the same between U20, U30 and U31. I refuse to give Denso any credit for being ingenious enough to actually make different versions of the NavDVD for each and every Nav unit they squirt out to Toyota. They just aren't that intelligent or they'd stop playing these stupid games with us in the first place.
Of course, that's just my opinion - and I could be wrong.
SonarTech
Thanks,
11-18-06, 05:11 PM
#219
Driver School Candidate
Join Date: Nov 2006
Location: PA
Posts: 14
Likes: 0
Received 0 Likes
on
0 Posts
Well...burning is not the problem....
This is an interesting new additional factor. Unfortunately, it's largely unknown and I can't begin to guesstimate what the differences are between all these "U" versions since the ***** at Denso don't have the Engrish skills necessary to tell us what we're actually paying for. However, I'm still very much inclined to believe there's not a lot of difference in structure or data format for the actual POI & MAP data - just the firmware. Of course, I could be talking out my ***, but in the absence of more reliable data, I'm going to suggest this may be the case. U20, though... Hmmm. That IS quite a step for just 1 years' worth of updates - ASSuming the U20, U30, U31 actually mean anything at all.
My wife's ES-350 was purchased about 3 months after my RX-350. The ES-350 came with U31 (D) v06.1 p/n 86271-53021 / 464210-0790. My RX-350 came with U30 (D) v05.1 p/n 86271-53020 / 464210-0629. The combo DVD I made is her entire v06.1 DVD with my v05.1 LOADING.KWI file. That is absolutely the only difference.
I have assisted someone else who couldn't make a DVD after multiple attempts, and the DVD I made for them worked fine. Have you been able to just make a successful 1:1 backup of either of your original NavDVD's and have them work? If NOT, then your problem's likely associated with your burning process. If you HAVE made a working backup, then there's something more sinister at work here... but I'll be damned if I know how to troubleshoot it not having access to the materials.
If the contents of your U20D match your new v6.1 DVD (mostly, I mean, not 1:1), then I still think you should be able to make a combo-DVD (U20D firmware w/ v6.1 MapDATA).
There is one other small factor that might be worth trying... A couple of people now have mentioned that they have only been able to make working 1:1 backup copies of their NavDVD's by "ripping" it first with one of the multiple DVD Rippers available. Normally, these rippers are used to remove CSS protection from movie DVD's, but they will also work on data (even though it's not typically protected).
... lots of god stuff elided by, er, me ...
SonarTech
My wife's ES-350 was purchased about 3 months after my RX-350. The ES-350 came with U31 (D) v06.1 p/n 86271-53021 / 464210-0790. My RX-350 came with U30 (D) v05.1 p/n 86271-53020 / 464210-0629. The combo DVD I made is her entire v06.1 DVD with my v05.1 LOADING.KWI file. That is absolutely the only difference.
I have assisted someone else who couldn't make a DVD after multiple attempts, and the DVD I made for them worked fine. Have you been able to just make a successful 1:1 backup of either of your original NavDVD's and have them work? If NOT, then your problem's likely associated with your burning process. If you HAVE made a working backup, then there's something more sinister at work here... but I'll be damned if I know how to troubleshoot it not having access to the materials.
If the contents of your U20D match your new v6.1 DVD (mostly, I mean, not 1:1), then I still think you should be able to make a combo-DVD (U20D firmware w/ v6.1 MapDATA).
There is one other small factor that might be worth trying... A couple of people now have mentioned that they have only been able to make working 1:1 backup copies of their NavDVD's by "ripping" it first with one of the multiple DVD Rippers available. Normally, these rippers are used to remove CSS protection from movie DVD's, but they will also work on data (even though it's not typically protected).
... lots of god stuff elided by, er, me ...
SonarTech
Under Mac OS X Tiger I can routinely duplicate a NavSys DVD under OSX natively, using Disk Utility, or by using thrird party software like Roxio's Toast.
All *I* need / want is a copy of the 5.1 LOADING.KWI file
Thanks,
Steve
11-18-06, 08:05 PM
#220
Driver School Candidate
Join Date: Nov 2006
Location: PA
Posts: 14
Likes: 0
Received 0 Likes
on
0 Posts
Dissecting the v5.1 and v6.1 LOADING.KWI files
[QUOTE=Sonartech;2154045]In a quest to determine why the v6.1 LOADING.KWI file was ~25 megs larger than the previous version, I dissected both versions and did a side-by-side comparison. Here are my findings:
v5.1 LOADING.KWI
Manufacturer ID's (1):
Manufacturer ID's (2):
>>>>>
>>>>> How does one determine "modules"? I assume you have already discovered some partial disassembly methodologies.
>>>>>
The first thing you might notice is that the actual firmware files are identically sized between v5.1 and v6.1. That's very comforting to know, and now I'm not near as "creeped-out" about forcing v5.1 firmware on a unit that originally came with v6.1. There are definitely changes in the firmware, however. The one file that's adding the additional 24.1MB to the v6.1 LOADING.KWI file is called "V314" and is almost certainly updates and/or enhancements to the voice recognition / talkback features. Nearly every string I found in that file had to do with verbal commands, text on the display in response to verbal commands or different ways to actuate similar functions using verbal commands. Nothing override-related in that file at all. Further, it's absence in the v5.1 firmware leads me to believe it's more of a "patch" than an actual replacement for one of the firmware modules. It's missing commands that we know work, like "I'm hungry", so I think it's just an update of some sort.
The real meat'n'taters is in the TD00 and TE00 modules. These are the files that we need to disassemble that contain all of the Navigation system magic, including bypasses and overrides. I haven't taken my Nav system out of my RX-350 and opened it up yet, but if this system's built similar to my old Cadillac Deville's DENSO-based Nav system, it uses a Hitachi SH-3 or SH-4 based processor. Even still, I don't know that disassembling these firmware segments would be too revealing, because I think there's some kind of UNIX-esq RTOS involved here - and if it's proprietary (and it smells like it might just be), even having the disassembled code might be worthless if we don't know how it works. About all I can do is some limited comparative analysis between the two. If we can disassemble these chunks into actual processor code, it's possible we might be able to find the chunk of code that draws the text "Over Ride" to the display. If we can find that, we should be able to trace backwards and find the start of that routine in the firmware. After we find that, we just need to find the jump from the code that starts that routine. That jump will likely be the code that handles the hidden input sequence. We can compare that code with the v5.1 code we know and love and see what Denso monkeyed around with and how they changed it. Hopefully from that we can determine what new voodoo is required to conjure up the blessed System menu that has both the "Over Ride" and the "Loading" menu options. Once we have that, we're done.
>>>>>
>>>>> OK, possibly dumb question: how/who/what/where was the 5.1 "touch pattern" that overrides the motion interlock discovered?
>>>>>
Sounds easy, huh? "Yes" you say? FINE. You do it. I'm going to go take a nap now. Let me know when you figure it out - and no, I won't hold my breath!!
Seriously, though, I don't know diddly-squat about SH-3 machine language. I can muttle my way around in 6502 and limited x86 ML, but I've never seen SH-3 or SH-4 ML in any form. I assume it's somewhat intuitive, so we can probably figure it out... IF we can find a disassembler that works AND we can find out how to actually remove the necessary code chunks from the TD00 and TE00 files themselves.
One other small point: Did you notice that v6.1 has an 1 extra "Over Ride" found in the TD00 file? I don't know why, and I don't have any theories, either.
>>>>>
>>>>>Aditional national language?
>>>>>
I can verify that there is more code in the relevant segments for the v6.1 firmware, so they definitely changed things up a bit. I can't really see any improvements in v6.1 over v5.1 using the car, however... Perhaps time will tell. I'll admit I'm somewhat handicapped at this point, however, because I've already reloaded my ES-350 with v5.1 firmware as well, and I'm very reluctant to re-load v6.1 just so I can play with it - especially when there are no obvious improvements to the UI or functionality.
A version 5.1 firmware using v6.1 map data is working just fine for me right now.
SonarTech
PS - If you're interested, here's a list of all of the available voice commands referenced in that V314 firmware file with duplicates removed:
>>>>>
>>>>> Elided. It's a superset of my 2007 Camry voice commands, which are available here:
http://www.lehigh.edu/~sol0/2007Camr...ceCommands.pdf
>>>>>
v5.1 LOADING.KWI
Manufacturer ID's (1):
- "DENSO"
- "TD00" - Size 21,506,048 bytes (20.5MB)
- "TE00" - Size 26,574,848 byes (25.3MB)
- TD00: 0xbf334d
- TD00: 0xc11fca
- TD00: 0xc308da
- TD00: 0xc4b6e2
- TE00: 0xdbe81f
- TE00: 0xddd49e
- TE00: 0xdfbdb0
- TE00: 0xe16bbb
Manufacturer ID's (2):
- "DENSO"
- "V£"
- "TD00" (DENSO) - Size 21,506,048 bytes (20.5MB)
- "TE00" (DENSO) - Size 26,574,848 byes (25.3MB)
- "V314" (V£) - Size 25,321,472 bytes (24.1MB)
- TD00: 0xbf31c5
- TD00: 0xc11e42
- TD00: 0xc30752
- TD00: 0xc4b6e2
- TD00: 0xc4b55a
- TE00: 0xdbe85f
- TE00: 0xddd4de
- TE00: 0xdfbdf0
- TE00: 0xe16bfb
>>>>>
>>>>> How does one determine "modules"? I assume you have already discovered some partial disassembly methodologies.
>>>>>
The first thing you might notice is that the actual firmware files are identically sized between v5.1 and v6.1. That's very comforting to know, and now I'm not near as "creeped-out" about forcing v5.1 firmware on a unit that originally came with v6.1. There are definitely changes in the firmware, however. The one file that's adding the additional 24.1MB to the v6.1 LOADING.KWI file is called "V314" and is almost certainly updates and/or enhancements to the voice recognition / talkback features. Nearly every string I found in that file had to do with verbal commands, text on the display in response to verbal commands or different ways to actuate similar functions using verbal commands. Nothing override-related in that file at all. Further, it's absence in the v5.1 firmware leads me to believe it's more of a "patch" than an actual replacement for one of the firmware modules. It's missing commands that we know work, like "I'm hungry", so I think it's just an update of some sort.
The real meat'n'taters is in the TD00 and TE00 modules. These are the files that we need to disassemble that contain all of the Navigation system magic, including bypasses and overrides. I haven't taken my Nav system out of my RX-350 and opened it up yet, but if this system's built similar to my old Cadillac Deville's DENSO-based Nav system, it uses a Hitachi SH-3 or SH-4 based processor. Even still, I don't know that disassembling these firmware segments would be too revealing, because I think there's some kind of UNIX-esq RTOS involved here - and if it's proprietary (and it smells like it might just be), even having the disassembled code might be worthless if we don't know how it works. About all I can do is some limited comparative analysis between the two. If we can disassemble these chunks into actual processor code, it's possible we might be able to find the chunk of code that draws the text "Over Ride" to the display. If we can find that, we should be able to trace backwards and find the start of that routine in the firmware. After we find that, we just need to find the jump from the code that starts that routine. That jump will likely be the code that handles the hidden input sequence. We can compare that code with the v5.1 code we know and love and see what Denso monkeyed around with and how they changed it. Hopefully from that we can determine what new voodoo is required to conjure up the blessed System menu that has both the "Over Ride" and the "Loading" menu options. Once we have that, we're done.
>>>>>
>>>>> OK, possibly dumb question: how/who/what/where was the 5.1 "touch pattern" that overrides the motion interlock discovered?
>>>>>
Sounds easy, huh? "Yes" you say? FINE. You do it. I'm going to go take a nap now. Let me know when you figure it out - and no, I won't hold my breath!!
Seriously, though, I don't know diddly-squat about SH-3 machine language. I can muttle my way around in 6502 and limited x86 ML, but I've never seen SH-3 or SH-4 ML in any form. I assume it's somewhat intuitive, so we can probably figure it out... IF we can find a disassembler that works AND we can find out how to actually remove the necessary code chunks from the TD00 and TE00 files themselves.
One other small point: Did you notice that v6.1 has an 1 extra "Over Ride" found in the TD00 file? I don't know why, and I don't have any theories, either.
>>>>>
>>>>>Aditional national language?
>>>>>
I can verify that there is more code in the relevant segments for the v6.1 firmware, so they definitely changed things up a bit. I can't really see any improvements in v6.1 over v5.1 using the car, however... Perhaps time will tell. I'll admit I'm somewhat handicapped at this point, however, because I've already reloaded my ES-350 with v5.1 firmware as well, and I'm very reluctant to re-load v6.1 just so I can play with it - especially when there are no obvious improvements to the UI or functionality.
A version 5.1 firmware using v6.1 map data is working just fine for me right now.
SonarTech
PS - If you're interested, here's a list of all of the available voice commands referenced in that V314 firmware file with duplicates removed:
>>>>>
>>>>> Elided. It's a superset of my 2007 Camry voice commands, which are available here:
http://www.lehigh.edu/~sol0/2007Camr...ceCommands.pdf
>>>>>
11-19-06, 05:47 PM
#221
Driver School Candidate
Join Date: Sep 2003
Location: NV
Posts: 20
Likes: 0
Received 0 Likes
on
0 Posts
Sounds like you need to force your NAV to reboot... either find the menu where it allows you to force the NAV to "upgrade" firmware... which in your case really is downgrade. or disconnect the NAV so it loses the firmware and so it reboots using your new mutant NAV DVD kwi file or pull the fuse of the NAV.
Thanks for all the help!!
11-19-06, 05:57 PM
#222
Lead Lap
Join Date: Apr 2006
Location: CA
Posts: 673
Likes: 0
Received 0 Likes
on
0 Posts
Finally...success! We disconnected the battery for about a minute, then reconnected, turned the car on and put the DVD in...there was a brief moment of panic when the screen said it couldn't read a disc, then it started going through a loading procedure. 3 minutes later, it was up and running and with a perfect override feature!! I did have a couple times that same day where the screen said it couldn't read the disc, but it only lasted for about 5 seconds each time...maybe the disc is dirty?
Thanks for all the help!!
Thanks for all the help!!
11-20-06, 12:41 AM
#223
Rookie
Join Date: Jul 2006
Location: WA
Posts: 51
Likes: 0
Received 0 Likes
on
0 Posts
Finally...success! We disconnected the battery for about a minute, then reconnected, turned the car on and put the DVD in...there was a brief moment of panic when the screen said it couldn't read a disc, then it started going through a loading procedure. 3 minutes later, it was up and running and with a perfect override feature!! I did have a couple times that same day where the screen said it couldn't read the disc, but it only lasted for about 5 seconds each time...maybe the disc is dirty?
Thanks for all the help!!
Thanks for all the help!!
Glad you got it to work. Perhaps now people will stop sending me private messages telling me they think I'm full of
and that the procedure doesn't (or can't possibly) work...Yeah, right.... Who am I kidding?
SonarTech
"The multiplying villainies of nature do swarm upon him..."
11-21-06, 07:30 PM
#224
Driver School Candidate
Join Date: Nov 2006
Location: PA
Posts: 14
Likes: 0
Received 0 Likes
on
0 Posts
Finally...success! We disconnected the battery for about a minute, then reconnected, turned the car on and put the DVD in...there was a brief moment of panic when the screen said it couldn't read a disc, then it started going through a loading procedure. 3 minutes later, it was up and running and with a perfect override feature!! I did have a couple times that same day where the screen said it couldn't read the disc, but it only lasted for about 5 seconds each time...maybe the disc is dirty?
Thanks for all the help!!
Thanks for all the help!!
Since you've already loaded the firmware, you will not have to repeat that step. If you have a marginal DVD you will hear the DVD reader "working harder", and tap responses will slow as reads are retried. Using new media may help ... then again, it may be your DVD writer.
11-26-06, 04:21 PM
#225
voice quality
I can adjust the recieve and send quality. From my trail and error I found that recieve level at +1 and send level at -1 is better for my set up. I'm not able to adjust the voice quality which remain at 11. The send level at 0 and +1 onwards is not good as it seem to have echoes or rumbling sound to the listener. Hope this helps. Anyone tried other settings?