Decompressing the Toyota 86 / FT86 / Scion / BRZ SatNav

My goal is the following:

1) Learn how to modify an embedded system
2) Disable the nag screen
3) Disable the speed lockout

The factory fitted Sat Nav systems in the Toyota 86 have the following parameters:

• Manufactured by Fujitsu Ten
• Run Windows CD 5.0
• Run a modified version of iGo

Firstly switch off the car and pull out the SD card and make an image of the card using HDD Raw Copy Tool from HDDGuru.com. This will allow you to return the card back to the car and also keep a backup in case something goes wrong.

If you explore the contents of the card you will see the following files:

 device.nng
 EB.DAT
 MM.DAT
 navigation (folder)
 RG.DAT
 SS.DAT

The main image is MM.DAT and is a uncompressed image of the file system. This can be extracted using the dumprom tool as follows:

dumprom MM.DAT -d "E:\86 Card\Filesystem"

This will create the following files:

AACDecode.dll
AC3Decode.dll
aerhd.dll
afd.dll
ALD.dll
ASC.dll
AstLogApi.dll
atlce400.dll
audevman.dll
aygshell.dll
bep.dll
beu.dll
BFL.dll
boot.hv
btagsvc.dll
btd.dll
btdrt.dll
bthusb.dll
busenum.dll
cdd.dll
cdr.dll
ceconfig.h
ceddk.dll
celog.dll
cemgrc.exe
ceplayer.exe
ceplayer.lnk
cetlkitl.dll
cetlstub.dll
ceu.dll
close.2bp
commctrl.dll
conshid.dll
Contents_10GAVN.swf
coredll.dll
credprov.dll
credsvc.dll
cxport.dll
data.zip
ddcore.dll
ddhel.dll
ddi_nop.dll
DDM.dll
ddraw.dll
default.hv
device.exe
devmgr.dll
dhcp.dll
diskcache.dll
DivXAVSplitter.dll
DivXCommon.dll
DivXSubtitleDecoder.dll
DivXVideoDecoder.dll
DivXVideoRenderer.dll
dresusage.dll
dwatchlatency.dll
ErrHandApi.dll
ErrHandServ.dll
esw.dll
fatfsd.dll
fatutil.dll
fgfr_sgm_arib.wgl
fgfr_srgm.wgl
fgfr_srgr_arib.wgl
filesys.exe
fsdmgr.dll
GAAsicWave.dll
gavn_version.dat
gdisub.dll
gdisubutil.dll
gdisubutil.dll
gpelcdc.dll
gwes.exe
hidparse.dll
HMI_PRO.exe
httplite.dll
i2c.dll
icm.dll
imaging.dll
initdb.ini
initobj.dat
IOP.dll
iphlpapi.dll
kbdhid.dll
kbdmouse.dll
lan91c111.dll
LastModeApi.dll
logsaver.dll
mmtimer.dll
MM_PRO.exe
MouHid.dll
mp3dmod.dll
MP4Decode.dll
MP4SourceFilter.dll
MP4Splitter.dll
msacmce.dll
msdmo.dll
msdxm.dll
mspart.dll
msrle32.dll
msxml3.dll
navigation.exe
ndis.dll
netbios.dll
netmui.dll
nk.exe
notify.dll
nspm.dll
ok.2bp
ole32.dll
oleaut32.dll
PF_PRO.exe
pls.dll
pm.dll
ppp.dll
pwm.dll
quartz.dll
ramdisk.dll
rds.dll
redir.dll
regenum.dll
resusage.dll
RG_CommonApis_dll.dll
rsaenh.dll
rtm.dll
rtone1.mp3
rtone2.mp3
rtone3.mp3
sdbus.dll
sdhc_sh7724.dll
sdkconnect.exe
sdmemory.dll
secur32.dll
serial.dll
serial_scif_sh7724.dll
services.exe
shell.exe
shellcelog.dll
spi.dll
spu2.dll
SPU2Wave_1.dll
SPU2Wave_2.dll
SPUSRV.dll
sqlcese30.sys.dll
stdsm.2bp
stdsm.bmp
tahoma.ttf
tapi.dll
tcpipc.dll
tcpstk.dll
tlcesrv.dll
toolhelp.dll
tsw.dll
udfs.dll
unimodem.dll
usbAudio1.dll
usbAudio2.dll
usbdisk1.dll
usbdisk2.dll
usbHid1.dll
usbHid2.dll
usbhost1.dll
usbhost2.dll
user.hv
vautov5.dll
vcl.dll
veu.dll
viewsm.2bp
viewsm.bmp
vocon3200_asr.dll
vocon3200_base.dll
vocon3200_platform.dll
vou.dll
vpu.dll
waveapi.dll
wince.nls
winsock.dll
wmadmod.dll
wmsdmod.dll
WMVDecode.dll
wmvdmod.dll
ws2.dll
ws2instl.dll
wspm.dll
xmh.dll

Hold on now, I've only got this far. Things that need investigation:

1) installing and using platform builder
2) Trying the platform builder tools

It looks like Fujitsu Ten use Platform builder and an inhouse software called SWIFT to build and test the images. Here's a link to their technical Journal.

----
13/8/14

Using strings and grep, I discovered that HMI_PRO.exe is the main executable which runs once the system starts up.


----

15/8/14

I build a VM with the following

• Win7 32bit
• Fully patched using windows update
• Install Dot Net 1.1
• Install Platform Build for WinCE5.0 using all the default options except add the SH4 processor