Range Rovers Forum banner
1 - 20 of 25 Posts

·
Registered
2002-2005 Range Rover MkIII / L322
Joined
·
18 Posts
Discussion Starter · #1 ·
So the navigation in the 2005 Range Rover is ugly as hell. The ugly colored lines under the titles and what not. Makes it look really outdated.

Now, I ordered the 2011-2012 Navteq DVD and I have a few questions.

1- Does the new CD updates the look of the navigation software?

2 - If it does, does anyone have a picture of the updated look of the main screen perhaps for reference?

3 - If it doesn't update the navigation, where is the software stored in the Range Rover? Is there a separate computer module that holds the software? And does anyone know what language platform it would be written in? Java perhaps.

I am toying with the idea of updating the graphics myself and possibly rewriting the navigation software if I could somehow decompile / reverse engineer the software.

Any answers and resources would be appreciated. From what I understand the platform is shared with other BMW vehicles, if anyone has any information about that, I could use that as well.

Thanks.
 

·
JACK'S GRANDAD
Joined
·
9,277 Posts
We updated to the MkIV navigation, and to be honest it is still ancient.
It is what it is, no getting around it. No touch screen in this day and age is useless. No doubt it kicked butt in 2002, but a decade later its all but useless.

Martin
 

·
Registered
Joined
·
1,806 Posts
The DVD will not change the appearance aside from having all the updated roads, etc. 2005 was the first year to get the Denso units so actually better than the BMW MKIV nav in my opinion. The firmware is written mostly in C with a mixture of assembly language. If you want to hack it, you'll have to spend many hours reverse engineering. Let me know if you make any progress with it, I have pulled images from mine to play with but haven't had much time to actually do anything with it yet. Mainly I'm interested in enabling navigation while in motion.

Also note, you won't get very far without access to an EE lab so you can access/reprogram what is on your EEPROM. If you know where to look you can find all the specs and circuit diagrams and explanations of what the pins do on all the chips for the nav computer, but I'm not going to mention more than that here since I'm pretty sure it could lead to legal issues ;)

Also, I don't think it is a good idea to encourage folks to probably ruin their expensive nav computers by attempting things without proper knowledge/tools/equipment.
 

·
JACK'S GRANDAD
Joined
·
9,277 Posts
05' is touch screen already... it's the 'newer' BMW system (from the time). `)
Oops. Please ignore what I posted then!

Martin
 

·
Registered
2002-2005 Range Rover MkIII / L322
Joined
·
18 Posts
Discussion Starter · #6 ·
Linuxfreakus: You can enable navigation in motion with a faultmate server from what I understand. They're $1500 and tied to your VIN number but they let you access every system in your vehicle. And from what I understand, you can go and check a setting to allow navigation in motion.

The information you just provided me is very interesting and I'd like to pick your brain if you don't mind. I'm gonna PM you right away.

Thanks to everyone for the replies.
 

·
JACK'S GRANDAD
Joined
·
9,277 Posts
I have Faultmate, and it wont change the actual settings in the nav unit as far as I know

Martin
 

·
Registered
2002-2005 Range Rover MkIII / L322
Joined
·
18 Posts
Discussion Starter · #8 ·
Don't quote me on this but I seem to recall an exchange I had with Wiggs where he said he was able to enable the in motion navigation through the faultmate server. Forgive me if I'm wrong.
 

·
Registered
2002-2005 Range Rover MkIII / L322
Joined
·
18 Posts
Discussion Starter · #9 ·

·
Registered
Joined
·
1,806 Posts
Linuxfreakus: You can enable navigation in motion with a faultmate server from what I understand. They're $1500 and tied to your VIN number but they let you access every system in your vehicle. And from what I understand, you can go and check a setting to allow navigation in motion.

The information you just provided me is very interesting and I'd like to pick your brain if you don't mind. I'm gonna PM you right away.

Thanks to everyone for the replies.
Yes there is a software setting in the navigation module for navigation while in motion. Unfortunately, when I toggle it the behavior does not change. I think there is something in the embedded firmware which takes precedence over that setting. There is some hope that it might be reversible without re-flashing the EEPROM, but IMO it is a very slim hope. The toyota system is not the same, Denso provides custom solutions for different manufacturers.
 

·
Registered
Joined
·
2,487 Posts
There is a hidden menu... You've gotta google for the instructions but basically you press on the screen for 3 seconds in a specific spot (not a button on the screen) and it brings you into a key pad... Type in a code and that disables locking the nav while in motion... worked for me.
 

·
LIFETIME CONTRIBUTOR
2006-2009 Range Rover Sport
Joined
·
11,015 Posts
You can enable navigation in motion with the temporary 1791 diagnostic code "hack" if you have a 2005-2006 with original software / DVD (there is a link to that thread in the FAQ of the RRS forum.) Once you upgrade to a later version however, you will lose that hack. Even with IIDTool, AFAIK it's not possible to permanently allow on-the-move navigation in NAS vehicles.

Edit - Here is the thread: http://www.rangerovers.net/forum/9-range-rover-sport-l320/4244-navigation-while-driving-hacked.html
 

·
Registered
2002-2005 Range Rover MkIII / L322
Joined
·
18 Posts
Discussion Starter · #13 ·
Yes there is a software setting in the navigation module for navigation while in motion. Unfortunately, when I toggle it the behavior does not change. I think there is something in the embedded firmware which takes precedence over that setting. There is some hope that it might be reversible without re-flashing the EEPROM, but IMO it is a very slim hope. The toyota system is not the same, Denso provides custom solutions for different manufacturers.
I see. Have you considered the hardware hack? There is a VSS wire tied into the back of the computer. People have been splicing a switch in line. If you need to change your destination, you turn the switch on, enter your new destination and then turn the switch back off. The VSS wire (Vehicle Speed Sensor) sends the signal that the vehicle is in motion. By turning the switch on, you cut signal to the computer and it makes the computer think the vehicle is not moving. One drawback of having the switch on is that your current position will not be updated until you turn the switch back off and tell the computer that you're moving again. Guys have been using that hack in their Corvette and have even seemless looking switches in their dashes. Just a thought.
 

·
Registered
2002-2005 Range Rover MkIII / L322
Joined
·
18 Posts
Discussion Starter · #15 ·
I see.

Anyways, let's get back to this navigation hacking thing. I'd be pretty much happy to just change the background and remove those ugly colored lines under the screen titles.

So with one of those computers, would the main part that controls the CD, shows the economy information, the phone section, etc. Be flashed into a chip on board somewhere? Like a BIOS type of thing?

How did you get those images you were talking about?
 

·
Registered
Joined
·
1,806 Posts
You can find most of what you'd be interested in the DVD, and I just had a closer look at it this evening. There might be more hope than I first thought. The image as a whole is vulnerable to modification, but the firmware blocks have to match a signature. It might be possible to figure out how the signature is generated and then modify the firmware blocks and the associated signatures. If that can be done, you might not need expensive EE lab equipment to forcefully flash the chips directly.


I should not discuss specific details, but if you know what you are doing that is probably enough to start making progress if it is possible.
 

·
Registered
Joined
·
1,806 Posts
Oh lordy... I just realized these firmware signatures are very weak (always blows my mind when I see stuff like this in software). All that is needed is to find the entry points and what gets loaded where... signature will not be a problem, but will probably be *many* hours to reverse the firmware unless google turns up someone who already figured it out :)

I've probably already said more than I should. Good luck. I am pretty sure this is doable. If I figure it out, I will confirm that it works, but I won't be sharing details (not via PM either). I do not wish to invite legal issues... I can envision so many potential liabilities, especially given that it is now possible to get sued for just texting someone *else* who happens to be driving... and even personal use of software modifications on equipment you own can be grey area unfortunately :(
 

·
Registered
2002-2005 Range Rover MkIII / L322
Joined
·
18 Posts
Discussion Starter · #19 ·
Perfect. Can't wait for my new nav CD to come in the mail. This should be fun. I know all the blocks in the kwi file have a checksum at the end. I'm hoping its a simple md5 checksum.
 

·
Registered
2002-2005 Range Rover MkIII / L322
Joined
·
18 Posts
Discussion Starter · #20 ·
Do you have any kind of idea if the platform to run these things is public by any chance? Would be way easier with a debugger. I think I read somewhere that it's probably using QNX.
 
1 - 20 of 25 Posts
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top