Thread: Extraction and Experimenting with Garmin voice Audio Packs and fw symbols, icons

What about this format (Garmin voice studio - VCT):

Code:

Please Login or Register to see the links

For me it is interesting to change Hebrew name of voice (displayed in device menu and looking incorrect if now Hebrew bin font into device) to Latin!

Originally Posted by osiris4isis

No sweat, if there is one, I'll test it. If not, I'll test something else Is there a list of all the region numbers and their meaning (like 0x11=voice, bitmap, font, etc...) ? I see it mentioned here and there but no central FAQ for it. So this is what I understand so far
1. GPS unit power on, an instruction (JMP?) at a fixed address is execute to load the boot trap code to continue
2. The boot trap code (in NVRAM?) then load firmware to execute (I would assume that in the boot trap is code to dump various regions)
3. The firmware go about creating resources for voice, font/text, bitmap, etc... and then start looking for map to load
4. Map loader start up and load map and GUI
Is this correct?

Well, you clearly have a higher opinion of my knowledge than is reasonable, but i'll try. As far as the two different types of Garmin units are concerned, the regions may or may not be used similarly. Even with the later types [with visible file system] there can be variance as to which regions are used and/or accessible for copying or writing to. So, in short, there's no full list of region meanings/functions posted that i'm aware of. Most of this stuff is over my head [as i said i'm not a coder or hardware geek], but to take the example you gave of 0x11 [aka rgn11 hex or reg17 dec] used for voice on the older 'region only' units: On the newer devices it is either empty or not existing or it's protected and can't be dumped.

I think some common regions [in decimal] and their functions/role in the boot process of modern units are:

• 5 stores the bootloader. Bootloader allows 'pre-boot' mode if requested by the user thru correct action [hold right spot on screen while powering on etc] and it communicates with Updater.exe via Garmin USB Protocol. If the pre-boot mode is not entered, or entered but not utilised in a set time, or the unit is just powered on normally then bootloader loads fw_all.bin from rgn14 [0x0E].
• 14 is the kernel, it draws the GUI, allows MSM [& MTP mode in later devices], verifies and allows flashing of firmware gupdate.gcd files, blah blah.
• 43 contains x-loader which initialises RAM and it loads the bootloader from rgn5 to RAM and executes that. Probably if regions 5 & 43 or ether is erased then the unit will be dead.

The 'boot.bin' is not well-named because that name tends to indicate it's the actual bootloader. It's actually the ramloader but it normally does contain copies of the bootloader [rgn5] and the x-loader [rgn43] and it will flash them when it's executed [but not in all devices].

I'm very hazy on this stuff and i believe that in different devices the boot 'sequence' does vary but that's the best i can do.

Other commonly known regions are:

• 3 [0x03] for basemap on older units;
• 10 [0x0A] for supplementary map [gmapsupp.img] on older units;
• 12 [0x0C] stores the 'ramloader' and is protected [common to both 'types' of unit];
• 16 [0x10] for the logo [common to both 'types' of unit];
• 48 [0x30] for file system on earlier modern units;
• 49 [0x31] for primary detail map [gmapprom.img] of older units;
• 50 [0x32] for OEM map [gmapoem.img] on older units.

Actually, Giomen could have answered this better than me and i'd been waiting for someone else to do just that. When i saw he'd responded only about Garmin Voice Studio i figured he couldn't be bothered ... You watch him or someone else beat me up severely if i've posted above though.

Originally Posted by osiris4isis

If that is in VPM format, it's encrypted.

It is true. It are official VCT voices from Garmin and others who are using legal copy of VoiceStudio.

For example:

Code:

Please Login or Register to see the links

They have two peculiarities:
1) Data is encrypted for purpose of reverse engineering protection.
2) It may be locked and user need to unlock it by the same way as for Maps and GPIs with usual unlock code.

Righto Tex, seeing nobody including the usually pedantic Giomen has roughed me up over Post #14, i'll stick my neck out a bit further and give you some more homework [test later, so pay attention]:

You'd be very familiar with rgn41 which is encrypted but in most units can be dumped to keep a 'non-vol' backup to restore if needed. 41 has all kinds of interesting and sensitive info in it such as UID and registration & unlock codes. If deleted, the unit will repopulate it but not fully. Codes can be forever lost for instance.

Apart from those already mentioned, other oft-used regions that can be [variously] dumped from modern units are 13, 15, 24, 34, 45, 83, 86, 91, 101, 127, 130, 132, 139, 140, 141, 142, 143, 150 & 154. Regions not mentioned are either empty, protected or don't exist afaik. The regions actually used and dumpable do vary and are differently used depending on series i.e. populated in some, empty on others. Maybe even protected or not depending on series too.

Region 83 in later devices [xx, 1xx, later 2/3xxx for example] is used for the file system in place of rgn48 which is used in earlier 2/4/7xx, 1/2/3xxx. If 48's used then 83 is empty and vice versa.

Region 140 can be manipulated in some modern units to unlock features otherwise blocked in firmware for certain models in a Series [e.g. [Only registered and activated users can see links. ] in a similar way that rgn16 [the logo] can be changed in some series to unlock features i.e. [Only registered and activated users can see links. ] and [Only registered and activated users can see links. ] for example. TTS can also be enabled in some 205/W, and HWID0827/0851 versions of 2x0W/2x0 can have traffic etc enabled by flashing a 'senior model logo' too: [Only registered and activated users can see links. ].

I'm unsure what those other regions' functions are specifically however, other than i think 34 has some quite sensitive functions and shouldn't be messed with at all and fw1_resources.bin is flashed to rgn127.
That should stop you looking for unicorns for a while .

That depends on what i want to use it for. For an 'all-rounder', i go for nuvi 5x0 which is a multimode waterproof unit with removable li-ion battery. It can be used as an auto unit for car or bike, an outdoor handheld for hiking and can function in boating mode if a marine map is loaded. It can be flashed to zumo 2xx to get full motorcycle functions. It's 'nuvi' name is a misnomer, seemingly labeling it as an auto-only device. I keep a nuvi 500 in the car with a spare battery for emergency use. 5x0 was never a popular series with General Public [who should be demoted to Private for their lack of wisdom and finesse] and so they tend to be not easy to get hold of 2nd hand now. The ppl who have them realise their value and hang on to them i reckon.

Code:

Please Login or Register to see the links

For something more 'modern' for auto use only, my first choice would be the nuvi 34x0 and 35x0 which can be mucked around with to add various functions including video & mp3 player, and junior 37x0 can also be played with to enable DEM and 3D Buildings and Landmarks, or in the case of 3760 [which has BT but not ASR], it can be tricked up to add ASR effectively making it a 3790. 37x0 can also be flashed to 34x0. Junior 1xxx can be flashed with 14x0 logo to enable extra features so that'd have to make the list too.

It's all just personal choice really and dependent on what you want to use the unit for, eventual practical day-to-day use or the fun of modding. Garmin has got really crafty with the latest units and made their modding quite hard [read impossible for the likes of me]. Drew a big blank even with Loly's help trying to add vid/mp3 to 3597 for instance, can mod rgn140 but the app icons don't appear in the selection like with 34/35x0. If you want to do something monumental mod 3597 firmware to allow effective manipulation of region 140 to show the icons.

PS: Had to have a bit of a at this:

Originally Posted by osiris4isis

... If you were to save up to get one, which one? .......

I've got well over 50 units, mostly auto devices. Haven't counted them for a while, might be 60+ by now .....

I suspect that encryption is streaming xor. To crack it you will need sample of encrypted and its corresponding decrypted file Once file is decrypted, parsing it shouldn't be hard.

And now for something different:

Code:

Please Login or Register to see the links

What does various sections: girimg, girclr, girfnt, girblob mean?