Indeed the logo bins are the same. As region 140 dumps empty the key isn't there either. It must elsewhere in a region used by both aera models though. I'd think dumping everything from yours and a virgin 500 then by comparing them the secret will out. Otherwise it may be that someone has modified the firmware, maybe the main system software (fw_all) in region 14, or perhaps the supplementary system software (fw_all2) in region 85. Who knows, it may even that one of the other regions in 5xx's fw such as 253, 254 or 250 as they are not usually present in the fw of 'standard' auto navigators. But i guess because all 5xx use the exact same fw it more feasible the modification's been done to some other region in much the same way region 140 can be altered to enable features in some automotive devices. In short, without another full region dump from an unmolested 500 we'll never know.