Thread: Garmin Map Pilot for Mercedes-Benz cars

to find out whether a copy of the SD card works
We will have to make a copy with different tool
On the Internet there are plenty of tools available
it could also be that there is an error written in a particular sector
GPS manufacturers use it more often
unfortunately I do not have original SD card

Well I have tried it with two different original cards.

I created a raw dump (of the raw device, not the partition) of a never used card using DD (Linux) as well as a dump of my used card.

When putting the dump back both don't work. The content was the same but the SD card CID of course could not be copied.

I also don't believe that the security mechanism has changed. Garmin is protecting their SD cards the same way for years.

The Maps can be copied of course but the can not be unlocked because the CID is used to generate a card specific unlock code.

They seem to use the same method in the new Map Pilot for Mercedes.

A few 'attack' scenarios come to mind (there might be more)

#1 clone CID ->would only be possible if we find non-compliant SD cards where the CID can be changed, so far I have not seen any
#2 emulate SD card >should be possible using a micro controller we could pass any CID to the unit, although I could not find any project that done this so far, also might be to slow
#3 understand encryption an create our own unlocker / unlock codes -> I don't know enough about the crypt method, also not even the MapID has been confirmed yet
#4 patch navigation software to bypass check -> navi_pch.exe and NaviPND.dll indicate it might be some versions of embedded Windows if that's the case and protection is checked here patching them could work
#5 pre-unlock maps -> a bit like option 3 we need to get a much better understanding before this can be done.


So to start some more investigation are there any non-EU maps available?
This could indicate whether we can find out the MapID from the .nds SQLite DB files.

Also the date format of the first satellite fix seems to be non -Garmin standard.

e.g. mine is: 12803556597326078075


So my view on this, at the moment there is no point for people that can not support a potential unlock approach to download any dumps yet as they can not be used.