Thread: *.gma - What's inside?!

Originally Posted by Swall

So it seems the unlocking code is buried in the map image.

It's easy to verify via ImgTool or GMapTool.
The 25-digit unlock code is written to the MPS subfile of the map as a U-record.

Originally Posted by Giomen

The both of things are fact!

Another fact is the device performs the map enabling procedure on each cold start. So it does not relies on the stored history data

Originally Posted by Swall

Another fact is the device performs the map enabling procedure on each cold start. So it does not relies on the stored history data

For most devices, the info on the successful authentication of the map is stored in non-volatile memory after the first success and kept there right down to the next hard/master reset or NonVol clearing.
For example, some tricks for temporary map authentication are based on this property.

Another update and I have to admit the .unl file is actually necessary. For the first time anyway. Garmin loves cashing very much

Originally Posted by timp4411

Others had figured out how to get around the GMA file check, but I have no idea how it was done.

By disassembling a firmware, locating the routine that performs the check, and bypassing it.
It’s done by changing only four bytes, which is probably one or two instructions for a 16 bit processor.