Thread: Nuvi 58LMT "can't unlock maps".

I got warnings downloading, extracting and opening JM until I disabled them.

It's part of my curiosity when I see a file like .unl to wonder how the information is encoded rather than just use a tool to parse/generate it and if I can do anything interesting by setting fields to strange values. If it was used as (admittedly bad) copy protection it wont be trivial but not too complex. There are obviously random elements in there as putting the same info in can produce multiple completely different outputs and changing one field changes the whole string. InfoUC looks like it's written in some flavour or BASIC and there's a CRC table in there.

BTW you're sort of right about my formal stuff. I was involved with some rather significant code development before I retired. I somehow persuaded people to pay me to write C code for nearly 20 years with occasional bits of other languages notably perl. Now I do that for fun.

Update: looks like .unl format is a very simple obfuscation which barely counts as cryptography. For my own amusement I'm working on a simple perl script that can unpick it. If I get bored I'll see if I can write something to generate it too.

Update#2: I've wrote a simple perl script that prints out the fields. InfoUC was very helpful in working out the format. Not sure I should say too much about what I found out in a public forum so

Originally Posted by stevex

.....................
Update#2: I've wrote a simple perl script that prints out the fields. InfoUC was very helpful in working out the format. Not sure I should say too much about what I found out in a public forum so

Well it's no problem talking here about defeating UNL codes in a very general and theoretical sense, because it's been done in actual practice for almost two decades anyway. I don't want to seem to be minimising what you've achieved because that's far from my intent - i'll explain below why i think it's only of particular academic interest to a few of us but of no real effect these days given Garmin's protection history ....

As you know, their UNL code protection is unbelievably trivial today and even was in comparison to some protections introduced by others around the same era. Before that Garmin's detail maps had no protection whatsoever and were "already unlocked" in the sense that they (potentially) could be moved from one device to another compatible device freely - however to do so in practice you needed to understand how it all worked - and few ppl did. Early Garmins didn't have any visible file system accessible by computer. They connected in "Garmin Mode" which is still mimicked by more modern devices as "preboot mode" today. Along with PC installation methods involving data on CDs, many detail maps and charts for automotive, offroad, marine and aviation devices were supplied as already-compiled IMG files on proprietary Garmin Data Cards. They were unable to be read like an SD/microSD card can now when inserted in a modern device connected via USB (or earlier, via Serial Port) to a computer. Those older devices will show in Device Manager on a PC, but not in Disk Management nor can it therefore be seen by File Explorer. In fact, the Data Card is treated as just another "region" of its own internal memory by the device, rgn10. It was possible to buy a USB Data Card reader/programmer from Garmin but they were expensive when available new and still are on the 2nd hand market. No after-market versions have ever been made AFAIK. Apart from using programs like [Only registered and activated users can see links. ] to facilitate a very involved dumping of the specific map region/s as a HEX file, converting that to a Garmin IMG file and then re-flashing it to another device, the only 'easy' way to copy mapping data from one Data Card to another was by using the Garmin Data Card reader. Regardless, because neither method was easily available to the average garmin user at the time, unlocked maps weren't much of a problem anyway. But Garmin did introduce the 25 character unlock codes anyway. However, once Garmin relented on its Data Card and started using SD cards as media cards in later devices, the game changed. Such devices (some early StreetPilots for example) were still "region-only" and the card when inserted in the device still didn't show in Disk Managment ....but!!! ... it was easy to get compatible media card readers and copy the gmappsupp.img from one SD card to another for illegitimate use if the maps weren't locked to a specific UID/CID. That action's clearly against Garmin's EULA for both its hardware and software/data of course, but that didn't much stop anyone. In mid-naughties Garmin moved to devices like SP c5x0 and nuvi 3x0/6x0 with locked internal maps and by then the first JetMouse keygen was widely distributed, so map piracy potential exploded further because those devices' internal files could be easily read in Mass Storage Mode just like an SD card.

Around the same time or shortly after, Garmin introduced the "NT Format" (i.e. New Technology) mapping for its detail maps. Then at the end of the naughties we got GMA (Garmin Map Authentication) in maps and device firmware, not such an easy protection to overcome as was the relatively trivial UNL code. But it was still easy. Then Garmin got serious with the previously mentioned MSV and GSV in firmware about 10 years ago, again it was eventually overcome by the Universal Firmware Patcher. So now we have heavily encrypted proprietary fw and also fw based on using an altered Android/Linux OS - and it seems everyone's given up trying to play catchup since Garmin took punitive action against this forum and some of its leading lights back in 2017.

Given the later developments in its protection, it's even surprising that Garmin still bothers to include UNL codes as part of map data protection. Seems more like habit, or an ingrained corporate culture of "it's there because we can't be bothered removing it". Whatever the reason it's simply no real protection at all now, an anachronism.

Good on you for figuring it out though, i still applaud that. Now if you could do the same with Garmin's proprietary encrypted firmware and their bastardized Android or Linux based firmware many ppl might just want to have your baby .... .... but then in the immortal words of Elmer Fudd you better be vewy vewy quiet ...

Spoiler: Image

[Only registered and activated users can see links. ]