Thread: Convert 3790/3760/3750 to 3490

Originally Posted by bpb

same funny I had.
now your unit also recovered the model number?

But now I'm investigating how to change UnitID and retain HWID.
And what I discovered:
UnitID stored in region 34 is decimal UnitID treated as "Unsigned long" and stored as Intel HEX. For example UnitID 1234567890 will be D2029649. In region 41 is applyed some "encryption". The bytes sequence stored in region 41 is the same bytes sequence from region 34 but XOR'ed with FF and then with C3 5A.
So the UnitID from region 34 (D2029649) in region 41 is stored like EEA7AAEC.
In region 41 from Nuvi 3490 there are 24 copies of this UnitID.
EDIT:
BTW in region 41 from unit which flashed from 3790 to 3490 there are 65 copies of UnitID.
NVRAM in 3490 is about 2MB and NVRAM in 3790 is about 6MB

All copies of UnitID in region 41 are protected by CRC or some kind of other protection. But at this moment for me it's not important.
First of all I modified UnitID in region 34 and uploaded to device.
Then I modified first instance of UnitID id region 41 and got nothing. Then I modified two instances of UnitID. All the time I don't care about CRC.
After modification of two UnitID copies I got new UnitID and 34xx. Region 41 completely updated.
Looks like software discovered modification in region 41 and cleared NVRAM (region 41).
Know in region 41 is new UnitID with correct (IMHO) CRC or other protection.
First instance of UnitID is at offset AA08 and group of bytes from offset AA00 looks:
36 05 3B C5 87 C4 3A C5 YY YY YY YY C5 3A where YY is an old UnitID
36 05 3B C5 36 C5 3A C5 XX XX XX XX C5 3A where XX is a new UnitID
As you can see some bytes also changed. In different places these CRC bytes are different.
According to this I modified all 24 instances in original region 41 and uploaded to device.
Sadly, but i got the same as before - new UnitID but 34xx.
I'm not sure it's the right way, but maybe we need more investigation.
EDIT:
Probably there are some other protections from modifying. For example some kind of CRC for area of region 41 or even CRC for the whole region 41.
Interesting why NVRAM wasn't cleared when I modified only the one instance of UnitID in region 41.
BTW I have a dump just after first attempt to modify UnitID. Probably there is some important information about updated CRC.

O,i forget this command