Thread: gfw.exe: a simple Garmin firmware manipulation utility.

From what I can see in the source, the rgn file has no checksum.

Looking on the other hand, the heads of the firmware, there are many more of those that support the current app.
Documented in gfw.exe and idaloader.

All headers:
21002000 Forerunner15_250.rgn / edge 20/25 / vivosmart_350.rgn
e28ff020 StreetPilotIII_regionfileonly__280.rgn
ea000002
ea000003
ea000004 GPSMAP60C_60CS_76C_76CS_forWebUpdater__420.rgn / edge205 / Forerunner301_forWebUpdater__320.rgn / Foreruner 201/205 / eTrexLegendC_VistaC_forWebUpdater__270.rgn / some Rinos / Quest /
e28fff46 NavtalkGSM_regionfileonly__260.rgn
e59ff008
e59ff00c
002a940c DC20,DC30,DC40_regionfileonly__410.rgn
ea000000 GPSMAP196_regionfileonly__460.rgn /
0000f04f Forerunner620,Taiwan_regionfileonly__330.rgn / a some of Forerunners / Fenix3_430.rgn
00000200 VIRB_400.gcd / VirbCHN_GCDfile__380.gcd
e59ff018 GTU10EU_290.rgn / GPS18x5Hz_340.rgn /
e28ff01c GPSMAP76SRev.B_regionfileonly__400.rgn / GPSMAP295_regionfileonly__250.rgn / Rino 110/120
f010f8df Edge520_230.gcd / ApproachS6_320.gcd

Documented in gfw.exe:

0xEA000002
0xEA000003
0xE59FF008
0xE59FF00C


Documented in IdaLoader pluguin


switch(dw[0])
{
case 0xE59FF008:
fwi.base = dw[4] - 0x14;
break;
case 0xE59FF00C:
fwi.base = dw[5] - 0x18;
break;
case 0xEA000002:
case 0xEA000003:
default:
fwi.base = dw[1] - (pend - p);
}


We could try to adapt all headers if possible.!!!

For idaloader 0xEA000004 can be:

case 0xEA000004:
fwi.base = dw[2];
break;
case 0xEA000000: like 0xEA000002 and 0xEA000003, default case.