Hi,
I'm working a little bit around traffic subscriptions in garmin and trying to find where are stored related data. Yes, I know that we can add/remove traffic subs directly in device with calculated key, but I want to discover how work with digital traffic (LMT-D devices) subs. After some "social" engineering with garmin helpline, helpline can not work with digital subs in other way than device return.
In case that I have some basic knowledge how TMC traffic works I've tried to find where are those subs stored. I've done these steps with (nuvi 150LMT):
- backup off all recognizable regions via update.txt to SD,
- add licence
- backup off all regions vi update.txt to SD
- only regions 13,41,91 have some differences
after observation of these diffs which are unreadable in easy way, I guess that there is some kind of filesystem.
Anyone have any suggestions / ideas?
all best
deadbeef
To avoid clutter, please don't leave any "Thank You" posts but use thebutton or the LIKE this post ↑ link instead
(found at the lower left hand side of any post)
To see hidden download links, use the same LIKE this post ↑ link and hit F5 on the keyboard to refresh the page.
Report broken download links by using thebutton at the lower left hand corner of that post.
Yeah, sure. If you calculate key for subscription i.e. for France V-traffic and use values 3902 / 30 / 32 / 1 for create / add subsription you can remove it with key generated from values with last byte = 0 in this case 3902 / 30 / 32 / 0. Calculate key for these values, enter key and licence will be removed.
To avoid clutter, please don't leave any "Thank You" posts but use thebutton or the LIKE this post ↑ link instead
(found at the lower left hand side of any post)
To see hidden download links, use the same LIKE this post ↑ link and hit F5 on the keyboard to refresh the page.
Report broken download links by using thebutton at the lower left hand corner of that post.
I've checked this with 2 devices 150LMT and 2699LMT-D and 0 byte remove subscription from:
- subscription list in user menu
- subscription count and position in debug -> Developer Info -> Traffic -> Traffic Receiver Subscriptions
Be aware of few things - if you have quite new receiver and have TrafficProvider.xml file device can recover subs (I don't know procedure). Try this with licence not sold with receiver you can also remove apriopriate key from TrafficProvider.xml. Strange things are going when you remove one sub from multi-sub (i.e. Medimobile Nordics (FI, NO, SE, PL). Sub hang in user menu, sub is removed from subs in debug menu - receiver can not tune signal.
With 0 you only disable subscription you don't remove it.
Test it with gtm25 that have max 20 subscription if i remember correct.
When you fill all 20 then try with last byte 0 for 1 subscription and you will see that you can't add new subscription becouse you only disable it ( hide from garmin ) and you still have 20 subscription not 19 like you think when you say that 0 remove subscription.
As I wrote I'm testing on devices with integrated traffic receiver. Maybe function work different on different devices. I have found suspicious 0:/.system/fm_sub.bin . I see that firmware is encrypted/scrambled and reading it with decompiler is unpossible any advices from old hands?
Thanks loly, that would explain the symptoms I observe on devices with non-integrated traffic receivers (the only ones I've ever owned).![]()
To avoid clutter, please don't leave any "Thank You" posts but use thebutton or the LIKE this post ↑ link instead
(found at the lower left hand side of any post)
To see hidden download links, use the same LIKE this post ↑ link and hit F5 on the keyboard to refresh the page.
Report broken download links by using thebutton at the lower left hand corner of that post.
Guys, you're right, 0 disables also in devices with integrated receiver. Garmin show up as I wrote but:
- fm_sub.bin have same size than before,
- one bit in structure is changed 1->0,
Now some info after tests:
- fm subscription info is stored in fm_sub.bin,
- before any manipulation save original file,
- each sub appends 16 byte structure to file,
- if you add same licence with different keys structure is same,
- you can remove last added sub by removing last 16 bytes from file,
- second byte, LSB tells if sub is enabled or not,
I guess that this 16 byte structure isn't encrypted with any crypto is just bit/byte scrambled.
Bookmarks