Thread: Garmin Map Pilot for Mercedes-Benz cars

@lolypop000 you have a lot of post in this forum and others forums talking about this afirmation. If the SD only had a unit ID protection, having a SD card not initiated would be enough to make a lot of copy of this SD card, and once married with the unit they would function properly.
For example, using the copy of piostrics, but it is not true. Futhermore, you can make a copy of a SD initiated and the copy do not function in the same unit although you have a perfect copy, you can read the experience of others members in this same topic, so obviously there will be another kind of protection to avoid you can clone the sd, and the only part of the sd that nobody can change is the CID. Unfortunately, I do not have enough knowledge to discover these things, simply I read some post.

Sorry if I offended someone.

to find out whether a copy of the SD card works
We will have to make a copy with different tool
On the Internet there are plenty of tools available
it could also be that there is an error written in a particular sector
GPS manufacturers use it more often
unfortunately I do not have original SD card

Well I have tried it with two different original cards.

I created a raw dump (of the raw device, not the partition) of a never used card using DD (Linux) as well as a dump of my used card.

When putting the dump back both don't work. The content was the same but the SD card CID of course could not be copied.

I also don't believe that the security mechanism has changed. Garmin is protecting their SD cards the same way for years.

The Maps can be copied of course but the can not be unlocked because the CID is used to generate a card specific unlock code.

They seem to use the same method in the new Map Pilot for Mercedes.

A few 'attack' scenarios come to mind (there might be more)

#1 clone CID ->would only be possible if we find non-compliant SD cards where the CID can be changed, so far I have not seen any
#2 emulate SD card >should be possible using a micro controller we could pass any CID to the unit, although I could not find any project that done this so far, also might be to slow
#3 understand encryption an create our own unlocker / unlock codes -> I don't know enough about the crypt method, also not even the MapID has been confirmed yet
#4 patch navigation software to bypass check -> navi_pch.exe and NaviPND.dll indicate it might be some versions of embedded Windows if that's the case and protection is checked here patching them could work
#5 pre-unlock maps -> a bit like option 3 we need to get a much better understanding before this can be done.


So to start some more investigation are there any non-EU maps available?
This could indicate whether we can find out the MapID from the .nds SQLite DB files.

Also the date format of the first satellite fix seems to be non -Garmin standard.

e.g. mine is: 12803556597326078075


So my view on this, at the moment there is no point for people that can not support a potential unlock approach to download any dumps yet as they can not be used.

Originally Posted by SergioSe

@lolypop000 you have a lot of post in this forum and others forums talking about this afirmation. If the SD only had a unit ID protection, having a SD card not initiated would be enough to make a lot of copy of this SD card, and once married with the unit they would function properly.
For example, using the copy of piostrics, but it is not true. Futhermore, you can make a copy of a SD initiated and the copy do not function in the same unit although you have a perfect copy, you can read the experience of others members in this same topic, so obviously there will be another kind of protection to avoid you can clone the sd, and the only part of the sd that nobody can change is the CID. Unfortunately, I do not have enough knowledge to discover these things, simply I read some post.

Sorry if I offended someone.

I talk about garmin nuvi and on nuvi you can take different SD card and map work.
Example: if you have nuvi 3490 and 8Gb SD, you just copy/paste from 8Gb SD on 16Gb SD and add it in the same unit and map work.
On mercedez, some of data is writen also in main unit not only on SD, unl and gma after first run go in main unit ( internal hdd ) but don't know how to access internal hdd of this mercedez unit.

Kenwood devica have on back mini usb port where you can connect notebook and explore internal storage but don't know if mercedez unit have also on back, mini usb port.

Do you try copy/paste ( in regular way ) your SD conntent and add it on different SD and try if your unit see it?

Originally Posted by Neil

I think that's a waste of time and won't change the CID.

So it will only change the number allocated by Windows 'not hardware serial number set by the manufacturer' which is the hard-coded CID.
Guys, please CODE all your outside links to prevent refbacks as per forum rules. Thx.

That's what I thought as well. I essence the tool seems to change the Volume Serial Number (which is part of the logical partition layout if you will). If you clone a card using a raw dump this serial would be identical.
But as Neil stated, it's not the CID.

But the interesting thing about micks post was that I did not check/consider if the map pilot would try to load from an USB stick.

Has anyone tried that? My car had a factory recall and is being repaired for the next days so I can't check or experiment any further.