Back to Hacking the RoadMate 360


[Product information screen.]

Hacking into the RoadMate 360

Some of these options could potentially damage the unit or the unit's software if used improperly. Proceed at your own risk.

The RoadMate 360 appears to run a stripped down version of the same operating system as its older siblings, thus making it a Windows CE (4.2?) machine with an ARM processor at an unknown clockspeed. This also means that much the same methods of hacking into the unit's software also apply, within certain limits given what is included. These notes apply to 1.81, the most current available firmware revision. You can see your machine's firmware under the OPTION menu, User Options, Diagnostics, Product Information.

USB and SD Card Contents

First, a word about how the RM360 stores data. I've chosen to discuss the filesystem and the USB together since some units, including mine, keep the SD card under a warranty sticker (but now I guess that doesn't matter anymore).

The RM360 has two memory sources, its internal memory and the SecureDigital slot (which comes prepopulated). The card is a bog-standard SD card, formatted FAT16, and appears to be 2GB in size. However, the maps on my card are only using about 3/4 of that -- 506.7MB of 1.89GB free, per the Finder.

The RM360's USB does not provide NMEA information (darn). In fact, all the USB seems to do is present the unit as a standard Mass Storage device, reading directly off the unit's SD card. When I connected it to my Power Mac G5 and looked at it in the Terminal, this is what I got:

/Volumes/NO NAME/% ls -lR
total 2928704
-rwxrwxrwx   1 censored censored   30697448 Sep 16  2005 NA_BSMAP_Q105.mgi
-rwxrwxrwx   1 censored censored     329618 Sep 16  2005 NA_BSMAP_Q105.nlt
-rwxrwxrwx   1 censored censored 1409286552 Sep 16  2005 Na.imi
-rwxrwxrwx   1 censored censored        211 Sep 16  2005 Na.msf
-rwxrwxrwx   1 censored censored    2806886 Sep 16  2005 Na1.nlt
-rwxrwxrwx   1 censored censored    4920170 Sep 16  2005 Na10.nlt
-rwxrwxrwx   1 censored censored    2472302 Sep 16  2005 Na11.nlt
-rwxrwxrwx   1 censored censored    5264006 Sep 16  2005 Na12.nlt
-rwxrwxrwx   1 censored censored    3761254 Sep 16  2005 Na13.nlt
-rwxrwxrwx   1 censored censored    2673486 Sep 16  2005 Na14.nlt
-rwxrwxrwx   1 censored censored    4865438 Sep 16  2005 Na15.nlt
-rwxrwxrwx   1 censored censored    6033238 Sep 16  2005 Na2.nlt
-rwxrwxrwx   1 censored censored    2792350 Sep 16  2005 Na3.nlt
-rwxrwxrwx   1 censored censored    3951314 Sep 16  2005 Na4.nlt
-rwxrwxrwx   1 censored censored    1182394 Sep 16  2005 Na5.nlt
-rwxrwxrwx   1 censored censored    4294262 Sep 16  2005 Na6.nlt
-rwxrwxrwx   1 censored censored    4473074 Sep 16  2005 Na7.nlt
-rwxrwxrwx   1 censored censored    3462834 Sep 16  2005 Na8.nlt
-rwxrwxrwx   1 censored censored    5590354 Sep 16  2005 Na9.nlt
-rwxrwxrwx   1 censored censored     153654 Jun 13  2006 PIC-0.BMP
drwxrwxrwx   1 censored censored      32768 Oct 24  2005 USBTRANS
-rwxrwxrwx   1 censored censored       3612 Sep 16  2005 index.mct
-rwxrwxrwx   1 censored censored         13 Sep 16  2005 opid.slt

./USBTRANS:
total 64
-rwxrwxrwx   1 censored censored 218 Oct 24  2005 UNIT_ID.DAT
(presumably the contents of the card in their entirety). Some of these files are readable:
/Volumes/NO NAME/USBTRANS/% xd UNIT_ID.DAT 
00000000  4d 6f 64 65 6c 3d 4d 52  4d 20 33 30 30 0d 0a 49  |Model=MRM 300..I|
00000010  44 3d 31 31 33 0d 0a 53  57 20 56 65 72 73 69 6f  |D=113..SW Versio|
00000020  6e 3d 31 2e 38 31 0d 0a  53 65 72 69 61 6c 20 4e  |n=1.81..Serial N|
00000030  75 6d 62 65 72 3d 31 31  33 31 31 30 30 33 36 37  |umber=1131100367|
00000040  30 0d 0a 43 6f 64 65 20  46 6c 61 73 68 3d 34 0d  |0..Code Flash=4.|
00000050  0a 4e 41 4e 44 20 46 6c  61 73 68 3d 31 32 34 0d  |.NAND Flash=124.|
00000060  0a 53 44 3d 31 39 33 37  0d 0a 53 44 20 53 65 72  |.SD=1937..SD Ser|
00000070  69 61 6c 20 4e 75 6d 62  65 72 3d 44 42 43 38 41  |ial Number=DBC8A|
00000080  32 32 30 38 30 34 37 33  32 33 30 34 34 35 33 34  |2208047323044534|
00000090  34 35 33 0d 0a 43 46 3d  30 0d 0a 43 46 20 53 65  |453..CF=0..CF Se|
000000a0  72 69 61 6c 20 4e 75 6d  62 65 72 3d 0d 0a 44 69  |rial Number=..Di|
000000b0  73 6b 3d 30 0d 0a 44 69  73 6b 20 53 65 72 69 61  |sk=0..Disk Seria|
000000c0  6c 20 4e 75 6d 62 65 72  3d 0d 0a 55 53 42 20 44  |l Number=..USB D|
000000d0  65 76 69 63 65 3d 53 44  0d 0a                    |evice=SD..|
000000da
/Volumes/NO NAME/USBTRANS/% cd ..
/Volumes/NO NAME/% xd opid.slt 
00000000  db c8 a2 20 80 47 32 30  44 53 44 53 54           |... .G20DSDST|
0000000d
/Volumes/NO NAME/% xd Na.msf 
00000000  4d 53 46 5f 56 45 52 53  49 4f 4e 20 3d 20 31 0d  |MSF_VERSION = 1.|
00000010  0a 42 41 53 45 4d 41 50  5f 55 53 45 44 20 3d 20  |.BASEMAP_USED = |
00000020  79 65 73 0d 0a 42 41 53  45 4d 41 50 5f 4e 41 4d  |yes..BASEMAP_NAM|
00000030  45 20 3d 20 4e 41 5f 42  53 4d 41 50 5f 51 31 30  |E = NA_BSMAP_Q10|
00000040  35 2e 6d 67 69 0d 0a 46  55 4c 4c 5f 43 4f 56 45  |5.mgi..FULL_COVE|
00000050  52 41 47 45 20 3d 20 79  65 73 0d 0a 4d 41 50 54  |RAGE = yes..MAPT|
00000060  59 50 45 20 3d 20 53 54  52 5f 52 4f 55 54 45 0d  |YPE = STR_ROUTE.|
00000070  0a 56 45 52 53 49 4f 4e  20 3d 20 32 2e 30 30 0d  |.VERSION = 2.00.|
00000080  0a 56 45 4e 44 4f 52 5f  49 44 20 3d 20 35 0d 0a  |.VENDOR_ID = 5..|
00000090  52 45 47 49 4f 4e 5f 49  44 20 3d 20 33 0d 0a 56  |REGION_ID = 3..V|
000000a0  45 52 53 49 4f 4e 5f 49  44 20 3d 20 32 31 0d 0a  |ERSION_ID = 21..|
000000b0  43 4f 4d 50 5f 56 45 52  53 49 4f 4e 20 3d 20 33  |COMP_VERSION = 3|
000000c0  32 0d 0a 4c 49 42 5f 56  45 52 53 49 4f 4e 20 3d  |2..LIB_VERSION =|
000000d0  20 39 32                                          | 92|
000000d3
In particular, notice that the unit identifies itself as an RM 300! There are also hooks for other devices listed, including what appears to be CompactFlash, and a "Disk" option.

It is unclear if the SD card uses encryption, but seems doubtful.

The *.pvt files are discussed in the Hidden Menu section below. PIC-0.BMP seems to be something related to the screenshot feature; see below as well.

The remainder of the files are opaque data, but do note the 15 Na??.nlt files corresponding to the 15 zones available for routing.

When I attempted to eject the "volume" on the G5, it went away, and then after a moment or two, came right back. The cleanest method of "ejecting" the RM360 is to hit eject on the Mac (or PC), immediately pull the USB, and reset the unit by holding down the power button until it shuts off.

There is nothing special about the USB cable; any USB-miniUSB cable will do.

Internal Memory

However, if you have the card out (to be nice to the unit, I turned it off, popped the SD card, connected the USB and turned it on), you'll be presented with the internal memory instead.

/Volumes/Untitled/% ls -lR
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 APPMODE.DAT
-rwxrwxrwx   1 censored  censored     65536 Oct 24  2005 CDSSESM.DAT
-rwxrwxrwx   1 censored  censored       348 Jul 18  2005 CHKLST.TXT
-rwxrwxrwx   1 censored  censored     65536 May 11  2005 CRITMEM.MEM
-rwxrwxrwx   1 censored  censored   7088188 Jul 18  2005 DUT_F.SND
-rwxrwxrwx   1 censored  censored   3604680 Jul 18  2005 ENG_F.SND
-rwxrwxrwx   1 censored  censored   5502248 Jul 18  2005 EUK_F.SND
-rwxrwxrwx   1 censored  censored  17082736 Jul 18  2005 EU_BSMAP.MGI
-rwxrwxrwx   1 censored  censored     97502 Jul 18  2005 EU_BSMAP.NLT
-rwxrwxrwx   1 censored  censored   6041484 Jul 18  2005 FRE_F.SND
-rwxrwxrwx   1 censored  censored   6497736 Jul 18  2005 GER_F.SND
-rwxrwxrwx   1 censored  censored      3428 Sep  6  2005 INDEX.MCT
-rwxrwxrwx   1 censored  censored   7183020 Jul 18  2005 ITA_F.SND
-rwxrwxrwx   1 censored  censored  28829874 Jul 18  2005 NA_BSMAP.MGI
-rwxrwxrwx   1 censored  censored     61786 Jul 18  2005 NA_BSMAP.NLT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERA.DAT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERB.DAT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERC.DAT
-rwxrwxrwx   1 censored  censored       304 May 11  2005 RPCHKLST.TXT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 SESMODE.DAT
-rwxrwxrwx   1 censored  censored        11 Jul 18  2005 SOUND.CFG
-rwxrwxrwx   1 censored  censored   7237084 Jul 18  2005 SPA_F.SND
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERA.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERB.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERC.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERA.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERB.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERC.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERA.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERB.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERC.DAT
-rwxrwxrwx   1 censored  censored     65536 May 11  2005 TRACKRE.DAT
drwxrwxrwx   1 censored  censored     16384 Dec  1 22:51 USBTRANS
-rwxrwxrwx   1 censored  censored       216 May 11  2005 tnErrorIndex.001
-rwxrwxrwx   1 censored  censored    128000 May 11  2005 tnErrorlog1.dat

./USBTRANS:
total 6368
-rwxrwxrwx   1 censored  censored  3238424 Sep  6  2005 FIRMWARE.BIN
-rwxrwxrwx   1 censored  censored      217 Sep 21  2005 UNIT_ID.DAT
Here at least we can make some educated guesses about what these are:

Oh Crap I Bought This On eBay And The Internal Memory Was Formatted

If you have a mute RM360, it's been formatted -- someone erased the internal memory. This is catastrophic, and it's really dumb that Magellan would make such a big league option accessible to a casual user. Magellan will not fix this under warranty, and now that the RM360 is discontinued, they will not fix them at all.

If you have a working RM360 (an RM300 may also have these files), several people have sent in before-and-afters of their unit so we do know what files perish in the formatting. Specifically, the format erases all files that do NOT end in .dat except tnErrorIndex.001 and RPCHKLST.TXT. A formatted RM360 looks like this:

/Volumes/Untitled/% ls -lR
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 APPMODE.DAT
-rwxrwxrwx   1 censored  censored     65536 Oct 24  2005 CDSSESM.DAT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERA.DAT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERB.DAT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERC.DAT
-rwxrwxrwx   1 censored  censored       304 May 11  2005 RPCHKLST.TXT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 SESMODE.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERA.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERB.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERC.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERA.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERB.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERC.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERA.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERB.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERC.DAT
-rwxrwxrwx   1 censored  censored     65536 May 11  2005 TRACKRE.DAT
-rwxrwxrwx   1 censored  censored       216 May 11  2005 tnErrorIndex.001
-rwxrwxrwx   1 censored  censored    128000 May 11  2005 tnErrorlog1.dat
As you can see, the format process deleted all the sound files, all the internal map data files, and a number of the configuration files. The exact list of missing files is actually our diff above between the two checklist files (notice that RPCHKLST.TXT survived and CHKLST.TXT didn't).

To restore a unit, you will need to replace the various internal map data files (either or both of NA_* for North America or EU_* for Europe), the critical memory image (CRITMEM.MEM), the CHKLST.TXT file, and at least one of the sound files (make sure SOUND.CFG points to that audio file). You should be able to get this by copying these files from a working RM360 -- a working RM300 may have this also, but I have not tested it, and the RM300 firmware image that I am told is present on the RM300 CD may or may not help you either. There are no firmware images on the RM360's CD; it only contains the manual, and the 1.81 update does not have these files either. Such a piecemeal sort of restoration process may make your unit even worse. Proceed at your own risk. (Though one could argue that it's bricked anyway so there's nothing to lose, but that's your own ballgame.)

Since writing this hacking page, I am getting besieged with mail asking me for copies of the firmware on my unit. These files are too large to offer over my overworked uplink, but more importantly, I am not interested in being a target for Magellan's lawyer attack dogs. Please do not mail me for a copy of the firmware -- I will ignore such requests. I can't help you with this. Because Magellan still locks the 1.81 update behind a whole registration process, I can only conclude they would be even more unwilling to let the whole firmware out.

[Screenshot of hidden menu.]

The Hidden Menu

Like its elders, the RM360 has the ++--+- menu (i.e., press the plus button twice, then minus button twice, then plus, minus, while in the OPTION menu). Most of these options are really only useful to Thales-Magellan programmers debugging the firmware, and some don't even seem to work, but we can still play around with them.



Back to Hacking the RoadMate 360