Hacking into the RoadMate 360

Some of these options could potentially damage the unit or the unit's software if used improperly. Proceed at your own risk.

The RoadMate 360 appears to run a stripped down version of the same operating system as its older siblings, thus making it a Windows CE (4.2?) machine with an ARM processor at an unknown clockspeed. This also means that much the same methods of hacking into the unit's software also apply, within certain limits given what is included. These notes apply to 1.81, the most current available firmware revision. You can see your machine's firmware under the OPTION menu, User Options, Diagnostics, Product Information.

USB and SD Card Contents

First, a word about how the RM360 stores data. I've chosen to discuss the filesystem and the USB together since some units, including mine, keep the SD card under a warranty sticker (but now I guess that doesn't matter anymore).

The RM360 has two memory sources, its internal memory and the SecureDigital slot (which comes prepopulated). The card is a bog-standard SD card, formatted FAT16, and appears to be 2GB in size. However, the maps on my card are only using about 3/4 of that -- 506.7MB of 1.89GB free, per the Finder.

The RM360's USB does not provide NMEA information (darn). In fact, all the USB seems to do is present the unit as a standard Mass Storage device, reading directly off the unit's SD card. When I connected it to my Power Mac G5 and looked at it in the Terminal, this is what I got:

/Volumes/NO NAME/% ls -lR
total 2928704
-rwxrwxrwx   1 censored censored   30697448 Sep 16  2005 NA_BSMAP_Q105.mgi
-rwxrwxrwx   1 censored censored     329618 Sep 16  2005 NA_BSMAP_Q105.nlt
-rwxrwxrwx   1 censored censored 1409286552 Sep 16  2005 Na.imi
-rwxrwxrwx   1 censored censored        211 Sep 16  2005 Na.msf
-rwxrwxrwx   1 censored censored    2806886 Sep 16  2005 Na1.nlt
-rwxrwxrwx   1 censored censored    4920170 Sep 16  2005 Na10.nlt
-rwxrwxrwx   1 censored censored    2472302 Sep 16  2005 Na11.nlt
-rwxrwxrwx   1 censored censored    5264006 Sep 16  2005 Na12.nlt
-rwxrwxrwx   1 censored censored    3761254 Sep 16  2005 Na13.nlt
-rwxrwxrwx   1 censored censored    2673486 Sep 16  2005 Na14.nlt
-rwxrwxrwx   1 censored censored    4865438 Sep 16  2005 Na15.nlt
-rwxrwxrwx   1 censored censored    6033238 Sep 16  2005 Na2.nlt
-rwxrwxrwx   1 censored censored    2792350 Sep 16  2005 Na3.nlt
-rwxrwxrwx   1 censored censored    3951314 Sep 16  2005 Na4.nlt
-rwxrwxrwx   1 censored censored    1182394 Sep 16  2005 Na5.nlt
-rwxrwxrwx   1 censored censored    4294262 Sep 16  2005 Na6.nlt
-rwxrwxrwx   1 censored censored    4473074 Sep 16  2005 Na7.nlt
-rwxrwxrwx   1 censored censored    3462834 Sep 16  2005 Na8.nlt
-rwxrwxrwx   1 censored censored    5590354 Sep 16  2005 Na9.nlt
-rwxrwxrwx   1 censored censored     153654 Jun 13  2006 PIC-0.BMP
drwxrwxrwx   1 censored censored      32768 Oct 24  2005 USBTRANS
-rwxrwxrwx   1 censored censored       3612 Sep 16  2005 index.mct
-rwxrwxrwx   1 censored censored         13 Sep 16  2005 opid.slt

./USBTRANS:
total 64
-rwxrwxrwx   1 censored censored 218 Oct 24  2005 UNIT_ID.DAT

(presumably the contents of the card in their entirety). Some of these files are readable:

/Volumes/NO NAME/USBTRANS/% xd UNIT_ID.DAT 
00000000  4d 6f 64 65 6c 3d 4d 52  4d 20 33 30 30 0d 0a 49  |Model=MRM 300..I|
00000010  44 3d 31 31 33 0d 0a 53  57 20 56 65 72 73 69 6f  |D=113..SW Versio|
00000020  6e 3d 31 2e 38 31 0d 0a  53 65 72 69 61 6c 20 4e  |n=1.81..Serial N|
00000030  75 6d 62 65 72 3d 31 31  33 31 31 30 30 33 36 37  |umber=1131100367|
00000040  30 0d 0a 43 6f 64 65 20  46 6c 61 73 68 3d 34 0d  |0..Code Flash=4.|
00000050  0a 4e 41 4e 44 20 46 6c  61 73 68 3d 31 32 34 0d  |.NAND Flash=124.|
00000060  0a 53 44 3d 31 39 33 37  0d 0a 53 44 20 53 65 72  |.SD=1937..SD Ser|
00000070  69 61 6c 20 4e 75 6d 62  65 72 3d 44 42 43 38 41  |ial Number=DBC8A|
00000080  32 32 30 38 30 34 37 33  32 33 30 34 34 35 33 34  |2208047323044534|
00000090  34 35 33 0d 0a 43 46 3d  30 0d 0a 43 46 20 53 65  |453..CF=0..CF Se|
000000a0  72 69 61 6c 20 4e 75 6d  62 65 72 3d 0d 0a 44 69  |rial Number=..Di|
000000b0  73 6b 3d 30 0d 0a 44 69  73 6b 20 53 65 72 69 61  |sk=0..Disk Seria|
000000c0  6c 20 4e 75 6d 62 65 72  3d 0d 0a 55 53 42 20 44  |l Number=..USB D|
000000d0  65 76 69 63 65 3d 53 44  0d 0a                    |evice=SD..|
000000da
/Volumes/NO NAME/USBTRANS/% cd ..
/Volumes/NO NAME/% xd opid.slt 
00000000  db c8 a2 20 80 47 32 30  44 53 44 53 54           |... .G20DSDST|
0000000d
/Volumes/NO NAME/% xd Na.msf 
00000000  4d 53 46 5f 56 45 52 53  49 4f 4e 20 3d 20 31 0d  |MSF_VERSION = 1.|
00000010  0a 42 41 53 45 4d 41 50  5f 55 53 45 44 20 3d 20  |.BASEMAP_USED = |
00000020  79 65 73 0d 0a 42 41 53  45 4d 41 50 5f 4e 41 4d  |yes..BASEMAP_NAM|
00000030  45 20 3d 20 4e 41 5f 42  53 4d 41 50 5f 51 31 30  |E = NA_BSMAP_Q10|
00000040  35 2e 6d 67 69 0d 0a 46  55 4c 4c 5f 43 4f 56 45  |5.mgi..FULL_COVE|
00000050  52 41 47 45 20 3d 20 79  65 73 0d 0a 4d 41 50 54  |RAGE = yes..MAPT|
00000060  59 50 45 20 3d 20 53 54  52 5f 52 4f 55 54 45 0d  |YPE = STR_ROUTE.|
00000070  0a 56 45 52 53 49 4f 4e  20 3d 20 32 2e 30 30 0d  |.VERSION = 2.00.|
00000080  0a 56 45 4e 44 4f 52 5f  49 44 20 3d 20 35 0d 0a  |.VENDOR_ID = 5..|
00000090  52 45 47 49 4f 4e 5f 49  44 20 3d 20 33 0d 0a 56  |REGION_ID = 3..V|
000000a0  45 52 53 49 4f 4e 5f 49  44 20 3d 20 32 31 0d 0a  |ERSION_ID = 21..|
000000b0  43 4f 4d 50 5f 56 45 52  53 49 4f 4e 20 3d 20 33  |COMP_VERSION = 3|
000000c0  32 0d 0a 4c 49 42 5f 56  45 52 53 49 4f 4e 20 3d  |2..LIB_VERSION =|
000000d0  20 39 32                                          | 92|
000000d3

In particular, notice that the unit identifies itself as an RM 300! There are also hooks for other devices listed, including what appears to be CompactFlash, and a "Disk" option.

It is unclear if the SD card uses encryption, but seems doubtful.

The *.pvt files are discussed in the Hidden Menu section below. PIC-0.BMP seems to be something related to the screenshot feature; see below as well.

The remainder of the files are opaque data, but do note the 15 Na??.nlt files corresponding to the 15 zones available for routing.

When I attempted to eject the "volume" on the G5, it went away, and then after a moment or two, came right back. The cleanest method of "ejecting" the RM360 is to hit eject on the Mac (or PC), immediately pull the USB, and reset the unit by holding down the power button until it shuts off.

There is nothing special about the USB cable; any USB-miniUSB cable will do.

Internal Memory

However, if you have the card out (to be nice to the unit, I turned it off, popped the SD card, connected the USB and turned it on), you'll be presented with the internal memory instead.

/Volumes/Untitled/% ls -lR
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 APPMODE.DAT
-rwxrwxrwx   1 censored  censored     65536 Oct 24  2005 CDSSESM.DAT
-rwxrwxrwx   1 censored  censored       348 Jul 18  2005 CHKLST.TXT
-rwxrwxrwx   1 censored  censored     65536 May 11  2005 CRITMEM.MEM
-rwxrwxrwx   1 censored  censored   7088188 Jul 18  2005 DUT_F.SND
-rwxrwxrwx   1 censored  censored   3604680 Jul 18  2005 ENG_F.SND
-rwxrwxrwx   1 censored  censored   5502248 Jul 18  2005 EUK_F.SND
-rwxrwxrwx   1 censored  censored  17082736 Jul 18  2005 EU_BSMAP.MGI
-rwxrwxrwx   1 censored  censored     97502 Jul 18  2005 EU_BSMAP.NLT
-rwxrwxrwx   1 censored  censored   6041484 Jul 18  2005 FRE_F.SND
-rwxrwxrwx   1 censored  censored   6497736 Jul 18  2005 GER_F.SND
-rwxrwxrwx   1 censored  censored      3428 Sep  6  2005 INDEX.MCT
-rwxrwxrwx   1 censored  censored   7183020 Jul 18  2005 ITA_F.SND
-rwxrwxrwx   1 censored  censored  28829874 Jul 18  2005 NA_BSMAP.MGI
-rwxrwxrwx   1 censored  censored     61786 Jul 18  2005 NA_BSMAP.NLT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERA.DAT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERB.DAT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERC.DAT
-rwxrwxrwx   1 censored  censored       304 May 11  2005 RPCHKLST.TXT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 SESMODE.DAT
-rwxrwxrwx   1 censored  censored        11 Jul 18  2005 SOUND.CFG
-rwxrwxrwx   1 censored  censored   7237084 Jul 18  2005 SPA_F.SND
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERA.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERB.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERC.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERA.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERB.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERC.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERA.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERB.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERC.DAT
-rwxrwxrwx   1 censored  censored     65536 May 11  2005 TRACKRE.DAT
drwxrwxrwx   1 censored  censored     16384 Dec  1 22:51 USBTRANS
-rwxrwxrwx   1 censored  censored       216 May 11  2005 tnErrorIndex.001
-rwxrwxrwx   1 censored  censored    128000 May 11  2005 tnErrorlog1.dat

./USBTRANS:
total 6368
-rwxrwxrwx   1 censored  censored  3238424 Sep  6  2005 FIRMWARE.BIN
-rwxrwxrwx   1 censored  censored      217 Sep 21  2005 UNIT_ID.DAT

Here at least we can make some educated guesses about what these are:

CHKLST.TXT contains a manifest of all the files in this directory (sans USBTRANS/). RPCHKLST.TXT is similar, but has one file in USBTRANS/, and seems to lack some of the others:

/Volumes/Untitled/% sort RPCHKLST.TXT | diff - CHKLST.TXT
2,3c2,8
< CDSSESM.DAT
< CRITMEM.MEM
---
> DUT_F.SND
> ENG_F.SND
> EU_BSMAP.mgi
> EU_BSMAP.nlt
> EUK_F.SND
> FRE_F.SND
> GER_F.SND
4a10,12
> ITA_F.SND
> NA_BSMAP.mgi
> NA_BSMAP.nlt
8d15
< RPCHKLST.TXT
9a17,18
> SOUND.CFG
> SPA_F.SND
19,22c28
< TRACKRE.DAT
< USBTRANS\\UNIT_ID.DAT
< tnErrorIndex.001
< tnErrorlog1.dat
---
> TRACKRE.DAT
\ No newline at end of file

Analysis of the firmware, however, seems to imply that the unit does its verification against CHKLST.TXT. In fact, RPCHKLST.TXT seems to be involved with formatting the unit's internal memory (do not do this); see below.

???_F.SND are the voice data files. SOUND.CFG stores the language file in use:
```
/Volumes/Untitled/% xd SOUND.CFG 
00000000  45 4e 47 5f 46 2e 53 4e  44 0d 0a                 |ENG_F.SND..|
0000000b
```
The firmware implies that these can go on the card too -- see below. It also implies that there are "gender-specific" sound files, so the _F is undoubtedly "female." Why, those sexist bastiches. What if I wanted a studly guy reading my directions to me?
??USER?.DAT appear to be the user settings files, all in somehat opaque binary format, but address strings can be seen in TGUSER?.DAT (both bookmarked addresses and recently routed-to addresses). [ABC] refers to user [123].
USBTRANS/FIRMWARE.BIN seems to be the executable image itself. There are some funny and also inexplicable strings in this file (a selection from strings below). Frequent reference is made to Saturn* in this file -- if you've disassembled an RM300 or RM360, you'll know why (see our disassembly). There are even pieces of a VCard in ROM, apparently for the POI data.
*** GAAK! DEATH AWAITS *** Erasing serial number not allowed NAND Primary Partition ?NAND Hidden Partition Not found SOUND.CFG in NAND SaturnAudio.c <<>> %s Line: %d - %s Not found SOUND.CFG in SD card either End of file name not found Not found the sound file in NAND Not found sound file in SD card either Same Language & Gender. No need to switch sound file Not found new sound file in NAND Not found new sound file in SD card Not found SOUND.CFG in NAND Flash, create one Not found SOUND.CFG in SD card, create one PrepareForNameRetrieval Failed Stupid No-Name check, should fix Irrational jump of maneuver index out of ProceedStage Guidance. Houston, we have a problem CHKLST.TXT ALL FILES FOUND ENG_F.SND ENG_M.SND EUK_F.SND EUK_M.SND [etc.] Time for strcmp in City List function Distance To San Dimas Plant (m): X Distance To Tulsa Plant (m): X Distance To Bangkok Plant (m): X Invlaid Valid char Index [sic] AMX 4-Thumb Kernel v%x.%02x%c All rights reserved. Copyright (c) 1997-2003 KADAK Products Ltd. VER=1.10a CLASS=9 TSID=26 PN=PN422-1 inflate 1.1.3 Copyright 1995-1998 Mark Adler Surinamese Food [in amongst the POI list]

USBTRANS/UNIT_ID.DAT is similar to the firmware's copy, but has one expected and one unexpected change:

/Volumes/Untitled/USBTRANS/% xd UNIT_ID.DAT 
00000000  4d 6f 64 65 6c 3d 4d 52  4d 20 33 30 30 0d 0a 49  |Model=MRM 300..I|
00000010  44 3d 31 31 33 0d 0a 53  57 20 56 65 72 73 69 6f  |D=113..SW Versio|
00000020  6e 3d 31 2e 38 31 0d 0a  53 65 72 69 61 6c 20 4e  |n=1.81..Serial N|
00000030  75 6d 62 65 72 3d 31 31  33 31 31 30 30 33 36 37  |umber=1131100367|
00000040  30 0d 0a 43 6f 64 65 20  46 6c 61 73 68 3d 34 0d  |0..Code Flash=4.|
00000050  0a 4e 41 4e 44 20 46 6c  61 73 68 3d 31 32 34 0d  |.NAND Flash=124.|
00000060  0a 53 44 3d 30 0d 0a 53  44 20 53 65 72 69 61 6c  |.SD=0..SD Serial|
00000070  20 4e 75 6d 62 65 72 3d  30 30 30 30 30 30 30 30  | Number=00000000|
00000080  30 30 30 30 30 30 30 30  30 30 30 30 30 30 30 30  |0000000000000000|
00000090  0d 0a 43 46 3d 30 0d 0a  43 46 20 53 65 72 69 61  |..CF=0..CF Seria|
000000a0  6c 20 4e 75 6d 62 65 72  3d 0d 0a 44 69 73 6b 3d  |l Number=..Disk=|
000000b0  30 0d 0a 44 69 73 6b 20  53 65 72 69 61 6c 20 4e  |0..Disk Serial N|
000000c0  75 6d 62 65 72 3d 0d 0a  55 53 42 20 44 65 76 69  |umber=..USB Devi|
000000d0  63 65 3d 4e 41 4e 44 0d  0a                       |ce=NAND..|
000000d9

The SecureDigital Serial Number really does appear as all zeroes in the file; I didn't blank that out. Otherwise it appears to be much the same as in the internal flash except for the USB Device.

Popping the card back in while still mounted doesn't seem to change the file contents.

Notice that there are European (EU_*.*) and North American (NA_*.*) data files, even though this is only a North American unit. Obviously this is not the complete map image, which is on the card.

Oh Crap I Bought This On eBay And The Internal Memory Was Formatted

If you have a mute RM360, it's been formatted -- someone erased the internal memory. This is catastrophic, and it's really dumb that Magellan would make such a big league option accessible to a casual user. Magellan will not fix this under warranty, and now that the RM360 is discontinued, they will not fix them at all.

If you have a working RM360 (an RM300 may also have these files), several people have sent in before-and-afters of their unit so we do know what files perish in the formatting. Specifically, the format erases all files that do NOT end in .dat except tnErrorIndex.001 and RPCHKLST.TXT. A formatted RM360 looks like this:

/Volumes/Untitled/% ls -lR
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 APPMODE.DAT
-rwxrwxrwx   1 censored  censored     65536 Oct 24  2005 CDSSESM.DAT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERA.DAT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERB.DAT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 PWUSERC.DAT
-rwxrwxrwx   1 censored  censored       304 May 11  2005 RPCHKLST.TXT
-rwxrwxrwx   1 censored  censored     16384 May 11  2005 SESMODE.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERA.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERB.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 STUSERC.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERA.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERB.DAT
-rwxrwxrwx   1 censored  censored     32768 May 11  2005 TCUSERC.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERA.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERB.DAT
-rwxrwxrwx   1 censored  censored    196608 May 11  2005 TGUSERC.DAT
-rwxrwxrwx   1 censored  censored     65536 May 11  2005 TRACKRE.DAT
-rwxrwxrwx   1 censored  censored       216 May 11  2005 tnErrorIndex.001
-rwxrwxrwx   1 censored  censored    128000 May 11  2005 tnErrorlog1.dat

As you can see, the format process deleted all the sound files, all the internal map data files, and a number of the configuration files. The exact list of missing files is actually our diff above between the two checklist files (notice that RPCHKLST.TXT survived and CHKLST.TXT didn't).

To restore a unit, you will need to replace the various internal map data files (either or both of NA_* for North America or EU_* for Europe), the critical memory image (CRITMEM.MEM), the CHKLST.TXT file, and at least one of the sound files (make sure SOUND.CFG points to that audio file). You should be able to get this by copying these files from a working RM360 -- a working RM300 may have this also, but I have not tested it, and the RM300 firmware image that I am told is present on the RM300 CD may or may not help you either. There are no firmware images on the RM360's CD; it only contains the manual, and the 1.81 update does not have these files either. Such a piecemeal sort of restoration process may make your unit even worse. Proceed at your own risk. (Though one could argue that it's bricked anyway so there's nothing to lose, but that's your own ballgame.)

Since writing this hacking page, I am getting besieged with mail asking me for copies of the firmware on my unit. These files are too large to offer over my overworked uplink, but more importantly, I am not interested in being a target for Magellan's lawyer attack dogs. Please do not mail me for a copy of the firmware -- I will ignore such requests. I can't help you with this. Because Magellan still locks the 1.81 update behind a whole registration process, I can only conclude they would be even more unwilling to let the whole firmware out.

[Screenshot of hidden menu.]

The Hidden Menu

Like its elders, the RM360 has the ++--+- menu (i.e., press the plus button twice, then minus button twice, then plus, minus, while in the OPTION menu). Most of these options are really only useful to Thales-Magellan programmers debugging the firmware, and some don't even seem to work, but we can still play around with them.

Playback Vehicle Position and Record Vehicle Position are used for testing the GPS. With a lock enabled, select Record and Select File, entering a filename. You cannot record over an existing filename (darn). Once set, you can use Auto Record (apparently records on motion), or manually use the Record/Pause/Stop buttons. Having saved the file, you can now replay it in Playback (using Auto Replay, Wrap Around and the 30 seconds forward and back as you would expect). To delete files, you'll have to do that manually from USB.
Files are stored in the root directory with an extension .pvt.
Simulator Mode is the same as regular Simulator Mode (see Tips and Tricks), but has an additional Generate input to Map Matching option, whatever that means.
Collect Time-To-First-Fix keeps a log of how long it takes for the unit to get an initial fix. This is not too useful for us.
Setup Miscellaneous System Flags is mysterious and seems buggy. It offers a tantalizing All System Flags option; press the down arrow and a list of apparent options appear, none of them selectable, and the screen accumulates garbage if you scroll around. Press CANCEL when you get tired of it.
Clear GPS Memory seems quite drastic and will warn you that you risk system failure if you run it. Since I want to keep my unit, I declined to run it. Your funeral.
Task Profiler examines the execution time required for the system task(s) (which are opaquely numbered). You can tap Duration for a particular testing interval, although I'm not sure how this works exactly.
Dump File System Info is an apparently tantalizing option that sits for a good minute or so, then returns without apparently having done anything (and there is nothing new on the card). Ditto for Dump Window Info.
Screen Capture lamentably doesn't work on the RM360. On the RM700 and other units, if you enable this (by ticking Enable Screen Capture), you can take a screenshot by holding down the REPEAT button and pressing VIEW. The shots are then saved as PIC-n.BMP to the root directory. Unfortunately, the RM360 doesn't have an obvious REPEAT button and I couldn't find any other method of kicking it off, so this initially promising option is apparently utterly worthless. For some strange reason my unit did have a PIC-0.BMP file, but it only contained garbage.
Task Stack Usage displays interesting but mostly non-useful information on the device's internal memory usage. Some of the subsystems can be guessed at if you think hard (exercise for the reader).

Back to Hacking the RoadMate 360