2013 – Satnav Hacking

Usually, commercial GPS navigation systems are completely closed off, so that only licensed content can be loaded onto them. It's the same with iGO, a popular satnav software that is being licensed to OEMs all around the world, sometimes under different names. Becker and Falk devices use an embedded version of iGO, but there's an Android and iPhone app available, too.

Why would you hack a satnav?

To modify the screen layout, some graphics, sounds, settings, for adding/removing features or for replacing the 3D model of the little arrow that indicates your position on the map, which is exactly what I was trying to do.

How?

How does one take on the task of injecting user-generated content into these systems? Fortunately, iGO uses several ZIP files and directory structures to load its content. A lot of complicated stuff can be found here, but I'm only interested in the little 3D car.

In some iGO versions, several car models can be found in the data.zip/content/car directory, but on my Becker Z107 satnav device, the model is hidden inside branding.zip/ui_becker/gfx/. The 3D car files have a .mdl extension and are accompanied by several other files: .ini, .tex, .nng and .bmp, to name a few.

Getting your own car into these systems is a matter of replacing the correct .mdl files. Unfortunately, there are a couple of road blocks along the way.

Unknown File Formats

Just extracting and re-packing the data.zip or branding.zip files will not work: iGO will refuse to load them, unless you use a specific tool to get the job done. More on that later.

One would think that these .mdl files might be versions of readily available formats, like Quake/HL models or something like that. Unfortunately, they're not. The file format is completely proprietary and one has to use reverse-engineering techniques to figure out how they work. The developer of the commercial software 3D Object Converter has done exactly this for dozens of file formats, including the iGO .mdl format. The demo version of his application helped me figure out the binary structure of .mdl files. They are actually a very basic 3D file format that supports vertices, UV coordinates, BGRA vertex colors and face indices of a single, unnamed object - and a texture. These textures have a .tex extension, but noone has really found out how they are encoded yet. Some tinkering has revealed that these .tex files have block offsets at the beginning of the file and, following that, blocks of decreasing size. I suspect that these might be OpenGL ES 1.0 mipmapped textures, but actually we don't need them to get our own model inside iGO.

Using the excellent 010 Editor and its binary templating technology, I was able to reverse-engineer the .mdl file format and wrote a script using PHP that converts between the Stanford PLY format and iGO's MDL.

Creating A New Model

I used Blender to create a model of a 1991 Peugeot 205 and since the .tex file format is unknown, I had to find another way of "painting" the car. However, the .mdl format does support vertex colors, so I used Blenders vertex color baking to get some lighting effects and materials onto my model. After that, I used ply2mdl.php to convert my mesh to the correct format, like this:

php ply2mdl.php input.ply output.mdl

Making A Package

As mentioned above, the data.zip and branding.zip files are a bit fragile. After a lot of trial and error, I found that the Linux command line tool zip gets the job done nicely. Just rename your .mdl to match the target exactly and put it inside a subdirectory structure that matches the structure found in your target zip. Backup your original data.zip and place a copy in the same directory as your .mdl, then open a terminal at that location and run this command (of course with your own file names):

zip -vuX9 branding.zip ui_becker/gfx/becker_car_gps.mdl
zip -vuX9 branding.zip ui_becker/gfx/becker_car_ghost.mdl
iGO_3D_format_templates.zip (1 KB)

010 Editor templates for the iGO .mdl and .tex (largely unknown) formats.

iGO_MDL_Converter.zip (5 KB)

PHP command line scripts for converting between Stanford PLY and iGO MDL.

/projects/02_projects/2013-08_satnav_hacking/thumbnail/773bdecb8711f5ff3e3f82e0f2480cfb_3_Peugeot205_Becker.jpg
/projects/02_projects/2013-08_satnav_hacking/thumbnail/65c721cb88d5eb73a6d7bbc7a422c7f5_1_Peugeot205_blender_materials.png
/projects/02_projects/2013-08_satnav_hacking/thumbnail/ecaaae278aa5defdd32b1d1df9228e1b_2_Peugeot205_iGO_Android.png