messing with This Satnav I Found at a Thrift Store

Introduction

#

So today, Sunday the 13th my big brother turned 23 and we celebrated his birthday. Afterwards, i started preparing for work. As at 16:30 I had a customer who needed some help with his computer and thus i prepared for that and then toom the bike to the customer all the way in Nuenen. This was a 10KM 33 Minutes travel. On the way to the address i had the wind in my back so that was nice and i came on time to the address. When i ran the doorbell, i got no response. I Ran it multiple times and then started calling the customer on my phone. When he answered, i heard he unfortunately suffered a brainbleed and thus he could not dismiss the appointment and was rushed to the hospital that same day. I felt bad for him, but i also felt bad that i had traveled all the way to Nuenen for it… Honestly these things simply happen in life and i wont blame him for it as a brainbleed is not a fun situation, but then i did get an idea to take a trip to the thrift store in Nuenen just so i could see if i could pickup some nice crappy gadgets/electronic devices, also to ease my pain of having traveled that long distance.

After some searching i found an old MIO satnav (GPS navigation device) and i also found a tomtom go one in the random items box. I picked up both and i paid 1 euro each so i thought it would be fun to try and see what i can do with those and mess around with their embedded OS’es. I knew satnavs either would use WindowsCE (A compact embedded version of WIndows for mobile and embedded devices) or Embedded Linux. And a satnav has a screen, so if i could hack the stock os, i could use that screen. So i bought those and traveled all the way home, this time with a fierce wind against me. In this post i will mess with the MIO one. Actually on the box it was listed as 5,99 but the cashiere discounted it to 1 euro.

The device

#

So i did not take a massive amount of pictures but below you can see the box and the device itself.

UART Port

#

SO i tore it down (sadly did not make any pictures) and i managed to spot a UART port inside. I also noticed that the screen ribbon cable was not properly seated and when i turned it on first time to see if it was even working, i got white and grey lines, but reseating the ribbon cable solved that. Sadly i also did not make any pictures of the board, but there where some small rx and tx labels near the USB port and i soldered wires to those tiny pads next to the labels.

We got boot output!

#

So after plugging it in to my laptop (as the battery was flat), it powered on and i got the bootlog below!

SDMMC booting
[S][216]: SD(Clk=50000000, Ratio=6), PWR_PRF_RATIO=0x6, PWR_CLK_SWITCH=0x65
Card is mmc v4 but doesn't support any high-speed modes
SD clock, div=0x200, supported=12500000, max=20000000


 MiscBinSize=0x2800
[nick]EBOOTStartSector=1
[nick]EBOOTSize=512
[nick]EBOOTNum=1
[nick]TOCStartSector=513
[nick]TOCSize=2
[nick]NumTOC=2
[nick]SecureStartSector=517
[nick]SecureSize=7168
[nick]MiscBinStartSector=7685
[nick]MiscBinSize=10240
[nick]MiscDataStartSector=17925
[nick]MiscDataSize=262144
[nick]RegionBinStartSector=280069
[nick]RegionBinSize=20480
[nick]ReservedPercentRoPart=-1
InitTocGlobalVariable,g_dwMiscBinSize=10240,g_dwMiscDataSize=262144,g_dwTOCStartSector=513
 +TOC_Setup +
ReadTOCSectors start sector 513 2 sectors, sig 0x434F544E, version 0x3
ReadTOCSectors start sector 515 2 sectors, sig 0x434F544E, version 0x3
Locate 0th TOC successfully
Eboot's vir sector:                     0x1,toc sector:0x1
nk's vir sector:                                0x49609,toc sector:0x49609
secur's vir sector:                     0x205,toc sector:0x205
region bin's vir sector:                0x44605,toc sector:0x44605
node 0 is created
Disable hwinit
--0v_pDriverGlobals->misc.dwIbootFlag = 0x0

--0v_pDriverGlobals->power.ResetStatus = 0x3

Read hibernation image, buf=0x8C100000,len=0x40000

::: WARM-RESET g_bWarmReset=0x1
Windows CE Atlas Bootloader Version 3.3 Built Jul 17 2013 17:06:48 
UART-UPDATE Flag: 0x0 
BP_Init
mbr blk=0xAC200200
Image sector starts at physical sector 49609(49609) 
[ADC] #### ADC:(1)981  (2)504  Group=19 ####
v_pDriverGlobals->misc.dwUTVersion = 0x0
---v_pDriverGlobals->misc.dwIbootFlag = 0x0
v_pDriverGlobals->power.ResetStatus=0x3
OEMPlatformInit: IMAGE_TYPE_RAMIMAGE|IMAGE_TYPE_BINFS
OEMPlatformInit: normal boot
ShowScreen++!!Sector_num = 2,dwSectorStart =280069,0x44605!

FRAMECOUNT= 32
TempBuffer=0x 8C0BBF88
INFO: Loading image from Boot Media to RAM (address=0x93C80000, sectors=0x1A7A, launch address=0x93C81000)...
IsValidMBR: MBR sector = 0x0
OpenPartition: Partition Exists=0x1 for part 0x21.
BP_SetDataPointer at 0x0
ReadData: Start = 0x0, Length = 0x34F400.
-OEMPreDownload: BL_JUMP
::OEMLaunch, ImageStart:0x93C80000, ImageLength:0x1A7A, LaunchAddr:0x93C81000

Jumping to image at virtual address 0x93C81000h

::: Physical Launch Address: 0xC7C81000h

Welp, this reveals a lot already :). I did not expect this one to run WindowsCE to be honest ( i thought the tomtom one would run it just because it looked exactly like a typical WindowsCE device), but i got surprised! Sadly no interactive shell via UART.

The filesystem

#

After a few seconds it showed up as a MIO USB storage device on my fedora system. I mounted it and when i looke din the folders, i saw indeed windows like components.

Doing some research into the filesystem and folders.

#

So i found out the main Application it runs at boot is called Navman. This is the GPS app that provides the interface ontop of WindowsCE. Then i epxlored the “Program Files” map a bit more and found a couple folders.

I dont know what the other folders are yet, but Navman is 100% the app it launches. I do expect that the other maps are for adding more stuff or such to the Main navman app. I did briefly scroll through the UI while it was powered on and i could see that it could play media and do a few other things so thats probably what those other MIO folders are for. ANyways, Navman is our focus right now. In the Navman folder i could see an .exe file named AppStartupSec.exe. I think this might run the App itself. Probably launched from DesktopLauncher.exe we found in the root of the filesystem. Nevermind, i think i am wrong, as i did find a appstartupsec.ini file and it contains below information.

[AppStartupSec]
TurnOffConsole=TRUE

[Process1]
RelativePath=TRUE
ProcessFile=SmartST_CE.exe
DefaultCmdLine=
BootCmdLine=
StartOnBoot=1
MaxRestarts=3
TreatCloseAsError=TRUE
Major=TRUE
WindowName=SmartST_CE
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

[Process2]
RelativePath=FALSE
ProcessFile=Program Files\Screen Saver\VideoShow.exe
DefaultCmdLine=
BootCmdLine=
StartOnBoot=0
MaxRestarts=0
TreatCloseAsError=FALSE
Major=FALSE
WindowName=VideoShow
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

[Process3]
RelativePath=FALSE
ProcessFile=Program Files\MioMediaPlayer\MioMediaPlayer.exe
DefaultCmdLine=AUD VID
BootCmdLine=
StartOnBoot=0
MaxRestarts=0
TreatCloseAsError=FALSE
Major=FALSE
WindowName=MioMediaPlayer
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

[Process4]
RelativePath=FALSE
ProcessFile=Program Files\MioBT\MioBT.exe
DefaultCmdLine=-h HFP HSP DUN PHBOOK
BootCmdLine=
StartOnBoot=5
MaxRestarts=0
TreatCloseAsError=TRUE
Major=FALSE
WindowName=MioBTUI
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

[Process5]
RelativePath=FALSE
ProcessFile=Program Files\MioCS\MioMoreShell.exe
DefaultCmdLine=
BootCmdLine=
StartOnBoot=0
MaxRestarts=3
TreatCloseAsError=FALSE
Major=FALSE
WindowName=CSMainShellWnd
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

[Process6]
RelativePath=FALSE
ProcessFile=Program Files\AV_IN\AV_IN.exe
DefaultCmdLine=
BootCmdLine=
StartOnBoot=0
MaxRestarts=3
TreatCloseAsError=FALSE
Major=FALSE
WindowName=AV_IN
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

[Process7]
RelativePath=FALSE
ProcessFile=Program Files\AV_IN\AVINMgr.exe
DefaultCmdLine=
BootCmdLine=
StartOnBoot=1
MaxRestarts=3
TreatCloseAsError=FALSE
Major=FALSE
WindowName=
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

[Process8]
RelativePath=FALSE
ProcessFile=Program Files\MioCS\Roadside.exe
DefaultCmdLine=
BootCmdLine=
StartOnBoot=0
MaxRestarts=3
TreatCloseAsError=FALSE
Major=FALSE
WindowName=CSRoadsideWnd
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

After some searching and sparring with AI, i found an answer that could be true. This could be (one of) the main/core startup management process. Anyways, this startup/bootstrap process could be an interesting entry point to hopefully get custom software running on it as there are a few Apps that are made for WIndowsCE by the community.

Can it run DOOM?

#

SO in tech and internet culture, there is this joke of “Can it run DOOM?” basically a meme/challenge where people tyr to get this classic 90s shooter running on some of the wildest hardware, due to the fact the code of the game can be so optimized and shrunken down to absolute minimum and also because the code is in the community. I know that others have tried running DOOM on WindowsCE devices so its definitely possible and i dont think this satnav does any integrity checks or verifications, so messing with the WindowsCE system should be possible!

ALso the fact the AppStartupSec.exe process can “kind off” be compared to busybox’s Init scripts in init.d, this could be an amazing entyrpoint to get doom runing on the device. Just have to make sure we have one compatible for the processor in this system and also we need enough storage space to launch the game and also store the WAD (game Level and map data) file.

Anyways, i will run doom later in a bit. First lets see if we can do some easier modifications like changing the splash screen.

Lets mess with the splash screen.

#

So i navigated into the Navman app and then into SmartST_CE and then i found a folder called “UI” which probably contains the User Interface (UI) data like Assets (eg sounds, icons and such) and probably also the splash screens. I first decided to mess with the screen you see when it loads the GPS maps. Its a file called “maploading.png” and this is exactly what the name is, this is shown when the map loads in.

After changing it to my 309ELE logo it worked!

This proves we can mess with the filesystem no problem! Great!

Lets mess with the startup Application.

#

So remember that “AppstartupSec.ini” file? thats the config file for the Startup bootstrap application, that “AppStartupSec.exe”. Below is an interesting snippet. Each entry is like this and each entry has the name of the process file it executes, commandline arguments that are passed to the Application and also “StartOnBoot” which tells the bootstrap process to launch it at boot. We could easily mess with it without doing irreperable harm to the device, we can simply make another entry and tell that to get started at boot, so we can launch our own application.

[Process1]
RelativePath=TRUE
ProcessFile=SmartST_CE.exe
DefaultCmdLine=
BootCmdLine=
StartOnBoot=1
MaxRestarts=3
TreatCloseAsError=TRUE
Major=TRUE
WindowName=SmartST_CE
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

We will do DOOM later, lets first see if we can get a sort of “Windows explorer” app running in the CE system. THis way we can browse the full filesystem and or see maybe hidden partitions or drives it does not expose over USB.

Ce-commander.exe

#

So there is this community project called cecmder.exe which aims to make a sort of file explorer app for WindowsCE thats also very tiny in size and cna run on these weak devices. I created an entry in the .ini file called Process9.

[Process9]
RelativePath=FALSE
ProcessFile=Program Files\Explorer\cecmd.exe
DefaultCmdLine=
BootCmdLine=
StartOnBoot=1
MaxRestarts=3
TreatCloseAsError=TRUE
Major=TRUE
WindowName=Hacked
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

[Process1]
RelativePath=TRUE
ProcessFile=SmartST_CE.exe
DefaultCmdLine=
BootCmdLine=
StartOnBoot=0
MaxRestarts=3
TreatCloseAsError=TRUE
Major=FALSE
WindowName=SmartST_CE
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

So this defines the app it needs to start. I made an “Explorer” folder in the Program Files directory and put all files of ce-commander inside. This way i can reverse stuff if i want. I also added this entry in the .ini file. After setting Process1’s startonboot= to 0, i set the process9 (our custom app) one to 1 so it should start our ce-commander process. Lets see if it works! Again, this is fully reversible and wont cause irreperable harm. And yes indeed it boot sinto ce-commander, yeeha!

Now we have full control over the system itself and we can start exploring the WindowsCE system.

It runs DOOM

#

So the final objective is getting the classic 90s shooter game running on hardware it was never meant for. Well, there are alredy ports of WidnowsCE release of chocolate-doom (free), so that makes life a lot easier! First i downloaded the .cab file from this site. Then i extracted the cab and oh boy, there are no normal files inside or atleast no normal file extensions.

Well, some files where quite obvious. the one with SDL in the name where for the external SDL dependencies/libraries (in the form of DLL files). SDLmixer.005 is obviously for the audio (mixer is a term used in the audio space). libDLne.001 probably is SDL network library and SDL is the main graphics DLL. Anyways, i figured it out with a bit of searching on the internet and a bit of AI and i managed to coe up with the table below:

So then i made a directory in the “Program Files” folder of the device’s mounted internal storage and inside copied all the DOOM files. Only thing we need is a WAD file, which contains the Assets and level stuff so i simply Downloaded the windows Doom95 version and extracted the zip and got the DOOM1.WAD file. Then i copied it to the DOOM folder. Then i made a startup entry in the appstartupSec.ini script so i could launch my program without having to write batch script or somehow enable commandline on WindowsCE.

[Process11]
RelativePath=FALSE
ProcessFile=Program Files\DOOM\chocolate-doom.exe
DefaultCmdLine=-iwad  "\My Flash Disk\Program Files\DOOM\DOOM1.WAD"
BootCmdLine=
StartOnBoot=1
MaxRestarts=3
TreatCloseAsError=FALSE
Major=False
WindowName=Chocolat DOOM
MaxCloseMessages=10
KeysToForward=0x7A,0xC4
KeysToBoot=

Please note: The script starts from the root of the device. I had some issues that specifying just “Program Files\DOOM\DOOM1.WAD” would lead to my WAD file not being found. After bit of digging and trial and error, it seems the game checks starting from the root of the device, so not the internal storage partition that gets mounted, but rather the underlying root thats normally hidden. SO thats why i ahd to specify “My Flash Disk” before as thats the folder that gets mounted and thats ofcourse not the real root, as thats above that out of the view and its normally hidden. After that the game worked wonderfully! Sadly i wont spend any more time on it or get somehow touch controls working but it plays the demo and technically thats not truly “running” the game but it does still show its capable of doing so.

So thats done! :)

Signing off

#

I really did enjoy this little fun project and i am happy i bought that satnav for 1 euro. I might also mess with the tomtom one in the futurue, but for now i am signing off here. Its also fun to explore WindowsCE. I remember whenn i was a little kid that at Jumbo supermarkten (One of our larger name grocery stores in the Netherlands), we got those motorola symbol scanners, the ones with a small screen and i believe those ran WindowsCE as well, as i once saw one with a WindowsCE dialog box on it in r/pbsod on reddit… Nowadays the scanners are all replaced by more modern Zebra personal shopper scanner series which run on Android, although i do believe some supermarkets also still have the older motorola/symbol scanners in place that ran Windows CE. I do sometimes still atleast so those price scanners (the ones hanging on the wall) and i believe those are still some part windowsCE,

Sadly WindowsCE is discountinued by microsoft i believe and Embedded linux / Android has taken up the place of WIndowsCE. And while its not exactly the Windows we know of Windows (NT on x86 desktops), it does show that it should be possible to run a flavor of Windows or atleast the core aesthetics and such on any device if they wanted too and that windows can be stripped down to its absolute bare core. I am a fan of Embedded Software and Operating Systems as not every manufacturer decides/wants to spin a custom OS from scratch. Using WindowsCE to power your product is easy. Compile the base OS for your chip and then build an executable and then have some clever mechanisms/scripts to run that app at boot. Same basically with embedded linux, just upload a few scripts to /etc/init.d and you cna launch your App and have it power the device while the average consumer wont notice that a whole OS is running under it all.

I also i love that in the past and even now people have run the classic 3d shooter game on the weirdest hardware you can imagine. Thats also why the meme is “If it has a screen, DOOM will be seen”. There has also been DOOM on a pregnancy test but that was kind of faked as the person ripped out all electronics and put in their own screen and such, so its not really running on the pregnancy test as its just the plastic casing of the device and if we judge based on that, DOOM can be played on anything if you put a pc into it and thats also where the meme kind of is wrong. But its still a fun hack to try and get DOOM running on as many devices. And with these days having gadgets with AI embedded and or gadgets with wifi and or screen, this will only become much more fun.