Plus if somebody already has RS Mon from factory, why should he need it? :)

@ebt25 - I am not sure I see the benefit of generating any slot for RS cars as we already have slots that are working. With my slots I can make the RS Monitor work on any RS. Only difference is the mod to have the EDC clutch if it's the case (clio vs megane) The issue is to make it work for non RS c...

You found it how? This makes me think you are using also a canalyzer? :)

If i look directly at the binary file, it's still unclear to me how you decided exactly to try that address before the point where you thought it was the RS Slot 1 but anyway :) For the rest of the parameters like SN and other stuff, don't get your hopes to high. You will soon find out that half of ...

Also forgot, the new issue is about making the RS Monitor work completely on non RS cars which I have not managed to resolve fully. The BIC from RS cars is not enough if you put it on normal cars. And further more as discovered by me and others, only script 11 will make most of the screens work. And...

Hmm, interesting, i went on vacation and a lot has happened :) @ebt25 - nice solution. Might I ask how you figured out the part with the modification in the memory? I mean, I use also a programmer but how did you find out the 3 values to change? Anyway I still want to root it and install new apps on...

Either desolder it and use a memory programmer that knows how to program that type of memory either on board welding some wires on the pins and connecting again to the same memory programmer. (you cannot do it with a simple upart/com etc) The pinout i dont have but is pretty easy to obtain on the ne...

Yes, if we manage this, then the image that is on the unit can be modified and then we will have access over usb. Once done, ssh will follow and push applications etc. In any case to do it you need to read that memory, modify the image, upload it again and try to boot until you see that the signatur...

Unfortunately you have no chance. The private key public key encryption is something that is suppose to work exactly like this. Why do you think they call it public key? :) It's no danger if you have it. You will never succeed to find a private key just because you know the public one :) Instead foc...

:) No, the private key is not even on the device.
On the device is the public key which is used to decrypt what is written with the private key.
Only way is to block the process which tries to verify the image signature

That link is for TomTom HOME :) That is the utility for Live not for R-link. The 4MB chip contains the x-loader and uboot. Inside is a binary image that needs to be modified in order to trick the device not to start the sign verification procedure. You download it and after that you start playing wi...

I presume you will try to connect from the PC on UART using a USB device.So no, you cannot. Even more the UART on R-Link is read-only , you cannot interact with the console in any way ...

CPU attack or LAN would be great but how? Everything is locked ...
No USB access, no lan/wireless

Any attack can be used if you manage to run some code on it but right now you cannot.
On SD card any program you put will not be run unless signed.

Yes I know :) R-Link 2 is much more easier to get into but for Tomtom I have not found a way ...
And you have above a sum of everything I tried until now. I wish it was easier.

If anybody has new ideas and another approach i would love to here it :)

Lets stop for a second and analyze, shall we? :) What if you manage to boot from another environment, what next? ... There is a a signed boot chain, specific for this type of application and it goes like this: 1. x-loader 2. u-boot 3. zimage 4. rootfs For each step, there is an algorithm that checks...