yep, you're right, i did the job, lot of time for preparation for 30 second of work
i used a really cheap programmer... it worked fine... thanks a lot man... great

i'm waiting for programmer, it will be shipped this morning... then i'll try...
any way, it could be (looks weird, but it could really be) a different software that shows a different offset...

@strayker is almost the same thing with android auto, made quite different... instead of send command via obd network, you write straight inside the nav configuration's chip... is quite easy to understand... not easy, but not even impossible, to replicate. NovaS found a way, ebt25 another... so it m...

Now we need to understand more about RS slot 1 and 2... We need to find more values (and car set up) to compare and get customized profile...

tomorrow morning i'll try on my skin, with a little bit of luck i'll be the first italian captur with rs monitor
ebt25 did you used a usb adapter or i can go straight to a com port?

man, simply genious... instead of using ddt, you directly modifyed the ".ini" file... really great... i have a question... if it worked, maybe mfd ecu has a wrong address, and we could easily change it an get it work via obd?

ebt25 well played, now if you could be more specific and explain how you did that, it could be very helpufl
thanks and, again congratulations

@Qbak, i know what you mean... in example r-link 2 has a-ivi ecu, is a second ecu that, with radnav, configure the whole unit. unfortunately, we're not so lucky, or at least, there is one but we do not know the existance... anyway, I think that NovaS already tryed almost everything... So, if he say ...

how do we connect to that chip? do we have to desolder it and find the pins or you already have a pinout? and we connect with a simple com port or we need some special hardware?

@Novas yes, if we avoid verification, no keys needed.. but, and correct me if i'm wrong, we need to connect on circuit board (maybe once and never again with a little bit of luck), skip verification and then install RS monitor... No "easy" sdcard update... Right?

Well, even with Nasa's network it will takes years... and maybe without results... I'm not say' crack anche RSA, i asked if we can get public Key, get the results of decryption and try to reverse the process... Never sayd "bruteforce", we're not talking about of crack a password protected zip archiv...

again, thanks... so, we can not get priv key... and what about retrieve public key? i mean, and it's just math, priv key is decrypted by public key, so it must gaves some kind of results, isn'it? as you sayd, priv key is NOT in the device, but if we get public key and if we get the result of decrypt...

@Novas thank's, got It :)

now, reflecting on what you said, it's possible to trick that image in order to show, during boot, priv key?

as far as we actually know, we don't have much to send command... as novas said, we can read but we can't write... stagefright is an opportunity, but actually we do not understand how it works, or we understand very well how it works, but without any kind of connection, we have no chance... we don't...

stupid question again, some kind of attack to cpu to gain access to ram (If i'm not wrong) as geohot did with ps3? i don't know, this is just an idea... it worked with a real fortrees like ps3, it should work on a f*cking tom tom... other type of attack? we discarded almost everything... we may cons...