TMC traffic events no longer being received...firmware update required?

[pcbbc]

25 minutes ago, alanOcty said:

Is this likely to work, or is there some inherent meaning in the values which I've not spotted ? 

The map updates for MIB2 High are signed.  If you modify the json you will invalidate the signing and the navigation will reject your modified maps as invalid.

 

If you have MIB Toolbox you can use that to force the unsigned json onto your unit, although you risk seriously mucking things up if you get it wrong. Here’s a similar hack for AUS/NZ units…

https://github.com/catatonicChimp/mib2-tmc-ANZ/tree/main/MIB2HIGH(MHI2)

Personally I don’t recommend it.

 

Also, as you point out you won’t be able to reload maps if you’re already on the latest version. You’d need VCDS to do that.

 

If your in or around SE London (Bromley) drop me a PM.

[Tell]

1 hour ago, alanOcty said:

Hi, 

 

Having prodded around in the JSON files, and NOT having VCDS to be able to make the tweaks myself, I am wondering if there could be another option, which is to relabel the block of text in paytmc.json (i.e. flip the values 32782 / 32783), so that the maps are updated to contain the new data rather than the pointers configured from VCDS. Likewise with the 14/15 which seem to be defined in  paytmc_s0to15.json. 

 

Is this likely to work, or is there some inherent meaning in the values which I've not spotted ? 

 

I'm assuming I could edit the ISO file and reload the maps file (I've just updated maps, so not sure I can do that even). 

 

Alan.

No the download is protected by the sla1 bank of signatures that you see. Whilst @pcbbcthought you can make changes looked at it several years ago and concluded it wasn't possible. It's an encryption method. Clever method using pure mathematics you'd study if you were doing a degree in encryption or pure maths probably. Would be a GCHQ sponsored degree. They can be cracked by brute force methods with Cray computers. That was a few years ago.

 

You have a private key and a public key. The public key is used in an algorithm to test that the files with the signature are valid and unchanged (where the pure maths comes in). The public key used by Vag is known but thd private key isn't. If you sow them up with your own private key the unit needs to know the public key. That is obviously locked in the unit.

 

The weakness was that Vag left a loop hole in the POI import. Any additional code can be added to the POI import and it sales into the unit as being valid code. No signature check is made. Those Mr Bonk group members found this so the toolkit for mib2 standard and high exploit this. The guys have now gone on to produce their own modified firmware identified as AIO, if you check that firmware it has no signature but tumbles into the unit on a POI import then bumps in on the back.

 

I don't think anyone has rewritten a map import on this basis. All the checksums have to be recalculated since it uses them but you wouldn't need the signature check. Clever soles that write the AIO firmware. That's used fairly commonly now. Doesn't please Audi who employ contractors to chase the file releases down.

 

Those toolboxes having got into the unit marry themselves  to the firmware using a developers hook. Each firmware release needs its own module written. The toolbox checks whether it has one for your firmware, if so you graft it in. If not a kind mib2 enthusiast may step forward and write the piece of code. That's what someone did for me a few years back. They then added my firmware release module to the release. They may have automated that now.

 

The mib2 high package then gives you retrofitter options. This is where the Ozzie people wanted their code added to give additional functionality. As it is we don't need this for the UK task on the mib2 high unit. Just simple vcds coding is required.

 

These are the public keys in all VAG units. They got published on a web site. It doesn't do you much good though. You can hand crank the logic with that module function. Eigenvalues and eigenvectors or something. A few years ago since I did my maths degree. Thought I'd raise to the occasion and with the help of a crypoto website worked it through. Somebody else fancied changing the primary key in the unit this was before the Mr Bonk stuff came out where you just bypass the SLA1 signatures. The secondary key is in a chip that can't be changed so that approach doesn't get you anywhere.

 

9a 49 9b 04 8b ae bf ac 83 3f de 81 ba 80 30 93
05 b6 6f ed 54 59 c3 8f 60 f6 10 a9 aa 5a 19 10
05 17 05 8f ea 49 d3 75 e3 f9 e1 54 4e 17 ee c9
c3 c1 dd 7d 30 16 de b1 55 45 fd 9e 18 00 51 22
d6 a1 33 10 95 c0 dd cf 43 a1 c2 fe c0 bc aa 1c
fe 48 49 25 89 9e dd 71 b0 d4 08 cf 16 bf 10 e2
e1 bc 70 a3 52 f2 e6 54 0b 60 05 5a a7 52 ec 4a
83 65 f7 68 19 66 f4 d5 46 c7 38 b1 6b 5a 1f 13
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03
1e 0b 93 73 dc b4 93 b6 12 ce 09 c4 03 e9 21 fc
9b 4e 97 ce 55 c5 b4 c0 80 ad 17 2d ca 91 4d c1
87 45 52 ca 4a 95 96 9e 61 ff c3 24 a5 91 5b d1
83 80 85 90 8f 99 8f 76 ba 5f b2 09 86 db 86 c1
b5 89 b9 58 75 4e d5 d5 aa 08 af 2f 16 3e 33 a6
c6 46 77 dd 32 e0 98 f0 ec f9 14 6b af 35 05 3c
23 aa 8b a8 76 fb 2d 0c 6e d7 2f 0b b3 dc 77 6e
b8 74 14 1c 95 c1 6f ff 0c bb 4a e9 ee 70 a2 3c

 

So yes you can hand check that the unit is going to reject your modified update before you load it up.... as said this was before they found the POI import approach.

Edited 14 June, 2023 by Tell

[joek666]

Still no meaningful response from Skoda for me, and I am chasing...

 

On a related note, is it possible for me to swap my MIB2 Amundsen for one of the head units that does accept the more straightforward fix? Or does that create a whole load of new problems? 

[Tell]

19 minutes ago, joek666 said:

Still no meaningful response from Skoda for me, and I am chasing...

 

On a related note, is it possible for me to swap my MIB2 Amundsen for one of the head units that does accept the more straightforward fix? Or does that create a whole load of new problems? 

 

There are web pages on that but will probably cost you £800 or something. East Yorkshire Retrofit use to sell mib2 highs but now they don't like them. It was a popular thing to do to retrofit a mib2 high inplace of mib1s. You can't pick one up of a crap car place since they have to be prepped so they are no longer linked to the car they were attached to.

 

I'd wait for that Mib2 DIY standard solution.

 

I wouldn't hold your breath on any official solution.

Edited 14 June, 2023 by Tell

[Tell]

Scrap... 🤣. The AI that Android uses on word correction these days has a sense of humour.

[AndyMD]

Is there anyone in the West Midlands area that would be willing to help fix a Mib2High on a Superb 3. Despite working in IT I havent got the nounce to do this myself!

[alanOcty]

22 hours ago, pcbbc said:

The map updates for MIB2 High are signed.  If you modify the json you will invalidate the signing and the navigation will reject your modified maps as invalid.

 

If you have MIB Toolbox you can use that to force the unsigned json onto your unit, although you risk seriously mucking things up if you get it wrong. Here’s a similar hack for AUS/NZ units…

https://github.com/catatonicChimp/mib2-tmc-ANZ/tree/main/MIB2HIGH(MHI2)

Personally I don’t recommend it.

 

Also, as you point out you won’t be able to reload maps if you’re already on the latest version. You’d need VCDS to do that.

 

If your in or around SE London (Bromley) drop me a PM.

Thanks, I did wonder about all those checksums. 

 

Looks like I need to find someone local to Ipswich witch VCDS to do the tweaks. I have a couple of indys I can try.

[hcuk94]

1 minute ago, alanOcty said:

Thanks, I did wonder about all those checksums. 

 

Looks like I need to find someone local to Ipswich witch VCDS to do the tweaks. I have a couple of indys I can try.

 

If you get stuck, I have OBDEleven Pro and am near Sudbury.

[alanOcty]

21 hours ago, Tell said:

No the download is protected by the sla1 bank of signatures that you see. Whilst @pcbbcthought you can make changes looked at it several years ago and concluded it wasn't possible. It's an encryption method. Clever method using pure mathematics you'd study if you were doing a degree in encryption or pure maths probably. Would be a GCHQ sponsored degree. They can be cracked by brute force methods with Cray computers. That was a few years ago.

 

You have a private key and a public key. The public key is used in an algorithm to test that the files with the signature are valid and unchanged (where the pure maths comes in). The public key used by Vag is known but thd private key isn't. If you sow them up with your own private key the unit needs to know the public key. That is obviously locked in the unit.

 

The weakness was that Vag left a loop hole in the POI import. Any additional code can be added to the POI import and it sales into the unit as being valid code. No signature check is made. Those Mr Bonk group members found this so the toolkit for mib2 standard and high exploit this. The guys have now gone on to produce their own modified firmware identified as AIO, if you check that firmware it has no signature but tumbles into the unit on a POI import then bumps in on the back.

 

I don't think anyone has rewritten a map import on this basis. All the checksums have to be recalculated since it uses them but you wouldn't need the signature check. Clever soles that write the AIO firmware. That's used fairly commonly now. Doesn't please Audi who employ contractors to chase the file releases down.

 

Those toolboxes having got into the unit marry themselves  to the firmware using a developers hook. Each firmware release needs its own module written. The toolbox checks whether it has one for your firmware, if so you graft it in. If not a kind mib2 enthusiast may step forward and write the piece of code. That's what someone did for me a few years back. They then added my firmware release module to the release. They may have automated that now.

 

The mib2 high package then gives you retrofitter options. This is where the Ozzie people wanted their code added to give additional functionality. As it is we don't need this for the UK task on the mib2 high unit. Just simple vcds coding is required.

 

These are the public keys in all VAG units. They got published on a web site. It doesn't do you much good though. You can hand crank the logic with that module function. Eigenvalues and eigenvectors or something. A few years ago since I did my maths degree. Thought I'd raise to the occasion and with the help of a crypoto website worked it through. Somebody else fancied changing the primary key in the unit this was before the Mr Bonk stuff came out where you just bypass the SLA1 signatures. The secondary key is in a chip that can't be changed so that approach doesn't get you anywhere.

 

9a 49 9b 04 8b ae bf ac 83 3f de 81 ba 80 30 93
05 b6 6f ed 54 59 c3 8f 60 f6 10 a9 aa 5a 19 10
05 17 05 8f ea 49 d3 75 e3 f9 e1 54 4e 17 ee c9
c3 c1 dd 7d 30 16 de b1 55 45 fd 9e 18 00 51 22
d6 a1 33 10 95 c0 dd cf 43 a1 c2 fe c0 bc aa 1c
fe 48 49 25 89 9e dd 71 b0 d4 08 cf 16 bf 10 e2
e1 bc 70 a3 52 f2 e6 54 0b 60 05 5a a7 52 ec 4a
83 65 f7 68 19 66 f4 d5 46 c7 38 b1 6b 5a 1f 13
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 03
1e 0b 93 73 dc b4 93 b6 12 ce 09 c4 03 e9 21 fc
9b 4e 97 ce 55 c5 b4 c0 80 ad 17 2d ca 91 4d c1
87 45 52 ca 4a 95 96 9e 61 ff c3 24 a5 91 5b d1
83 80 85 90 8f 99 8f 76 ba 5f b2 09 86 db 86 c1
b5 89 b9 58 75 4e d5 d5 aa 08 af 2f 16 3e 33 a6
c6 46 77 dd 32 e0 98 f0 ec f9 14 6b af 35 05 3c
23 aa 8b a8 76 fb 2d 0c 6e d7 2f 0b b3 dc 77 6e
b8 74 14 1c 95 c1 6f ff 0c bb 4a e9 ee 70 a2 3c

 

So yes you can hand check that the unit is going to reject your modified update before you load it up.... as said this was before they found the POI import approach.

Thanks for that comprehensive description of how PKI works - I suspected things were pretty locked downL, and you have confirmed my suspicion. 

 

I will see if I can find a local Indy with VCDS.

[Tell]

Mib2 high maps are locked down from tinkering the files by the signature, Mib2 standard are not.  VCDS locks into coding thats already in those files. The toolbox stuff allows you to fiddle with the material once in the unit if VCDS coding isnt sufficient. For the mib2 high and mib1 standard VCDS does the job.

[Tell]

On mib2 standard not that I'm wearing my auditors hat but ID 12 editting into the ID 15 bank would look promising. It's missed out of the non online bank, the 15. But appears on the online bank of codes. That feels to me its being offered if you have the online subscription but not if you don't. You edit 2 to 12. Bit of a synergy going on there. Toss that one in. Whether you need old maps, pass. I'm probably going to be told I'm wrong.

[joek666]

19 hours ago, Tell said:

On mib2 standard not that I'm wearing my auditors hat but ID 12 editting into the ID 15 bank would look promising. It's missed out of the non online bank, the 15. But appears on the online bank of codes. That feels to me its being offered if you have the online subscription but not if you don't. You edit 2 to 12. Bit of a synergy going on there. Toss that one in. Whether you need old maps, pass. I'm probably going to be told I'm wrong.

 

I'd be very interested in a solution for MIB2 units but my understanding from the discussion on this thread is that I'd be stuck on 2020 maps for ever more. 

 

Already looking at trading in my Skoda now for something non-VAG. Shouldn't really cost me much if anything, might even get some money back. Best do it now rather than a few years down the line when this issue is more widely known and it's used to knock down a bit of money off the asking price ("oh those are the ones with broken sat navs"). 

[Hillbilly23]

3 hours ago, joek666 said:

 

I'd be very interested in a solution for MIB2 units but my understanding from the discussion on this thread is that I'd be stuck on 2020 maps for ever more. 

 

Already looking at trading in my Skoda now for something non-VAG. Shouldn't really cost me much if anything, might even get some money back. Best do it now rather than a few years down the line when this issue is more widely known and it's used to knock down a bit of money off the asking price ("oh those are the ones with broken sat navs"). 

I pretended I was interested in a 2018 Audi A6 from my local main dealer. Emailed them about it asking about the RDS-TMC feature on the car. Guess what - no reply.

[Tell]

3 hours ago, joek666 said:

 

I'd be very interested in a solution for MIB2 units but my understanding from the discussion on this thread is that I'd be stuck on 2020 maps for ever more. 

 

Already looking at trading in my Skoda now for something non-VAG. Shouldn't really cost me much if anything, might even get some money back. Best do it now rather than a few years down the line when this issue is more widely known and it's used to knock down a bit of money off the asking price ("oh those are the ones with broken sat navs"). 

I'm still interested in the mib2 standard solution. My experiment didn't get anywhere. Wait till @bigade1publishes their fix but that if it uses the mib2 toolbox / kit whatever will be fussy to the firmware installed and as you say we are told old maps. I can see as I have said before you could run a two card system if you could use your old card if you needed TMC and the latest maps if not. Depends where you are driving. 

 

Mib2 high is a more flexible system to configure into another TMC provider set. It's the way it was setup to do that. On the thread we have mib1 solutions the same as mib2 high (the non SD card system), Just leaves mib2 standard and any pre mib ?. Pass on models prior to mib1.

 

Most youngsters don't see a need for built in satnav using Android Auto / Cap Play so it's not really a concern if your car supports that, it won't affect second-hand value. Others want to be able to get in and drive without fumbling with the mobile phone or are driving in locations where 4G is patchy / abroad. Depends on whether you are in the first group or the second group. I would not trust my mobile device to operate in real time.

 

We await @bigade1

Edited 16 June, 2023 by Tell

[langers2k]

Anyone got a link for the older MIB2 std (Amundsen) maps? Or can upload/send me a copy?

 

Hoping it's just one DB that'll need moving over...

[Tell]

Thats one for @MartiniB I did start looking but with changes in servers. If @bigade1can say what it is then I'm sure MartiniB can find it.

 

The Ozzies were using 8021 we would need 8020 for Europe if that's the last working one we are talking about.

Edited 16 June, 2023 by Tell

[bigade1]

Ok then: MAJOR WARNING!! DO THIS AT YOUR OWN RISK!!

 

Procedure for enabling RDS-TMC on the MIB2STD aka Amundsen/Discover Media/Technisat.

 

Requirements: VCDS/OBD11, MIB STD2 Toolbox and a V12 or older map version.

 

Using VCDS/OBD11 enable Development Mode in Unit5F of your vehicle to enable the Green Engineering Menu (GEM for short) display on your unit. Using the adaptions menu of your diagnostic tool change/check the setting FEE BASED TRAFFIC INFO (TMC) is set to 1023. After installing the V12 or older map onto your SD card navigate to the "mapcfg" folder ( \maps\00\cfg\mapcfg). Inside you will find 3 folders named VW, SEAT and SKODA. Inside each folder navigate to Traffic then TMC and you will see 2 folders named TmcProviders and TmcProviderSets. Replace the respective .xml file in each folder with the ones attached below. Do this for all the 3 folders i.e. VW, SEAT and SKODA. That's the map configured. Now to configure the unit. Install the MIB STD Toolbox and after installation is complete enter the GEM by long pressing the MENU button and entering the Testmode Menu option. Using the toolbox settings make a dump of your mapcfg folder. Copy the dump of your mapcfg folder to the matching counterpart of the Customization folder inside the toolbox. Enter the Customization folder and navigate to Traffic then TMC and replace the 2 .xml files in their respective folders with the same ones attached. Re-enter the GEM and using the toolbox upload your customized folder to your unit. Press the Traffic Button on your unit and after a few minutes traffic reports should start appearing. That's it job done.

This procedure will store 2 errors on your unit which won't affect the unit and can only be seen by using a diagnostic tool. Should you wish to remove them permanently Step 1 is to use the toolbox settings and remove your SWDL ( software download ) history leaving only the last SWDL visible. Step 2 is to do the XOR adaptation in the Confirmation Of Installation setting using your diagnostic tool. 

 

Some useful info : I have not linked to any websites so Google is your friend. There are a couple of different version toolboxes so make sure you use the correct one. The toolbox is a very powerful tool which can be used to enable Mirrorlink/Carplay for free ( untested by me ) and it can also enable the use of any SD card for your map ( tested by me and works faultlessly ) so use it with caution. There's plenty of videos around on the usual site. I used the ones by Mr Fix to guide me. With regards to the maps I don't know of any links sorry. Furthermore, I don't think you can use 2 maps at the same time. Also if you do change your map to a different version and you then decide to go back to the map you just customized you will need to do this procedure all over again. It's even a possibility ( untested ) that you may have to do the customization of your unit if you even remove and re-insert your map SD card. It's unfortunate that this fix will only work on older maps at the present time but hopefully this procedure is of help to anyone who tries it. It's not for the faint hearted but can be done. You have to decide yourself if the effort is worth it. The MIB2HIGH units are quite easy to do compared to the MIB2STD.

 

TmcProviders.xmlTmcProviderSets.xml

 

Edited 16 June, 2023 by bigade1

[MartiniB]

@langers2k

https://www.briskoda.net/forums/topic/512842-amundsen-mib2-map-updates-2024/

 

[bigade1]

3 minutes ago, MartiniB said:

@langers2k

https://www.briskoda.net/forums/topic/512842-amundsen-mib2-map-updates-2024/

 

 

I think he's after the older maps.

[Tell]

Looking for v12 @MartiniBfor @bigade1special sauce above.

[langers2k]

7 minutes ago, MartiniB said:

@langers2k

https://www.briskoda.net/forums/topic/512842-amundsen-mib2-map-updates-2024/

 

 

As mentioned above, it's the older maps I'm hoping to find

 

I tend to update to the latest version as soon as you announce them

[MartiniB]

Each new tread contains links to previous,

which version you are searching for?

[langers2k]

21 minutes ago, MartiniB said:

Each new tread contains links to previous,

which version you are searching for?

 

V12 from this thread: https://www.briskoda.net/forums/topic/480367-amundsen-mib2-map-updates/

 

Seems VAG have deleted them from their servers which isn't too surprising.

 

 

 

[Tell]

They normally twiddle them around in the naming so I reckon MartiniB will find them.

[Tell]

Going to be the AS platform extended to V12

 

http://wiki.ross-tech.com/wiki/index.php/VW_Navigation_System_Maps#Platform_AS