Reverse engineering Volvo RTI MMM+ DVD maps

Latest available DVD maps as for now for XC90 are from 2015. So, quite old…

I spent some time trying to understand the format of DVD and if there is any chance I can produce my own maps or at least update the POIs.

General Information

The KIWI GPS navigation system is used in various in-car systems factory-installed by automotive manufacturers. Variations of this format have been reported for Volvo and Lexus cars; they’re probably used in other makes and models as well. Quite a number of variations exist, so you need a navigation update specifically approved for your particular model. They generally come on DVD, and can cost as much as $200 or more, with an additional fee for installation (the dealer apparently has to do something more complicated than just sticking a DVD into a drive within the car).

The main files on the navigation DVD have a .kwi extension (there are also a few other files, such as .bmp files that don’t seem to be in the normal Windows BMP format, and a few other files). They are in a proprietary binary format, which some hobbyist experimenters have made attempts to decode.

Latest version

The 2015 map disc is sold as a 2015 update
The DVD is labelled EU-3050-00_1
It has VCC (Volvo Car Corporation) part number 31456966 1520

HW P/N 0031260715 AA

SW P/N 0031427857 AB

Map P/N 31427790 AA

SW version 00002308/02400

Map version AEU_06_201501A


Two DVD discs (double layer)

DVD1 – EU-3050-00_1
Analysing DVD1 I see the following folders and files:

Folder MAP was created on 19.05.2015
Folder MAP contains 1484 files with names like 1.000 to 2.272, some are named PARCEL.nnn, some AREASRC, etc. All files were created 15.01.2015 – so the 2015 map disc contains map data from before 15.01.2015

File ALLDATA.KWI (4 KB, created 16.12.2014) contains map version data, indeed here we see:
AEU_06_201501A which is the map name: labeled as 2015 map
DATA VERSION 14/12/04/01 which tells me the map data came from 04.12.2014, makes sense
31427790 AA which is the Volvo map number, it corresponds to the DVD box label ‘includes map 31427790’
0020HEV300A__00 000115740+574221 not sure what this refers to
FORMAT VERSION KIWI01-22-00 version of KIWI maps used. In this case KIWI 1.22.

File DKLABEL.DAT (1 KB, created 15.01.2015) contains disc label data, the file contains
Version,CUP2006_1 this is the disc version
CurrentDisk,1 is the current disc number
AllDisk,2 is the total number of disks in the set, in this case 2
TGTCntstart,0 some counter start
CPYCntstart,0 another counter start
TGTCntend,49 a counter end
CPYCntend,85 another counter end

File LOADING.KWI (14.7 MB, created 30.03.2015) is the nav OS software (so I hope it is a newer version to what I have)

It contains headers with the followig identifiers:
CUP2006.MLD.ORG (obviously the system type)
00000253 (could be a version number?)
00002308 (could be a version number?)

B L D – C U – P 2 0 0 6 2 . 5 3 N A V I C O R E ( S H 7 7 7 0 / S H 4 A ) 3 r d C u t (looks like an identifier for the navigation core)
The 2.53 matches the 00000253 number in the file header, so this is the navicore version number
The 2308 could be another version number, I’ll have to see what appears on the nav screen after loading the map update

Browsing through the file you can see all the bootloader error messages and various subroutine names, here’s a sample:
FLASH erase FLASH write : adr %X
FLASH write : Timeout error of Flash reday wait.
Now Launching NK image! : %X
Bad value of return code the DiscLibProcess() ! : %X
DiscLoadmain() Call of the NaviTelop WAITING.
start of DiscLoadmain.
DispLib:InitDispLib() DispDriverispLoadBitmap()is fault. return error (-16).
DispLib:InitDispLib() DispDriverispLoadBitmap()is fault. return error (-15).
DispLib:InitDispLib() DispDriverispLoadBitmap()is fault. return error (-12).
DispLib:InitDispLib() Start of Init for S-Loader.
DispLib:InitDispLib() Start of Init for B-Loader.
DispLib:InitDispLib() DispDriverispLoadBitmap()is fault. return error (-22).
DispLib:InitDispLib() Start draw of back plane.
DispLib:InitDispLib() Opening BMP address = 0x%X.
DispLib:InitDispLib() DispDriver is fault. return error.
DispLib:InitDispLib() Start of DU Init.
DispLib:InitDispLib() Start of Init for M-Loader.
DispLib:InitDispLib() Kind number(%d) is Error.
DispLib:InitDispLib() EvqCreate is fault. return error.
DispLib:InitDispLib() pParameter is NULL. return error.
InitDispLib() : Kind is %X, pBitmap = %X, pParameter is %X
DispLib:NaviTelop() DispMsgReqTelop() is fault 0x%X.
DispLib:NaviTelop() Bad Telop ID! (0x%X)
DispLib:NaviTelopInd() EvqPut is fault.
QueID = %x.
DvdDDRead : Already Async Read Start
DvdDDRead : parameter handle error
DvdDDWrite : parameter handle error
DvdDDDeviceIO : undefined Control Code %X
DvdDDDeviceIO : in/out parameter pointer error
DvdDDDeviceIO : in/out parameter size error
DvdDDDeviceIO : parameter handle error
DvdDDDeviceIO : async_read_start : Read Size Error
DvdDDDeviceIO : async_read_start : Read Buffer Pointer Error
DvdDDDeviceIO : async_read_start : Already Async Read Start
DvdDDDeviceIO : async_read_check : Not Async Read Start
DVDLIBVDRead:ATAPIreset time-out
DVDLIBVDRead retry after 02:24 error
DVDLIBVDReadMA-wait cancel by EJECT, DMA stop.
DVDLIBVDReadMA-wait cancel by DRV-Error
DVDLIBVDReadMA time-out
DVDLIBVDRead:error %B %B %B %B %B %B
DVDLIBVDRead:Block %X Buffer %X Sector %d Length %d
DVDVDInit Mecha=%d
DVDLIBVDReadEx error=%X
DVDReadEx Overrap Reqest : Cancel Start
DVDReadEx Overrap Reqest : DestroyE=%X
DVDLIBVDReadEx retry after 02:24 error

File MMM02400.SUB (80 KB, created 25.12.2008) contains this header:
CU-P2006 NaviSub CPU F/W 00.00.00;504080 Copyright(C) 2004 MITSUBISHI ELECTRIC CORPORATION All Rights Reserved.
So we know who the manufacturer is
It also contains this content:
Most Reset SyncInConnect: Go_Start OS8104ResetIN bMostLongReset
so we see the file is some sub program dealing with MOST communications
Must be very reliable, hasn’t been updated since 2008.

File P2006.CPE (122 KB, created 15.01.2015) contains a table of references and offsets to data blocks in the MAP folder, here’s a sample of the content:
LBL alldata.kwi alldata.kwi

TGT 0.1 0.1 3669585760 2
CPY 1.000 N 8388608 8388608 780038875
CPY 1.001 N 8388608 8388608 771205072
CPY 1.002 N 8388608 8388608 3318159898
CPY 1.003 N 8388608 8388608 1876744912
CPY 1.004 N 8388608 8388608 1294600000

File SUBCPU.ME (1 KB, created 27.12.2008) contains the following information:

…showing that the system is a CU-P2006 system, otherwise known as the MMM+
This data stays constant, hasn’t changed since 2008. This shows that 2400 is not a version number, but a system number.
Indeed MMM02400 means MMM system, type 2400.

DVD2 – EU-3050-00_2
Analysing DVD2 I see the following folders and files:

So it contains the same structure and the same OS update files as DVD1. Makes sense, you can use either disc to update the OS.
Of course, file DKLABEL.DAT will be different:

Folder MAP contains 1127 files with names like PO+SR045, RDICAREA, REGION, SADSR042, TMCINFO, VOICE001, VOICE002 (interesting), XSTINFO, ZIPSR001, etc. These are the map and TMC and voice files

I’m still exploring what I can do here… Any thoughts?

Leave a Reply

Your email address will not be published. Required fields are marked *