Home

RNS510 Map Disc — File Format Wiki

This wiki documents the on-disc file formats of CD_8555.ISO, a genuine VW navigation map disc ("EU East V17", Navteq database EEU, part number 1T0051859AR). All findings here come from direct, byte-level reverse engineering against the real disc — every claim in these pages is backed by a concrete, reproducible check (exact-coordinate matches against real cities/roads, cross-file validation, large-sample statistics), not guesswork. See the main README for the full, detailed research log this wiki summarizes, and research/*.py / rns510_map_viewer.py for the reusable reader code.

Mostly not covered here: the separate firmware/application image (FHDD6.FLI, from the factory Software-Loading CD, VwSwIndex 5238) — that's a different product on this platform (application software, not map data) and has its own section in the README (§2). Exceptions: real PowerPC disassembly/reverse-engineering of that firmware — a load base recovered, a real symbol table found, and several functions fully traced — is documented on Firmware Reversing; everything AROUND that firmware — the real boot chain (bootloader -> BLSCRIPT.CFG -> SWL.FLI -> DLSCRIPT.TXT -> FHDD6.FLI), the factory build-configuration system, and the separate HOST processor's own VxWorks BSP and real vehicle-coding diagnostic protocol — is on SWL Disc: Boot Chain and Build System and HOST BSP and Vehicle Coding.

How the disc is organized

Every logical file lives under db/ as eeu.<ext> (uncompressed) or eeuz.<ext> (compressed, note the z), all for the East Europe (eeu) dataset. The disc's own files.cfg (plain text, disc root) documents 39 logical file types (numFileIds = 39, each with its own one-line comment — not all 39 are actually populated on this specific disc, see Phoneme Cluster List) and 4 compression types:

Code	Name	What it means
0	NOT_COMPRESSED	Raw fixed/variable-length records, straight after a 94-byte SIEMENS/(C) SIEMENS AG header
1	FLAT_COMPRESSED	A block-based zlib container (own header, offset table, sequential zlib blocks) — see FLAT COMPRESSED Container Format
2	MAP_COMPRESSED	A tile-based zlib container (own header, directory, back-to-back independent zlib streams) — see MAP COMPRESSED Container Format
3	FEATURE_COMPRESSED	Same directory-then-zlib-streams shape as MAP_COMPRESSED but a different, still partly unresolved directory encoding — only eeuz.fea uses this

The underlying disc itself is a UDF+ISO9660 "bridge" image with a broken (vestigial) UDF layer — see ISO Container Handling.

The disc root also has 5 subsystems outside db/ — config/, tpd/, EDB/, telemat/, speech/, dbal/ — revealed by the disc's own build script, config/create_cd. All 1,535 files on the disc are now examined and documented — EDB/POI/POI.DB3 (a real 4.7M-row SQLite POI database) and speech//dbal/ are cracked at the identity/metadata level (SVOX TTS engine, VxWorks RTOS, ~330 real internal source file names extracted from dbal/'s own ELF binaries); telemat/tmc2/ and tpd/ (1,443 files, the largest area — a real embedded HTML destination-search UI) are cracked at the config/system level, with a handful of proprietary binary formats (voice models, TMC location tables, compressed search-index bodies) identified but not byte-level decoded — see config/create_cd and the Disc-Root Subsystems.

Status legend

Symbol	Meaning
✅	Cracked — byte layout understood and validated against real, independently-verifiable data (exact coordinate/name matches, not just "looks plausible")
🟡	Partially cracked — most of the structure is understood and validated, but specific fields or edge cases remain open
🟠	Container cracked, content not analyzed — we can losslessly decompress/parse the container, but haven't reverse-engineered what's inside
⚪	Not examined — no reverse-engineering attempted yet this project

File status at a glance

Sizes are from the reference disc's extracted db/ folder.

Road network

File	Size	Type	Status	Summary
eeu.rd	590 MB	NOT_COMPRESSED	✅	Road/routing graph — 67-byte records, coordinates + name. Fully cracked (a still later session): every header byte now accounted for — cityID/countryID/prefixID/suffixID/typeID/roadInfo (highway/preferred/explicate/ramp/name-type/interchange), via real DBAL.OUT disassembly + a newly-cracked eeu.mod binary field-descriptor format, validated against real data (geographic clustering, route-name correlation, eeu.typ's own entry count). Details
eeu.il	39 MB	NOT_COMPRESSED	✅	Name/intersection index into eeu.rd. Details
eeu.iof	52.8 MB	NOT_COMPRESSED	🟡	Parallel per-road array to eeu.rd; a "nearby street names" pointer into eeu.il is cracked for 0.36% of records. Which records get one is now substantially narrowed — route-numbered-road names are 7.5x enriched among these anchors at full file scale, though not a clean 1:1 rule. Real firmware disassembly (DBAL.OUT, a still later session) confirmed the real struct IOF_Record and cracked type's real meaning (a validity + cache-resolution-state flag, not a simple classifier). The common-case count field for the 99.64% non-anchor majority still correlates only weakly with eeu.il's own per-road reference count. Details
eeu.typ	105 KB	NOT_COMPRESSED	✅	Localized street-type word dictionary (VIA, RRUGA, SOKAK, ...). Details
eeuz.rt	62.1 MB	FLAT_COMPRESSED	✅	Road-name character-trie (search/autocomplete). Details
eeuz.rl	203 MB	FLAT_COMPRESSED	✅	Road-name-search "pointer" records, → eeu.rd + eeuz.prl. Details
eeuz.prl	248 MB	FLAT_COMPRESSED	✅	Road-name-search string catalog (not deduplicated, sort-key rewritten). Details
eeuz.prd	279 MB	FLAT_COMPRESSED	✅	Phonetic pronunciation catalog for road names (TTS voice guidance) — record format, eeu.rd linkage, and a real minNumber/maxNumber house-number address range all cracked and validated at full file scale (11.96M records, zero exceptions). Details
eeu.si	195 KB	NOT_COMPRESSED	✅	Segment classification table ("seginfo") — fixed 8-byte records, 24,353 of them. All 20 real leaf fields positioned in exact schema order; the final 11 single-bit flags rest on position + schema-order match (2 of them additionally corroborated by a joint-exclusivity signature). Details
eeu.tmc	25.8 MB	NOT_COMPRESSED	🟡	TMC/ALERT-C traffic-data file — the file header, 44-table directory, AND the complete per-location byte-offset index (100% of the file's own addressing structure, every table's location_offset_table_p/_n arrays) cracked and validated at full scale, zero exceptions. Only the deepest leaf chain records' own content remains undecoded. Details

Places (cities, towns, countries)

File	Size	Type	Status	Summary
eeu.ctr	1.6 KB	NOT_COMPRESSED	✅	Country table — 35 records, ISO 3166 codes. Details
eeu.cty	74.2 MB	NOT_COMPRESSED	✅	City/town/locality catalog — name + bounding box + representative point. Details
eeuz.cl	75.8 MB	FLAT_COMPRESSED	✅	City-name search records, → eeu.cty. Details
eeuz.ct	5 MB	FLAT_COMPRESSED	✅	City-name character-trie, same node format as eeuz.rt. Details

Map rendering tiles

File	Size	Type	Status	Summary
eeuz.mp0	2.14 GB	MAP_COMPRESSED	✅	Most-detailed street-level rendering tiles. Details
eeuz.mg1	240 MB	MAP_COMPRESSED	✅	Generalized tiles, 1 level up from mp0. Details
eeuz.mg2	113 MB	MAP_COMPRESSED	✅	Generalized tiles, 2 levels up. Details
eeuz.mg3	46 MB	MAP_COMPRESSED	✅	Generalized tiles, 3 levels up. Details
eeuz.mg4	16.5 MB	MAP_COMPRESSED	✅	Most-generalized (lowest zoom) tiles. Details
eeuz.fea	553 MB	FEATURE_COMPRESSED	🟡	Multi-language gazetteer (cities/seas/islands/route shields) — not road geometry. What each entry contains is cracked, and so is the directory format (a big-endian offset/length index, 4 of its tables located and validated). Real DBAL.OUT disassembly (a still later session) fully cracked the relative point-geometry delta-chain format, and found strong direct evidence the absolute anchor is supplied externally, not stored in this file at all — see its own page for why that may not be resolvable by further firmware disassembly. Details

Speech / misc small files

File	Size	Type	Status	Summary
eeuz.pca	2.9 KB	FLAT_COMPRESSED	🟡	Phoneme catalog for country/continent names (EUROPE, AUSTRIA, ...) — record framing cracked and validated at full file scale (188 records); clusterOffset/clusterCount confirmed always-zero (matches eeu.pcl empty); cityOffset/cityCount's target file not identified. Details
eeuz.pct	15.7 MB	FLAT_COMPRESSED	✅	Phonetic pronunciation catalog for CITY names (major places, multi-language) — record format cracked and validated at full file scale (649,956 records); the trailing field is a phonemeRoadOffset/phonemeRoadCount pointer into eeuz.prd, naming that city's own road phonetics. Details
eeu.abc	897 B	NOT_COMPRESSED	✅	"Alphabet" — the 125-character uppercase glyph repertoire used across every supported language, plus an 86-record table of 52 supported languages, each tagged with 1-3 of exactly 3 fixed flag-pairs (meaning not fully confirmed). Details
eeu.aff	138 B	NOT_COMPRESSED	✅	"Affix" table — structurally fully cracked (1 record of 44 bytes), but that one record is all zero on this disc; plausibly a Hunspell-style affix-stripping rule set this dataset simply doesn't need. Details
eeu.cal	22.8 KB	NOT_COMPRESSED	✅	Multi-language country/continent name catalog — 484 records, every field explained and validated exhaustively (all 35 groups, not sampled). Details
eeu.cat	759 B	NOT_COMPRESSED	✅	Per-country (+ Europe) real-world bounding-box table, same country numbering as eeu.cal — validated directly against real geography (Germany/Austria/Switzerland/Italy near-exact, 3 microstates correctly tiny). One unresolved anomaly (Denmark's western edge). Details
eeu.cny	400 KB	NOT_COMPRESSED	✅	County catalog — real sub-national divisions (Italian provinces, Swiss canton districts, Greek prefectures), a level between eeu.cal's countries and eeu.cty's cities. stateID validated against real geography AND directly against eeu.stt's own content; timeinfoID confirmed directly against eeu.ti's own content. Details
eeu.mod	40 KB	NOT_COMPRESSED	✅	The disc's own database schema dictionary — names and orders every one of the 36 real tables/files on the disc, authored by tool Arriba 5.3. The single most valuable file examined this project; resolved several previously-open mysteries in other files. Details
eeu.stt	79 KB	NOT_COMPRESSED	✅	State/region catalog — the real table eeu.cny's state_id refers to, confirmed by full set equality (691 records both files). country_id is a real FK into eeu.ctr's own row order — a 3rd distinct country-numbering scheme found on this disc. Details
eeu.ti	485 B	NOT_COMPRESSED	✅	Time-info/DST rule table — timezone field cracked and confirmed against real-world geography (Russia's own 11 real time zones, exact); timeinfo_id=1/3 confirmed as the disc's real CET/EET DST zones by joining eeu.cny→eeu.stt→eeu.ctr. A few sub-fields' exact hour/day semantics remain unconfirmed. Details
eeu.pcl	94 B (header only, no body)	NOT_COMPRESSED	✅	"Phoneme cluster list" per the disc's own files.cfg (id 27) — genuinely empty on this disc; no eeu.mod schema block exists for it, so its identity came from files.cfg directly, not byte-level reversing. Details
eeu.pmc / eeu.pmm	16.3 MB each	NOT_COMPRESSED	✅	"Postal-code merge city"/"merge separator" tables — fixed 4-byte records, real count 4,084,104. Content is a perfect identity function on this disc (value == index, no exceptions) and the two files are byte-identical — confirms the whole postal-code subsystem (.pol/.pot/.pmm/.pmc/.pmp) is unpopulated. Details
eeu.pol / eeu.pot / eeu.pmp	94 B each (header only, no body)	NOT_COMPRESSED	✅	Postal-code list/tree/merge files — genuinely empty on this disc; eeu.mod's schema reconstructs the intended design (.pot = same character-trie template as eeuz.rt/.ct; .pol = postalcode+lat/lon+list-index record; .pmp = the third "merge" sibling of .pmc/.pmm). Details

Formerly "never examined" — now all resolved

Every one of these shares the identical 94-byte SIEMENS/(C) SIEMENS AG NOT_COMPRESSED header already cracked for eeu.rd/.il/.iof/.typ/ .ctr/.cty — so the container is a known quantity, and since 3 more fields in that shared header were cracked (record count, most files' total size), a candidate fixed record SIZE is now derivable for several of these without touching their actual content — see Unexamined Files for the full byte-level first look and those derived candidates, to give a future session a head start. (eeu.cal, eeu.cat, and eeu.cny, previously listed here with derived record-size candidates of 48, 19, and 176 bytes, are now cracked — Country Names, Country Bounding Boxes, and County Catalog — all three candidates were exactly right. eeu.mod, also previously listed here, turned out to be the disc's own schema dictionary, not a data file at all — see Database Schema; its own discovery gives every remaining file below a known, schema-declared field layout even though their bytes haven't been opened yet, noted per-file below. eeu.pcl, the one schema-declared file token with no eeu.mod block at all, is also now cracked — its real name and purpose came from the disc's own files.cfg instead, see Phoneme Cluster List. eeu.pmc/eeu.pmm, whose derived record size looked "not clean" here, are now cracked too — the real wraparound multiple was just larger than tried, see Postal-Code Merge Tables. eeu.pmp/eeu.pol/eeu.pot, previously listed here as confirmed-empty placeholders, are also now cracked (identified) in the same sense as eeu.pcl — eeu.mod's schema reconstructs their intended design even though there's no content to open — see Postal-Code Files (Empty). eeu.si, whose derived 8-byte record size was already exact here, is now fully cracked — all 20 real leaf fields positioned in exact schema order — and the "likely lead for eeu.rd's bytes[1:5]" noted below turned out not to hold up — see Segment Classification Table. eeu.stt, the real "region/canton" table eeu.cny's own stateID refers to, is also now cracked — see State/Region Catalog, which closes the loop this page's own eeu.cny entry left open. eeu.ti, the real "timeinfo" table eeu.cny's own timeinfoID refers to, is also now partially cracked — see Time-Info / DST Rule Table. eeu.tmc, the last file still listed here, is also now partially cracked — its file header + 44-table directory decoded using ground truth found via config/create_cd — see TMC Traffic-Data File, now listed in the Road network table above. zone.cfg (81 B, plain text, not a files.cfg data file, so it never belonged in the table below) has also been opened and identified — see Disc-Root Subsystems. With these two, every file on the whole disc has now been examined at least once — see Unexamined Files for the full historical record.)

Other pages

• config/create_cd and the Disc-Root Subsystems — the disc's own build script; every one of the 1,535 files on the disc examined, including a real 4.7M-row POI database, the SVOX TTS engine, VxWorks RTOS, and ~330 real internal source file names
• eeu.mod — Database Schema Dictionary — the disc's own full table/field list, cross-cutting corrections to many other files
• eeu.pcl — Phoneme Cluster List — identified via the disc's own files.cfg, not eeu.mod; genuinely empty on this disc
• eeu.pmc/eeu.pmm — Postal-Code Merge Tables — fixed 4-byte records, provably a placeholder identity array on this disc
• eeu.pol/eeu.pot/eeu.pmp — Postal-Code Files (Empty) — genuinely empty, but eeu.mod's schema reconstructs the intended design
• eeu.si — Segment Classification Table — all 20 real fields cracked (rank/class/divided/paved plus 11 more single-bit flags); corrects a previous eeu.rd cross-reference lead
• eeu.stt — State/Region Catalog — the real "state" table eeu.cny's state_id points into, confirmed by full set equality
• eeu.ti — Time-Info / DST Rule Table — a real DST/UTC-offset table, confirmed by joining every county to its real country and checking against Russia's actual 11 time zones
• eeuz.pca — Country/Continent Phoneme Catalog — record framing cracked at full scale; cityOffset/cityCount's target file still unresolved
• Tile Geometry and Topology — how a rendered road polyline and its point-to-point connectivity graph are decoded from a tile
• Road Naming Join — attaching real eeu.rd names to decoded tile geometry
• Header Trailer Fields — 3 more cracked fields shared by every NOT_COMPRESSED file's header (record count, total size)
• ISO Container Handling — reading/writing the disc image itself
• Map Viewer Tool — the visualization/debugging GUI built on top of all of the above
• Road Editor Tool — the actual editing tool that writes real changes back into a real ISO, and exactly what's solid vs. experimental about it
• Firmware Reversing — the head unit's own PowerPC/VxWorks application (FHDD6.FLI), not the map disc: a recovered load base, a real symbol table, and 3 functions fully disassembled and understood
• DBAL.OUT Full Decompilation and research/dbal.py — a local Ghidra install decompiled all 1,915 real functions in DBAL.OUT; definitively confirms the generic field-reader is external to the file; research/dbal.py ports the parts that ARE resolvable and is now wired into rns510_core.py/road_naming.py
• SWL Disc: Boot Chain and Build System — the factory flashing process, the real testmode/speed-lockout "unlock" pattern (confirmed 8 times across independent disc pairs), and a leaked internal engineering artifact in the oldest disc in the collection
• HOST BSP and Vehicle Coding — the separate HOST processor's VxWorks BSP, the real SetCoding/SetRegData vehicle-coding protocol (fully disassembled), the real BAP wire protocol (recovered from working community source), and the gateway routing-table format (vendor identified: K2L GmbH)
• Theft Protection, the CAN Gateway, and TpPvVerifyPin — a real ST10/C166 disassembler, a byte-level-confirmed EEPROM anti-theft state machine, the real vehicle-ClusterID pairing design, and TpPvVerifyPin confirmed live over a real serial console
• RNS510 Serial Console: Command Reference — every real command confirmed understood by the unit's own VxWorks shell over its serial debug port, consolidated into one scannable reference
• Sirius TravelLink and North America Discs — the first real NAR-market SWL discs, a complete SIRIUS.DB3/.DDB channel-art format crack (the map viewer's own Sirius POI layer uses this), and a real IBOC/HD-Radio negative result