.et packing wall: firmware reveals a real LanguageTable/TokenTable dictionary-tokenizer subsystem -- structurally plausible mechanism, not a confirmed identification
The firmware's own debug strings name a complete longest-match dictionary
tokenizer (SortTokenTable/FindLongestInTokenTable/AddTokenEntity/decode())
in naviservice/voicegeneral/SentenceAssembler.cpp -- the turn-by-turn
voice-guidance sentence assembler, not eeu.tmc's own .et phrase table
directly, though it does handle TMC voice tokens via its own AddTmc/GetTmc
methods. Upgrades the .et wall from "unknown scheme" to "very likely a
dictionary/token-table scheme, real precedent in this exact code area,"
without overclaiming a crack.
Confirm dbal 5-version-diff and eeu.mod seg_list findings from the firmware's own runtime code (separate SWL disc the user provided)
FHDD6.FLI's own 0-24MB native-PowerPC region carries a massive debug-string
table (1,476 distinct source basenames in one 5.3MB slice alone). Two direct
confirmations of prior map-disc-only findings: (1) dbaLib's own runtime log
strings ("best matching dbal.out version on DVD: V%03d_%03d", "now unload
DBAL version...") give the complete, real end-to-end dbal/ dynamic-loading
mechanism, explaining why 5 DBAL builds ship side by side; (2) a 77-function
catalog of real, versioned db_*_V0NN accessor names independently confirms
eeu.mod schema field names from live compiled code, including an exact match
for seg_marker_left/seg_marker_right and the db_tmc_all_headers_V003 vs
_deprecated_V005 pair (2nd independent confirmation of the earlier
db_tmc_deprecated correction). No code was disassembled -- names only.
telemat/tmc2/*.et: document a real attempt at the string-packing scheme -- 2 hypotheses refuted, a genuine wall
Tested (offset,length) uint16 index table and plain float32 array as
explanations for the 5,764-byte binary region preceding english.et's text
blob; both refuted with concrete byte-distribution/range evidence. Confirmed
precisely, via exact hex offsets, that the "missing leading characters"
effect is real (not a scan artifact) and that the same letter is encoded two
different ways a few bytes apart -- real evidence of a per-entry prefix/
dictionary substitution scheme whose exact code table wasn't identified.
dbal/: cracked full 5-version diff (corridor removal, phoneme EU/NA split, navmedia, postalcode addition); correct db_tmc_deprecated claim
A direct re-verification of dbal/ (prompted by "did we check it?") found the
5 DBAL.OUT builds diff cleanly across releases: db_postalcode.* added in
V007_038; a whole aspect/event/listener-proxy settings-change framework and
the CPhonemeEUHandler/CPhonemeNA*Handler class split added in V008_704; a
navmedia disc-management subsystem added in V009_038; routepath_coordhashtable.h
added in V010_015. A full V010 vs V006 diff also found an 11-file "generic
corridor" subsystem (real route-corridor mp0-tile prefetch cache, per its own
log strings) present in V006/V007 and removed exactly at the V007->V008
boundary. This refutes the earlier "db_tmc_deprecated.cpp suggests the TMC
format changed between DBAL versions" guess -- both files coexist in all 5
versions -- corrected on both affected pages.
tpd/: find ctrlhost (2nd CGI host) and cgi/setdest; fix 2 stale file counts
Mirrors the main repo's research/tpd_reader.py update: ST_DETAIL.HTM
reveals a 2nd real embedded CGI host (ctrlhost) handling menu/phone/
setdest control actions, distinct from tpdhost's data-fetch endpoints.
Also corrects 2 stale file-count claims (59 SF forms and matching .IDX
files, not 60).
Map viewer: document v20->v21 (real POI category icons)
Mirrors the main repo's README S10 "v20 -> v21" writeup and the
research/poi_db_reader.py load_poi_icons() crack: real, standard PNG
icons throughout PoiPartition -> Image -> ImageBlob, a real grid-based
declutter fix found and verified on the actual ISO (a dense Sofia view
first rendered as an unreadable wall of icons, fixed and re-verified by
inspecting a real screenshot).
Crack POI.DB3's Coordinate field: a 64-bit Morton/Z-order code
Mirrors the main repo's research/poi_db_reader.py update. Reinterpret
as unsigned 64-bit, deinterleave into 2 32-bit values (even bits ->
longitude, odd bits -> latitude), each scaled from the full unsigned
32-bit range to [-180,180) degrees. Validated at bulk scale: 9,988 of
10,000 real POIs across 5 cities decode inside their own city's correct
real-world bbox, plus 2 individually-known airport landmarks matching
within 1-3km.
tpd/ .IDX: crack the per-block lambda-hash index table; refute zlib body
Mirrors the main repo's research/tpd_reader.py update. The region right
after each .IDX file's 2-line header is a real per-block (offset,
lambda_hash) index table, both fields monotonically increasing,
confirmed on a small per-form .IDX and the much larger GENERIC.IDX
(92,006 records) alike -- matches order-type=lambda exactly. The
compressed block bodies themselves are tested and refuted as standard
zlib/deflate/gzip/bz2 despite the compr-type=Z label -- a still
unidentified proprietary encoding, documented as an open item.
Open and crack tpd/TPD3.DIC: not a dictionary, a 3rd product manifest
Mirrors the main repo's research/tpd_reader.py update. The last file
under tpd/ that had never actually been read turns out to be 60 bytes
of plain text, not a binary dictionary -- a 3rd disc-root product
manifest confirming the disc's 2019060000 build stamp a 4th independent
way and naming the one shipped product instance (eue_0,
/nscWeu_eue_20190607). One field ("25") doesn't match any other known
count on this disc -- documented as unexplained.
Examine and document every remaining file on CD_8555
All 1,535 files on the disc now examined at some level:
- cdrom.toc/DBINFO.TXT: real manifests confirming every subsystem's
version stamp (TPD/SVD/TMC/DBAL dates all cross-confirmed)
- telemat/tmc2: TMCCONFIG.ini fully cracked; .et files confirmed real
TMC phrase text; .lt binary tables identified, not byte-cracked
- speech/: confirms the real TTS vendor (SVOX) and the actual embedded
RTOS (VxWorks) -- the first OS identification in this project. Real
dated Siemens VDO/SVOX license string (2005).
- dbal/: confirmed PowerPC ELF relocatable objects; ~330 real internal
source file names extracted, mapping almost 1:1 onto this project's
own already-cracked eeu.* files; independently confirms eeuz.fea's
hash-table directory from the source's own runtime log strings; real
dated bug-fix branch history
- tpd/ (1,443 files): confirmed a real embedded HTML destination-search
UI (CGI-style forms to a local web server), category hierarchy, icon
set, compressed search-index tables (header decoded, body not)
- EDB/POI/POI.DB3: PredefinedStatement embeds real SQL, confirming the
precompiled-statement architecture already inferred from firmware
Rewrites Disc-Root-Build-Script.md comprehensively, updates Home.md and
Unexamined-Files.md.
Document config/create_cd: the disc's own build script, plus EDB/POI.DB3 (4.7M real POIs)
config/create_cd is the disc's own mastering/build script, revealing:
- the literal origin of the EEU50530910.84 version string
- ZIP_3kb as the source tree's own real name for block_size=3072
- 5 never-examined disc-root subsystems: config, tpd, EDB, telemat,
speech, dbal
Opens and confirms EDB/POI/POI.DB3, a real standard SQLite database
with 4,733,183 real POIs, full addresses, and real brand-specific
category sets (main vw/seat/skoda/bentley) -- confirming this POI
database is shared across the whole VW Group. Independently confirms
eeu.mod's own 'Arriba' self-identification via the database's own
ClearCase build metadata (arriba2/arriba2_VW).
Also finds telemat/tmc2/TMCCONFIG.ini: real, standard ALERT-C TMC
location-table config for 14 countries, giving eeu.tmc (still
unexamined) a strong new lead -- a quick scan already finds a plausible
sequence of real ALERT-C Location Code numbers in its body.
Adds Disc-Root-Build-Script.md, updates Home.md, _Sidebar.md,
eeu-mod-Database-Schema.md, Unexamined-Files.md.