Carminat TomTom LIVE: Reverse Engineering

Reverse engineering of the Renault embedded NavCore 9.884 (codename beaumont)
Tested on: Renault Laguna 3 GT Monaco GP 2012 (a superb car, by the way)

flowchart TD
    A[Carminat TomTom LIVE] --> B[Samsung S5P6440<br/>Linux 2.6.28 verrouillé]
    
    B --> C[NAND interne]
    B --> D[Carte SD externe]
    
    C --> E[Verrouillé]
    D --> F[Modifiable]
    
    E -.->|UART| G[shell root théorique ?]
    F -.->|fichiers SD| H[Personnalisations<br/>splash · menus · POI]
    
    style A fill:#5B4FBE,color:#fff
    style E fill:#A32D2D,color:#fff
    style F fill:#3B6D11,color:#fff
    style G fill:#EF9F27,color:#000
    style H fill:#1D9E75,color:#fff

Table of contents

1. Context and objective
2. System identification
3. Hardware
4. Firmware extraction
5. Filesystem architecture
6. Boot chain
7. Processes and services
8. Analysis of the ttn binary
9. GPRS modem and connectivity
10. Attack surface from the SD card
11. Root UART access
12. Customizations without UART
13. Tools and resources
14. Use of AI in this project
15. Legal disclaimer

---

1. Context and objective

The Carminat TomTom LIVE is Renault's built-in navigation system equipping 2009-2014 models (Laguna 3, Mégane 3, Scénic 3, Espace 4, Fluence, Latitude, Koleos…). It differs from the non-Live Carminat TomTom by:

• A firmware stored on internal NAND (and not on the SD card)
• An integrated GPRS modem for real-time services (traffic, weather, speed cameras)
• An RSA-signed and locked bootloader
• According to community reports, a kernel module signedloop would verify the integrity of the rootfs via a Merkle tree (not confirmed by this analysis, cf. §3)

This repository documents an analysis of the NavCore 9.884 beaumont firmware, including the mapping of the filesystem, the static analysis of the NavCore binary, and the runtime analysis via QEMU/strace.

Methodology used:

• System identification via the SD card extracted from the vehicle (reading of the ttgo.bif, loopdir/ext3_loopback files)
• Firmware retrieval via the official TomTom CDN (cf. section Firmware extraction)
• Static analysis of the rootfs extracted from the CAB
• Setup of a QEMU emulator reproducing the ARM/Linux environment of the unit to enable dynamic analysis of the ttn binary (strace of system calls, observation of opened files, runtime behavior)

No modification was made to the physical unit of the vehicle. All analyses were carried out on copies of the SD files and of the downloaded firmware.

All the work documented here was carried out from a personal SD card (extracted from the vehicle for analysis) and from the official firmware downloaded from the TomTom CDN.

📌 Evolving document: This report represents the current state of knowledge resulting from this analysis. It may be improved, corrected or enriched over the course of future discoveries, community contributions, and empirical validations on real hardware. Contributions, corrections and feedback are welcome.

---

2. System identification

Field	Value
DeviceName	TomTom Carminat LIVE
Hardware codename	beaumont (rev 11)
NavCore version	9.884, build 9.884.1609031
Official release	NFA2.8-RC06, compiled on 27/06/2014 in Dieppe
Linux kernel	2.6.28.10-tt1574740
Toolchain	gcc 4.3.3 TomTom CipherWizardry 2009q1_203-474426
Libc	uClibc
Init system	Upstart (via shell script /sbin/init → exec /sbin/upstart)

This information comes from the ttgo.bif extracted from the loopdir/ext3_loopback image of the SD card, and from the TomTom-Cfg/release.nfo file.

# Extrait ttgo.bif
[TomTomGo]
DeviceName=TomTom Carminat LIVE
DeviceVersionHW=beaumont
ApplicationVersionVersionNumber=9884
ApplicationVersion=1609031.550
RamDiskVersion=20140626
BootLoaderVersion=839378
LinuxVersion=1574740

3. Hardware

Component	Identification
SoC	Samsung S5P6440 (confirmed via /etc/udev/rules.d/20_local-s5p6440.rules)
CPU	ARM1176JZF-S · ARMv6 · little-endian · EABI
RAM	not determined by static analysis
Internal storage	NAND flash · eMMC (/dev/mmcblk0)
User SD card	/dev/mmcblk1 (accessible slot)
Screen	Samsung LCD LTA058B3L0F (per DTB) · 480×272
Framebuffer	/dev/fb0 · RGB16/24
GPS	SiRF3 PRIMA · /dev/ttySAC2
GSM/GPRS modem	Wavecom WISMO218 · /dev/ttyS0
RDS-TMC tuner	BCM4750 · bcm4750_spi
Bluetooth	Integrated · hci_uart · HFP + PBAP only (no A2DP)
Touchscreen	libts · /dev/input/event0

Loaded kernel modules (excerpts from /etc/modules)

unionfs · ppp_async · ppp_generic · slhc · hidp · hid · rfcomm
sco · hci_uart · l2cap · bluetooth · bcm4750_spi · vfat · msdos
fat · evdev

⚠️ The signedloop module is reported by the community (gpspower.net) as verifying the integrity of rootfs.img. Not observed in the extracted rootfs (neither in /etc/modules, nor in /lib/modules/2.6.28.10-tt1574740/). To be confirmed.

---

4. Firmware extraction

4.1 Downloading the official CAB

The firmware can be downloaded without authentication from TomTom's Akamai CDN:

curl -A "TomTom HOME/2.24.11.8" -O \
  "http://download.tomtom.com/sweet/navcore/9.884.1609031_RC06.CAB-Dieppe.cab"

# SHA256 de référence
a4d32daae2cdd6bc23a0660285c4e32e3a098034731eb257172ed7aaef9052d5

Other available versions (tested HTTP 200):

Version	URL
9.844	http://download.tomtom.com/sweet/navcore/9844.634510.Carminat_TomTom.cab
9.845 RC10	http://download.tomtom.com/sweet/navcore/9.845_1115399_RC10.CAB-Camiron-RC10.cab
9.846 RC12	http://download.tomtom.com/sweet/navcore/9.846_1165624_RC12.CAB-Camiron-RC12.cab
9.847 RC14	http://download.tomtom.com/sweet/navcore/9.847.1302316_RC14.CAB-Camiron-RC14.cab
9.884 RC06	http://download.tomtom.com/sweet/navcore/9.884.1609031_RC06.CAB-Dieppe.cab

4.2 CAB extraction

brew install cabextract  # macOS
mkdir extracted && cabextract 9.884.1609031_RC06.CAB-Dieppe.cab -d extracted/
ls extracted/
# → splashw.bmp  ttsystem  TomTom-Cfg/release.nfo

The ttsystem is an ext2 image (not a TTBL), unlike the non-Live versions.

4.3 Extracting the complete rootfs

cd extracted/
mkdir rootfs && 7z x ttsystem -o rootfs/

# Le rootfs réel est dans userfs_partition.tar.gz
cd rootfs/
tar xzf userfs_partition.tar.gz

# Contenu :
# _zImage       → Linux kernel ARM zImage
# rootfs.img    → filesystem Linux complet (ext2, 67 MB)
# WISMO218_*.cla → firmwares modem

mkdir rootfs_mnt
# Sur Linux :
sudo mount -o loop rootfs.img rootfs_mnt/
# Sur macOS (lecture seule) :
7z x rootfs.img -o rootfs_mnt/

4.4 Structure of the extracted firmware