The dashboard clock in a 2014 Renault Latitude was running an hour off, and no matter how many menus the owner combed through, there was simply no way to fix it. What stood in his way was not a mechanical failure, but a decommissioned map server thousands of kilometers away.
The car’s Carminat LIVE head unit was manufactured by TomTom. When purchasing the car, the previous owner asked if he wanted the navigation SD card, remarking that “in this car, you even need it just to set the clock.” Skeptical and figuring the maps were hopelessly obsolete anyway, he declined, and the card was tossed into the trash. As it turned out, every word the former owner had said was true.
A vehicle’s clock, held hostage by an SD card. This architectural choice effectively turned hardware ownership into a rented privilege tethered to an external service. With the servers permanently offline, the only patch capable of restoring basic functionality had to be written by the owner himself.
Setting the Clock Required Buying an Old Map Card
In the Renault Latitude, the center console screen is driven by a platform codenamed beaumont, powered by a Samsung S5P6440 SoC running a customized TomTom distribution on Linux kernel 2.6.28.10.
The primary user interface entry point is PNDNavigator. Neither Renault nor TomTom wrote a dedicated standalone settings menu for the car; basic preferences like time, language, and display brightness were all bundled into PNDNavigator’s interface definition—which was read dynamically from the external SD card. Without the card inserted, the infotainment system had no idea how to even launch the settings interface.
Figure: The head unit displaying a prominent Estonian prompt “No maps found!”—the SD card controls far more than just map data. Source: blog.nns.ee
After spending an hour digging through every corner of the UI, the owner never found the “Set time” option. The easiest official workaround was buying a replacement card: original units can still be found on secondary markets, but shipping one to Estonia would cost around €60. Refusing to pay €60 just to set a dashboard clock, he resolved to reclaim root access on his own terms.
Auto Vendors Made Core Settings an Accessory to Maps
More than a decade ago, the automotive industry launched its first wave of connected cockpits. Eager to market “smart” dashboards but lacking in-house software capabilities, legacy OEMs outsourced entire infotainment stacks to navigation suppliers like TomTom. Under tight launch deadlines, the supplier took portable navigation device (PND) firmware and ported it wholesale into built-in head units: the boot sequence launched the GPS suite first, with basic vehicle settings tacked underneath. Because basic settings were coupled directly to navigation services, the clock functionality died alongside the retired map infrastructure. Owners were left stranded with mechanically sound vehicles unable to adjust for daylight saving time.
Silicon Handshakes and noexec: Layered Defenses Against the Owner
The most obvious fix was buying a standard SD card and dropping custom scripts onto it. The infotainment system, however, had several defensive layers in place.
The first barrier was silicon-level binding. TomTom’s DRM verifies the Card Identification (CID) register—a unique hardware serial burned into the card controller at the factory that cannot be altered via standard commands—along with cryptographic signatures on map files. A blank, off-the-shelf card is rejected immediately at step one.
The second barrier was embedded in the storage mount policy: even if a legitimate CID could be spoofed, the operating system mounts external storage with noexec. Any binaries or shell scripts on the card are strictly forbidden from executing. Mechanisms originally engineered to curb map piracy ended up locking out legitimate owners trying to fix their own cars.
Triggering a Crash to Bypass Execution Restrictions
The owner, Rasmus Moorats, dumped the firmware directly from the unit, spun up a QEMU emulation of the S5P6440 on his PC, and began disassembling the binaries. He reversed ttn—the binary responsible for parsing master.script—and documented the internal SHEX command protocol. SHEX accepts only a single space-separated argument and forwards it to launchserver, which then executes it via execve—a pathway squarely blocked by noexec.
The breakthrough arrived via the Linux kernel’s core dump mechanism. Linux allows configuring crash dump handling via /proc/sys/kernel/core_pattern. Support for command-line arguments in this pipeline was introduced in kernel 2.6.24, and because this system ran kernel 2.6.28, core_pattern remained writable from userspace. Moorats picked a process guaranteed to crash: /bin/dbus-monitor throws a SIGABRT whenever it fails to connect to the system D-Bus daemon. Because the kernel executes the command specified in core_pattern with elevated root privileges, this invocation completely bypasses filesystem noexec restrictions.
Figure: The head unit acknowledging execution of master.script, with custom scripts subsequently running on bare metal despite noexec. Source: blog.nns.ee
The outcome was full root execution for user-supplied scripts on the car’s head unit, restoring complete control over the system clock and time zones.
When Vendor Code Ceases Maintenance
Word of the jailbreak spread rapidly across automotive and hacking communities, where other owners reproduced the exploit. On TomTom forums, contributors confirmed that the exact same attack vector works on Carminat TomTom firmware version 8.843. Forum discussions revealed another counterintuitive discovery: GPS navigation itself does not fail without the card; only the clock display goes dark. The only missing pieces were the ephemeris cache files (packedephemeris.ee, ee_meta.tlv, ee_meta.txt). Replacing them with fresh offline ephemeris data restores both satellite positioning and clock synchronization.
Motorists who paid tens of thousands of dollars for a complete car are forced to rely on exploit techniques just to maintain basic cabin functions. When automakers mortgage hardware capabilities to ephemeral cloud services, buyers are left holding a temporary lease. Servers go dark, code repositories are abandoned, and unlocking device control remains the only path for hardware to outlive its manufacturer.
References:
- blog.nns.ee: Jailbreaking my car’s navigation system just so I can change the time
- TomTom Official Community Discussion (Carminat TomTom 8.843)
- Lobsters Technical Community Discussion
