Jailbreaking my car's navigation system just so I can change the time

A 2014 Renault Latitude’s TomTom Carminat LIVE navigation unit had no visible way to change the clock after its map SD card was discarded. The missing card did more than remove navigation: it contained the menu definition needed to reach the time settings. Replacing it with a blank card was not an option, because the unit checked the card’s unique hardware identifier and signatures. Buying a replacement would cost about €60, so the author set out to gain control of the device instead. The unit runs a customized Linux 2.6 system, and its update image exposes much of the root filesystem, but attempts to modify and install that image stalled at an apparent verification step.

Emulation with QEMU helped reveal how the system worked and test possible attack paths. Most partitions were read-only or mounted with execution disabled, limiting the damage possible from files on the SD card. The author reverse-engineered the boot-time master.script interpreter, finding a command that could launch programs but could not pass arguments, and a logging command that allowed root-written, printable text to be placed at arbitrary paths through directory traversal. Neither offered a way around the filesystem restrictions. Fuzzing image decoders found out-of-bounds reads but no useful memory writes. After these dead ends, the investigation turns toward adapting a technique from kernel exploits; the available account ends as that approach begins, before describing its outcome.