Failed attempt at Open Software on 9500ix

[mswlogo]

I really wanted to have some of the features Jim's prgram had for the 9500i. I would like to see what's locked and possibly do some cleanup or change some to manual locks so they don't get removed.

After pounding my head on the wall for a couple weeks and several helpful discussions with Jim I think I'm throwing in the towel.

It appears the data transmission is encrypted. It's encryption key I believe is a combination of wall time and serial number. So that you cannot share camera database or even manual or automatic lockouts.

I did manage to get it to switch to USB mode automatically in software and back out. I learned how to communicate with it in a "Block Mode" to avoid data overruns and underruns in "stream mode".

I can't really blame Escort for encrypting it because they need to protect their redlight database revenue stream.

I could be wrong and it's doing something simple but when it's data changes over time it's really hard to decode it.

[jimbonzzz]

I could be wrong and it's doing something simple but when it's data changes over time it's really hard to decode it.

Yep, this is the biggest problem I see with it: even if someone were to figure out the current scheme, they are only a firmware update away from having all of that work invalidated when Escort decides to change it. So, there's not a lot of motivation to put much time and work into it.

[statusquo]

How come I can load the same download from Escort into both my 9500ix units?

Maybe because one of them is the 3 year (i.e. the one that came with the refurb'ed 9500i one)? It's the only one I download and use on both units.

I bought the extra year with the new (blue) 9500i as the lady said they "Were locked by the serial number and I needed two subscriptions." Turns out I didn't -- at least for now.


sq~

[mswlogo]

How come I can load the same download from Escort into both my 9500ix units?

Maybe because one of them is the 3 year (i.e. the one that came with the refurb'ed 9500i one)? It's the only one I download and use on both units.

I bought the extra year with the new (blue) 9500i as the lady said they "Were locked by the serial number and I needed two subscriptions." Turns out I didn't -- at least for now.


sq~

And how do you KNOW they actually loaded

Since I believe all detectors capable of redlight database included some amount of subscription they may not have fully secured it against serial numbers yet.

[Obsidian]

It appears the data transmission is encrypted. It's encryption key I believe is a combination of wall time and serial number. So that you cannot share camera database or even manual or automatic lockouts.

How come I can load the same download from Escort into both my 9500ix units?

The camera database may well be encrypted, but it's absolutely not tied to a single detector from what I can tell. You can download it and give it to anyone else with a 9500ix to use (which would be lame, considering it's $10 freakin' bucks per year, but I digress).

I have md5 hashed every database update I have downloaded for the 9500ix and then compared them to a friend of mine's md5's, as well as two other members of this forum's md5's. Each corresponding download has the exact same hash. The .lcd file is also the same before and after applying the update to the detector.

If the file was "encrypto-matched" to a single unit, it would be impossible for the files to have the same md5.

I have not tried sharing my own Truelocks (have no interest in that honestly), so I can't really comment on if that works or not, but I suspect it would.

These are the md5 hashes below. If anyone's matching update is different, PM me, cuz I'd like to know.

# MD5 checksums generated by MD5summer (Home of the MD5summer)
# Generated 12/18/2008 10:47:48 PM

fbe5944726144c7a4b72ee3628023538 *LocationDatabase-07-01-2008.lcd
e8fc0413172681ed4515898d5d61ffd8 *LocationDatabase-08-01-2008.lcd
8eddbb522b139ca13223ecb8b1eac07e *LocationDatabase-09-01-2008.lcd
029bdbed276337e1fca8a04eb47280af *LocationDatabase-10-01-2008.lcd
5f850e15cccc6ef6f6f1291366f68d54 *LocationDatabase-11-01-2008.lcd
25c0d2c51b0cbbdcf9cde130816d74d7 *LocationDatabase-12-01-2008.lcd

I would be interested in knowing the md5 of the GX65 12-01-08 update as well ... I would not be surprised if it was the same as the 9500ix 12-01-2008 update.

[mswlogo]

This is for 9500ix

8eddbb522b139ca13223ecb8b1eac07e *LocationDatabase-09-01-2008.lcd
5f850e15cccc6ef6f6f1291366f68d54 *LocationDatabase-11-01-2008.lcd
25c0d2c51b0cbbdcf9cde130816d74d7 *LocationDatabase-12-01-2008.lcd

[Obsidian]

This is for 9500ix

8eddbb522b139ca13223ecb8b1eac07e *LocationDatabase-09-01-2008.lcd
5f850e15cccc6ef6f6f1291366f68d54 *LocationDatabase-11-01-2008.lcd
25c0d2c51b0cbbdcf9cde130816d74d7 *LocationDatabase-12-01-2008.lcd

Yep, perfect match. Location database downloads are not matched to a specific unit.

[dannyz]

Keep going guys, as i mentioned in a previous post, I think sharing user information could be very helpful. If we collected the information, we should be able to share it.

[mswlogo]

Keep going guys, as i mentioned in a previous post, I think sharing user information could be very helpful. If we collected the information, we should be able to share it.

The only thing this helps is sharing our subscription which we all have.

As far as sharing lockouts the file is encrypted. Given that the redlight files are not uniquely encryted then the backup of personal lockouts can probably be shared too. If you trust the backup and restore which I don't at this point.

Even if backup and restore does work and you wish to ignore it's error messages (it may be just a bug in the verify step) it does not help us share/compare lockouts.

I will post later some data if anyone wants to take a stab at it.