https://raymii.org/s/blog/Bringing_a_Decade_Old_Bicycle_Navigator_Back_to_Life_with_Open_Source_Software_and_DOOM.html Skip to main content Raymii.org Raymii.org Logo Quis custodiet ipsos custodes? Home | About | All pages | Cluster Status | RSS Feed Bringing a Decade Old Bicycle Navigator Back to Life with Open Source Software (and DOOM) Published: 25-07-2025 23:37 | Author: Remy van Elst | Text only version of this article Table of Contents * Planned Obsolescence * Navman Bike 1000 / Mio Cyclo 200 * First Impressions * mitmproxy & WireShark * Researching the firmware and DODGE.exe * Replacing DODGE.exe * NAVeGIS * Conclusion --------------------------------------------------------------------- I recently found a Navman Bike 1000 in a thrift store for EUR 10. This is a bike computer, a navigation device for cyclists, made by MiTaC, the same company that makes the Mio bike computers. This Navman Bike 1000 is a rebadged Mio Cyclo 200. It's from 2015 and as you might have guessed, no more map updates. There seem to be newer maps from 2020, but the official download tool fails. Planned Obsolescence at its best. The device is still in very good condition, the battery runs for 5 hours, the screen has great visibility outside and the software is extensive. navegis NAVeGIS Open Source navigation with up to date maps Recently I removed all Google Ads from this site due to their invasive tracking, as well as Google Analytics. Please, if you found this content useful, consider a small donation using any of the options below. It means the world to me if you show your appreciation and you'll help pay the server costs: GitHub Sponsorship PCBWay referral link (You get $5, I get $20 after you've placed an order) Digital Ocea referral link ($200 credit for 60 days. Spend $25 after your credit expires and I'll get $25!) This article shows how I dabbled a bit in reverse engineering, figuring out the device runs Windows CE 6.0 and using Total Commander and NaVeGIS together with Open Street Map to get up to date maps from the OpenFietsMap project, allowing me to use this device for navigation with the most up to date maps. Since it is all open source, even if the current map provider would stop, I can always make my own maps. Oh and it runs DOOM: doom There is no other input than the touch screen, so I can shoot and nothing more, but hey, it runs DOOM! Planned Obsolescence Mio still makes newer devices like this one, which probably only last 2 years and then the maps are out of date with no updates. I'd even be willing to pay Mio for updated maps for this older model. original maps The original maps (kaarten, Dutch) are from 2015. I wonder why a company would assign its engineers the task of providing maps for old devices when newer gizmos consistently generate hundreds of dollars every two years. The high prices of new Garmin units, for instance, make it clear where their development priorities lie. Why are there no laws requiring device manufacturers to open source all software and hardware for consumer devices no longer sold? This would not directly impact their revenue and would help reduce the growing volume of e-waste. However, I believe such a measure would likely shrink their profit margins, as consumers might no longer purchase new devices annually if existing models remained functional for ten years. You could turn this thought around. There is no information on the box nor in the manual regarding (free) map updates, so you could expect nothing, no updates at all. That they provided 5 years (2015 - 2020) of free map updates is nice, but since it was never promised, we should not complain. The promise was NO map updates, but you still got 5 years worth. Navman Bike 1000 / Mio Cyclo 200 To start this post off here are some pictures of the device and a global overview. This is the unit with box: unit with box Here is the Mio counterpart, mounted on a bike. mio cyclo 200 mio cyclo 200 Both units are almost exactly the same except for housing colour and background, software wise this article will work on both the Navman Bike 1000 and the Mio Cyclo 200. Here is an excerpt from its introduction in 2015: The Mio Cyclo 200 is an entry level bike navigation device with a 3.5-inch color touchscreen and a very simple interface. It offers address navigation, GPX track import, and a special "Surprise Me" feature that creates random routes based on time or distance. It is loaded with OpenStreetMap data for 23 Western European countries and includes cycling-specific points of interest like repair shops and restaurants. It is waterproof, designed for outdoor use, and has a battery life of around 10 hours. There's also a "Where am I" function to quickly check your location. Mounting options include a handlebar mount, and a stem mount (Garmin mount). Updates are handled via a desktop application. The device focuses on basic navigation without training features, making it ideal for leisure riders and e-bike users, with a price of EUR 179.99. First Impressions Mounting on the bike was very easy and the battery still holds charge up to 8 hours. It gets a GPS fix quite fast when you are outside. The software is basic, but for its intended use case it's fine. You can enter an address or postal code and it will navigate to there using full colour maps. When you need to do something, like take a turn, it beeps a few times. I could see myself using this for longer bicycle trips or on holiday. But! Problems start arising when it sends you along roads that no longer exist or when you want to navigate to addresses that the device does not know about. It's showing its age and since you can no longer download new maps, that will never be fixed. The desktop software says there are maps available for download: update available But when trying to download them, it fails: fail A bit of searching around on the web does turn up a lot of info regarding Garmin custom maps but nothing for Mio devices. mitmproxy & WireShark I was wondering what this application was doing so I set up mitmproxy and let it only monitor navman.exe. mitmproxy is software that intercepts app network (https) requests and since the navigation desktop software was from 2018, I didn't suspect that it does any certificate pinning. That means that it uses the system certificate store and accepts the mitmproxy certificate. If it did certificate pinning, mitmproxy wouldn't work. But as I suspected, no pinning and I could snoop in to the network traffic of the desktop software. There were two requests that stood out. Request 1 seems to be a software update check: POST: http://update.mio-tech.com.tw/Dodge/IaaCheckUpdateServlet 8613 Prod WIN32 000...B1 NAVMAN BIKE 1000 Response: IMAGE 2017-08-31 33.03.0807 11700606 http://download.mio.com/MioCyclo/GPST/Agent/8613/R33.zip http://service.navman.com/ APPLICATION 2018-02-02 5091 28599221 http://download.mio.com/MioCyclo/GPST/Agent/Application/App 5.0.9.1 only.zip http://service.navman.com/M0100/FileReader_111306_UK%20Ireland%20NAVMAN_English%20Navman.html Request two contains the map updates: POST: http://update.mio-tech.com.tw/DodgeAgentMapUpdate/MiomoreMapUpdate.action Response: 1909.02 129030470 2016-02-16 02:49:50.115686 WEU-BM-cyclo2 173 http://download.mio.com/MioCyclo/GPST/MapData_v3/Basemap/WEU_BaseMap_150602.zip 9fb4549793498cf1a1024ae825c7f88c http://v5.test.mioshare.com/en/news/detail?newsid=44 1201.01 3018402 2015-06-12 10:04:51.191228 WEU-CountryID-V4 49 http://download.mio.com/MioCyclo/GPST/MapData_v3/CountryMap/WEU_Countries_23.zip FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF http://www.mioshare.com/news/detail?newsid=6 1910.02 1899741519 2016-02-16 02:48:57.010793 WEU-OSM-cyclo2 172 http://download.mio.com/MioCyclo/GPST/MapData_v3/OSM/WEU_OSM_150902.zip 1d349e6be7657d828c4d287b812522c5 http://v5.test.mioshare.com/en/news/detail?newsid=44 1909.02 1242676960 2016-02-16 02:49:31.575609 WEU-TA-cyclo2 171 http://download.mio.com/MioCyclo/GPST/MapData_v3/TA/WEU_TeleAtlas_150602.zip 512ba03cd982ed6b4cf80f9e85c23161 http://v5.test.mioshare.com/en/news/detail?newsid=44 You can see that the download URL's are from Mio, not Navman, they're made by the same OEM. What's up with the weird checksum? But sadly, all map urls give a Not Found error. I've contacted Mio support but haven't yet received a response. If I ever get any I'll update this post. The software update download responses do work. App 5.0.9.1 only.zip contains a program named dodge.exe. I even tried to monitor the USB communication but I didn't get very far with that: wireshark Researching the firmware and DODGE.exe The app only download included a program called dodge.exe. Uploading it to VirusTotal told me that it was an ARMv4 Tumb application for Windows Mobile. Binwalk said the same: $ docker run -t -v "$PWD":/analysis refirmlabs/binwalk:branch-master -Me dodge.exe /analysis/extractions/dodge.exe ------------------------------------------------------------------------------------------------------------------------ DECIMAL HEXADECIMAL DESCRIPTION ------------------------------------------------------------------------------------------------------------------------ 0 0x0 Windows PE binary, machine type: Thumb 4066336 0x3E0C20 CRC32 polynomial table, little endian 4067375 0x3E102F Copyright text: "Copyright 1995-2002 Jean-loup Gailly " 4070255 0x3E1B6F Copyright text: "Copyright 1995-2002 Mark Adler " 4186952 0x3FE348 CRC32 polynomial table, little endian 4193320 0x3FFC28 Copyright text: "Copyright (C) 1994-2008 Lua.org, PUC-Rio $ $Authors: R. Ierusalimschy, L. H. de Figueiredo & W. Cele" 4241612 0x40B8CC Copyright text: "Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll" 4241698 0x40B922 Copyright text: "Copyright 1998-2004 Gilles Vollant - http://www.winimage.com/zLibDll" 4298913 0x4198A1 Copyright text: "copyright_navman." 4298941 0x4198BD Copyright text: "copyright." 4298953 0x4198C9 Copyright text: "copyright.eng.txt" 4298972 0x4198DC Copyright text: "CopyrightText" 4298992 0x4198F0 Copyright text: "CopyrightText" 4521372 0x44FD9C Copyright text: "Copyright (C) 2009, Thomas G. Lane, Guido Vollbeding" 4577656 0x45D978 CRC32 polynomial table, little endian ------------------------------------------------------------------------------------------------------------------------ The firmware update image included a large file named xip.bin: $ docker run -t -v "$PWD":/analysis refirmlabs/binwalk:branch-master xip.bin /analysis/xip.bin ------------------------------------------------------------------------------------------------------------------------ DECIMAL HEXADECIMAL DESCRIPTION ------------------------------------------------------------------------------------------------------------------------ 0 0x0 Windows CE binary image, base address: 0x80420000, image size: 23814492 bytes, file size: 19793959 bytes ------------------------------------------------------------------------------------------------------------------------ This seems to be the entire firmware image (with Windows CE). I used the desktop program to flash this new firmware. The device showed a black screen with a few lines of update information: bootloader flash Afterwards it rebooted. Extracting this xip.bin image didn't work with binwalk, only a few picture (image) files were extracted and a file named EBOOT.NB0 which binwalk identified as an AES S-BOX. I might pursue that later with some help of the XDA Developers forum, xip images seemed to be popular back in the Windows Mobile days. But I have a way easier method, read on for that. Replacing DODGE.exe When connecting the device via USB to the PC, two new drives show up. Nav_data and Nav_system. The first is where you can load .gpx tracks and where routes are saved. The second seems to be the entire Windows CE system partition! Because the earlier app only download had a file named DODGE.exe I went looking for that file. Found it in the, surprisingly named, DODGE\PROGRAM folder. Renamed it to DODGE2.exe and put Total Commander for ARMv4 for Windows CE there as DODGE.exe and behold: total commander Using Total Commander I can browse the filesystem, there are lots of leftovers and test programs. For example, here is Windows Explorer running on top of the original DODGE.exe program: explorer The original Windows CE desktop: windows ce desktop A GPS Test program: godspeed Calculating Pi, including a third party on screen keyboard since this ROM does not ship with one: pi calc This is way too much fun. I love me some Windows CE as with the HP Jornada, trying out all kinds of Windows CE Applications, games like DOOM and much more. But we're here for the navigation part, I only wanted up to date maps. NAVeGIS NAVeGIS is a Windows Mobile and WinCE navigation application, last updated in March of 2025. NAVeGIS can use the OpenStreetMap maps and in my case, the open Bicycle maps from OpenFietsMap. NAVeGIS is provided under the GNU GPLv3. After downloading the OpenFietsMap map file and placing it on a Micro SD card I selected the img file as map source in NAVeGIS. You select a destination by either selecting it via the menu, or by dragging the map to where you want to go and pressing the screen, then setting that as destination. It saves a list of recent destinations. Route hints are given by a big yellow arrow, the route itself is purple: navegis Here is a route it planned, about 25 KM,zoomed out a bit: navegis 2 There is no way to record GPS tracks or to change the screen layout. It does not support the beeper on this Mio device, so no audio hints as well. But, the maps are updatable and the navigation itself is just as good as the Mio application's routing engine. It also supports Points of Interests (POI). I find myself using the regular Mio (DODGE.exe) to record GPX tracks and for navigation I'm using NAVeGIS. The Mio maps are so out of date that the instructions more often than not are incorrect. Without this piece of open source software I would probably have to throw this device back in the bin (or the second-hand store). But with it, I have the most recent up to date maps and navigation on a 10 year old Windows CE device. I hope current Mio or Garmin or comparable devices are this open to allow for continued usage. Locked down devices, signed bootloaders and such shenanigans are nice if you're a manufacturer, but not if you're and end user. Conclusion Thanks to open source software and a bit of reverse engineering, a 10 year old GPS device is now fully functional. Proprietary abandonment was bypassed entirely. With NAVeGIS, Total Commander, and OpenStreetMap, I have modern mapping on legacy hardware. Obsolescence is a choice. Reverse engineering is resistance. For fun I installed Windows XP in a VM with Visual Studio 2008 and compiled NAVeGIS myself. Git source and build instructions here winxp NAVeGIS compiled and running in the Windows CE emulator Tags: binwalk , blog , c++ , cpp , cycling , development , doom , garmin , historical , mio , mitac , mitmproxy , mobile , navman , openstreetmap , pda , planned-obsolescence , pocket-pc , windows-ce , windows-mobile , wireshark Home | About | All pages | Cluster Status | Generated by ingsoc.