Decompression/unpacking routine for files included on Nissan Connect 3 SD cards. Tested with "Europe V5" (pictured below).

You may also wish to check out the head unit root exploit by ea at github.com/ea/bosch_headunit_root/.

Decompress a specified file or files:

DecompressAlgorithm.py <filepath>

Decompress all files in the current directory:

DecompressAlgorithm.py all

Files will be saved as <filename>.BIN, or <filename>.PNG if the extension is one of .PHD, .PHN, .PND, .PNN.

If you have a Nissan made within the last 10 or so years, chances are you have a head unit that looks something like this:

Here in Europe, the SD card slot next to the CD reader contains one of these:

Taking a cursory look at the files on the SD card, you will realise most of them are unreadable (although there are a few plaintext and SQLite DB files).

If you're able to find a copy of the head unit's firmware online (hint: Nissan QashQai Forums) then it's fairly straightforward to find the binary responsible for decompression (another hint: do a grep for "CPRNAV_2", the file signature, and you find one result: /var/opt/bosch/dynamic/processes/DAPIAPP.OUT). Fortunately the symbols haven't been stripped so it's not too hard to get a basic understanding of the methods/structs/etc. used.

The values listed below are from the file /CRYPTNAV/DATA/DATA/INSTRUCT/3D_PICT/ALP/ALR/JUG00378.PNN (values shown in little-endian).

All compressed files have the following header:

Values between 0x18 and 0x1C (i.e. the first block) are offsets to the end of each block, in this case:

In the case of JUG00378.PNN, 0x108 is also the end of the file.

Compressed files contain one or more blocks of packed data. Blocks have a very simple header consisting of two values: "unpacking data" size and the unpacked block size. "Unpacking data" is data used to look up values from a preset code table which indicate things such as how many bytes to copy. Blocks appear to only unpack a maximum of 0x4000 bytes.