I recently found a Navman Bike 1000 in a thrift store for EUR 10. This is a
bike computer, a navigation device for cyclists, made by MiTaC, the same
company that makes the Mio bike computers. This Navman Bike 1000 is a
rebadged Mio Cyclo 200. It’s from 2015 and as you might have guessed, no more
map updates. There seem to be newer maps from 2020, but the official download
tool fails. Planned Obsolescence at its best. The device is still in very
good condition, the battery runs for 5 hours, the screen has great visibility
outside and the software is extensive.
NAVeGIS Open Source navigation with up to date maps
Recently I removed all Google Ads from this site due to their invasive tracking, as well as Google Analytics. Please, if you found this content useful, consider a small donation using any of the options below. It means the world to me if you show your appreciation and you’ll help pay the server costs:
GitHub Sponsorship
PCBWay referral link (You get $5, I get $20 after you’ve placed an order)
Digital Ocea referral link ($200 credit for 60 days. Spend $25 after your credit expires and I’ll get $25!)
This article shows how I dabbled a bit in reverse engineering, figuring out
the device runs Windows CE 6.0 and using Total Commander and NaVeGIS together with Open Street Map to
get up to date maps from the OpenFietsMap project, allowing me to use this
device for navigation with the most up to date maps. Since it is all open
source, even if the current map provider would stop, I can always make my own
maps.
Oh and it runs DOOM:
There is no other input than the touch screen, so I can shoot and nothing
more, but hey, it runs DOOM!
Planned Obsolescence
Mio still makes newer devices like this one,
which probably only last 2 years and then the maps are out of date with no
updates.
I’d even be willing to pay Mio for updated maps for this older model.
The original maps (kaarten, Dutch) are from 2015.
I wonder why a company would assign its engineers the task of providing maps
for old devices when newer gizmos consistently generate hundreds of dollars
every two years. The high prices of new Garmin units, for instance, make it
clear where their development priorities lie.
Why are there no laws requiring device manufacturers to
open source all software and hardware for consumer devices no longer sold?
This would not directly impact their revenue and would help reduce the
growing volume of e-waste. However, I believe such a measure would likely
shrink their profit margins, as consumers might no longer purchase new
devices annually if existing models remained functional for ten years.
You could turn this thought around. There is no information on the box nor in
the manual regarding (free) map updates, so you could expect nothing, no
updates at all. That they provided 5 years (2015 – 2020) of free map updates
is nice, but since it was never promised, we should not complain. The promise
was NO map updates, but you still got 5 years worth.
Navman Bike 1000 / Mio Cyclo 200
To start this post off here are some pictures of the device and a global
overview.
This is the unit with box:
Here is the Mio counterpart, mounted on a bike.
Both units are almost exactly the same except for housing colour and
background, software wise this article will work on both the Navman Bike 1000
and the Mio Cyclo 200.
Here is an excerpt from its introduction in 2015:
The Mio Cyclo 200 is an entry level bike navigation device with a 3.5-inch
color touchscreen and a very simple interface. It offers address
navigation, GPX track import, and a special “Surprise Me” feature that
creates random routes based on time or distance. It is loaded with
OpenStreetMap data for 23 Western European countries and includes
cycling-specific points of interest like repair shops and restaurants.It is waterproof, designed for outdoor use, and has a battery life of around
10 hours. There’s also a “Where am I” function to quickly check your
location. Mounting options include a handlebar mount, and a stem mount
(Garmin mount). Updates are handled via a desktop application. The device
focuses on basic navigation without training features, making it ideal for
leisure riders and e-bike users, with a price of EUR 179.99.
First Impressions
Mounting on the bike was very easy and the battery still holds charge up to 8
hours. It gets a GPS fix quite fast when you are outside. The software is
basic, but for its intended use case it’s fine. You can enter an address or
postal code and it will navigate to there using full colour maps. When you
need to do something, like take a turn, it beeps a few times. I could see
myself using this for longer bicycle trips or on holiday.
But! Problems start arising when it sends you along roads that no longer exist
or when you want to navigate to addresses that the device does not know
about. It’s showing its age and since you can no longer download new maps,
that will never be fixed.
The desktop software says there are maps available for download:
But when trying to download them, it fails:
A bit of searching around on the web does turn up a lot of info regarding
Garmin custom maps but nothing for Mio devices.
mitmproxy & WireShark
I was wondering what this application was doing so I set up mitmproxy and let it only monitor navman.exe.
mitmproxy is software that intercepts app network (https) requests and since
the navigation desktop software was from 2018, I didn’t suspect that it does
any certificate pinning. That means that it uses the system certificate store
and accepts the mitmproxy certificate. If it did certificate pinning,
mitmproxy wouldn’t work. But as I suspected, no pinning and I could snoop
in to the network traffic of the desktop software.
There were two requests that stood out.
Request 1 seems to be a software update check:
POST: http://update.mio-tech.com.tw/Dodge/IaaCheckUpdateServlet
8613
Prod
WIN32
000...B1
NAVMAN BIKE 1000
Response:
IMAGE
2017-08-31
33.03.0807
11700606
http://download.mio.com/MioCyclo/GPST/Agent/8613/R33.zip
http://service.navman.com/
APPLICATION
2018-02-02
5091
28599221
http://download.mio.com/MioCyclo/GPST/Agent/Application/App 5.0.9.1 only.zip
http://service.navman.com/M0100/FileReader_111306_UK%20Ireland%20NAVMAN_English%20Navman.html
Request two contains the map updates:
POST: http://update.mio-tech.com.tw/DodgeAgentMapUpdate/MiomoreMapUpdate.action
Response:
1909.02
129030470
2016-02-16 02:49:50.115686
WEU-BM-cyclo2
173
http://download.mio.com/MioCyclo/GPST/MapData_v3/Basemap/WEU_BaseMap_150602.zip
9fb4549793498cf1a1024ae825c7f88c
http://v5.test.mioshare.com/en/news/detail?newsid=44
1201.01
3018402
2015-06-12 10:04:51.191228
WEU-CountryID-V4
49
http://download.mio.com/MioCyclo/GPST/MapData_v3/CountryMap/WEU_Countries_23.zip
FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF
http://www.mioshare.com/news/detail?newsid=6
1910.02
1899741519
2016-02-16 02:48:57.010793
WEU-OSM-cyclo2
172
http://download.mio.com/MioCyclo/GPST/MapData_v3/OSM/WEU_OSM_150902.zip
1d349e6be7657d828c4d287b812522c5
http://v5.test.mioshare.com/en/news/detail?newsid=44
1909.02
1242676960
2016-02-16 02:49:31.575609
WEU-TA-cyclo2
171
http://download.mio.com/MioCyclo/GPST/MapData_v3/TA/WEU_TeleAtlas_150602.zip
512ba03cd982ed6b4cf80f9e85c23161
http://v5.test.mioshare.com/en/news/detail?newsid=44
You can see that the download URL’s are from Mio, not Navman, they’re made by
the same OEM. What’s up with the weird checksum? But sadly, all map urls
give a Not Found error. I’ve contacted Mio support but haven’t yet received a
response. If I ever get any I’ll update this post.
The software update download responses do work. App 5.0.9.1 only.zip
contains a program named dodge.exe.
I even tried to monitor the USB communication but I didn’t get very far with that:
Researching the firmware and DODGE.exe
The app only download included a program called dodge.exe. Uploading it to
VirusTotal told me that it was an ARMv4 Tumb application for Windows Mobile.
Binwalk said the same:
$ docker run -t -v "$PWD":/analysis refirmlabs/binwalk:branch-master -Me dodge.exe
/analysis/extractions/dodge.exe
------------------------------------------------------------------------------------------------------------------------
DECIMAL HEXADECIMAL DESCRIPTION
------------------------------------------------------------------------------------------------------------------------
0 0x0 Windows PE binary, machine type: Thumb
4066336 0x3E0C20 CRC32 polynomial table, little endian
4067375 0x3E102F Copyright text: "Copyright 1995-2002 Jean-loup
Gailly "
4070255 0x3E1B6F Copyright text: "Copyright 1995-2002 Mark Adler "
4186952 0x3FE348 CRC32 polynomial table, little endian
4193320 0x3FFC28 Copyright text: "Copyright (C) 1994-2008 Lua.org,
PUC-Rio $ $Authors: R. Ierusalimschy, L. H. de
Figueiredo & W. Cele"
4241612 0x40B8CC Copyright text: "Copyright 1998-2004 Gilles
Vollant - http://www.winimage.com/zLibDll"
4241698 0x40B922 Copyright text: "Copyright 1998-2004 Gilles
Vollant - http://www.winimage.com/zLibDll"
4298913 0x4198A1 Copyright text: "copyright_navman."
4298941 0x4198BD Copyright text: "copyright."
4298953 0x4198C9 Copyright text: "copyright.eng.txt"
4298972 0x4198DC Copyright text: "CopyrightText"
4298992 0x4198F0 Copyright text: "CopyrightText"
4521372 0x44FD9C Copyright text: "Copyright (C) 2009, Thomas G.
Lane, Guido Vollbeding"
4577656 0x45D978 CRC32 polynomial table, little endian
------------------------------------------------------------------------------------------------------------------------
The firmware update image included a large file named xip.bin:
$ docker run -t -v "$PWD":/analysis refirmlabs/binwalk:branch-master xip.bin
/analysis/xip.bin
------------------------------------------------------------------------------------------------------------------------
DECIMAL HEXADECIMAL DESCRIPTION
------------------------------------------------------------------------------------------------------------------------
0 0x0 Windows CE binary image, base address:
0x80420000, image size: 23814492 bytes, file
size: 19793959 bytes
------------------------------------------------------------------------------------------------------------------------
This seems to be the entire firmware image (with Windows CE). I used the
desktop program to flash this new firmware. The device showed a black screen
with a few lines of update information:
Afterwards it rebooted. Extracting this xip.bin image didn’t work with
binwalk, only a few picture (image) files were extracted and a file named
EBOOT.NB0 which binwalk identified as an AES S-BOX. I might pursue that
later with some help of the XDA Developers forum,
xip images seemed to be popular back in the Windows Mobile days. But I have
a way easier method, read on for that.
Replacing DODGE.exe
When connecting the device via USB to the PC, two new drives show up.
Nav_data and Nav_system. The first is where you can load .gpx tracks
and where routes are saved. The second seems to be the entire Windows CE
system partition!
Because the earlier app only download had a file named DODGE.exe I went
looking for that file. Found it in the, surprisingly named, DODGE\PROGRAM
folder. Renamed it to DODGE2.exe and put Total Commander for ARMv4 for
Windows CE
there as DODGE.exe and behold:
Using Total Commander I can browse the filesystem, there are lots of leftovers
and test programs. For example, here is Windows Explorer running on top of
the original DODGE.exe program:
The original Windows CE desktop:
A GPS Test program:
Calculating Pi, including a third party on screen keyboard since this ROM does
not ship with one:
This is way too much fun. I love me some Windows CE
as with the HP Jornada, trying out all kinds of Windows CE Applications,
games like DOOM and much more. But we’re here for the navigation part, I only
wanted up to date maps.
NAVeGIS
NAVeGIS is a Windows Mobile and
WinCE navigation application, last updated in March of 2025. NAVeGIS can use
the OpenStreetMap maps and in my case, the open Bicycle maps from
OpenFietsMap. NAVeGIS is provided under the
GNU GPLv3.
After downloading the OpenFietsMap map file and placing it on a Micro SD card
I selected the img file as map source in NAVeGIS.
You select a destination by either selecting it via the menu, or by dragging
the map to where you want to go and pressing the screen, then setting that as
destination. It saves a list of recent destinations.
Route hints are given by a big yellow arrow, the route itself is purple:
Here is a route it planned, about 25 KM,zoomed out a bit:
There is no way to record GPS tracks or to change the screen layout. It does
not support the beeper on this Mio device, so no audio hints as well. But,
the maps are updatable and the navigation itself is just as good as the Mio
application’s routing engine. It also supports Points of Interests (POI).
I find myself using the regular Mio (DODGE.exe) to record GPX tracks and for
navigation I’m using NAVeGIS. The Mio maps are so out of date that the
instructions more often than not are incorrect.
Without this piece of open source software I would probably have to throw this
device back in the bin (or the second-hand store). But with it, I have the
most recent up to date maps and navigation on a 10 year old Windows CE
device.
I hope current Mio or Garmin or comparable devices are this open to allow for
continued usage. Locked down devices, signed bootloaders and such shenanigans
are nice if you’re a manufacturer, but not if you’re and end user.
Conclusion
Thanks to open source software and a bit of reverse engineering, a 10 year old
GPS device is now fully functional. Proprietary abandonment was bypassed
entirely. With NAVeGIS, Total Commander, and OpenStreetMap, I have modern
mapping on legacy hardware. Obsolescence is a choice. Reverse engineering is
resistance.
For fun I installed Windows XP in a VM with Visual Studio 2008 and compiled
NAVeGIS myself. Git source and build instructions here
NAVeGIS compiled and running in the Windows CE emulator
Tags: binwalk
, blog
, c++
, cpp
, cycling
, development
, doom
, garmin
, historical
, mio
, mitac
, mitmproxy
, mobile
, navman
, openstreetmap
, pda
, planned-obsolescence
, pocket-pc
, windows-ce
, windows-mobile
, wireshark
