So now that I had a little more time I moved a little further into this (also a friendly forum member loaned me a release 5.1 DVD which happens to have a difference firmware). I’ve found that the “Program Block’s” within the hardware modules have a 32bit checksum as the last 4 bytes of each block. So if you patch changes you’d need to update the checksum to convince the NAV to accept them…
Now to try and find the section the factory override uses to open up full control!
foglem@sixcore:~/kiwi/U20 5.1/out$ md5sum *
Now that I know a little more what I’m looking for with the CRC of the program blocks but failing to find a checksum for the MIUT blocks I’ve googled around a bit more with actual strings from the unknown blocks and found some more reading material. Linking here: