This wiki documents the on-disc file formats of CD_8555.ISO, a genuine VW navigation map disc ("EU East V17", Navteq database EEU, part number 1T0051859AR). All findings here come from direct, byte-level reverse engineering against the real disc — every claim in these pages is backed by a concrete, reproducible check (exact-coordinate matches against real cities/roads, cross-file validation, large-sample statistics), not guesswork. See the main README for the full, detailed research log this wiki summarizes, and research/*.py / rns510_map_viewer.py for the reusable reader code.

Mostly not covered here: the separate firmware/application image (FHDD6.FLI, from the factory Software-Loading CD, VwSwIndex 5238) — that's a different product on this platform (application software, not map data) and has its own section in the README (§2). Exceptions: real PowerPC disassembly/reverse-engineering of that firmware — a load base recovered, a real symbol table found, and several functions fully traced — is documented on Firmware Reversing; everything AROUND that firmware — the real boot chain (bootloader -> BLSCRIPT.CFG -> SWL.FLI -> DLSCRIPT.TXT -> FHDD6.FLI), the factory build-configuration system, and the separate HOST processor's own VxWorks BSP and real vehicle-coding diagnostic protocol — is on SWL Disc: Boot Chain and Build System and HOST BSP and Vehicle Coding.

Every logical file lives under db/ as eeu.<ext> (uncompressed) or eeuz.<ext> (compressed, note the z), all for the East Europe (eeu) dataset. The disc's own files.cfg (plain text, disc root) documents 39 logical file types (numFileIds = 39, each with its own one-line comment — not all 39 are actually populated on this specific disc, see Phoneme Cluster List) and 4 compression types:

Code	Name	What it means
0	NOT_COMPRESSED	Raw fixed/variable-length records, straight after a 94-byte SIEMENS/(C) SIEMENS AG header
1	FLAT_COMPRESSED	A block-based zlib container (own header, offset table, sequential zlib blocks) — see FLAT COMPRESSED Container Format
2	MAP_COMPRESSED	A tile-based zlib container (own header, directory, back-to-back independent zlib streams) — see MAP COMPRESSED Container Format
3	FEATURE_COMPRESSED	Same directory-then-zlib-streams shape as MAP_COMPRESSED but a different, still partly unresolved directory encoding — only eeuz.fea uses this

The underlying disc itself is a UDF+ISO9660 "bridge" image with a broken (vestigial) UDF layer — see ISO Container Handling.

The disc root also has 5 subsystems outside db/ — config/, tpd/, EDB/, telemat/, speech/, dbal/ — revealed by the disc's own build script, config/create_cd. All 1,535 files on the disc are now examined and documented — EDB/POI/POI.DB3 (a real 4.7M-row SQLite POI database) and speech//dbal/ are cracked at the identity/metadata level (SVOX TTS engine, VxWorks RTOS, ~330 real internal source file names extracted from dbal/'s own ELF binaries); telemat/tmc2/ and tpd/ (1,443 files, the largest area — a real embedded HTML destination-search UI) are cracked at the config/system level, with a handful of proprietary binary formats (voice models, TMC location tables, compressed search-index bodies) identified but not byte-level decoded — see config/create_cd and the Disc-Root Subsystems.

Symbol	Meaning
✅	Cracked — byte layout understood and validated against real, independently-verifiable data (exact coordinate/name matches, not just "looks plausible")
🟡	Partially cracked — most of the structure is understood and validated, but specific fields or edge cases remain open
🟠	Container cracked, content not analyzed — we can losslessly decompress/parse the container, but haven't reverse-engineered what's inside
⚪	Not examined — no reverse-engineering attempted yet this project

Sizes are from the reference disc's extracted db/ folder.

File	Size	Type	Status	Summary
eeu.rd	590 MB	NOT_COMPRESSED	✅	Road/routing graph — 67-byte records, coordinates + name. Fully cracked (a still later session): every header byte now accounted for — cityID/countryID/prefixID/suffixID/typeID/roadInfo (highway/preferred/explicate/ramp/name-type/interchange), via real DBAL.OUT disassembly + a newly-cracked eeu.mod binary field-descriptor format, validated against real data (geographic clustering, route-name correlation, eeu.typ's own entry count). Details
eeu.il	39 MB	NOT_COMPRESSED	✅	Name/intersection index into eeu.rd. Details
eeu.iof	52.8 MB	NOT_COMPRESSED	🟡	Parallel per-road array to eeu.rd; a "nearby street names" pointer into eeu.il is cracked for 0.36% of records. Which records get one is now substantially narrowed — route-numbered-road names are 7.5x enriched among these anchors at full file scale, though not a clean 1:1 rule. Real firmware disassembly (DBAL.OUT, a still later session) confirmed the real struct IOF_Record and cracked type's real meaning (a validity + cache-resolution-state flag, not a simple classifier). The common-case count field for the 99.64% non-anchor majority still correlates only weakly with eeu.il's own per-road reference count. Details
eeu.typ	105 KB	NOT_COMPRESSED	✅	Localized street-type word dictionary (VIA, RRUGA, SOKAK, ...). Details
eeuz.rt	62.1 MB	FLAT_COMPRESSED	✅	Road-name character-trie (search/autocomplete). Details
eeuz.rl	203 MB	FLAT_COMPRESSED	✅	Road-name-search "pointer" records, → eeu.rd + eeuz.prl. Details
eeuz.prl	248 MB	FLAT_COMPRESSED	✅	Road-name-search string catalog (not deduplicated, sort-key rewritten). Details
eeuz.prd	279 MB	FLAT_COMPRESSED	✅	Phonetic pronunciation catalog for road names (TTS voice guidance) — record format, eeu.rd linkage, and a real minNumber/maxNumber house-number address range all cracked and validated at full file scale (11.96M records, zero exceptions). Details
eeu.si	195 KB	NOT_COMPRESSED	✅	Segment classification table ("seginfo") — fixed 8-byte records, 24,353 of them. All 20 real leaf fields positioned in exact schema order; the final 11 single-bit flags rest on position + schema-order match (2 of them additionally corroborated by a joint-exclusivity signature). Details
eeu.tmc	25.8 MB	NOT_COMPRESSED	🟡	TMC/ALERT-C traffic-data file — the file header, 44-table directory, AND the complete per-location byte-offset index (100% of the file's own addressing structure, every table's location_offset_table_p/_n arrays) cracked and validated at full scale, zero exceptions. Only the deepest leaf chain records' own content remains undecoded. Details

File	Size	Type	Status	Summary
eeu.ctr	1.6 KB	NOT_COMPRESSED	✅	Country table — 35 records, ISO 3166 codes. Details
eeu.cty	74.2 MB	NOT_COMPRESSED	✅	City/town/locality catalog — name + bounding box + representative point. Details
eeuz.cl	75.8 MB	FLAT_COMPRESSED	✅	City-name search records, → eeu.cty. Details
eeuz.ct	5 MB	FLAT_COMPRESSED	✅	City-name character-trie, same node format as eeuz.rt. Details

File	Size	Type	Status	Summary
eeuz.mp0	2.14 GB	MAP_COMPRESSED	✅	Most-detailed street-level rendering tiles. Details
eeuz.mg1	240 MB	MAP_COMPRESSED	✅	Generalized tiles, 1 level up from mp0. Details
eeuz.mg2	113 MB	MAP_COMPRESSED	✅	Generalized tiles, 2 levels up. Details
eeuz.mg3	46 MB	MAP_COMPRESSED	✅	Generalized tiles, 3 levels up. Details
eeuz.mg4	16.5 MB	MAP_COMPRESSED	✅	Most-generalized (lowest zoom) tiles. Details
eeuz.fea	553 MB	FEATURE_COMPRESSED	🟡	Multi-language gazetteer (cities/seas/islands/route shields) — not road geometry. What each entry contains is cracked, and so is the directory format (a big-endian offset/length index, 4 of its tables located and validated). Real DBAL.OUT disassembly (a still later session) fully cracked the relative point-geometry delta-chain format, and found strong direct evidence the absolute anchor is supplied externally, not stored in this file at all — see its own page for why that may not be resolvable by further firmware disassembly. Details

File	Size	Type	Status	Summary
eeuz.pca	2.9 KB	FLAT_COMPRESSED	🟡	Phoneme catalog for country/continent names (EUROPE, AUSTRIA, ...) — record framing cracked and validated at full file scale (188 records); clusterOffset/clusterCount confirmed always-zero (matches eeu.pcl empty); cityOffset/cityCount's target file not identified. Details
eeuz.pct	15.7 MB	FLAT_COMPRESSED	✅	Phonetic pronunciation catalog for CITY names (major places, multi-language) — record format cracked and validated at full file scale (649,956 records); the trailing field is a phonemeRoadOffset/phonemeRoadCount pointer into eeuz.prd, naming that city's own road phonetics. Details
eeu.abc	897 B	NOT_COMPRESSED	✅	"Alphabet" — the 125-character uppercase glyph repertoire used across every supported language, plus an 86-record table of 52 supported languages, each tagged with 1-3 of exactly 3 fixed flag-pairs (meaning not fully confirmed). Details
eeu.aff	138 B	NOT_COMPRESSED	✅	"Affix" table — structurally fully cracked (1 record of 44 bytes), but that one record is all zero on this disc; plausibly a Hunspell-style affix-stripping rule set this dataset simply doesn't need. Details
eeu.cal	22.8 KB	NOT_COMPRESSED	✅	Multi-language country/continent name catalog — 484 records, every field explained and validated exhaustively (all 35 groups, not sampled). Details
eeu.cat	759 B	NOT_COMPRESSED	✅	Per-country (+ Europe) real-world bounding-box table, same country numbering as eeu.cal — validated directly against real geography (Germany/Austria/Switzerland/Italy near-exact, 3 microstates correctly tiny). One unresolved anomaly (Denmark's western edge). Details
eeu.cny	400 KB	NOT_COMPRESSED	✅	County catalog — real sub-national divisions (Italian provinces, Swiss canton districts, Greek prefectures), a level between eeu.cal's countries and eeu.cty's cities. stateID validated against real geography AND directly against eeu.stt's own content; timeinfoID confirmed directly against eeu.ti's own content. Details
eeu.mod	40 KB	NOT_COMPRESSED	✅	The disc's own database schema dictionary — names and orders every one of the 36 real tables/files on the disc, authored by tool Arriba 5.3. The single most valuable file examined this project; resolved several previously-open mysteries in other files. Details
eeu.stt	79 KB	NOT_COMPRESSED	✅	State/region catalog — the real table eeu.cny's state_id refers to, confirmed by full set equality (691 records both files). country_id is a real FK into eeu.ctr's own row order — a 3rd distinct country-numbering scheme found on this disc. Details
eeu.ti	485 B	NOT_COMPRESSED	✅	Time-info/DST rule table — timezone field cracked and confirmed against real-world geography (Russia's own 11 real time zones, exact); timeinfo_id=1/3 confirmed as the disc's real CET/EET DST zones by joining eeu.cny→eeu.stt→eeu.ctr. A few sub-fields' exact hour/day semantics remain unconfirmed. Details
eeu.pcl	94 B (header only, no body)	NOT_COMPRESSED	✅	"Phoneme cluster list" per the disc's own files.cfg (id 27) — genuinely empty on this disc; no eeu.mod schema block exists for it, so its identity came from files.cfg directly, not byte-level reversing. Details
eeu.pmc / eeu.pmm	16.3 MB each	NOT_COMPRESSED	✅	"Postal-code merge city"/"merge separator" tables — fixed 4-byte records, real count 4,084,104. Content is a perfect identity function on this disc (value == index, no exceptions) and the two files are byte-identical — confirms the whole postal-code subsystem (.pol/.pot/.pmm/.pmc/.pmp) is unpopulated. Details
eeu.pol / eeu.pot / eeu.pmp	94 B each (header only, no body)	NOT_COMPRESSED	✅	Postal-code list/tree/merge files — genuinely empty on this disc; eeu.mod's schema reconstructs the intended design (.pot = same character-trie template as eeuz.rt/.ct; .pol = postalcode+lat/lon+list-index record; .pmp = the third "merge" sibling of .pmc/.pmm). Details

Every one of these shares the identical 94-byte SIEMENS/(C) SIEMENS AG NOT_COMPRESSED header already cracked for eeu.rd/.il/.iof/.typ/ .ctr/.cty — so the container is a known quantity, and since 3 more fields in that shared header were cracked (record count, most files' total size), a candidate fixed record SIZE is now derivable for several of these without touching their actual content — see Unexamined Files for the full byte-level first look and those derived candidates, to give a future session a head start. (eeu.cal, eeu.cat, and eeu.cny, previously listed here with derived record-size candidates of 48, 19, and 176 bytes, are now cracked — Country Names, Country Bounding Boxes, and County Catalog — all three candidates were exactly right. eeu.mod, also previously listed here, turned out to be the disc's own schema dictionary, not a data file at all — see Database Schema; its own discovery gives every remaining file below a known, schema-declared field layout even though their bytes haven't been opened yet, noted per-file below. eeu.pcl, the one schema-declared file token with no eeu.mod block at all, is also now cracked — its real name and purpose came from the disc's own files.cfg instead, see Phoneme Cluster List. eeu.pmc/eeu.pmm, whose derived record size looked "not clean" here, are now cracked too — the real wraparound multiple was just larger than tried, see Postal-Code Merge Tables. eeu.pmp/eeu.pol/eeu.pot, previously listed here as confirmed-empty placeholders, are also now cracked (identified) in the same sense as eeu.pcl — eeu.mod's schema reconstructs their intended design even though there's no content to open — see Postal-Code Files (Empty). eeu.si, whose derived 8-byte record size was already exact here, is now fully cracked — all 20 real leaf fields positioned in exact schema order — and the "likely lead for eeu.rd's bytes[1:5]" noted below turned out not to hold up — see Segment Classification Table. eeu.stt, the real "region/canton" table eeu.cny's own stateID refers to, is also now cracked — see State/Region Catalog, which closes the loop this page's own eeu.cny entry left open. eeu.ti, the real "timeinfo" table eeu.cny's own timeinfoID refers to, is also now partially cracked — see Time-Info / DST Rule Table. eeu.tmc, the last file still listed here, is also now partially cracked — its file header + 44-table directory decoded using ground truth found via config/create_cd — see TMC Traffic-Data File, now listed in the Road network table above. zone.cfg (81 B, plain text, not a files.cfg data file, so it never belonged in the table below) has also been opened and identified — see Disc-Root Subsystems. With these two, every file on the whole disc has now been examined at least once — see Unexamined Files for the full historical record.)

• config/create_cd and the Disc-Root Subsystems — the disc's own build script; every one of the 1,535 files on the disc examined, including a real 4.7M-row POI database, the SVOX TTS engine, VxWorks RTOS, and ~330 real internal source file names
• eeu.mod — Database Schema Dictionary — the disc's own full table/field list, cross-cutting corrections to many other files
• eeu.pcl — Phoneme Cluster List — identified via the disc's own files.cfg, not eeu.mod; genuinely empty on this disc
• eeu.pmc/eeu.pmm — Postal-Code Merge Tables — fixed 4-byte records, provably a placeholder identity array on this disc
• eeu.pol/eeu.pot/eeu.pmp — Postal-Code Files (Empty) — genuinely empty, but eeu.mod's schema reconstructs the intended design
• eeu.si — Segment Classification Table — all 20 real fields cracked (rank/class/divided/paved plus 11 more single-bit flags); corrects a previous eeu.rd cross-reference lead
• eeu.stt — State/Region Catalog — the real "state" table eeu.cny's state_id points into, confirmed by full set equality
• eeu.ti — Time-Info / DST Rule Table — a real DST/UTC-offset table, confirmed by joining every county to its real country and checking against Russia's actual 11 time zones
• eeuz.pca — Country/Continent Phoneme Catalog — record framing cracked at full scale; cityOffset/cityCount's target file still unresolved
• Tile Geometry and Topology — how a rendered road polyline and its point-to-point connectivity graph are decoded from a tile
• Road Naming Join — attaching real eeu.rd names to decoded tile geometry
• Header Trailer Fields — 3 more cracked fields shared by every NOT_COMPRESSED file's header (record count, total size)
• ISO Container Handling — reading/writing the disc image itself
• Map Viewer Tool — the visualization/debugging GUI built on top of all of the above
• Road Editor Tool — the actual editing tool that writes real changes back into a real ISO, and exactly what's solid vs. experimental about it
• Firmware Reversing — the head unit's own PowerPC/VxWorks application (FHDD6.FLI), not the map disc: a recovered load base, a real symbol table, and 3 functions fully disassembled and understood
• DBAL.OUT Full Decompilation and research/dbal.py — a local Ghidra install decompiled all 1,915 real functions in DBAL.OUT; definitively confirms the generic field-reader is external to the file; research/dbal.py ports the parts that ARE resolvable and is now wired into rns510_core.py/road_naming.py
• SWL Disc: Boot Chain and Build System — the factory flashing process, the real testmode/speed-lockout "unlock" pattern (confirmed 8 times across independent disc pairs), and a leaked internal engineering artifact in the oldest disc in the collection
• HOST BSP and Vehicle Coding — the separate HOST processor's VxWorks BSP, the real SetCoding/SetRegData vehicle-coding protocol (fully disassembled), the real BAP wire protocol (recovered from working community source), and the gateway routing-table format (vendor identified: K2L GmbH)
• Theft Protection, the CAN Gateway, and TpPvVerifyPin — a real ST10/C166 disassembler, a byte-level-confirmed EEPROM anti-theft state machine, the real vehicle-ClusterID pairing design, and TpPvVerifyPin confirmed live over a real serial console
• RNS510 Serial Console: Command Reference — every real command confirmed understood by the unit's own VxWorks shell over its serial debug port, consolidated into one scannable reference
• Sirius TravelLink and North America Discs — the first real NAR-market SWL discs, a complete SIRIUS.DB3/.DDB channel-art format crack (the map viewer's own Sirius POI layer uses this), and a real IBOC/HD-Radio negative result