A whole-file, reloc-confirmed name catalog — 1,573 distinct real names, 3 major new subsystems

Part of Firmware Reversing.

The method

Different from (and more direct than) the "field-4 code address" resolution this project has relied on elsewhere, which resolves a symbol/EH-descriptor table record's own described code address (limited to the verified <9MB range, and independently shown to need content verification before trusting). This method instead asks: what real, compiled code directly references each table record's address? — i.e. who actually uses each piece of type/EH metadata, regardless of where that metadata's own "owner" function lives.

Concretely, scanned the entire 24,000,000-byte native code region of FHDD6.FLI for the standard PowerPC absolute-address-formation idiom: lis rX, HI16 (opcode 15, no base register) immediately followed (within 10 instructions) by addi rX, rX, LO16 targeting the same register — reconstructing the real absolute VA the compiler embedded, exactly the same lis/addi technique already used (one call site at a time) throughout this wiki, just applied exhaustively.

• 121,056 real lis rX,HI16 instructions found
• 34,736 of them paired with a matching addi within 10 instructions
• Built the full 26,320-record descriptor table directly from FHDD6.FLI's own bytes (using this project's own research/swl_5238_reader.py marker-scan logic: \x00\x10\x05 marker + NUL-terminated name), independent of the 9MB code-address limit — this check only needs a record's own byte range, not its resolved code address
• Checked whether each reconstructed VA falls inside any record's byte range: 1,573 distinct record names hit, several independently referenced from many different call sites (one name has 25 separate referencing addresses)

This is a floor, not a ceiling — the scan only catches the same-register lis/addi idiom; PowerPC EABI code can also reference globals via r2/r13-relative (TOC/SDA) addressing, which this pass doesn't attempt. The real reference count is certainly higher. The full 1,573-entry hit list (name, reference count, example caller addresses) is archived at references/reloc_confirmed_names_1573.txt in this wiki's own repo for future mining.

Known caveat: a handful of names have a stray trailing non-ASCII byte (a parser edge case in how swl_5238_reader.py's simple NUL-terminator scan occasionally over-reads by one byte at a record boundary) — e.g. __37ê, vp_dump_poss__FP10VpDumpSink¸. The bulk of each name is still real and legible; just don't trust the very last character of names that look truncated/odd.

Three major, previously entirely undocumented real subsystems

1. SDARS satellite radio data services (SDARSVWDATASV namespace)

Correction: not a new subsystem discovery — this is the compiled CODE side of an already-fully-documented real subsystem. Sirius TravelLink and the North America Discs already cracked the real Sirius TravelLink SQLite database (SIRIUS.DB3) from a real NAR disc, and already directly proved the shared-codebase-across-markets model — "Sirius"/"SDARS" debug strings were found in the EU build too, gated at runtime by a SetCoding byte-7 enum, not a separate per-market binary. What's new here is the actual compiled class/method names implementing that already-known schema, which map onto it almost one-to-one: SportsScoresPersistData/SportsScoresPresentH2HEntity ↔ that page's Sports/Teams/HeadToHeadSportTable; FuelPricesPersistData ↔ FuelPrice/FuelBrand/FuelRegions; GraphicalWeatherPersistData/ MDCacheWeatherShapes (section 3 below) ↔ WeatherMessages/ StormAttributes/SkiMessages; ChannelArtPersistData ↔ the real CHARTS/ChannelArtsCache/ image cache that page fully decoded. SDARS is the real automotive-industry term for satellite digital audio radio (XM/Sirius). Real, confirmed sub-features found on the code side:

• Sports scores: SportsScoresPersistData, create_SportsScoresPresentH2HEntity / create_SportsScoresPastH2HEntity (H2H = head-to-head game data), UpdateTeamGrouping, storeHeadlines — real-time sports score delivery over satellite radio's data channel, a genuine period-correct XM/Sirius premium feature.
• Song tagging: Sdars_DataServices_StorePSIs, Sdars_GetSongTaggingProduct, CfcEdbSongTaggingServiceInterfaceFuture — the real XM/Sirius "tag a song" (for later iTunes purchase) feature.
• Fuel prices: FuelPricesPersistData — real-time fuel-price data delivered via satellite, another genuine period SDARS data service.
• Channel art: ChannelArtPersistData, deleteImages.
• AUDecoder (Audio Unit Decoder) and AbstractPersistData as a shared base class across the above.

2. Real-time TMC traffic processing (MDCacheTI* family)

Related existing work: eeu.tmc already cracked the on-disc TMC file format itself (header, 44-table directory, per-location byte-offset index) and already found real firmware-side accessor names (db_tmc_all_headers_V003, db_tmc_seg_V003) for reading it — a different, lower layer (the raw on-disc data reader) than the MDCacheTI* family below, which looks like the in-memory spatial cache/rendering layer that consumes parsed TMC data once loaded, not the file-format reader itself. Likely adjacent/connected pieces of the same overall pipeline, not independently confirmed to be directly connected.

An entire, previously undocumented (at this layer — see above) traffic-information pipeline: spatial R-tree caching (MDCacheTIRTree/MDCacheTIRTreeNode, MDCacheTIIconRTree), simplification ("thinout") machines (MDCacheTIThinoutMachine, MDCacheTIThinoutMachineJamNative, thinoutRecursive), jam detection (MDCacheTIJam, createNodeRecursive), a message/worker pipeline (MDCacheTIMessage, MDCacheFlowMultiUpdateMessage, CFlowTmcWorker, ExecuteTmcWithNLocations), and real genuine RDS-TMC (Traffic Message Channel) data structures — tmcExpandExtentIn_t, tmcMsgData_t, tmcExpandExtentOut_t — confirming this firmware implements the real, industry-standard RDS-TMC traffic protocol, not just a proprietary equivalent. Also: a full traffic-assessment/ rendering layer (TrafficAssessmentManagerImpl, CfcTrafficassessmentTrafficAssessmentResultFuture, MapLoaderJobTrafficView, MDRenderCacheTrafficView, CfcAspectTrafficSituationChangedEvent, CfcTypeMapTrafficInformation).

3. Satellite weather radar overlay (MDCacheWeatherShapes, MDSiriusDatabase)

Storm tracking and rendering: RetrieveStormPositionFeatures, StormFeatureVector/StormFeatureDescriptor, drawStorms, CloneStormTrackLineData, MDFeatureWeatherSurfaceStormTrack, ParcelReplicator, WeatherShapesParcelMatrix, StormPositionDetailsReceiver. Explicitly backed by a class literally named MDSiriusDatabase (addWeatherPartition, setupWeatherPartitionVisibility) — directly confirming this weather overlay is SDARS/Sirius-delivered, not a separate system. Also: getWeatherIssueDateTime, MapLoaderJobWeatherPOI, BuildWeatherAU, WeatherSkiUpdateProcessedBuffer.

Other confirmed real findings

• Extensive, definitive SQLite confirmation: sqlite3_open, sqlite3_exec, sqlite3_overload_function, sqlite3_stmt_status, sqlite3_value_bytes16, CSqliteStatementWrapper, create_sqlite_statement — this firmware embeds and extensively uses a real SQLite engine (first suspected from a single sqlite3_version hit on registerBlocking, now confirmed at scale).
• Real zlib usage: inflateBackEnd — ties directly to the "MAP_COMPRESSED segment" already noted in research/swl_5238_reader.py's own docstring.
• Satellite/aerial imagery caching: CfcTypeMapSatelliteImagesCacheUsage, CfcMapMapSatelliteImagesCacheUsageFuture, getSatelliteImagesServerAddressF, isSatelliteImagesShown__15CfcMapViewProxy — confirms a real satellite-photo map-view feature (ties to CfcMapViewProxy, already found this session via its RTTI name string).
• A real German-language internal identifier: PSD_Ges_Geschwindigkeit_Gespann__C12PSD_Database ("total speed, trailer/combination" in German) — ties to the already-documented PSD (Posted Speed Display) ADAS subsystem, and is a nice, human confirmation of this codebase's real Volkswagen/German origin.
• The Vp class family grows again: vp_dump_poss__FP10VpDumpSink joins VpTurtle and VpSimEventSetPosition as a third confirmed Vp-prefixed class/function.
• Map rendering/customization: MapRectangleZoom/ MapRectangleZoomProperties, MapRenderCustSymbol, setupAlphaTable__C11MapRenderer.
• Guidance/maneuver ties: GuidanceManagerImpl::sendSoftWaypointManeuver, MapFlyRouteAccess::rematch_newRoutePath (a real "fly-to route" rematch feature).

Further mining: clustering all 1,573 names by class/namespace

The 3 subsystems above were found by keyword-searching a sample of the highest-reference-count hits. A systematic follow-up — grouping ALL 1,573 names by their most prominent length-prefixed class/namespace token — found 766 distinct classes/namespaces, many independently confirmed by several different method names, not just the 3 big subsystems above. Top 80 archived at references/class_cluster_summary_top80.txt. Highlights:

• EHTreeNode (6 refs) — independently confirms the real class name this wiki had only inferred from context on the struct-layout page (a real constructor, EHTreeNode::EHTreeNode(unsigned long, unsigned long, vseg*, long), and GetFirstSegment()). Seeing the sibling class EHDatagramGraph (SetSlope, IsLeftHand) right next to it clarifies that "EH" here means Electronic Horizon, not exception handling — an unfortunate naming coincidence with this wiki's own unrelated .frame_info/EH discussion elsewhere; don't conflate them.
• Adas_Most_Dispatcher (Send, SetFBlockAvailable, DispMqStruct) — confirms the ADAS subsystem communicates over a genuine MOST bus (Media Oriented Systems Transport), upgrading the already-existing speculation on 0x78834c from a guess to a reloc-confirmed fact.
• CfcXmlExpatParser (ProcessingInstructionHandler, StartElementHandler) — these are the real, standard callback names from the open-source Expat XML parser library, confirming this firmware embeds it.
• edal18PredStDebuggerImpl (variableToString, CVariableStorage, scriptlet_type) — reveals the edal ("embedded data access layer") namespace, already suspected from SQL-adjacent call sites elsewhere on this wiki, is a real embedded scripting/predefined-statement engine with its own debugger, not just a thin SQL wrapper.
• LanguageTable (AddInstruction, NodeVoiceToken, AddRangesSFeet) and CfcPhonemeDataRetrieverProxy (getIntersectionRecords, phoneme data) — real voice-guidance/TTS subsystem internals.
• PSD_Database (PSD_Ges_Geschwindigkeit_Gespann, PSD_wahrscheinlichster_Pfad — German for "most probable path") — ties the already-documented PSD (Posted Speed Display) subsystem to real path-prediction logic, and is another human German-language confirmation of this codebase's VW origin.
• MapAPI (TestVehicleMove, NextMapPosition) — a real, directly named test/simulation API for moving the simulated vehicle position on the map, plausibly used for QA/demo modes.
• DestinationInputSession (getPossibleCharacters, getListOfPossibilities) — real destination-entry (address search) UI session backend.
• MapGraphicsUGL — ties to UGL (Universal Graphics Library), a real embedded graphics library.
• StubSegs (filter_stubs, taking a vehicle_location) — plausibly directly related to filterToggleSeg, already traced elsewhere on this wiki as a real record-copy/filter operation — worth checking for a direct connection in a future session.

Net read

A single systematic pass — exhaustively applying this wiki's own already-validated lis/addi reloc-confirmation technique across the whole file instead of one call site at a time — surfaced three entire previously-undocumented real subsystems (satellite radio data services, RDS-TMC traffic processing, satellite weather radar) in one session, plus extensive corroboration of already-suspected facts (SQLite, zlib). The underlying 1,573-name catalog is archived in this wiki's repo for future sessions to keep mining, since the scan is known to be a floor (same-register lis/addi only) rather than a complete accounting.