> The system had DRM checks which rejected SD cards without the correct CID (a unique ID burned into the card) and files with signatures based on that specific CID, so I couldn't even copy the files to a blank SD card.

FWIW, there are grey market sites that will sell you an SD burned with a custom CID so you can clone an SD card with this kind of copy protection. It sounds like in this case maybe he could've gotten away with an empty maps card + menu definitions file.

There is code execution exploit in Samsung SD/eMMC firmware which, among other things, will allow changing the CID