I beg your pardon, this is old stuff, I have no more documentation and I forgive a bit the exact clockwork. The reverse engineering has to begin from the CL named MEPMNU, and one master key is the dataarea MEPINF (Cf the description in RTVMEPINF).