Bosch ME7 IDA Plugin

This was written by Andy Whittaker to help with initial disassembly setup when dealing with the ME7.

Could be a version mismatch between the plugin and IDA.

It's for M7.1 and M7.5, the guy who wrote the plugin also made a video tutorial with the basics to use it

http://www.andywhittaker.com/ECU/DisassemblingaBoschME755/tabid/96/language/en-GB/Default.aspx

BTW: what happened to Andy? Long time he did not update his website! Is he already being hired by CMD etc. and had to sign a NDA?

Hello all - here goes my first post. As a quick intro I have been into reverse engineering uC firmwares for a few years, usually with a plan to add new functions rather than alter some data.  My daily drive is stage 3 S4, d box.

Returning to the topic at hand I agree with the DPP settings noted above.

Andy's plugin is unfinished, and there are only a few functions labelled.  Some are correct, many are not.  In particular Andy started calling various routines LookupA, through LookupZ and beyond.  Then he tried to isolate what each Lookup did, here was a mistake.

ME7x uses the Lookup routines by data structure, not by motronic function.  Ie there is a Lookup which reads 8byte signed integers, with independent external axes.  It is not LookupIgnition for example as Andy hints.  

I have reversed his plugin    It is a dead end, fortunately it only took a few minutes to figure out what it was doing and how it was doing it.


All in all, the excitement of the old plugin should fade quickly.  

Now, where you load the binary.  It is interesting as motronic is broken in to three areas by design. The ERCOS real time OS, a library area, and a user code area.  What people upload on to the internet is usually the library and user area, starting at 0x800000 code , 0x810000 data and 0x820000 code.  ERCOS resides much lower.

When you load ERCOS into the CPU internal rom you can see all those calls suchas calls 0, 754e etc line up perfectly.  ERCOS *seems* byte compatible across the family.  You can also see how the interrupts are routed through a gateway, some are handled by ERCOS, some are passed to routines in higher memory.


I have been trying to automate some of the donkey work with the reverse engineering.  I have created some code which creates output like



With it if you give me an address of some ME7 data and a binary, I can more than likely locate it in another binary if it exists.

Spen    

The code seeks the entry point to any address I specify, as there are finite ways ME7 does that. Once I have that I can build a fingerprint for the function which I can locate in other ME7 roms.

Once my program finds the fingerprint it locates the register which is loaded with the target address and converts it to an absolute address.  The program counter, the DPR, the page offset and data absolute address are then thrown in to a data grid.  The code also notes if there are any bytes of axes in front of the data, as some structures contain internal axes.

To be honest how I handle the axes needs to change, it's not accurate enough.

Once I have that data grid I can export to csv, text, ida idc script and I am 90% through to xdf.  On the agenda are damos, maybe mappack.

In short I want to be able to regenerate a damos for any ME7 binary automatically.  I'm not looking at pure rom addresses, I really want to understand the structures in ram also.

Wow, great work.

Have you posted these apps up yet? or are they private?

i'm planning to release all my work on here.