NefMoto

Dear Members,

I have boot read with K-tag S3 8L  018BJ box it dumped .MPC(ROM), .FLS(Flash Content),EEP(95040 eeprom).
After I have created IDA Project and mapped MPC to address 0x0000.
The code in the ROM is as follows:

ROM:00006470 RESET_handler:                          ; CODE XREF: ROM:RESET↑J
ROM:00006470                                         ; seg010:j_RESET_handler↓J
ROM:00006470                 mov     CP, #0F740h
ROM:00006474                 mov     BUSCON0, #4ADh
ROM:00006478                 jnb     ROMEN, loc_6482
ROM:0000647C                 mov     SYSCON, #1110011000000100b
ROM:00006480                 jmpr    cc_UC, loc_6486
ROM:00006482 ; ---------------------------------------------------------------------------
ROM:00006482
ROM:00006482 loc_6482:                               ; CODE XREF: RESET_handler+8↑j
ROM:00006482                 mov     SYSCON, #1110001000000100b
ROM:00006486
ROM:00006486 loc_6486:                               ; CODE XREF: RESET_handler+10↑j
........

It looks like if SYSCON ROMEN bit is enabled the ECU is booting from the internal ROM(MPC in My case) if ROMEN bit is not set than the CPU boots from external Flash(FLS) so I have to map the first 32k from flash to 0x0000 address.

My question is what is usually the ROMEN bit status for ME7.5?
Should I map the internal ROM dump to 0x0000 or first 32k of external Flash to address 0x0000.

Thank you in Advance,

Depends of board HW release.
RTFM.
ROMEN bit is set according to pin EA state during reset

Thank you for fast reply. This is a standard s3 8L me7.5 my 2001. 225 ph.
Could you please tell how I can find the HW release information?

Regards,

I didn't knew what RTFM means. :) Now I know.
IHRFM! ;)
I'm asking because it's not Clear in The FM.

Open ecu and check mcu pin 99 connection.
If connect to Vcc than ROMEN=1, else ROMEN=0