NefMoto

Technical => Reverse Engineering => Topic started by: flamy on January 03, 2022, 12:42:46 PM



Title: ME7 - Section of Flash ROM mirrored in RAM
Post by: flamy on January 03, 2022, 12:42:46 PM
Hi,

I recently pulled a full dump from the RAM (0x380000-0x38FFFF) of my 8D0907551K (RS4).
While analyzing the data, I recognized a bigger block at the address window 0x385000-0x3874FF (9242 Bytes)
Comparing a part of this block with the binary, I could identify this block as a section of the Flash ROM (0x80ADE6-0x80D2E6).

One weird thing is, that the block starts in the middle of a 4 byte instruction:
Code:
0x80ADE4: 64 F2 74 E0 [and word_E074, r2]

Anyway, is anybody able to explain the reason why this section of program code is mirrored from Flash ROM to RAM?


Title: Re: ME7 - Section of Flash ROM mirrored in RAM
Post by: prj on January 04, 2022, 02:04:01 AM
Probably RSA computation related. Read it multiple times in a row and it will most likely change.