Pages: [1]
Author Topic: error_flags setting workaround  (Read 4263 times)
fknbrkn
Hero Member
*****

Karma: +186/-24
Offline Offline

Posts: 1455


mk4 1.8T AUM


« on: November 15, 2016, 02:27:18 PM »

hi
there is a little guide how to find a routine which activated error flags.
for example we interested in e_dk flag.

1. find e_dk in the ecu file (0x383952 in my case)
same in IDA. you can see there is a few xrefs for reading this ram value but no one for a write. and there is a problem.

2. go upward to the first defined word, the undefined word above is start of the table.
this word used in dtc_set routine as the base for offset.
0x383920 in my file (= 0xB920

3. there is some math to find a routine where is the error_flag is set
in our case with e_dk it is
383952h-383920h = 32h
divide it by 2 (32h/2 = 19h)

4. now search for #19h in IDA
multiple results can be found ofcourse.
we interested only in this

               mov r12, #19h

go there and if your code looks like this

                mov     [-r0], r4
                mov     r12, #19h
                calls   84h, sub_12345

than its yours.

5. for sure, jump to the sub_12345 and there should be some strings like

                 mov     r5, #0B920h

yay
« Last Edit: November 15, 2016, 02:50:22 PM by fukenbroken » Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.013 seconds with 17 queries. (Pretty URLs adds 0s, 0q)