So I thought I'd make my first proper post a contribution to the knowledge on here by sharing my findings.
I'm not making a complete tutorial as I had to figure things out by taking the time to look and think, and I'm glad I did.
However if it can provide someone with a few pointers hopefully in the right direction all good.
First job was just studying the flash ROM in WinOLS
So I knew where the maps were because I study 2d shapes and number sequences really hard or I'm just lazy and found a DAMOSs or a2ls-
however regardless they come in compact blocks rather than scattered through the file.
To me it seemed a good hint there as to what is going on and how it links data to code.
It became even more clear when looking at a ROM file with more than one block of data.
Most maps shared the same last four digits in their address e.g A1234 B1234 with maps of the same function in the next block of data.
A quick hex sequence search for these addresses seemed to highlight a useful area
Its easier to spot on EDC15C than EDC15P but still clear enough. Now what would that be there for I thought...
On to the eternal question of DPP's.
Well if I knew where to find the data references then logically thats where the dpp's point.
Or even if they didn't and on startup the whole data block was transfered to another area; it doesn't really matter at least for now as the same code will be calling the same piece of data albeit from a different place.
So I loaded the file in IDA and to start with I converted nearly everything other than the map area into code. I could undefine later any bits which were not code.
So surely EDC15 follows the ME7's tradition of defining the DPP's soon in the code, it's running on the same hardware isn't it?
And sure enough I came across the relevant code.
So plugging it in suddenly I got:
Remember the slope? A bit of playing with offsets and labelling and it became easy to see which functions were calling the maps.
I'm no expert on code but whatever logic the subroutines take they need to follow the path shown in the Funktionsbeschreibung for the RAM values passed along and order of maps.
So follwing the xrefs took me to where the maps where being used in the subroutine
3 registers in a row then passed to a subroutine in the IROM for a 2d map. Wasn't to hard to imagine what the 2 other references were and start labelling.
Finally looking at the function in graph view is like reading the flow charts in the EDC15Funktionsbeschreibung.
I must have worn out google translate by now.
All functions sat there ready to start abusing, mutating, chopping and patching.
Now by no means am I saying everything I've done is 100% right, there's probably lots of mistakes I'm sure people smarter than me can see. And there's loads I don't know yet so any help would be much appreciated.
The work and information on the forum here is great so hopefully some development on this ECU can be encouraged from this.
