NefMoto > Technical > Reverse Engineering > help with operand location (IDA)
Pages: [1]
« previous next »
Author Topic: help with operand location (IDA)  (Read 2164 times)
lgtmelo
Full Member
***

Karma: +2/-13
Offline Offline

Posts: 115
« on: December 20, 2022, 04:53:37 PM »
hey, can someone kindly explain to me why after disassembling a med9.1.1 file in IDA there are few references to addresses that dont exist? like on the attached screenshot, the red addresses.

thanks Smiley

file: https://filebin.net/1i3kvmfgwrvitska
« Last Edit: December 21, 2022, 06:59:07 AM by lgtmelo » Logged
prj
Hero Member
*****

Karma: +915/-427
Offline Offline

Posts: 5839
« Reply #1 on: December 21, 2022, 12:07:30 AM »
Load the Micro content at the correct address.
Logged
PM's will not be answered, so don't even try.
Log your car properly.
lgtmelo
Full Member
***

Karma: +2/-13
Offline Offline

Posts: 115
« Reply #2 on: December 21, 2022, 05:44:50 AM »
hi, thanks for answering. im not sure how to proceed. im using an a2l that has these addresses as guide:

Code:
  /begin MOD_PAR "D91157_49GB00"
    VERSION "MED911"
    ADDR_EPK 0x1C21F0
    EPK "58/1/MED911/5/8442.04//D91157_49GB00/D91157_49GB00/120608/"
    CUSTOMER_NO "5"
    USER "GS/PVW23-Vogt"
    PHONE_NO ""
    CPU_TYPE "GoldenOak"
    ECU "MED911"
    /begin MEMORY_SEGMENT Pst0 "" CODE EPROM EXTERN 0x0 0x20000 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_CCP ADDRESS_MAPPING /*orig_adr:*/0x0 /*mapping_adr:*/0x0 /*length:*/0x20000 /end IF_DATA
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x0 /*mapping_adr:*/0x0 /*length:*/0x20000 /end IF_DATA
    /begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x0 /*mapping_adr:*/0x0 /*length:*/0x20000 /end IF_DATA
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Pst20000 "" CODE EPROM EXTERN 0x20000 0x1A0000 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_CCP ADDRESS_MAPPING /*orig_adr:*/0x20000 /*mapping_adr:*/0x20000 /*length:*/0x1A0000 /end IF_DATA
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x20000 /*mapping_adr:*/0x20000 /*length:*/0x1A0000 /end IF_DATA
    /begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x20000 /*mapping_adr:*/0x20000 /*length:*/0x1A0000 /end IF_DATA
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Pst400000 "" CODE EPROM INTERN 0x400000 0x80000 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_CCP ADDRESS_MAPPING /*orig_adr:*/0x400000 /*mapping_adr:*/0x400000 /*length:*/0x80000 /end IF_DATA
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x400000 /*mapping_adr:*/0x400000 /*length:*/0x80000 /end IF_DATA
    /begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x400000 /*mapping_adr:*/0x400000 /*length:*/0x80000 /end IF_DATA
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Dst1C2000 "" DATA EPROM EXTERN 0x1C2000 0x3E000 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_CCP ADDRESS_MAPPING /*orig_adr:*/0x1C2000 /*mapping_adr:*/0x5C2000 /*length:*/0x3E000 /end IF_DATA
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x1C2000 /*mapping_adr:*/0x902000 /*length:*/0x3E000 /end IF_DATA
    /begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x1C2000 /*mapping_adr:*/0x5C2000 /*length:*/0x3E000 /end IF_DATA
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT ExtRam900000 "" VARIABLES RAM EXTERN 0x900000 0x2000 -1 -1 -1 -1 -1 
        /* AsapMLXFm - CCP_V2_1 */
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x900000 /*mapping_adr:*/0x900000 /*length:*/0x2000 /end IF_DATA

        /* AsapMLXFm - KWP2000 */ 
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Ram7F8000 "" VARIABLES RAM INTERN 0x7F8000 0x8000 -1 -1 -1 -1 -1 
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Ram800000 "" VARIABLES RAM INTERN 0x800000 0x8000 -1 -1 -1 -1 -1 
    /end MEMORY_SEGMENT


however, thats from a 8T0907560M, and my ECU is actually a 8T0907560AD. but thats the best i could do.

i used RAM @ 0x600000 size 0x300000
ROM @ 0x000000 size 0x200000
Loading address 0x000000 size 0x200000

and the only additional load i did was (0x1C0000-0x1FFFFF), Loading segment: 0x5C0000, from:
Code:
/begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x1C2000 /*mapping_adr:*/0x5C2000 /*length:*/0x3E000 /end IF_DATA


what am i missing?

ps: TOC address: 0x5C9FF0
SDA (r13): 0x7FFFF0
« Last Edit: December 21, 2022, 06:50:24 AM by lgtmelo » Logged
lgtmelo
Full Member
***

Karma: +2/-13
Offline Offline

Posts: 115
« Reply #3 on: December 21, 2022, 06:54:41 AM »
its like theres a chunk missing, it skips from ROM:001FFFFC to seg001:005C0000 (my additional load), and the unexistant address references are all of 0x4----- magnitude. i.e.:

Code:
bl        0x4135F4

Code:
bl        0x413958

Code:
bl        0x41333C
Logged
lgtmelo
Full Member
***

Karma: +2/-13
Offline Offline

Posts: 115
« Reply #4 on: December 21, 2022, 06:59:28 AM »
updated 1st post to include the .bin
Logged
prj
Hero Member
*****

Karma: +915/-427
Offline Offline

Posts: 5839
« Reply #5 on: December 21, 2022, 07:01:25 AM »
Your bin only contains the extflash, it does not contain the uC intflash.
If you don't load the uC intflash then of course all jumps to it will be undefined.

Your A2L clearly shows this as well:
Code:
    /begin MEMORY_SEGMENT Pst400000 "" CODE EPROM INTERN 0x400000 0x80000 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_CCP ADDRESS_MAPPING /*orig_adr:*/0x400000 /*mapping_adr:*/0x400000 /*length:*/0x80000 /end IF_DATA
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x400000 /*mapping_adr:*/0x400000 /*length:*/0x80000 /end IF_DATA
    /begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x400000 /*mapping_adr:*/0x400000 /*length:*/0x80000 /end IF_DATA
    /end MEMORY_SEGMENT
You're missing this whole data.
Logged
PM's will not be answered, so don't even try.
Log your car properly.
lgtmelo
Full Member
***

Karma: +2/-13
Offline Offline

Posts: 115
« Reply #6 on: December 21, 2022, 07:31:21 AM »
Quote from: prj on December 21, 2022, 07:01:25 AM
Your bin only contains the extflash, it does not contain the uC intflash.
If you don't load the uC intflash then of course all jumps to it will be undefined.

Your A2L clearly shows this as well:
Code:
    /begin MEMORY_SEGMENT Pst400000 "" CODE EPROM INTERN 0x400000 0x80000 -1 -1 -1 -1 -1 
    /begin IF_DATA ASAP1B_CCP ADDRESS_MAPPING /*orig_adr:*/0x400000 /*mapping_adr:*/0x400000 /*length:*/0x80000 /end IF_DATA
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x400000 /*mapping_adr:*/0x400000 /*length:*/0x80000 /end IF_DATA
    /begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x400000 /*mapping_adr:*/0x400000 /*length:*/0x80000 /end IF_DATA
    /end MEMORY_SEGMENT
You're missing this whole data.


thanks, thats what i was wondering. is this portion of any importance to what im trying to accomplish here? patching the boost pid?
Logged
prj
Hero Member
*****

Karma: +915/-427
Offline Offline

Posts: 5839
« Reply #7 on: December 21, 2022, 07:33:05 AM »
Quote from: lgtmelo on December 21, 2022, 07:31:21 AM

thanks, thats what i was wondering. is this portion of any importance to what im trying to accomplish here? patching the boost pid?
There's 0.5mb code you are missing.

There is no boost PID, boost control or notion of boost in this ECU.
Logged
PM's will not be answered, so don't even try.
Log your car properly.
lgtmelo
Full Member
***

Karma: +2/-13
Offline Offline

Posts: 115
« Reply #8 on: December 21, 2022, 07:36:20 AM »
Quote from: prj on December 21, 2022, 07:33:05 AM
There's 0.5mb code you are missing.

There is no boost PID, boost control or notion of boost in this ECU.

i know, thats why im trying to patch it with one
Logged
Pages: [1]
  Print  
« previous next »
 
Jump to:  

Navigation
Personal Tools
  • April 23, 2024, 08:03:59 PM
  • Welcome, Guest. Please login or register.
    Did you miss your activation email?

    Login with username, password and session length
Search
 
Advanced Search
About Disclaimer
All Rights Reserved 2010 Nefarious Motosports
Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.019 seconds with 18 queries. (Pretty URLs adds 0.001s, 0q)