Pages: [1]
Author Topic: Looking For Guidance On Locating Maps in IDA Pro  (Read 5151 times)
Cadensdad14
Full Member
***

Karma: +8/-1
Offline Offline

Posts: 134


« on: January 17, 2018, 07:48:26 PM »

I am working on a 5120 hack on a 551r file and have am trying to find the missing maps.  I am working through all of this for thoroughness.  I am looking for KFDPVL in BGTEV.  I have disassembled the file, expanded all the code, cleaned up all the code, and entered all the ram values I know of.  I am seeing in the FR that mshfm_w and ps_w feed into KFDPVL and output to a function with pu_w that outputs pvl_w. 

And this is where I hit a wall.  I feel like Im starting to understand this but I dont know the structure of what Im looking for will look like.  At the same time, I tried to follow LAMFAW because I feel confident about my understanding of how it works and still ended up lost.  Can anyone help to point me in the right direction and give me an idea of what im looking for?  Id really like to understand the structure of it so I can work on my own in the future.

Logged
SB_GLI
Hero Member
*****

Karma: +116/-10
Offline Offline

Posts: 1022


« Reply #1 on: January 18, 2018, 06:26:21 AM »

There is a 5120 hack file for 551r posted on this forum.  Let that not distract you from your efforts in learning to disassemble.
Logged
nubcake
Sr. Member
****

Karma: +53/-4
Offline Offline

Posts: 400


« Reply #2 on: January 18, 2018, 05:31:22 PM »

I think there's a list of RAM variables for 551R floating around here. And a full definition as well.

But back on subject: generally if you're looking for some specific function (and know the output variable) - you just go to that var address in RAM, press "x" for cross-references, sort by "R/W" and check writes to it. Some will usually be initialization (either by some constant, or from another var), others will lead you to the actual function.

Finding map references is a bit trickier.

That being said, AFAIK, there's no KFDPVL (and hence, pvl_w) in this binary.
Logged
Cadensdad14
Full Member
***

Karma: +8/-1
Offline Offline

Posts: 134


« Reply #3 on: January 18, 2018, 06:58:43 PM »

I just noticed that r/w in the cross reference table and it makes sense now.  Is there a different FR for me7.1 vs me7.1.1?

This file is my brothers and he built it using the 5120 551r hack file.  The problem is that it is never entering closed loop.  I tried to follow the 5120 hack thread as referenced on s4wiki to try and understand how we ended up with what we had.  Were just having trouble defining 0x1291C, 0x1291D, and 0x1291E.  They have changed values and we dont know why or what they do and I dont believe theyre checksums.

I cant seem to upload the xdf file.
Logged
SB_GLI
Hero Member
*****

Karma: +116/-10
Offline Offline

Posts: 1022


« Reply #4 on: January 19, 2018, 07:12:57 AM »

I can tell you for certain the 5120 hack that is available here works as it's supposed to.  I use it on my car.  Keep in mind, this file uses base boost pid calibration, so the pid control is different than an s4 for example.  The damos for this binary is available, that is why variable listings, 5120 hacks etc are available as well.
Logged
nubcake
Sr. Member
****

Karma: +53/-4
Offline Offline

Posts: 400


« Reply #5 on: January 19, 2018, 03:58:38 PM »

I just noticed that r/w in the cross reference table and it makes sense now.  Is there a different FR for me7.1 vs me7.1.1?

The publicly available 7.1 FR is actually for one specific ECU. There are variations even within one "family". So the only "sure" way to find stuff out is to look in the code.
« Last Edit: January 19, 2018, 04:03:14 PM by nubcake » Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.015 seconds with 16 queries. (Pretty URLs adds 0.001s, 0q)