Need hint identify maps edc15cp2

Pages: [1]

« previous next »

Author

Topic: Need hint identify maps edc15cp2 (Read 3509 times)

nolo

Newbie

Karma: +1/-13
Offline

Offline

Posts: 8

	Need hint identify maps edc15cp2 « on: March 27, 2018, 01:58:02 AM »

This is my coming back to reversing project. EDC15C2, Lancia Phedra, 2.0 JTD Engine.

Looks that I'm still rosty in reversing, it's been a long time.

I'm still not able to identify maps. I don't find any references to maps. Looks like I need a hint from one of the experienced users.

I can 100% identify axis in the binary file. And there is a Axis Pointer Table too. I wrote a programm to get me all addresse to the axis and imported them into ida to get either a reference to the axis or the pointer table. Now I get references, but they are wrong.

Then I wrote a program to decode opcodes to know where the dpp register points to. I found out that only dpp0 and dpp3 are used. I changed register to get a better result, did not work.

Addressing is still wrong.

Now I'm lost. What should I try next?

Olaf


	Logged

Still learning!

prj

Hero Member

Karma: +915/-426
Offline

Offline

Posts: 5835

	Re: Need hint identify maps edc15cp2 « Reply #1 on: March 27, 2018, 08:44:29 AM »

I am going to give you some generic info. It might not apply to your ECU.

1. EDC15 has bank switching, so DPP's are switched on the fly via coding.
2. There needs to be no reference to the exact map. Often a reference to the start of the first axis is enough.
3. At least in ME7 there is a million different map lookup routines which take different arguments. Keep that in mind.

I don't really have time to look at your specific code, but maybe this info is of some use.


	Logged

PM's will not be answered, so don't even try.
Log your car properly.

nolo

Newbie

Karma: +1/-13
Offline

Offline

Posts: 8

	Re: Need hint identify maps edc15cp2 « Reply #2 on: March 27, 2018, 10:57:54 AM »

Got it! Somewhere I messed everything up. Loaded everything new, found references! Now will hunt for map references.

For other people:

; assume dpp0: 3Ch (page 0xF0000)
; assume dpp1: 1 (page 0x4000)
; assume dpp2: 2 (page 0x8000)
; assume dpp3: 3 (page 0xC000)

dpp3 goes to MEM_EXT:00008000, there is measurement data
dpp0 goes to Calibration Data

At least I can see that my imported AxisPtrTable get referenced.

Olaf


« Last Edit: March 27, 2018, 11:02:26 AM by nolo »	Logged

Still learning!

prj

Hero Member

Karma: +915/-426
Offline

Offline

Posts: 5835

	Re: Need hint identify maps edc15cp2 « Reply #3 on: March 27, 2018, 11:14:42 PM »

Btw, as a tip - remove "run final analysis pass" and then use my IDA Pro scripts to only analyze the areas that you know are code.
That way your references will be cleaner.


	Logged

PM's will not be answered, so don't even try.
Log your car properly.

nolo

Newbie

Karma: +1/-13
Offline

Offline

Posts: 8

	Re: Need hint identify maps edc15cp2 « Reply #4 on: April 24, 2018, 05:40:15 AM »

I'm still working on this. This is fun.

For those who are interested in what I have achieved so far:

There are maps with direct axis and with axis pointers. Found a way to detect maps with axis pointers. Scanned the opcodes to find the corresponding addresses for axis and maps. So for a map where the axis are unknown opcodes are scanned until the corresponding axis is found even for those one where the axis is preloaded in ram.

Code:

0x761E4
[1000, 1200, 1400, 1600, 1800, 2000, 2250, 2500, 3000, 3500, 4000, 4500]
[800, 1000, 1200, 1400, 1600, 1800, 2000, 2300, 2600, 3000, 3500, 4000, 4500, 5000, 6000, 7000]
[[-430, -510, -580, -640, -710, -770, -830, -890, -950, -990, -980, 0, 0, 0, 0, 0],
[-390, -470, -560, -630, -670, -720, -760, -800, -820, -840, -650, -500, 0, 0, 0, 0],
[-350, -480, -550, -620, -670, -690, -705, -710, -720, -730, -720, -610, -470, -250, -20, 0],
[-350, -470, -540, -595, -640, -670, -680, -690, -634, -590, -570, -530, -420, -280, 0, 0],
[-360, -440, -500, -545, -585, -620, -630, -640, -640, -550, -490, -440, -350, -280, 0, 0],
[-360, -420, -470, -510, -550, -570, -590, -590, -570, -510, -460, -390, -300, -250, 0, 0],
[-350, -410, -460, -500, -530, -550, -560, -560, -556, -500, -450, -440, -270, -270, 0, 0],
[-350, -400, -440, -480, -500, -520, -530, -550, -560, -540, -500, -380, -270, -210, 0, 0],
[-390, -460, -515, -570, -620, -660, -680, -680, -670, -500, -480, -380, -250, -80, 0, 0],
[-350, -430, -508, -590, -660, -750, -790, -740, -630, -490, -400, -290, -100, 0, 0, 0],
[-330, -400, -480, -500, -630, -660, -660, -620, -500, -380, -280, -160, -100, 0, 0, 0],
[-310, -380, -478, -540, -590, -600, -600, -550, -430, -300, -190, -60, 0, 0, -40, 0]]

I will continue working on it until I have identified all maps.


	Logged

Still learning!

Pages: [1]

« previous next »

Jump to:

Navigation

Personal Tools

April 18, 2024, 10:52:36 AM

Welcome, Guest. Please login or register.
Did you miss your activation email?

Navigation

Personal Tools

Search