Pages: [1]
Author Topic: a2l files in IDA  (Read 3171 times)
HexTrain
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 7


« on: August 19, 2019, 05:32:51 AM »

I have downloaded damos package, and I'm a bit confused about its content.

It's called:
EDC16C39 Real (A2L) damos
And it has the following files:

149-1-922-E279.ORI
1037391922.HEX
F36JTDA5EI.a2l

From what I understand, the ORI file is the memory dump of the ECU. I can open it in IDA, and by choosing PowerPC architecture and mpc5xxx I can see the disassembly, including many functions with complex code flow, suggesting I'm opening it right.

But now I'm a bit confused about the following issues:
What is the purpose of the .hex file? As far as I understand it's just another way to represent the .ori file.
How can I apply the a2l? Is there a way to do it in IDA?

I see that in the a2l there are many sections, like characteristics.
For example:

Code:
/begin CHARACTERISTIC

    ZFC_uBattMin_C
    "Minimal battery voltage for the zero fuel quantity calibration"
    VALUE
    0x1E7EFA

Does ZFC_uBattMin_C is the actual name the developer gave to a variable corresponded to 0x1E7EFA rva of the raw .ori file?
Is there something similar like classic function symbols - for example, is there a way from the a2l to understand what is the name of the function at 0x218E4?

In addition, what do the name of the files mean? What is 149-1-922-E279 and 1037391922 and F36JTDA5EI?

Thanks in advance!
« Last Edit: August 19, 2019, 06:05:27 AM by HexTrain » Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12232


WWW
« Reply #1 on: August 19, 2019, 09:46:22 AM »

ORI is just short for "original" it has no other real meaning. hex is the actual image. naming of variables and function names is all over the map and is up to the developer. Map names, some ram variables, (and map lookup function names) are usually standardized (see the corresponding FR). Importing a2l data to IDA generally requires writing your own scripts to automate. I have a few, and prj (iirc) has a fairly complete way of automating all of it.

1037 numbers are almost always SW Number. That, along with P/N uniquely identifies the version of image. Note that variants of the same P/N can have different SW numbers, and consequently both map and ram locations may not be identical between the two (though they often are).

« Last Edit: August 19, 2019, 09:49:57 AM by nyet » Logged

ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
HexTrain
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 7


« Reply #2 on: August 20, 2019, 02:12:12 AM »

ORI is just short for "original" it has no other real meaning. hex is the actual image. naming of variables and function names is all over the map and is up to the developer. Map names, some ram variables, (and map lookup function names) are usually standardized (see the corresponding FR). Importing a2l data to IDA generally requires writing your own scripts to automate. I have a few, and prj (iirc) has a fairly complete way of automating all of it.

1037 numbers are almost always SW Number. That, along with P/N uniquely identifies the version of image. Note that variants of the same P/N can have different SW numbers, and consequently both map and ram locations may not be identical between the two (though they often are).



Thank you very much for the information!
Just what are FR and p/n? (bolded in the quote)
Logged
aef
Hero Member
*****

Karma: +69/-46
Offline Offline

Posts: 1566


« Reply #3 on: August 20, 2019, 05:23:39 AM »

Funktionsrahmen
Partnumber
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.025 seconds with 18 queries. (Pretty URLs adds 0s, 0q)