NefMoto > Technical > Reverse Engineering > Loading ME7.4.6 in Ida Pro 8.3
Pages: [1]
« previous next »
Author Topic: Loading ME7.4.6 in Ida Pro 8.3  (Read 1044 times)
NBN
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 7
« on: August 23, 2024, 12:16:32 PM »
Hi!

Can someone please help me to correctly load these files in Ida Pro 8.3?
I've been trying for days, reading multiple instructions for similar ecus but I just can't get it to work correctly.

It's a Citroen C5 ME7.4.6 that i've dumped with Ktag and i have the following files:
- MICRO_ST10C167 (32kb)
- EXTFLASH_AM29F400BB (512kb)
- EEPROM_ST95160 (2kb Immo)

I'm loading the MICRO first but i'm not sure that IDA auto-configures the segments correctly.
I also don't really understand where in memory the flash and eeprom should reside. I'm really confused about the DPP registers.

I have been using Ida for years but this is the first time I'm working with anything other than Intel x86/64 stuff.

Please help me!

// Parre
Logged
prj
Hero Member
*****

Karma: +1069/-476
Offline Offline

Posts: 6011
« Reply #1 on: August 24, 2024, 01:56:14 AM »
Find at the start of the code where the DPP segments are set.
Based on that you should understand the memory layout and be able to load things at the correct addresses.

One or two of the segments will point to extflash, most likely calibration area.
One will point to internal RAM.
Another one will point to external RAM (if any).

Analyzing absolute calls in the code will help you verify that your assumptions are correct.
Here is the relevant thread about VAG ME7:
http://nefariousmotorsports.com/forum/index.php?topic=744.0
Logged
PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
NBN
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 7
« Reply #2 on: August 24, 2024, 04:16:24 AM »
Quote from: prj on August 24, 2024, 01:56:14 AM
Find at the start of the code where the DPP segments are set.
Based on that you should understand the memory layout and be able to load things at the correct addresses.

One or two of the segments will point to extflash, most likely calibration area.
One will point to internal RAM.
Another one will point to external RAM (if any).

Analyzing absolute calls in the code will help you verify that your assumptions are correct.
Here is the relevant thread about VAG ME7:
http://nefariousmotorsports.com/forum/index.php?topic=744.0

Thank you. After trying like 20 times I finally think I got it sort-of right.
What I'm really looking for with all this is where the Immobilizer stuff is handled. I guess there should be some code that access the 25C16 eeprom.

Any idea where and how I load the 2kb eeprom dump correctly to be able to find references to it?
Logged
prj
Hero Member
*****

Karma: +1069/-476
Offline Offline

Posts: 6011
« Reply #3 on: August 25, 2024, 10:40:45 PM »
Quote from: NBN on August 24, 2024, 04:16:24 AM
Any idea where and how I load the 2kb eeprom dump correctly to be able to find references to it?
There is no direct memory mapping to the eeprom.
There is a mirror in memory based on a custom configuration where certain pages get copied to certain areas.
There are also subroutines to read and write the eeprom directly.

I have no idea if this handling is different between e.g. ME7.4.6 and ME7.1, you will have to do some reversing to find out.
You can take a shortcut and dump the RAM on a running ECU, then you will have an idea to which area the eeprom is loaded and can find the pointer in the binary and references to it.
Logged
PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
NBN
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 7
« Reply #4 on: August 27, 2024, 04:03:34 AM »
I see!

Any suggestions on how to dump the memory while running?
The dumpa i have are from boot mode with Ktag.
Logged
prj
Hero Member
*****

Karma: +1069/-476
Offline Offline

Posts: 6011
« Reply #5 on: August 27, 2024, 08:27:04 AM »
Quote from: NBN on August 27, 2024, 04:03:34 AM
I see!

Any suggestions on how to dump the memory while running?
The dumpa i have are from boot mode with Ktag.

You can check if it has $23 and/or $2C service on KWP.
It might or might not and it might be protected.

ISO 14230-3.

Tbh if you don't have even a basic idea how to attack this, then you're in way over your head and my suggestions will do very little.
« Last Edit: August 27, 2024, 08:28:35 AM by prj » Logged
PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
NBN
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 7
« Reply #6 on: August 27, 2024, 11:51:29 AM »
Thank you for your time.

The car runs so no need to find eeprom.
Now, instead i need to find and fix the speed signal.

Getting there!
Logged
Pages: [1]
  Print  
« previous next »
 
Jump to:  

Navigation
Personal Tools
  • November 13, 2024, 12:02:06 AM
  • Welcome, Guest. Please login or register.
    Did you miss your activation email?

    Login with username, password and session length
Search
 
Advanced Search
About Disclaimer
All Rights Reserved 2010 Nefarious Motosports
Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.015 seconds with 16 queries. (Pretty URLs adds 0s, 0q)