Hi,
I'm trying to investigate how CAN messages handled in this ECU(e.g. intercept cruise control buttons to switch maps). And at all logic, how this functionality is working in embeded systems.
I'm not professional reverse engineer, just studying. And have no experience with embedded development(just desktop/web software development).
So will be very appresiate for any help/advices.
Maybe I'm doing something wrong, so will be very happy if someone correct me.
1. Preparation steps:1.1. Loaded .bin file in Ghidra with 0x09000000 offset
1.2. At
LAB_09040468 I found some registers definition:
e_lis r1,0x5280
e_or2i r1,0x6060
e_lis r13,0x952
e_or2i r13,0x1ee0
e_lis r2,0x4000
e_or2i r2,0x8e00
e_lis r14,0x4800
e_or2i r14,0x0
e_lis r15,0x5280
e_or2i r15,0x8048
e_lis r16,0x5080
e_or2i r16,0x8048
e_lis r17,0x5180
e_or2i r17,0x8048
and set values for appropriate registers via selecting all code.(not sure that this correct).
2. Tryied next attempts during my investigation:2.1. Got some RAM variables from A2L, and via XREF in Ghidra tryied to find a function where it set: no results...
2.2. According to MPC Manual define memory map in Ghidra:
- 0xFFED4000: Shared CAN Message RAM
- 0xFFED8000: Shared CAN Message RAM (extended)
- 0xFFEDC000: Time Triggered Controller Area Network 0 (TTCAN_0)
- 0xFFEE4000: CAN Subsystem: Controller Area Network 1 (MCAN_1)
- 0xFFEE8000: CAN Subsystem: Controller Area Network 2 (MCAN_2)
- 0xFFEEC000: CAN Subsystem: Controller Area Network 3 (MCAN_3)
- 0xFFEF0000: CAN Subsystem: Controller Area Network 4 (MCAN_4)
Just only in MCAN_1 I have XREF to main code at DAT_ffee4018, but it wasn't help me much. Maybe I missed some global registers configuration?
2.3. Looking in manual: CAN Subsystem -> Memory map and register description
And tryied to identify place where registers(M_CAN_CREL, M_CAN_ENDN, M_CAN_FBTP etc.) configured. Didn't work...
2.4. At 0x090F9000 I found some calls to functions, which is look very similar to what I need(but I'm not sure...)
As far as I'm not embeded developer, I'm not fully understand how ECU is working.
What I undestand(
correct me if I'm wrong):
- Somewhere in code there is CAN message
receiving function, from where data bytes parsed and assigned to some addresses in RAM
- Somewhere in code there is CAN message
sending function, from where appropriate RAM addresses reading, and setting CAN message data bytes.
So, manipulating with values in RAM we can achive that ECU will send CAN message with changed bytes, and in such way we can achive what we want(e.g. display current map in tacho, if modify rpm byte of appropriate CAN message)
Can someone explain me, what I'm missing, how to understand CAN system configuration, etc.
Here on forum I found some usefull topic:
http://nefariousmotorsports.com/forum/index.php?topic=9027With help of it I was able to reproduce that steps on MEVD17.2.G BMW N55, but for that TC1797 I have no much info Ghidra(and have no car with such ECU for tests), so I decided to switch back my MPC5777 project.
Will be very appreciate for any help, or
even ready for some paid consultation via Skype/GoogleMeet.
And attaching a file on which I'm working. This is a full file with btld and calibrations. Software started at 0x040000, Calibrations at 0x680000 https://drive.google.com/file/d/17iLSndpWJVVlMewibNbzx_T56U2LC-Um