Diving into Bosch MG1 ECU

Pages: [1]

« previous next »

Author

Topic: Diving into Bosch MG1 ECU (Read 1213 times)

pego_rus

Newbie

Karma: +0/-0
Offline

Offline

Posts: 4

	Diving into Bosch MG1 ECU « on: December 15, 2024, 09:44:23 AM »

Hello everyone!
I`m searching for info and some advices about disassembling Bosch MG1 ECU. Now I`m working on Bosch MG1US008 (chinese cars), Tricore tc277, and searching for non-trivial maps (f.e. charge air cooling pump control). I have no exprience in disassembling Bosch ME17/MG1 ECUs, but I have some experience in disassembling old Bosch Me7/9 ECU. Main problem is missing documentation for these new MG1 ECU`s.
Now I have 2 primary tasks: to find seed-key alghoritm and to find map offsets.
Where should I start from?

P.S. It`s OK, if I have to pay for some consultation or ready solution.


	Logged

pego_rus

Newbie

Karma: +0/-0
Offline

Offline

Posts: 4

	Re: Diving into Bosch MG1 ECU « Reply #1 on: December 15, 2024, 09:47:40 AM »

Original file looks like this in attachment


	Logged

gt-innovation

Sr. Member

Karma: +60/-92
Offline

Offline

Posts: 450

	Re: Diving into Bosch MG1 ECU « Reply #2 on: December 15, 2024, 11:21:32 AM »

Quote from: pego_rus on December 15, 2024, 09:44:23 AM

Mg1 is a much more complex ecu to start with, plus Legacy leaked MED17 stuff will help you understand the newer ecus up to one level.Bad choice to jump into tricore without playing around with med17.


	Logged

fastboatster

Full Member

Karma: +3/-0
Offline

Offline

Posts: 81

	Re: Diving into Bosch MG1 ECU « Reply #3 on: December 15, 2024, 08:11:13 PM »

Quote from: pego_rus on December 15, 2024, 09:47:40 AM

Original file looks like this in attachment

Ghidra seems to disassemble it quite well, can't say that about some PowerPC-based MG1 ecus. Just load it using TC29x language at 0x80000000 address.
You might want to set the a0, a1, a8 and a9 registers, the code dealing with that is at 0x80080a82, though a9's real value is not set there, must be same as MED17 where a9 is a cal table pointer.
You have to have at least some map addresses and/or variable addresses, or otherwise it will be very difficult to get anything out of this.


	Logged

pego_rus

Newbie

Karma: +0/-0
Offline

Offline

Posts: 4

	Re: Diving into Bosch MG1 ECU « Reply #4 on: December 16, 2024, 04:17:48 AM »

Quote from: fastboatster on December 15, 2024, 08:11:13 PM

though a9's real value is not set there, must be same as MED17 where a9 is a cal table pointer.

a0, a1, a8 register values successfully found. As regards a9 register, I found some topics about ME17 ECU`s with a9 register searching info. As far as I know in ME17 a9 register value should be set with one of another global registers value (+ offset). I`ve found some subroutines with a9 register occurrences, but I`m surely missing something.

Code:

 
...
ROM:800850F8                 add16.a         a9, a6
ROM:800850FA                 fret16
...
ROM:80086068 loc_80086068:                           ; DATA XREF: sub_800D47DC+CE↓r
ROM:80086068                                         ; sub_800FEF48+56↓r
ROM:80086068                 sub16.a         sp, #0x45 ; 'E'
ROM:8008606A                 nop16
ROM:8008606C                 mov16.a         a9, d13
ROM:8008606E                 fret16
...
ROM:800943F8 loc_800943F8:                           ; DATA XREF: ROM:801F39C6↓o
ROM:800943F8                                         ; ROM:801F39CC↓o ...
ROM:800943F8                 addsc16.a       a15, a9, d15, #0
ROM:800943FA  
...
ROM:8009A948 loc_8009A948:                           ; DATA XREF: sub_80231B72+C↓o
ROM:8009A948                                         ; sub_80231B72+1A↓o ...
ROM:8009A948                 mov16           d0, d0
ROM:8009A94A                 nop16
ROM:8009A94C                 mov16.a         a9, d13
ROM:8009A94E                 fret16
...
ROM:8009AFE0                 mov16.a         a9, #0xC
ROM:8009AFE2                 fret16

Quote from: fastboatster on December 15, 2024, 08:11:13 PM

You have to have at least some map addresses and/or variable addresses, or otherwise it will be very difficult to get anything out of this.

I have some map addresses, digged out from winOLS. Should I try to find out a9 value using map addresses and offsets?


« Last Edit: December 16, 2024, 06:07:49 AM by pego_rus »	Logged

fastboatster

Full Member

Karma: +3/-0
Offline

Offline

Posts: 81

	Re: Diving into Bosch MG1 ECU « Reply #5 on: December 16, 2024, 12:40:32 PM »

Quote from: pego_rus on December 16, 2024, 04:17:48 AM

Code:

 
...
ROM:800850F8                 add16.a         a9, a6
ROM:800850FA                 fret16
...
ROM:80086068 loc_80086068:                           ; DATA XREF: sub_800D47DC+CE↓r
ROM:80086068                                         ; sub_800FEF48+56↓r
ROM:80086068                 sub16.a         sp, #0x45 ; 'E'
ROM:8008606A                 nop16
ROM:8008606C                 mov16.a         a9, d13
ROM:8008606E                 fret16
...
ROM:800943F8 loc_800943F8:                           ; DATA XREF: ROM:801F39C6↓o
ROM:800943F8                                         ; ROM:801F39CC↓o ...
ROM:800943F8                 addsc16.a       a15, a9, d15, #0
ROM:800943FA  
...
ROM:8009A948 loc_8009A948:                           ; DATA XREF: sub_80231B72+C↓o
ROM:8009A948                                         ; sub_80231B72+1A↓o ...
ROM:8009A948                 mov16           d0, d0
ROM:8009A94A                 nop16
ROM:8009A94C                 mov16.a         a9, d13
ROM:8009A94E                 fret16
...
ROM:8009AFE0                 mov16.a         a9, #0xC
ROM:8009AFE2                 fret16

I have some map addresses, digged out from winOLS. Should I try to find out a9 value using map addresses and offsets?

you can, there has to be a long table of pointers with most of the map addresses, you can probably find the pointers to your map there. 0x80245660 looks like the start of that table, i.e., your a9 reg value


	Logged

pego_rus

Newbie

Karma: +0/-0
Offline

Offline

Posts: 4

	Re: Diving into Bosch MG1 ECU « Reply #6 on: Today at 01:22:48 PM »

After repeating register searching on a few MG1 binaries with the same CPU (I used MG1CS002 binary and a2l for research) I`ve found some necessary maps and functions using BinDiff. Next step is searching comms stack and seed key alghoritm inside my original binary.

I`ve tried to search some "0x27" and "0x56" occurrences to find any "traces" of seed-key alghoritm and found smth similar to stack. Moreover, code jumps to some switch-case statements, that I found very promising. But the question stays, what could it actually be? Other reason I found this code interesting is, that there is very similar code snippet in other MG1 binary (although it is 3.0 VAG engine).

Code:

                             LAB_800fa4fc                                    XREF[1]:     800fa2e8(j)  
        800fa4fc 82 14           mov        d4,#0x1
        800fa4fe 1d 00 84 00     j          LAB_800fa606
                             LAB_800fa502                                    XREF[1]:     800fa2ec(j)  
        800fa502 82 24           mov        d4,#0x2
        800fa504 1d 00 81 00     j          LAB_800fa606
                             LAB_800fa508                                    XREF[2]:     800fa300(j), 800fa304(j)  
        800fa508 82 04           mov        d4,#0x0
        800fa50a 3c 56           j          LAB_800fa5b6
                             LAB_800fa50c                                    XREF[1]:     800fa308(j)  
        800fa50c 3b c0 00 40     mov        d4,#0xc
        800fa510 3c 53           j          LAB_800fa5b6
                             LAB_800fa512                                    XREF[1]:     800fa30c(j)  
        800fa512 3b d0 00 40     mov        d4,#0xd
        800fa516 3c 50           j          LAB_800fa5b6
...
                             LAB_800fa5a0                                    XREF[1]:     800fa3b0(j)  
        800fa5a0 3b 50 02 40     mov        d4,#0x25
        800fa5a4 3c 09           j          LAB_800fa5b6
                             LAB_800fa5a6                                    XREF[1]:     800fa3b4(j)  
        800fa5a6 3b 60 02 40     mov        d4,#0x26
        800fa5aa 3c 06           j          LAB_800fa5b6
                             LAB_800fa5ac                                    XREF[1]:     800fa3b8(j)  
        800fa5ac 3b 70 02 40     mov        d4,#0x27
        800fa5b0 3c 03           j          LAB_800fa5b6
                             LAB_800fa5b2                                    XREF[1]:     800fa3c0(j)  
        800fa5b2 3b 80 02 40     mov        d4,#0x28

Code:

                             switchD_800fa640::switchD
        800fa640 dc 0f           ji         a15
        800fa642 00 00           nop
                             switchD_800fa640::caseD_13                      XREF[1]:     800fa640(j)  
        800fa644 1d 00 e4 00     j          LAB_800fa80c
                             switchD_800fa640::caseD_14                      XREF[1]:     800fa640(j)  
        800fa648 1d 00 ef 00     j          LAB_800fa826
                             switchD_800fa640::caseD_15                      XREF[1]:     800fa640(j)  
        800fa64c 1d 00 c7 01     j          switchD_800fa640::caseD_72
                             switchD_800fa640::caseD_16                      XREF[1]:     800fa640(j)  
        800fa650 1d 00 c5 01     j          switchD_800fa640::caseD_72
...
                             switchD_800fa640::caseD_7f                      XREF[1]:     800fa640(j)  
        800fa7f4 1d 00 de 00     j          LAB_800fa9b0
                             switchD_800fa640::caseD_80                      XREF[1]:     800fa640(j)  
        800fa7f8 1d 00 dc 00     j          LAB_800fa9b0
                             switchD_800fa640::caseD_81                      XREF[1]:     800fa640(j)  
        800fa7fc 1d 00 ef 00     j          switchD_800fa640::caseD_72
                             switchD_800fa640::caseD_82                      XREF[1]:     800fa640(j)  
        800fa800 1d 00 d8 00     j          LAB_800fa9b0
                             switchD_800fa640::caseD_83                      XREF[1]:     800fa640(j)  
        800fa804 1d 00 d6 00     j          LAB_800fa9b0
                             switchD_800fa640::caseD_84                      XREF[1]:     800fa640(j)  
        800fa808 1d 00 e0 00     j          LAB_800fa9c8


	Logged

prj

Hero Member

Karma: +1074/-500
Offline

Offline

Posts: 6069

	Re: Diving into Bosch MG1 ECU « Reply #7 on: Today at 03:31:09 PM »

Seed key for what?

For flashing on VAG it's SA2, there are implementations on github and the SA2 string is in every single FRF/ODX.
This is manufacturer specific.


	Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches

Pages: [1]

« previous next »

Jump to:

Navigation

Personal Tools

December 24, 2024, 11:07:53 PM

Welcome, Guest. Please login or register.
Did you miss your activation email?

Navigation

Personal Tools

Search