Pages: [1] 2 3
Author Topic: MED 9 Reversing  (Read 28350 times)
rajivc666
Full Member
***

Karma: +23/-2
Offline Offline

Posts: 127



« on: November 25, 2012, 09:56:52 AM »

Some time back I embarked on a mission to study the Magneti Marelli 1.3 MJD which is in my other car. As I could not find much resources on it I decided to study the MED9 ecu which is based on the same processor mpc5XX and has similarity with ME7 and lot more resources available. So after months of reversing I have now acquired some understanding of the ECU as to how it refers to maps, RAM variables etc. As of now I am writing a routine to switch maps the same way I did for ME7. Also have plans to add other functions. Now my main question is can the NLS/LC be ported for this ECU, if so how will it be different from the one for ME7. I have identified all the required variables. Will it work if I convert the exact code into this ECU. My knowledge is limited to only the ecu and not the car, what other problems are likely...
Logged
hotbmwm3
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 5


« Reply #1 on: November 26, 2012, 09:46:59 PM »

This will be a great project, I would like to help

My own car I drive is a 2005 golf gti

I have two ecus for the car so it is easy to test code for you

And using BDM to write is easy for me, as well as having OBD2 tools

I also have vagcom VCDS

Let me know if I can help



Some time back I embarked on a mission to study the Magneti Marelli 1.3 MJD which is in my other car. As I could not find much resources on it I decided to study the MED9 ecu which is based on the same processor mpc5XX and has similarity with ME7 and lot more resources available. So after months of reversing I have now acquired some understanding of the ECU as to how it refers to maps, RAM variables etc. As of now I am writing a routine to switch maps the same way I did for ME7. Also have plans to add other functions. Now my main question is can the NLS/LC be ported for this ECU, if so how will it be different from the one for ME7. I have identified all the required variables. Will it work if I convert the exact code into this ECU. My knowledge is limited to only the ecu and not the car, what other problems are likely...
Logged
rajivc666
Full Member
***

Karma: +23/-2
Offline Offline

Posts: 127



« Reply #2 on: November 26, 2012, 10:01:22 PM »

Thanks very much , I will send you the  files very soon. I am making a map switch to start with. So ones its confirmed my RAM variables are correct , we will proceed with other . Grin.
Logged
rajivc666
Full Member
***

Karma: +23/-2
Offline Offline

Posts: 127



« Reply #3 on: November 26, 2012, 10:02:47 PM »

Also is your car Manual gear.
Logged
hotbmwm3
Newbie
*

Karma: +0/-0
Offline Offline

Posts: 5


« Reply #4 on: November 27, 2012, 12:21:23 AM »

My car is DSG
Logged
Rick
Hero Member
*****

Karma: +63/-4
Offline Offline

Posts: 704


« Reply #5 on: November 29, 2012, 01:18:33 PM »

I'm working on something similar currently.
Logged
rajivc666
Full Member
***

Karma: +23/-2
Offline Offline

Posts: 127



« Reply #6 on: December 29, 2012, 01:02:15 AM »

My first attempt at ldrxn switch, 5 maps. Switched by brk/acc but not tested. The second map is a valet map. The three ldrxns in stock location is disabled.
If this works then lc/nls will follow. One file is cksmcorrected the other one is not corrected. Hope somebody can test it for me. Grin

Edit: Removed as I found some mistakes.
« Last Edit: January 12, 2013, 01:24:50 PM by rajivc666 » Logged
littco
Hero Member
*****

Karma: +52/-7
Offline Offline

Posts: 903


« Reply #7 on: December 29, 2012, 03:49:06 AM »

Nice work.

What chip does the me9 have? Do you still use idapro to disassemble?
Logged
rajivc666
Full Member
***

Karma: +23/-2
Offline Offline

Posts: 127



« Reply #8 on: December 29, 2012, 04:25:57 AM »

mpc5xx (mpc563 i think). yes idapro always
Logged
technic
Full Member
***

Karma: +18/-5
Offline Offline

Posts: 227


« Reply #9 on: January 02, 2013, 07:52:17 AM »

Very nice work indeed! How did you set up your memory regions?
Logged
rajivc666
Full Member
***

Karma: +23/-2
Offline Offline

Posts: 127



« Reply #10 on: January 02, 2013, 09:08:27 AM »

Load the file at 0x400000 and ram from 0x600000 to 0x900000, not accurate but will work.
Logged
rajivc666
Full Member
***

Karma: +23/-2
Offline Offline

Posts: 127



« Reply #11 on: January 02, 2013, 09:16:47 AM »

Also in >options>general>Analysis>processor specific analysis options>
TOC address = 0x5C9FF0
SDA(r13)..... = 0x7FFFF0
Thats the key to finding map references, took me sometime to find it.
Logged
technic
Full Member
***

Karma: +18/-5
Offline Offline

Posts: 227


« Reply #12 on: January 02, 2013, 03:07:07 PM »

I never managed to get the TOC correct before, so this was very nice info. Thanks a lot Smiley
Logged
rajivc666
Full Member
***

Karma: +23/-2
Offline Offline

Posts: 127



« Reply #13 on: January 04, 2013, 07:21:46 AM »

You are welcome Smiley.
Logged
B234R
Full Member
***

Karma: +11/-0
Offline Offline

Posts: 75


« Reply #14 on: December 23, 2013, 05:03:25 AM »

Good info, but I have a question, maybe someone can help:

On ME7 C16x MCUs there is an 32K IROM section, which contains a boot ROM etc.

Is there anything similar on MPC MCUs as used in MED9?
Or is all the code needed for disassembly stored in the external flash?

Thanks!


Logged
Pages: [1] 2 3
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.021 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)