Pages: 1 [2] 3
Author Topic: MED 9 Reversing  (Read 27063 times)
Aurélien
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 60


« Reply #15 on: December 23, 2013, 11:29:02 AM »

It depends.

On MED9.1 ( 2.0 TFSI, MPC562 ) everything you need is in da flash !
Logged
dream3R
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 1194


« Reply #16 on: December 27, 2013, 08:41:13 AM »

It depends.

On MED9.1 ( 2.0 TFSI, MPC562 ) everything you need is in da flash !


OK, so ME(D)9, I can see how maps are referenced and also how ram is accessed, that is fairly simple.  What I can't see is how, for example rl_w, is set in ram from it's parent function, there's no code like mov rl_w r4; (like C167).

I'm assuming it's using a stack and I need to read more but any prod in the right direction would be helpful.

Smiley
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
Aurélien
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 60


« Reply #17 on: December 27, 2013, 01:49:14 PM »

Look for sth.
Logged
dream3R
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 1194


« Reply #18 on: December 27, 2013, 03:51:13 PM »

+1 for you my friend, thank you, it was staring me right in the face Smiley
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
littco
Hero Member
*****

Karma: +52/-7
Offline Offline

Posts: 903


« Reply #19 on: February 25, 2014, 04:33:50 AM »

Is there a particular version of IDApro needed to disassemble the MEd9? I have version 6.2 and its not listing the MPC562 processor.. Excuse my ignorance but is it labelled as something else?
Logged
rajivc666
Full Member
***

Karma: +23/-2
Offline Offline

Posts: 127



« Reply #20 on: February 25, 2014, 07:08:47 AM »

Look for powerpc.
Logged
oldcarguy85
Full Member
***

Karma: +15/-1
Offline Offline

Posts: 247


« Reply #21 on: February 26, 2014, 06:30:48 PM »

Also in >options>general>Analysis>processor specific analysis options>
TOC address = 0x5C9FF0
SDA(r13)..... = 0x7FFFF0
Thats the key to finding map references, took me sometime to find it.

Hey -- i'm JUST getting started with dissasembly.  Can you offer some clarification on the SDA thing and how you found map references?  I found the TOC address setting, but couldn't find SDA in options anywhere?  I can't seem to find any references to maps.

Thanks for any input!
-Jordan
Logged
automan001
Full Member
***

Karma: +47/-0
Offline Offline

Posts: 153


« Reply #22 on: May 22, 2015, 07:15:54 AM »

Load the file at 0x400000 and ram from 0x600000 to 0x900000, not accurate but will work.
I usually look into damos/a2l file.
For example i took a binary and a2l file from here
http://nefariousmotorsports.com/forum/index.php?topic=467.msg74873#msg74873
(These files came with WinOls in damos folder).
In the file clearly see memory structure, all segments & addresses.
Also if you scroll down the file you will find proper addresses of all variables for the bin.
So I think a2l file is very useful as reference for disassembling.
For example, here is clear description of segment structure, you can make same segments in IDA:
    ECU "MED91"
    /begin MEMORY_SEGMENT Pst20000 "" CODE EPROM EXTERN 0x20000 0x1A0000 -1 -1 -1 -1 -1
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x20000 /*mapping_adr:*/0x20000 /*length:*/0x1A0000 /end IF_DATA
    /begin IF_DATA ASAP1B_CCP ADDRESS_MAPPING /*orig_adr:*/0x20000 /*mapping_adr:*/0x20000 /*length:*/0x1A0000 /end IF_DATA
    /begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x20000 /*mapping_adr:*/0x20000 /*length:*/0x1A0000 /end IF_DATA
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Pst1F0000 "" CODE EPROM EXTERN 0x1F0000 0x10000 -1 -1 -1 -1 -1
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x1F0000 /*mapping_adr:*/0x1F0000 /*length:*/0x10000 /end IF_DATA
    /begin IF_DATA ASAP1B_CCP ADDRESS_MAPPING /*orig_adr:*/0x1F0000 /*mapping_adr:*/0x1F0000 /*length:*/0x10000 /end IF_DATA
    /begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x1F0000 /*mapping_adr:*/0x1F0000 /*length:*/0x10000 /end IF_DATA
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Pst0 "" CODE EPROM EXTERN 0x0 0x20000 -1 -1 -1 -1 -1
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x0 /*mapping_adr:*/0x0 /*length:*/0x20000 /end IF_DATA
    /begin IF_DATA ASAP1B_CCP ADDRESS_MAPPING /*orig_adr:*/0x0 /*mapping_adr:*/0x0 /*length:*/0x20000 /end IF_DATA
    /begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x0 /*mapping_adr:*/0x0 /*length:*/0x20000 /end IF_DATA
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Dst1C2000 "" DATA EPROM EXTERN 0x1C2000 0x2E000 -1 -1 -1 -1 -1
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x1C2000 /*mapping_adr:*/0x902000 /*length:*/0x2E000 /end IF_DATA
    /begin IF_DATA ASAP1B_CCP ADDRESS_MAPPING /*orig_adr:*/0x1C2000 /*mapping_adr:*/0x5C2000 /*length:*/0x2E000 /end IF_DATA
    /begin IF_DATA ASAP1B_KWP2000 ADDRESS_MAPPING /*orig_adr:*/0x1C2000 /*mapping_adr:*/0x5C2000 /*length:*/0x2E000 /end IF_DATA
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT ExtRam900000 "" VARIABLES RAM EXTERN 0x900000 0x2000 -1 -1 -1 -1 -1
        /* AsapMLXFm - CCP_V2_1 */
    /begin IF_DATA ETK ADDRESS_MAPPING /*orig_adr:*/0x900000 /*mapping_adr:*/0x900000 /*length:*/0x2000 /end IF_DATA
        /* AsapMLXFm - KWP2000 */
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Ram7F8000 "" VARIABLES RAM INTERN 0x7F8000 0x8000 -1 -1 -1 -1 -1
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Ram800000 "" VARIABLES RAM INTERN 0x800000 0x8000 -1 -1 -1 -1 -1
    /end MEMORY_SEGMENT
Logged
marrakech
Jr. Member
**

Karma: +0/-0
Offline Offline

Posts: 30


« Reply #23 on: June 15, 2015, 04:25:34 AM »

Yes that's right. I always use a2l files to get info about memory map for IDA )
Logged
TC
Newbie
*

Karma: +1/-2
Offline Offline

Posts: 16


« Reply #24 on: September 18, 2015, 01:36:58 PM »

OK all is clear about RAM ROM settings but how can I find correct TOC and SDA settings ?
Logged
gt-innovation
Sr. Member
****

Karma: +60/-90
Offline Offline

Posts: 449


« Reply #25 on: September 19, 2015, 11:36:36 AM »

I usually do it like that and this serves my purpose..


Step 1 : Open ida and press work on your own
setp 2 : Drag and drop med9.1 binary
step 3 : click select powerpc(ppc) cpu
step 4 : Set button
Step 5 : Click processor options
step 6 : Click and enter toc & Sda Address
    Toc address : 0x5c9ff0
    Sda address : 0x7ffff0
step 7 : Click ok and ok
Step 8 : On the memory organization window insert ram and rom values
    Ram : 0x600000 Size : 0x300000
    Rom : 0x000000 Size : 0x200000
    Loading address : 0x000000 size : 0x200000
Step 9 : Press ok and ok
Step 10: Click on file -> Load file -> load additional binary
Step 11: Insert Load segment : 0x0
      Loading offset : 0x5c0000
      File offset in bytes : 0x1c0000
      Number of bytes : 0x40000
step 12: Click ok & Done

i worte this to send to a friend some time ago so i think it will help anyone who needs to start reversing med9.1

« Last Edit: September 19, 2015, 11:59:36 AM by gt-innovation » Logged
dream3R
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 1194


« Reply #26 on: September 19, 2015, 11:59:42 AM »

I usually do it like that and this serves my purpose..


Step 1 : Open ida and press work on your own
setp 2 : Drag and drop med9.1 binary
step 3 : click select powerpc(ppc) cpu
step 4 : Set button
Step 5 : Click processor options
step 6 : Click and enter toc & Sda Address
    Toc address : 0x5c9ff0
    Sda address : 0x7ffff0
step 7 : Click ok and ok
Step 8 : On the memory organization window insert ram and rom values
    Ram : 0x600000 Size : 0x300000
    Rom : 0x000000 Size : 0x200000
    Loading address : 0x000000 size : 0x200000
Step 9 : Press ok and ok
Step 10: Click on file -> Load file -> load additional binary
Step 11: Insert Load segment : 0x0
      Loading offset : 0x5c0000
      File offset in bytes : 0x1c0000
      Number of bytes : 0x40000
step 12: Click ok & Done



Nice work, remember the SDA/TOC are platform independant
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
TC
Newbie
*

Karma: +1/-2
Offline Offline

Posts: 16


« Reply #27 on: September 20, 2015, 04:19:28 AM »

GT-Innovation thanks for a reply . in MED9 is clear ... but take a look on memory organisation in EDC16C35 in BMW ,  addresses of RAM INT are mixed with DATA FLASH . I cannot organise in simple way RAM and ROM :/

 /begin MEMORY_SEGMENT Pst8000 "" CODE FLASH INTERN 0x8000 0xB8000 -1 -1 -1 -1 -1
            ADDRESS_MAPPING
                /* origin addr  */ 0x8000
                /* mapping addr */ 0x8000
                /* length       */ 0xB8000

    /begin MEMORY_SEGMENT Pst100000 "" CODE FLASH INTERN 0x100000 0x100000 -1 -1 -1 -1 -1
 
            ADDRESS_MAPPING
                /* origin addr  */ 0x100000
                /* mapping addr */ 0x100000
                /* length       */ 0x100000

    /begin MEMORY_SEGMENT DstC0000 "" DATA FLASH INTERN 0xC0000 0x3DF78 -1 -1 -1 -1 -1
     
            ADDRESS_MAPPING
                /* origin addr  */ 0xC0000
                /* mapping addr */ 0x8C0000
                /* length       */ 0x3DF78

    /begin MEMORY_SEGMENT DstFDF78 "" RESERVED FLASH INTERN 0xFDF78 0x88 -1 -1 -1 -1 -1

            ADDRESS_MAPPING
                /* origin addr  */ 0xFDF78
                /* mapping addr */ 0x8FDF78
                /* length       */ 0x88
     
    /begin MEMORY_SEGMENT ExtRam8FE000 "" VARIABLES RAM EXTERN 0x8FE000 0x2000 -1 -1 -1 -1 -1
   
            ADDRESS_MAPPING
                /* origin addr  */ 0x8FE000
                /* mapping addr */ 0x8FE000
                /* length       */ 0x2000

    /begin MEMORY_SEGMENT Ram7F8000 "" VARIABLES RAM INTERN 0x7F8000 0x8000 -1 -1 -1 -1 -1
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Ram6F8000 "" VARIABLES RAM INTERN 0x6F8000 0x800 -1 -1 -1 -1 -1
    /end MEMORY_SEGMENT

    /begin MEMORY_SEGMENT Ram800000 "" VARIABLES RAM INTERN 0x800000 0x8000 -1 -1 -1 -1 -1
    /end MEMORY_SEGMENT
 
Logged
gt-innovation
Sr. Member
****

Karma: +60/-90
Offline Offline

Posts: 449


« Reply #28 on: September 21, 2015, 03:30:03 AM »

GT-Innovation thanks for a reply . in MED9 is clear ... but take a look on memory organisation in EDC16C35 in BMW ,  addresses of RAM INT are mixed with DATA FLASH . I cannot organise in simple way RAM and ROM :/
 

i did not see that you were talking about edc16c35 in the previous posts...Never tried to disassemble this one.But when you cross reference the sections you are interested in with a damos i am sure you will be able to find the correct toc/sda addresses.
Logged
dream3R
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 1194


« Reply #29 on: October 09, 2015, 01:24:46 PM »

R13 - read the cpu book
Logged



How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
Pages: 1 [2] 3
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.028 seconds with 18 queries. (Pretty URLs adds 0.001s, 0q)