360trev
Full Member
Karma: +68/-2
 Offline
Posts: 235
|
 |
« Reply #88 on: August 24, 2018, 12:17:09 AM »
|
|
|
And you can also use the same needle/mask approach to identify the location where these main rom checksums should end up going...
>>> Scanning for Main ROM Checksum sub-routine #2 [to extract stored checksums and locations in ROM]
main checksum byte sequence #2 block found at offset=0x6f894.
Stored Main ROM Block Checksum:
lo:0x7ffe0 hi:0x7ffe2 (seg: 0x21f phy:0x87ffe0) : 0xbbb0180a
Stored Main ROM Block ~Checksum:
lo:0x7ffe4 hi:0x7ffe6 (seg: 0x21f phy:0x87ffe4) : 0x444fe7f5
MAIN STORED ROM CHECKSUM: bbb0180a ? bbb0180a : OK! ~CHECKSUM: 444fe7f5 ? 444fe7f5 : OK!
Here's the needle I use for this ...
//
// this is the needle (masked) for the Main Checksum function to extract the stored checksum Hi & Lo Words
//
const unsigned char needle_3[] = {
0xF2, 0xF4, XXXX, XXXX, // mov r4, var_Y
0xF2, 0xF5, XXXX, XXXX, // mov r5, var_Y
0xD7, 0x50, 0x1f, 0x02, // extp #21fh, #2 <--- * this is the segment offset (should be 0x21f - LAST SEGMENT IN 512Kbyte ROM)
0x22, 0xF4, XXXX, XXXX, // sub r4, var_Y <--- * this is offset to the [EndFirmware_hi] word (stored checksum)
0x32, 0xF5, XXXX, XXXX, // subc r5, var_Y <--- * this is offset to the [EndFirmware_lo] word (stored checksum)
0x3D, XXXX, // jmpr cc_NZ, offset_XXXX
0xE6, 0xF4, XXXX, XXXX, // mov r4, #XXXXh
0xE6, 0xF5, XXXX, XXXX, // mov r5, #XXXXh
0xDC, 0x45, // extp r5, #1
0xA9, 0x64, // movb r13, [r4]
0x77, 0xF6, 0x08, 0x00, // orb r13, #8
0xE6, 0xF4, XXXX, XXXX, // mov r4, #XXXXh
0xE6, 0xF5, XXXX, XXXX, // mov r5, #XXXXh
0xDC, 0x45, // extp r5, #1
0xB9, 0x64, // mov [r4], r13
0x0D, 0x0E // jmpr cc_UC, +0xE
};
const unsigned char mask_3[] = {
MASK, MASK, SKIP, SKIP, // mov r4, var_Y
MASK, MASK, SKIP, SKIP, // mov r5, var_Y
MASK, MASK, MASK, MASK, // extp #21fh, #2 <--- * this is the segment offset (should be 0x21f - LAST SEGMENT IN 512Kbyte ROM)
MASK, MASK, SKIP, SKIP, // sub r4, var_Y <--- * this is offset to the [EndFirmware_hi] word (stored checksum)
MASK, MASK, SKIP, SKIP, // subc r5, var_Y <--- * this is offset to the [EndFirmware_lo] word (stored checksum)
MASK, SKIP, // jmpr cc_NZ, offset_XX
MASK, MASK, SKIP, SKIP, // mov r4, #XXXXh
MASK, MASK, SKIP, SKIP, // mov r5, #XXXXh
MASK, MASK, // extp r5, #1
MASK, MASK, // movb r13, [r4]
MASK, MASK, MASK, MASK, // orb r13, #8
MASK, MASK, SKIP, SKIP, // mov r4, #XXXXh
MASK, MASK, SKIP, SKIP, // mov r5, #XXXXh
MASK, MASK, // extp r5, #1
MASK, MASK, // mov [r4], r13
MASK, MASK // jmpr cc_UC, +0xE
};
|
