Pages: 1 ... 135 136 [137] 138 139 ... 182
Author Topic: The Volvo ME7 thread:  (Read 1078255 times)
BaxtR
Full Member
***

Karma: +17/-25
Offline Offline

Posts: 64


« Reply #2040 on: January 17, 2023, 01:28:32 PM »

It depends on hardware. For example for EC.2 ECM it should be here:
Code:
ROM:000408B8                 mov     r2, F_AD11    ; F_AD11 = 0xF2C6
ROM:000408BC                 and     r2, #3FFh
ROM:000408C0                 mov     word_30198E, r2

Next is example from 50WRHJ software.
This variable is used here:
Code:
ROM:00076AA4                 mov     r4, word_30198E
ROM:00076AA8                 shr     r4, #2
ROM:00076AAA                 movb    byte_3015C1, rl4
Then here:
Code:
ROM:000CAD6E                 movb    rl1, byte_3015C1
ROM:000CAD72                 cmpb    rl1, byte_1458D ; looks like threshold for clutch pressed state
ROM:000CAD76                 jmpr    cc_ULE, loc_CAD7C

And later B_kuppl bit is set:
Code:
ROM:000CADC0                 bset    word_FD64.9     ; 9 - B_kuppl - clutch pressed
ROM:000CADC2                 bset    word_FD64.10    ; 9 - B_kuppl - clutch pressed


Any tips on using IDA to find maps? Currently trying to define a map pack but my damos and the bin im trying to define are quite different.. having trouble lining some axis up..
Logged

2007 Volvo S60R, PT6266 BB, 1700x ID Injectors, Walbro525. Halme Built manifold and exhaust #BaxtrPerformance
prometey1982
Sr. Member
****

Karma: +70/-60
Offline Offline

Posts: 323



WWW
« Reply #2041 on: January 17, 2023, 02:08:33 PM »


Any tips on using IDA to find maps? Currently trying to define a map pack but my damos and the bin im trying to define are quite different.. having trouble lining some axis up..
There is a dozen of map lookup functions in me7. Just identify they and you'll understand where is lookup call. Some functions use single register for address. In such case DDP approach is used. Other functions use two registers for address. In this case one register contains page offset and other - page. To get absolute address you need page * 0x4000 + offset. Also some functions pass arguments by stack. Because number of arguments is huge.

To identify axis you have to find where axis value is set. And you'll saw map lookup function call with axis value.

Some maps has size and axis before data. WinOLS automatically identify some of such bosch maps.
Logged

Россия - Великая страна!
https://youtu.be/fup5GzIFdXk
prj
Hero Member
*****

Karma: +1072/-480
Offline Offline

Posts: 6035


« Reply #2042 on: January 18, 2023, 04:16:00 AM »

It's also a good idea to understand what is a __near ptr and what is a __far ptr and how they are passed in the EABI used by Tasking Classic Compiler and Keil Compiler.
Remember, the ECU code was written in C.

R12-R15 registers are using for passing variables, R4 and R5 for returning.
The rest is passed on stack.
Logged

PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #2043 on: January 19, 2023, 05:37:36 AM »

Python dumper for Denso SH7055 with SBL attached. The SBL sends(spams) the contents of the specified address over CAN. Fast, but in some cases there could be dropped bytes due to certain edge cases, such as entirely absent frames to a protocol error. The SBL is not aware of those and continues to send data.

The code could be optimized more by utilizing the 29 bit extended ID to cram more data, potentially getting up to 11 bytes per can message. Or it can be used a pointer to the address and contents being sent.
Further optimization could be employed similar to compressors where repeatable data is marked as <size>#repeatedbyte saving even more time, but only for very large data.
« Last Edit: January 19, 2023, 05:45:22 AM by dikidera » Logged
t6
Full Member
***

Karma: +0/-5
Offline Offline

Posts: 55


« Reply #2044 on: January 21, 2023, 02:12:28 PM »

You have to modify some constants in the code. I posted WinOLS file in this thread with my learn burn modifications.

   Need your help in finding the addresses in QHHJ,
 these are addresses from your winlos file A0A06 , A0C6E
Logged
prometey1982
Sr. Member
****

Karma: +70/-60
Offline Offline

Posts: 323



WWW
« Reply #2045 on: January 22, 2023, 01:22:53 AM »

  Need your help in finding the addresses in QHHJ,
 these are addresses from your winlos file A0A06 , A0C6E
The code from 50QHHJ is different to 50WRHJ. So you still need to analyze memory variables with logger during drive. Constants are you need placed inside this function
Quote
ROM:000927BE sub_927BE:
Here is IDA project with some needed variables https://cloud.mail.ru/public/eqsu/ocRSX3WmP
Logged

Россия - Великая страна!
https://youtu.be/fup5GzIFdXk
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #2046 on: January 25, 2023, 09:12:24 AM »

Well with a lot of my changes in place, I will soon test them out on the car.

On my CAN boards I have permanently shorted the 120 ohm terminator, this works fine for the bench, but on the car with the CEM, would there be any issues?
Additionally, I believe my 2005+ CEM does not have a diagnostic relay so I should be ok in connecting via CAN and no kline needed.

Last time when sending FF86 on the HS bus, my car was rebooting for some reason, but now that I can communicate via the LS as well, I think there should be no problem if I send both BUS-es this command.

« Last Edit: January 25, 2023, 09:26:36 AM by dikidera » Logged
s60rawr
Full Member
***

Karma: +19/-1087
Offline Offline

Posts: 170



« Reply #2047 on: January 26, 2023, 08:28:47 AM »

   Need your help in finding the addresses in QHHJ,
 these are addresses from your winlos file A0A06 , A0C6E

i had on my drive. lmk. i didnt check it tbh

Logged


There is a free flash suite in progres

-Karma Sponge
luki743
Newbie
*

Karma: +2/-0
Offline Offline

Posts: 18


« Reply #2048 on: January 28, 2023, 12:15:07 PM »

@dikidera
Here is an A6 list made from tables in your CPU and External Flash files.
I'm not sure what you have seen in your files.

Is the RAM address taken from the VIDA database? In SQL I only found addresses such as 0x1001, 0x1002 etc. but no RAM addresses.
Maybe it is possible to convert address from 0x1002 to RAM address? (In IDA)
Logged
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #2049 on: January 28, 2023, 06:02:07 PM »

Is the RAM address taken from the VIDA database? In SQL I only found addresses such as 0x1001, 0x1002 etc. but no RAM addresses.
Maybe it is possible to convert address from 0x1002 to RAM address? (In IDA)
Actually I missed his zip file, rkam is a saviour Smiley I can at least label some data.

He has his ways. Has been around Volvo much longer, has better tools. Is pretty much the father of the whole volvo tuning scene.

Anyway, I am abusing the ECU a bit by writing custom interrupt routines. I have an SBL and can overwrite the internal FLASH at any point in time, but any and I mean any problem, and I am left with a bricked ECU. An alternative is to abuse the available tools, the PBL's write-what-where functions and my own custom SBL and the internal debug peripherals, such as UBC and AUD. One problem is that the reset vectors when called will disable reset the chip, reset the UBC, possibly clear out RAM and my SBL goes the way of the dodo.

When the chip is reset, it will disable AUD, we need to steer the execution such, that we skip the instruction that updates the MSTCR register. The AUD is not very powerful, but it will output every branch address and then we can correlate this with the main event loop that streams ECU data and/or handles the A6 command, although I am more interested how CAN is accessed indirectly. This technique may yet work with just UBC, but it means we have to get creative.

However there are several ways for the ECU to reset itself(I obviously cannot verify this), pointers to poweron and main are laid out in many many locations, part of function pointer tables, bypassing the VBR.

Also, no wonder the CAN registers are hidden. My own SBL when compiled with GCC had the offset "obfuscated" by taking one unrelated address, adding an absurdly large number such as 3F7C5243 producing my intended address. This had me confused for a while and running in circles debugging my code only to find out it was working just fine.
« Last Edit: January 28, 2023, 06:08:26 PM by dikidera » Logged
rkam
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 55


« Reply #2050 on: January 29, 2023, 03:13:42 PM »

The RAM addresses are from the binary file.

Find something like this (for ME7):

mov     r4, r12
sub     r4, #1000h          ;  Search for this
cmp     r4, #3CFh
jmpa    cc_UGT, locret_38FD6
shl     r4, #1
add     r4, #25C4h   ;Flash 125C4
mov     r4, [r4]
jmpi    cc_UC, [r4]


Get jump addresses from address above.
125C4: CE8F EE73 F473 FC73 0474 0A74 1074 1674 2074 2674 3074 3674 3E74

Each jump address points to a subroutine that most often reads a RAM address.
Then you can link the parameter number with a RAM address for your binary.

1000: 8FCE
1001: 73EE
1002: 73F4
1003: 73FC
1004: 7404
1005: 7410
1006: 7416 RAM 304752
1007: 7420
1008: 7426 RAM 3046FC
1009: 7430
100A: 7436
« Last Edit: January 29, 2023, 03:22:37 PM by rkam » Logged
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #2051 on: January 29, 2023, 03:24:56 PM »

Is this the same methodology you used for my A6 param list in Denso?

I looked around and yes I see the A6 param list, but the algorithm for parameter discovery is a bit more complicated. It does not seem to be a linear table where every parameter such as 1000 then 1001 corresponds to the next function pointer. In fact parameter 1001 is further in the list than param 1005, according to your zip file.

« Last Edit: January 29, 2023, 03:29:13 PM by dikidera » Logged
rkam
Full Member
***

Karma: +4/-0
Offline Offline

Posts: 55


« Reply #2052 on: January 29, 2023, 03:49:32 PM »

No. Denso was a bit different.
There is a list of parameter numbers with a number that is the position in another table. This then points to an address where the value is retrieved from RAM or by  other calculation.
Logged
dikidera
Full Member
***

Karma: +8/-8
Offline Offline

Posts: 149


« Reply #2053 on: January 29, 2023, 04:37:13 PM »

Hehe, needlessly complicated. Look at what my GCC outputted.

Address FFFFB000. My original vector table is at address 7FC58 and it needs to lay in FFFFB000. How do we calculate the address?

We take this seemingly random constant, 0x3FF7EFA8 then we do 3FF7EFA8 + 7FC58 = 0x3FFFEC00 looks close. 0x3FFFEC00  << 2 = 0xFFFFB000.

The constant isn't random you can easily see this, but imagine this kind of code in the whole ROM. Offsets for all mmio registers are hidden like this, probably.
Logged
BaxtR
Full Member
***

Karma: +17/-25
Offline Offline

Posts: 64


« Reply #2054 on: January 29, 2023, 08:59:39 PM »

Updated QHHJ... Getting better, needs sorting but majority of the maps youll ever need are there and good... Feedback welcome
Logged

2007 Volvo S60R, PT6266 BB, 1700x ID Injectors, Walbro525. Halme Built manifold and exhaust #BaxtrPerformance
Pages: 1 ... 135 136 [137] 138 139 ... 182
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.036 seconds with 18 queries. (Pretty URLs adds 0.00099999999999999s, 0q)