Pages: 1 [2] 3
Author Topic: Bosch ME7 IDA Plugin  (Read 60405 times)
360trev
Full Member
***

Karma: +66/-2
Offline Offline

Posts: 235


« Reply #15 on: January 08, 2011, 04:59:21 PM »

Q. Does this IDA Bosch ME7 plugin only support 'some' variants of Bosch ME ?

Andy did quite a bit of hardcoding in that code. Must have written it fast, fast, fast.

Noticed in the segments section of the C++ code it does the following (hardcoded)
-without any ability to change from a config file.
Same thing goes for the function signatures it finds. All of them hardcoded with no ability to extend or modify the signature names for both functions and data that it finds... Sad

Here's the CreateSegmemts() function (C++ code)...

---cut---cut---cut---cut---cut---cut

  if (NewBoschME7111)
  {
    result = BoschHelper::CreateC16xSmallBoschSegments(0x00000, 0x08000, "MEM_EXT",  "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x08000, 0x0E000, "MEM_EXT",  "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0E000, 0x0E800, "XRAM",     "DATA", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0E800, 0x0EF00, "RESERVED", "BSS",  44, 45, 60, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0EF00, 0x0F000, "CAN1",     "DATA", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0F000, 0x0F200, "E_SFR",    "DATA", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0F200, 0x0F600, "RESERVED", "BSS",  44, 45, 60, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0F600, 0x0FE00, "IRAM",     "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0FE00, 0x10000, "SFR",      "DATA", 44, 45, 60, 3);
   
   result = BoschHelper::CreateC16xBoschSegments(0x01000, 4, "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x02000, 4, "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x03000, 4, "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x04000, 4, "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x05000, 4, "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x06000, 4, "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x07000, 4, "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x08000, 4, "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x09000, 4, "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x0A000, 4, "CODE", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x0B000, 4, "DATA", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x0C000, 4, "DATA", 44, 45, 60, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x0F000, 4, "RAM",  44, 45, 60, 3);
  }
  else
  {
    result = BoschHelper::CreateC16xSmallBoschSegments(0x00000, 0x08000, "MEM_EXT",  "CODE", 0, 1, 2, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x08000, 0x0E000, "MEM_EXT",  "CODE", 0, 1, 2, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0E000, 0x0E800, "XRAM",     "DATA", 0, 1, 2, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0E800, 0x0EF00, "RESERVED", "BSS",  0, 1, 2, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0EF00, 0x0F000, "CAN1",     "DATA", 0, 1, 2, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0F000, 0x0F200, "E_SFR",    "DATA", 0, 1, 2, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0F200, 0x0F600, "RESERVED", "BSS",  0, 1, 2, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0F600, 0x0FE00, "IRAM",     "CODE", 0, 1, 2, 3);
    result = BoschHelper::CreateC16xSmallBoschSegments(0x0FE00, 0x10000, "SFR",      "DATA", 0, 1, 2, 3);
   
    result = BoschHelper::CreateC16xBoschSegments(0x38000, 2, "DATA", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x80000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x81000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x82000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x83000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x84000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x85000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x86000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x87000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x88000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x89000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x8A000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x8B000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x8C000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x8D000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x8E000, 4, "CODE", 516, 517, 224, 3);
    result = BoschHelper::CreateC16xBoschSegments(0x8F000, 4, "CODE", 516, 517, 224, 3);
  }

---cut---cut---cut---cut---cut---cut

and the 'MakeDiss()' function

---cut---cut---cut---cut---cut---cut


char MakeDissCode(int NewBoschME7111_Mode)
{
  char result;

  if ( BoschME7111_Mode )
  {
    result = Create_Dissassembly(0x00000, 0xA7FFF);
    result = Create_Dissassembly(0xC0000, 0xCDFFF);
  }
  else
  {
    result = Create_Dissassembly(0x000000, 0x0001FF);
    result = Create_Dissassembly(0x000700, 0x007FFF);
    result = Create_Dissassembly(0x800000, 0x810000);
    result = Create_Dissassembly(0x830000, 0x8FFF00);
  }
  return result;
}


---cut---cut---cut---cut---cut---cut

Perhaps I need to re-write the entire thing...
« Last Edit: January 08, 2011, 05:08:36 PM by 360tee » Logged
Tony@NefMoto
Administrator
Hero Member
*****

Karma: +130/-4
Offline Offline

Posts: 1389


2001.5 Audi S4 Stage 3


« Reply #16 on: January 20, 2011, 01:19:24 PM »

My suggestion would be to use Andy's plugin as an example and write your own.
Logged

Remember you have to log in if you want to see the file attachments!
Info or questions, please add to the wiki: http://www.nefariousmotorsports.com/wiki
Follow NefMoto developments on Twitter: http://twitter.com/nefmoto
360trev
Full Member
***

Karma: +66/-2
Offline Offline

Posts: 235


« Reply #17 on: January 04, 2013, 04:55:10 PM »

I know this is an old topic but here goes...

Anyone fancy contributing to re-writing Andy's old plug-in as an source project that we can all contribute too?
Andy has pretty much given up on the old one so here is some inspiration to get you guys started.. this will need porting to the IDA plug-in dev kit!

The attached bits are a "work-in-progress" reverse into C. I looked at Andy's old IDA plug-in to see how he did it and surprisingly its actually very simple stuff actually so I will re-write it from scratch. Watch this space. I will put all my work on git hub...

Here's a great starting place to learn how to write an IDA plug-in...

http://www.binarypool.com/idapluginwriting
« Last Edit: January 05, 2013, 04:24:01 AM by 360trev » Logged
360trev
Full Member
***

Karma: +66/-2
Offline Offline

Posts: 235


« Reply #18 on: January 05, 2013, 05:48:22 AM »

Right, latest update on this. (If anyone is interested)  Huh

I have now downloaded a sample IDA plugin and installed VC++ 2010 express (free edition).

I too have now built a basic plugin this morning that can walk through the entire functions list in the buffer. I've just tested it and yes it works (yipee!). The first thing I did was search for known signatures by using the signature/mask function searched from our Open Source ME7 Checksum tool (thanks nyet!), so far it only knows how to find a couple of functions (!) but I will add more signatures [I'll make the signature use an external config file so you DON'T have to re-compile the plugin].

So in forthcoming days I will clean this lot up and upload the entire plugin and sources onto github, so you'll be free to add to contribute to it and make a really useful Bosch ME plugin! Yes you'll be able to add your own config with the ini file loader (again from our other project!).

Things are looking promising!
Logged
littco
Hero Member
*****

Karma: +52/-7
Offline Offline

Posts: 903


« Reply #19 on: January 05, 2013, 06:09:34 AM »

Brilliant..

Sounds very promising, I will be very keen to see this as spent a lot if time recently on Ida
Logged
360trev
Full Member
***

Karma: +66/-2
Offline Offline

Posts: 235


« Reply #20 on: January 05, 2013, 06:13:57 AM »

Brilliant..

Sounds very promising, I will be very keen to see this as spent a lot if time recently on Ida

Wasn't sure if anyone cared anymore. Its quite old now.

Here's the latest trace using Andy's signature names db. We really need better names, anyone got a good IDB file that I could take them from or is this something we need to do too?

Code:
NefMotoBoschME7x plugin: 
Version: 0.1 Alpha
Last Built: Jan  5 2013 (14:01:05) by 360trev

Found 'LookupA_803826' at 00803826
Found 'LookupB_803866' at 00803866
Found 'LookupC_8038a6' at 008038A6
Found 'LookupD_8038ee' at 008038EE
Found 'LookupE_803936' at 00803936
Found 'LookupF_8039ba' at 008039BA
Found 'LookupG_803a50' at 00803A50
Found 'LookupH_803ad4' at 00803AD4
Found 'LookupI_803b6a' at 00803B6A
Found 'LookupJ_803bde' at 00803BDE
Found 'LookupK_803c58' at 00803C58
Found 'LookupL_803cd0' at 00803CD0
Found 'LookupM_803d4a' at 00803D4A
Found 'LookupN_803e36' at 00803E36
Found 'LookupO_803f52' at 00803F52
Found 'LookupP_803f98' at 00803F98
Found 'LookupQ_803fde' at 00803FDE
Found 'LookupR_80402c' at 0080402C
Found 'LookupS_80407a' at 0080407A
Found 'LookupT_8040a0' at 008040A0
Found 'LookupU_8040ae' at 008040AE
Found 'LookupU_8040be' at 008040BE
Found 'LookupV_8040ce' at 008040CE
Found 'WLookup1DIAT_8040dc' at 008040DC
Found 'LookupX_804102' at 00804102
Found 'LookupY_804134' at 00804134
Found 'LookupZ_804166' at 00804166
Found 'LookupAA_80424e' at 0080424E
Found 'WLookup2DBoost_8042ea' at 008042EA
Found 'LookupAC_804386' at 00804386
Found 'LookupAD_8043b6' at 008043B6
Found 'LookupAE_8043e6' at 008043E6
Found 'LookupAF_804456' at 00804456
Found 'Do803cChksumLoop_80602a' at 0080602A
Found 'ReadADC1_80790e' at 0080790E
Found 'SetupADC_80793e' at 0080793E
Found 'ReadADC2_807966' at 00807966
Found 'EnableADC_807a56' at 00807A56
Found 'CANWriteToMsgController_807b90' at 00807B90
Found 'CANStuff1_807bea' at 00807BEA
Found 'CopyROMtoRAM_80dc70' at 0080DC70
Found 'ReadADC3_80de6a' at 0080DE6A
Found 'WLookup1D_CTS_824000' at 00824000
Found 'BLookup2D_Fuel_8240a0' at 008240A0
Found 'WLookup2D_Spark_8241ce' at 008241CE
Found 'SetDTCME71_82ea26' at 0082EA26
Found 'CRC32ME75_86be6e' at 0086BE6E
Found 'CRC32ME71Sub_86bedc' at 0086BEDC

Getting there Wink
Logged
littco
Hero Member
*****

Karma: +52/-7
Offline Offline

Posts: 903


« Reply #21 on: January 05, 2013, 06:29:20 AM »

Think rajiv66 might the man for an idb. I gave up with Angus plugin as it seemed very hit or miss whether it worked or not.

I'm Definately interested but know nothing about coding so input will be limited but I like soduko so happy to descramble :-)
Logged
360trev
Full Member
***

Karma: +66/-2
Offline Offline

Posts: 235


« Reply #22 on: January 05, 2013, 06:33:41 AM »

Think rajiv66 might the man for an idb. I gave up with Angus plugin as it seemed very hit or miss whether it worked or not.

I'm Definately interested but know nothing about coding so input will be limited but I like soduko so happy to descramble :-)

No need to be a coder to help us, we will require testers too as well as people to find signatures, maps, etc..

Just think how many variants of dumps we have on here to test alone!
Logged
prj
Hero Member
*****

Karma: +915/-427
Offline Offline

Posts: 5840


« Reply #23 on: January 05, 2013, 06:55:22 AM »

I made a macro that loads a binary into ida properly and allows you to quickly convert everything needed to code.
As for identifying functions, well I don't know.

If you have seen the function once, then it won't be too hard to find in any other binary, since you pretty much know exactly what to look for.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
lulu2003
Full Member
***

Karma: +11/-1
Offline Offline

Posts: 242



« Reply #24 on: January 16, 2013, 06:01:42 AM »

macro ...and allows you to quickly convert everything needed to code.

any quick tip to get that -> next unexplored -> create function loop done inside IDA?
Logged
prj
Hero Member
*****

Karma: +915/-427
Offline Offline

Posts: 5840


« Reply #25 on: January 16, 2013, 06:23:28 AM »

any quick tip to get that -> next unexplored -> create function loop done inside IDA?


No idea, I just wrote a macro, haven't explored IDA commands.
Logged

PM's will not be answered, so don't even try.
Log your car properly.
Joe_Jinkx
Newbie
*

Karma: +1/-0
Offline Offline

Posts: 9


« Reply #26 on: January 16, 2013, 01:22:45 PM »

Thanks for the head start on this. I'll take a look at the plugin when I have time, and let you know what I find.

Joe
Logged
lulu2003
Full Member
***

Karma: +11/-1
Offline Offline

Posts: 242



« Reply #27 on: January 17, 2013, 04:47:19 PM »

No idea, I just wrote a macro, haven't explored IDA commands.

you mean that auto it makro?
works fine for me, thanks!
Logged
360trev
Full Member
***

Karma: +66/-2
Offline Offline

Posts: 235


« Reply #28 on: January 20, 2013, 03:12:31 AM »

Sorry guys, been very busy lately with work so haven't had any time to play with this. I did however get working a tool which is already very useful (to me anyway). I can now dump all of the individual binary functions out of a dump directly into separate files. I can then compare them with dumps from other me7's. The goal here is to be able to auto detect ALL equivalent rom functions and then easily look up the actual addresses of information using that approach (such as checksum boundary locations, etc.). Its close to being useful and as soon as I get some free time I will post the whole thing on github...

 
Logged
360trev
Full Member
***

Karma: +66/-2
Offline Offline

Posts: 235


« Reply #29 on: January 20, 2013, 03:21:58 AM »

Here's the main 'business function' that finds all the functions and dumps them into separate files...
Ironically due to the flexible way IDA api's are built the dumping of binaries for individual functions works across any cpu architecture, not just c167...

Here's the main code snippet for interested parties... once cleaned up and doing all the useful stuff I will release it properly...

Code:
static void PlugIn_process(int iArg)
{
  char funcName[MAXSTR];
  char filename[MAXSTR];
  char mnem[MAXSTR];
  char tmp[1024*512];
  int offset=0;
  int inst_count,func_len;
  unsigned int x, num_funcs, num_segments;
  ea_t addr, start_addr;
  asize_t our_size;
  flags_t flags;
  func_t *f=0;
  segment_t *seg=0;

  // We are only interested in segments containing code.
  seg = getnseg(0);
  num_funcs = get_func_qty();

         // Loop through each function
  msg("Found <%d> functions\n",num_funcs);

for (x = 0; x < num_funcs; x++)
        {
        f = getn_func(x);      // get ptr to the function itself
if(f == 0) {
msg("func not found at address %p\n");
}
else
{
// start address of this function..
start_addr = f->startEA;
addr = start_addr;

get_func_name(addr, funcName, sizeof(funcName)-1); // find the function name
//      set_name(addr, new_funcName, SN_NOWARN);

flags = get_flags_novalue(addr);
msg("Found %-32.32s: at %p, func_flags(%lx)",funcName,addr,flags);
//  Add name if there's no meaningful name assigned.
if(has_name(flags) != 0)       { msg("(customized name   ) "); }
if(has_dummy_name(flags) != 0) { msg("(autogenerated name) "); }
if(has_auto_name(flags) != 0)  { msg("(has_auto_name     ) "); }

//
// calc number of instructions
//
inst_count = 0;
addr = start_addr; // start of function
func_len   = ((f->endEA)-(start_addr));

// count the number of instructions within the function
for (; addr < f->endEA;) {
  // Get the flags for this address
  flags = get_flags_novalue(addr);
  // Only look at the address if it's a head byte, i.e. the start of an instruction and is code.
  if (isHead(flags) && isCode(flags))  {   
  inst_count++; // increase number of instructions counter we have seenn within this function
  }
  our_size = get_item_size(addr); // get number of bytes within this function
  addr += our_size;                 // move addres pc to next instruction...
}
//
// at this point 'inst_count' is total number of asm instructions within the buffer
//
msg(" func len = %-8d bytes (%-8d instructions)\n",func_len, inst_count );

sprintf(filename,"c:\\bin\\%p_%s_%d.bin",start_addr,funcName,inst_count);

#if 1
addr = start_addr; // start of function
offset=0;
// lets now loop through the instructions in each function
for (; addr < f->endEA;)
{
  // Get the flags for this address
  flags = get_flags_novalue(addr);

    // get the size of this item (e.g. instruction length)
  our_size = get_item_size(addr);

  // Only look at the address if it's a head byte, i.e.
  // the start of an instruction and is code.
  if (isHead(flags) && isCode(flags))
  {   
char instruction[16];

// Fill the cmd structure with the disassembly of the current address and get the mnemonic text.
ua_mnem(addr, mnem, sizeof(mnem)-1);

ua_ana0(addr);
ua_mnem(addr, instruction, sizeof(instruction));
tag_remove(instruction, instruction, sizeof(instruction));

// lets view the mnemonic of *this* address
// msg("%p:[%-2.2d] ", addr, our_size);
#if 1
msg(".");
get_many_bytes(addr,&tmp[offset],our_size);
offset += our_size;
#else
for(int j=0;j < our_size; j++)
{
tmp[j] = get_byte(addr+j);
}
#endif
// show the hex dump of the instruction
// hex_dump((unsigned char *)&tmp[offset], our_size);
// show the mnemonic of the instruction
// msg(" %-8.8s\n",instruction);
  }
  // move addres pc to next instruction...
  addr += our_size;
}

// dump it..
msg("dumping %s\n",filename);
save_file(filename, (unsigned char *)tmp, (size_t)offset);

#endif
}//end if

  }//end for
}


Enjoy!
Logged
Pages: 1 [2] 3
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.031 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)