Hi everybody,

I was reading the 'Bosch Me7 IDA plugin' topic very thoroughly starting from here http://nefariousmotorsports.com/forum/index.php/topic,35.msg976.html#msg976 and got confused about who is right.

So, Andy's  suggestion is (http://www.andywhittaker.com/en-us/ecu/disassemblingaboschme755.aspx):
1. Load lower 64K of ECU stock file to 0x0000
2. Create 64K of RAM at 0x380000
3. Load the rest of ECU stock file to 0x810000
4. Set DPP0 = 204h, DPP1 = 205h, DPP2 = E0h, DPP3 = 3

From other side, Tony's and Spen's suggestions coincide:
1. Load all ECU stock file to 0x800000
2. Set DPP0 = 204h, DPP1 = 205h, DPP2 = E0h, DPP3 = 3

Now, let's take into account the following facts:
1. ECU ROM is 512K, so it's impossible to fit 1Mb ECU stock file size in ECU ROM starting at 0x800000.
2. Interrupt vectors start at 0, so it looks like at least 1-st 64K really should be loaded to 0, not 0x800000
3. RESET_handler sets DPP0 = 0, so where 204h is taken from at all?
So, who is right here and what is exact correct way of loading a ECU stock file to disassembler?

Thanks in advance.

No.
First you must load C167 CPU 32K-dump to address area 0000...7FFF.
Than create and add other RAM-ROM segments as additional files.

Clarificatoin about 32-kb dump of CPU programm.
It isn't first 32k of main stock dump that contain flash chip. It's internal content of CPU and it differs from content of start part of flash.
The rest of segment (8000...FFFF) is internal registers and internal CPU RAM. See datasheets for C167 processor for details.
External RAM and ROM are mapped on 380000 and 800000  respectively.
 

The problem is that both people doesn't take in account CPU internal programm code.
When you disasm main flash code you will see some "jumps" and "calls" addressing to 0000...7FFF.
But if you see these addrs remapped from 800000 to 0000 these calls and jumps will be targeted to wrong subroutines entry points.
What software dump do you plan to disasm?
Give me SW number and I wiil post CPU internal dump for this ECU.
Than you try to disasm using the method described above.

 

Gremlin, thank you very much for clarification and example! To summarize, the 0x800000-0x808000 range can either duplicate CPU ROM or contain come code using during boot, correct?

If so, then the meaning of next 32k can vary as well depending on what first 32k means, correct? And what is the purpose of this area at all?

Thanks

AFAIK there is 4 version of CPU dumps for VAG ME7.x ECUs family for turbo engines.
Unfortunately CPU chip marking can be different for chips having inside equal dumps.
But it's no problem to read CPU content using boot-mode and C167 software tools like minimon for example.
 

This is the memory layout of the ME7.1:
0x0-0x7FFF: Internal ROM on the C167 processor
0xE000-0xFFFF: Internal RAM on the C167 processor
0x380000-0x38FFFF: External RAM
0x800000-0x8FFFFF: External Flash

The bin files that everyone reads off of their ECU are the external flash memory in the starting at 0x800000.

The only way to read the internal ROM from 0x0 to 0x7FFF is in boot mode. All of the OBD communication protocols prevent reading the internal ROM memory region.

The code in the internal ROM forwards some interrupts to the code in the external Flash. That is why it looks like there are interrupt vectors at 0x800000, because the internal ROM code forwards to there.

I can 100% guarantee the DPP registers are set as such:
DPP0: 0x0204
DPP1: 0x0205
DPP2: 0x00E0
DPP3: 0x0003

I'm newbie with ida pro and assembler, but after watching andy videos and reading this, cant understand how to load whole bin file to 0x800000 address without splitting.
Could someone tell me what values to write into window (attached image)? I've checked my DPP0...3 and they're same in Andy video. But after identifying DPP... He splits file into two parts and then sets RAM start address @ 0x380000and uses default for ROM...