0

Recently I work on Tricore Arch to reverse an algorithm. But I had a problem to find a constant value(4 byte). the line of code shown below:

ld32.w          d4, [a0]-0x68D4

I know a0 = 0xD00032E0 but it seems I need to find the equivalent copy_block that tells I where d000032e0 was copied to.

1- basically what is Copy_Block in tricore?
2- How I can find copy_block?

Thanks

Improve this question
2

1 Answer 1

Reset to default
2

So, the term copy_block seems to be an invention of the forum poster. It is not specific to Tricore but a general approach used in many embedded firmwares to solve the following problem:

The firmware runs from read-only flash memory, but in some situations you need parts of it in RAM, either because you need writable data, or for speed (often code in RAM runs much faster than from flash).

To solve this, usually there is some code which performs copying of blocks of data from flash to RAM, and it can us either hardcoded addresses or a separate table. Generally, such table would consist of multiple records (which are called copy_block by the poster) with the following information:

  1. Source address (address of original data in flash)

  2. Target address (destination in RAM)

  3. Size of data to copy

There is no standard procedure to find such routines; basically you need to look for functions that copy data around and possibly get the addresses and size from a table. Usually such functions are called early in the firmware initialization process.

After identifying the routine you can simulate its behavior by copying the bytes from FLASH to RAM segments using information from the table. A script similar to memcpy.idc shipped with IDA could be used for this.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.