1

Upon performing a disassembly of a binary, I noticed that many of the subroutines have the wrong offset for the address. It seems that the byte preceding the 2 byte address is wrong. For example, in the screenshot below, the disassembly indicates the functions should be at 0xA5C1E and 0xA5BCA. I've double checked the raw hex dump and confirmed that there is an "A" byte before the 2 byte address. It's also interesting to note that addresses which start with "A" are impossible in this binary since it's only 0x7FFFF in length. Based on experience from other binaries, I know the true addresses for these functions should be 0x25C1E and 0x25BCA, respectively. I can also confirm that I have subroutines which start at these locations.

enter image description here

I've disassembled other binaries (different application, same processor) and this problem didn't appear. However, every binary I've disassembled from this application shows this problem.

Is there a way to correct this in IDA Pro? Does it have anything to do with my DPP register values?

Improve this question
4
  • 4
    I don't even know which processor or hardware this is, but 2 things come to mind. a) Your binary is intended to be loaded at 0x80000, but you're loading it to 0x00000. b) The hardware doesn't decode more than 19 address bits, so 0xa5c1e maps to 0x25c1e on the address bus, and the software uses address bit 19 as a kind of flag.
    – Guntram Blohm
    Commented Feb 10, 2015 at 3:55
  • Danke schön! You were exactly right about the loading offset! It took some fiddling around (and some searching on Google), but I think I figured it out. Do you want to post the same thing again as an "answer" so I can answer it appropriately?
    – r00kie
    Commented Feb 10, 2015 at 5:45
  • @GuntramBlohm The architecture is C166. It's an old Siemens/ST architecture that later became Infineon and is now used by Intel in their ultra low cost mobile solutions and Infineon in their embedded systems and industrial control systems. It's 16 bit and segmented. What are you working with r00kie if I may ask?
    – Peter Andersson
    Commented Feb 10, 2015 at 12:00
  • Impressive with such a small screenshot! It's an automotive ecu. :)
    – r00kie
    Commented Feb 10, 2015 at 23:15

1 Answer 1

Reset to default
2

Your broken addresses seem to be exactly 0x80000 plus the intended address.

There's two possibilities:

  • Your binary is intended to be loaded at 0x80000, but you're loading it to 0x00000.
  • The hardware doesn't decode more than 19 address bits, so 0xa5c1e maps to 0x25c1e on the address bus, and the software uses address bit 19 as a kind of flag.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.