3

I'm a total newbie with disassembly and code. I am trying to understand how the computer in my truck works (Dodge Ram with 5.9 Cummins). I know the vehicle control module uses a Motorola MPC555 processor and I've found the documentation containing the memory map here: http://www.nxp.com/assets/documents/data/en/product-briefs/MPC555PB.pdf

I'm curious if i'm on the right track because when i load the flash file into IDA Pro I set the processor to a motorola cpu32 since my exact processor isn't listed and skip establishing a ram which I think is incorrect. IDA Pro also asks me to find the entry point of the bin which by this processor I assume is the reset vector address of 0x100 according to page 2:

http://cache.freescale.com/files/microcontrollers/doc/app_note/AN2109.pdf

Can you guys tell me if I'm way off here? Thanks for any help you can give me.

Improve this question
6
  • well, did you actually try doing what IDA suggested or not? you kind of end with a cliffhanger here.
    – Igor Skochinsky ♦
    Commented Jun 23, 2017 at 17:48
  • Yes just went back and did it. loaded the binary and set cpu as motorola cpu32, left ram and rom options alone. Then went into IDA View window and hit "g" and searched for address 0x100 which as you can see below seems to have taken me right to the top of the bin file. So i assume this would mean that the entry point of the file is simply the beginning of the file for this processor? drive.google.com/file/d/0BxIxrvwjNVdAelI3NWlHd0JsX1U/…
    – Rob D
    Commented Jun 23, 2017 at 18:25
  • When I hit "c' at that address this is the code produced: drive.google.com/file/d/0BxIxrvwjNVdAN0pKYXU1Qk0ybk0/…
    – Rob D
    Commented Jun 23, 2017 at 18:29
  • CPU32 is a 68K derivative, you should use PPC.
    – Igor Skochinsky ♦
    Commented Jun 23, 2017 at 18:31
  • Holy Cow. That certainly changed things. i loaded PPC, and set it to mpc5xx, kept default options and now I have this: drive.google.com/file/d/0BxIxrvwjNVdAQVpDQWxOaW9aRlU/…
    – Rob D
    Commented Jun 23, 2017 at 18:45

1 Answer 1

Reset to default
1

Well, there are two main issues here.

First, even though PPC555 was made by Motorola, it did not use the 68000-derivative CPU32 core but the co-developed with IBM PowerPC core (I think at one point Motorola called it RCPU32, probably to further confuse people). So you should select "ppc" processor instead of CPU32 to get proper disassembly.

Then, raw firmware files do not have any metadata which would tell IDA where is the code and where's data. So it may try to scan for possible instructions in the whole file and convert some of them to code if they seem legit. In your case it did find some functions but apparently the bytes around the reset vector looked a bit iffy so it converted them to data instead. This is easy to fix though - just undefine (U) wrong data and create code (C) at the correct location.

Improve this answer
5
  • So I went to 0x100 and undefined it, then created code. It seems to have produced a Branch to a different address as shown: drive.google.com/file/d/0BxIxrvwjNVdAVkticDlzSi10TmM/…
    – Rob D
    Commented Jun 23, 2017 at 19:55
  • @RobD yes, it's very common to have a branch to the actual handler in the interrupt vectors. Sometimes you get only four bytes per vector so need to put most of the code somewhere else.
    – Igor Skochinsky ♦
    Commented Jun 23, 2017 at 19:58
  • great you've really helped me here thank you. I guess now it's just a matter of learning the assembly code and trying to figure out what the functions do...
    – Rob D
    Commented Jun 23, 2017 at 20:04
  • drive.google.com/file/d/0BxIxrvwjNVdAUm5RX09RZ091bWs/… Ive renamed this as you can see to ECM Power on. Am i correct in my code that this function is commanding the clearing of registers 9 and 10, then storing something back into register 9, loading register 29, not sure what the references to r0 are doing... Does the code flow in order as I've interpreted it?
    – Rob D
    Commented Jun 23, 2017 at 20:31
  • it looks like the last code is BLR, branch to link register; but there is no address. How can I find the address this brach command is heading to?
    – Rob D
    Commented Jun 26, 2017 at 22:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.