3

I'm a total newbie with disassembly and code. I am trying to understand how the computer in my truck works (Dodge Ram with 5.9 Cummins). I know the vehicle control module uses a Motorola MPC555 processor and I've found the documentation containing the memory map here: http://www.nxp.com/assets/documents/data/en/product-briefs/MPC555PB.pdf

I'm curious if i'm on the right track because when i load the flash file into IDA Pro I set the processor to a motorola cpu32 since my exact processor isn't listed and skip establishing a ram which I think is incorrect. IDA Pro also asks me to find the entry point of the bin which by this processor I assume is the reset vector address of 0x100 according to page 2:

http://cache.freescale.com/files/microcontrollers/doc/app_note/AN2109.pdf

Can you guys tell me if I'm way off here? Thanks for any help you can give me.

1

Well, there are two main issues here.

First, even though PPC555 was made by Motorola, it did not use the 68000-derivative CPU32 core but the co-developed with IBM PowerPC core (I think at one point Motorola called it RCPU32, probably to further confuse people). So you should select "ppc" processor instead of CPU32 to get proper disassembly.

Then, raw firmware files do not have any metadata which would tell IDA where is the code and where's data. So it may try to scan for possible instructions in the whole file and convert some of them to code if they seem legit. In your case it did find some functions but apparently the bytes around the reset vector looked a bit iffy so it converted them to data instead. This is easy to fix though - just undefine (U) wrong data and create code (C) at the correct location.

| improve this answer | |
  • So I went to 0x100 and undefined it, then created code. It seems to have produced a Branch to a different address as shown: drive.google.com/file/d/0BxIxrvwjNVdAVkticDlzSi10TmM/… – Rob D Jun 23 '17 at 19:55
  • @RobD yes, it's very common to have a branch to the actual handler in the interrupt vectors. Sometimes you get only four bytes per vector so need to put most of the code somewhere else. – Igor Skochinsky Jun 23 '17 at 19:58
  • great you've really helped me here thank you. I guess now it's just a matter of learning the assembly code and trying to figure out what the functions do... – Rob D Jun 23 '17 at 20:04
  • drive.google.com/file/d/0BxIxrvwjNVdAUm5RX09RZ091bWs/… Ive renamed this as you can see to ECM Power on. Am i correct in my code that this function is commanding the clearing of registers 9 and 10, then storing something back into register 9, loading register 29, not sure what the references to r0 are doing... Does the code flow in order as I've interpreted it? – Rob D Jun 23 '17 at 20:31
  • it looks like the last code is BLR, branch to link register; but there is no address. How can I find the address this brach command is heading to? – Rob D Jun 26 '17 at 22:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.