I'm working on disassembling a flash dump from a TriCore TC1766 which came from a car (an MT86 ECU). My goal is to identify tables and scalars in the data area, and determine what they are used for. I used a heat map analysis to locate 200+ potential tables based on a pattern I found and I verified my results were (mostly) valid based on some known table locations. The table dimensions are known as well.
Since i'm working blind with only a disassembler (IDA Pro), I'm finding it difficult to even get started. I know the addresses for a few tables and 2 scalars but I cannot find any references to them in the disassembled code.
I know that each of the table values and the scalers need to be converted in some way to get the correct values. For example, A scalar located at 0x30D4C has the following bytes F8 D9 and when reversed, are an integer of 55,800 which is then multiplied by 0.125 to get the target value of 6975 which is the maximum RPM that the ECU will let the engine spin to.
I was thinking if I could find where the operations were that did this conversion, i'd have a place to start navigating. But, I'm not really sure how the operations would be done, would it be a multiply opcode or would it be bit shifting? I have no idea what compiler options were used or what optimizations were used when the code was built.
What are some techniques I can use to find where these memory locations are referenced?
Heat map of a known table that is 13x19
Same table in IDA before the analysis
Same table in IDA after the analysis
If I look for any XREFs on dword_208C8 there aren't any