1

In the firmware I am reversing (for a 16-bit MCU), there is code that copies the code of a function from flash memory to RAM, then jumps to it for execution:

F000:FEFF : mmap'ed location of function code in flash memory
2400:32FF : RAM location where the function code is copied

Inside said copied function, there are absolute jmps, such as:

jmp     loc_2838

The operand is the absolute address 2838. Unfortunately, in the disassembly, this address is in the RAM area and it contains only 0s obviously. The corresponding code in the flash area of the disassembly is at F438 (F000 + 2838-2400 = F000 + 438). Is there a way to apply a jmp target correction so that IDA understands that the target code of the jump is F438 instead of 2838?

This would correct the XREFs, repeatable comments and would make navigation easier. It would be nice also if there was a mechanism to correct all absolute references in a section of code, but I don't mind correcting all absolute references manually.

EDIT

One thing that wasn't clear in my question is that there are both absolute and relative references in the block of code copied to RAM. Therefore, creating a segment with a different base to encompass that code would not work since it would correct the absolute references, and break the relative references.

Improve this question
4
  • why is this tagged motorola but the code seems x86?
    – Igor Skochinsky ♦
    Jan 11, 2021 at 23:51
  • Kind of seems like you want to create a new segment at the proper base address and copy the code there. Or, perhaps you could rebase the whole database. Or, perhaps create a new database with just the copied code located at the proper base address.
    – Rolf Rolles
    Jan 12, 2021 at 0:30
  • @IgorSkochinsky I tagged it motorola because the chip is a Freescale HCS12X, which is ultimately a derivative of the Motorola 6800, and the exact chip has no bearing on the question. Also note that the Motorola 6800 familly had the jmp instruction since the beginning.
    – Naju
    Jan 12, 2021 at 14:05
  • @RolfRolles Seems like that could be a solution. It becomes extremely tedious though, as this copy-flash-function-to-ram happens many times, so I would need to create a new segment and correct the base address for every function =\
    – Naju
    Jan 12, 2021 at 14:10

2 Answers 2

Reset to default
1

You need to create a segment with such a base that the offset inside the segment matches the expected 16-bit address. For example, if F438 corresponds to 2838 then creating a segment with base of 0xcc00 (or possibly 0xcc0 since IDA expects it in paragraphs) should make things "line up".

More about segments in IDA.

Improve this answer
1

As mentioned in my edit, creating a segment for the code and changing the base wouldn't work.

However, I found that when manually editing the operand (Alt+F1) - e.g. changing loc_29E4 to loc_F5E4 (or whatever the target is called) - the navigation to the target (Enter or double-click) works and I can even see the repeatable comment. This suits my needs so I'll close the question.

Thank you all.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.