I wonder how i can provide data took by BDM from an MC9S12X MCU to IDA Pro that it knows about paging of Flash memory? If i load the linear dump of the local address map of the MCU (0x0000-0xFFFF) it contains only one page (usually page index 0xFE it dump taken directly after reset) at 0x8000-0xBFFF but while the program runs, some calls switch the current page by the PPAGE register at 0x0030 to a different one.

  • How about EEPROM, which addresses its uses for EPAGE?
    – pRoxxxDD2
    Dec 8, 2022 at 20:05

1 Answer 1


IDA has wrong realization of MC9S12X, because it calculate global address as (ppage << 16) + local_addr. So, to load all flash data you should break you binary file on pages (16KB).Page FF is the last data chunk (16KB) of the binary. Each page should be load in appropriate location:

  • ppage == FF -> addr = 0xC000, size = 0x4000 // unpaged
  • ppage == FE -> addr = 0x8000, size = 0x4000 // flash window
  • ppage == FD -> addr = 0x4000, size = 0x4000 // unpaged
  • ppage == FC -> addr = 0xFC8000, size = 0x4000
  • ppage == FB -> addr = 0xFB8000, size = 0x4000
  • ppage == FA -> addr = 0xFA8000, size = 0x4000
  • ... etc

When you will done, you should set ppage (Alt+G) to appropriate value for each location. After that IDA will print correct function names in 'call' instruction and make correct xref.

Set ppage value for segment

Reset vector


  • Are you able to help me to siasssemble an HC12(X) srec firmware file? Thanks Dec 17, 2022 at 12:53
  • Yes, i can help.
    – strannyi
    Dec 18, 2022 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.