How can IDA Pro disassemble paged memory from HCS12 processort?

Question

I wonder how i can provide data took by BDM from an MC9S12X MCU to IDA Pro that it knows about paging of Flash memory? If i load the linear dump of the local address map of the MCU (0x0000-0xFFFF) it contains only one page (usually page index 0xFE it dump taken directly after reset) at 0x8000-0xBFFF but while the program runs, some calls switch the current page by the PPAGE register at 0x0030 to a different one.

Answer 1

IDA has wrong realization of MC9S12X, because it calculate global address as (ppage << 16) + local_addr. So, to load all flash data you should break you binary file on pages (16KB).Page FF is the last data chunk (16KB) of the binary. Each page should be load in appropriate location:

• ppage == FF -> addr = 0xC000, size = 0x4000 // unpaged
• ppage == FE -> addr = 0x8000, size = 0x4000 // flash window
• ppage == FD -> addr = 0x4000, size = 0x4000 // unpaged
• ppage == FC -> addr = 0xFC8000, size = 0x4000
• ppage == FB -> addr = 0xFB8000, size = 0x4000
• ppage == FA -> addr = 0xFA8000, size = 0x4000
• ... etc

When you will done, you should set ppage (Alt+G) to appropriate value for each location. After that IDA will print correct function names in 'call' instruction and make correct xref.