I have a HEX file with a firmware for Attiny45. What I want to do is to extract some kind of formula that is coded inside it. I have done some research (mostly to find out that "it is not possible", etc, etc) but I decided I could give it a try since other parts of my research showed me that most of the people that ask this type of question barely knows what a HEX file is.
The objective of this post is not to came up with a brightly C code from the HEX file but rather build solid knowledge about the subject. I'm aware that the compiler, doing its job, can make my own job harder but there is some kind of structure (maybe primitive) that needs to be followed for the CPU to be able to execute the code.
So, I sat on my desk and coded a little Python tool to help me in the process. It loads the HEX file, and I interactively can add information to it. Here is what I've got so far:
The first line of the HEX file, says:
: 02 0000 04 0000 FA
Which was decoded by the tool to:
: --> MARK 02 --> RECORD LENGTH 0000 --> LOAD OFFSET 04 --> RECORD TYPE (EXTENDED LINEAR ADDRESS RECORD) 0000 --> DATA FA --> CHECKSUM
Seems that this line serves the propose of telling that the initial address on which code should be put is
Second, the next line says:
: 20 0000 00 34C0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF50C07EEE7EB9 51
The tool decoded it to:
: --> MARK 20 --> LENGHT OF THE RECORD 0000 --> OFFSET 00 --> RECORD TYPE (00 -> DATA RECORD) 34C0FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF50C07EEE7EB9 (ACTUAL DATA) 51 --> CHECKSUM
Here is where the fun and the questions starts.
I could not find anywhere the memory map of the ATTiny45. I thought it should be somewhere in the data sheet or the instruction set manual. From what I could figure out, at
0x0000lives the interrupt vector (page 49, data sheet) and the first one is the reset vector. So, AVR being little endian and instructions being 16bits-wide, I can decode that the reset vector contains the value
0xC034. Using the instruction set, I figure out that
Is this correct?
Continuing with this line of thinking, the same line pointed before shows that some of the interrupt vectors have values
0xFFFF, which causes me surprise but does not seem to be a problem since probably these will be disabled. The only other vector that have a working value is
USI_OVF_ISR, which is equal to
0xC050. So, according to the ideas presented before, this says that
USI_OVF_ISRhas the instruction:
Is this also correct?
If the reset vector points to
0x034, this says that the program will begin running at
0x034. The next line
: 20 0020 00 7FE77FB9B89A089570EE7EB95FB9B89A08957EEE7EB9B898089570EE7EB9B898 22
0xB898and that is the first instruction that will be executed.
Is this correct?