How to properly define a byte in code with tvrfan's SAD?

[DWS]

I've been using SAD (Semi Automatic Disassembler) for a bit now and has been a great tool for what I've been doing in the EEC-V computers, linked below.

https://github.com/tvrfan/EEC-IV-disassembler

Currently the only thing I haven't worked out how to define correctly is hard coded values aka constants. For an example, this if statement checks if(0 = 0), however it's a flag to enable/disable a feature. I'd like to make it so it's defined as if(Something_Flag = 0) so it's easier to read when looking over the code.

1da35: 99,00,00 cmpb R0,0
1da38: d7,03 jne 1da3d if ( true ) {

My current solution has been to define a sym for the code line instead of the actual data item which puts the name before the statement like this:

DIR file

sym 1da35 "Something_Flag" # Just an example

LST output

Something_Flag:
1da35: 99,00,00 cmpb R0,0
1da38: d7,03 jne 1da3d if ( true ) {

I've tried several ways of trying to define the byte at 1da36 but haven't found anything better yet. The only way I've found to effect the hard coded values like that is if I assume it's an address, then it flags, but every instance of that value gets flagged as that address even when it's not an address and of course a single value can only be named once.

Seems like such a simple issue, maybe I'm overlooking something, but if anyone else disassembling the ford computers could give me any suggestions that would be great.

Besides working out a ford bin (EEC-V), I'm also working on an in house project to define and enforce requirements within functions for accurate pattern matching, like all temp vars start with the same data source and are processed in the same way. A side effect of that effort is I'd like to make it auto generate a DIR file for the file I'm looking at to save a load of time manually defining things that I've already done in another bin file. It's kind of a constraints logic type of system, match the pattern (generic), then check registers, data items, etc to make sure they are the correct pattern within the mask pattern basically. Like R74 might be used in one computer and R46 in another. Data items like say injector high slope needs to be referenced in the subs in the same way for it to be the same code. Basically automating the process of matching functions up and knowing with a high degree of certainty that they are matching and the data items, subs, etc are accurate, and any code changes gets flagged for manual review but with the other items defined that don't conflict. That's where the DIR output comes in, I don't want to build my own disassembler when one already exists. I'm just doing simple pattern matching and loosely looking at the op codes to make sure I get the lengths correct, register locations, etc.

I'm kind of shocked the SAD program doesn't offer a pattern matching system like this, or maybe it's undocumented? I know there's some level of pattern matching being done, but not sure where the program grabs the data from for that or if it's hard coded.

[Tazzi]

Typically you would use a variable that is stored in ram, or flash to be able to turn a feature on and off.

I do not recall what the ram addressing is for the EECV ecus, but for example:
Ram address range is: 0x80000000-0x80010000

You could then save a variable in some unused ram area (you’d need to dump ram to check), and check that byte to turn a feature on and off.

Typically the higher addresses are least likely to be used.

In a basic pseudo form:

Load byte 0x80010000, R2 (whatever register you want)

cmpb R2, 0

[DWS]

Yea if I was writing my own EEC-V code that's the route I'd go, however this is the stock code, there's some settings that aren't exactly meant to be able to be changed and those are effectively hard coded. When disassembling a file it would be nice to have the var name in the if statement so I don't miss it in what basically ends up being a label/comment.

For EECV, 0x10000-0x11FFF seems to be ram addresses, I'm sure there's more locations, but that's part of the dumps that isn't accessible and the code looks similar such as:

DIR File

Code: Select all

sym 10570 "tq_source"

Output

Code: Select all

95bce: b3,01,70,05,38     ldb   R38,[R0+570]     R38 = tq_source;

FYI, first digit is a bank indicator, SAD assumes bank 1 by default so I've been defining them that way.

Anyway, my question more relates to SAD's DIR file format for definitions. Here's the user manual I'm refereeing for everything else. Not sure if I'm missing something in there or if it's a limitation that SAD can't handle currently.

https://github.com/tvrfan/EEC-IV-disass ... ands_5.pdf