16206304 and less important 1623019 from poland

[gabriel0]

I'm using disassembler from techedge, and i checked all the tutorial stuff. http://www.techedge.com.au/utils/dhc11tut.htm
I want to be sure that i did everything i could about decompiling the code.

Yeah, now i'm chosing the long road, just because i'm curious about electronics (not only car electrionics). I'm just curious if there are a functions that nobody knows about in this car, and just for practice in hc11 assembly language.

And to make a step into 12p, for sure i want to know the maps from the original code. I'm just a guy that if i'm interested in something i need to know it from the core.
So if you have any advices, i'm ready to learn. For now the things i have is bua_hac.pdf and anht_hac.pdf which are deduced disassembly what functions do. And whole folder of random stuff from techedge and similar sites.

[gabriel0]

Ok, so except one single line at the start, there is no difference between first and last half of the eprom. LC006 is the checksum which is C5 8C so they are the same.

Screenshot_1050.png

This is probably because hc11 in special mode or bootstrap mode starts vectors have not from $FFC0-$FFFF but $BFC0-$BFFF, so $7FFF earlier.
Now i dont know what to think about it, but i know more than before.

BUT
If i cut this bin in half, and put it in gmcks, then bang. Work for both. STANDARD which is typical load from $FFF0 and SPECIAL which is from $BFC0

Both, nah, checkstum NOT match.

Screenshot_22.png

I'll let you all know what i learn and discover. Cheers whole forum

[antus]

For learning, you may be better off working on 12P. Because it is defined, you will be able to look in the XDF to know the addresses for all of the calibration variables and you can probably script something to generate the config file for the disassembler. That additional information will help you greatly in understanding the ECM. Then once you are starting to understand it then come back to your original target as a lot of the code will be similar and things should start to look clearer. Other options are you could look in to ghidra or ida (if you are able to obtain the pro version) as more modern disassemblers. But the one you are using was written for this task and is a capable of doing a good job. In fact 12P grew out of a disassembly of factory operating system $12 which was generated by dehc11.

[antus]

As for the repeated data, I think that is evidence of a stacked bin. There are two copies of the 16kb file on the chip. If it was a 16kb chip that was read off the end, they'd have read identical as the high address bit would have done nothing. The 6 bytes at the start of your disasm look typical for a segment header. The first two are probably a calibration segment ID number, or 1 or both are a checksum. Then the next 4 is probably space for another identifier. My *guess* would be that at the factory they had the bin ready to go, then they assigned the 4 byte number, and wrote out a copy with the release version of the software in those 4 bytes, and stacked the release version on top of the pre-release file they had on their computer just to fill up the bottom half of the chip. The ECU would use the second copy, and this would explain how and why this could have been created with just this difference. Though if that is the case they did it backwards as the ID is on the unused copy at the start of the bin