Help Getting Started With Ghidra For MPC562 ME9.6.1 VE E77 LY7

[hjtrbo]

You'll probs have these mapped with your previous work. But in case you haven't. Also note the bin includes a placeholder boot block. For your reference.

[hjtrbo]

If you haven't already done so, I highly recommend you dock the memory map into your display. The reason being you can click the start / end address and it will move the navigation focus to that address in the listing display. In the early phases of discovery, that makes moving around the listings quick and convenient.

I highly recommend you download and install my ghidra mcp server. There is an instruction manual in the github /docs folder, it guides you step by step to get it going. Caveats, you need ghidra version 11.3.2 (strict), java 21 & python 3 installed. Once the server is loaded, make sure you tell claude to read the included skill file.

As you can tell, I'm playing along. But what is concerning is there are no xref's to the spark tables. Or any tables in the cal regions for that matter...

[hjtrbo]

I need gatecrasher to help.

If I rebase the bin to 0x420000 (instead of 0x4a0000) the xref's to the calibration area exist and the ones I checked look likely.

Screenshot 2026-06-15 113323.png

Screenshot 2026-06-15 113515.png

[Lucasperks06]

ill reply to you gatecrasher soon thanks for that reply too really appreicate it just trying to fully understand it all before i do

but how did you get that xdf hjtrbo? ive never seen that, do you have some sort of tool that converts hpt files to xdf's? even if not thats really helpful as i have pretty much no hpt maps in my file, and i would have to change values in one map, and compare the 2 files to locate maps, so i never really bothered. thanks man.
also how did you get that bin file? did you have a good convertor?
really appreciate it man.

and thanks for mucking around with the bin too, sort of gives me an idea on where i should be going. obviously im not just gonna try and copy you and not understand what im doing, i still wanna actually know what im doing.
but what your doing is exactly what i want to start doing once i understand everything a bit more and get my file setup properly

[hjtrbo]

I just slide shit around until the xrefs line up. It's not the purist way, but you can only fuck with the dick that you've got. AI makes it happen instant now, usually on the first try with the latest models, it's scary good. The crux is you need to know a handful of switches or scalars or tables to start with so you have targets to hit. If you don't have anything to target then you need to know your chip layout and revert to first principals.

But it raises questions that hopefully gatecrasher can weigh in on. Perhaps your chip is not as you thought or the data sheet interpretation is not as it seems? I don't know.

[Lucasperks06]

okay so gatecrasher, i believe im understanding it alot better now, thank you. things are actually making sense and i understand why you did the certain things to set the file up the way you did.
let me just explain my thinking and let me know if im wrong at all.
so basically based off the r2/r13 values, we determined that we are in block 2 (400000-800000)
based off that, if we had a 512kb flash, we would start at 400000, but we do not, according to the reference manual, after the 512kb flash, the main flash begins at 80000, but of course we are in block 2 so that is 480000
this is where i may be wrong, but because of my incomplete bin, we skipped the first 20000 of the boot section because it didnt exist anyway (which techically we should be able to add back in and start at 480000 cause we have a complete bin now thanks to hjtrbo)
assuming the boot is there it would be at 480000 and continue for 20000
from there the main OS/flash should begin at 4A0000, now length, im assuming will be left as standard
and although this isnt talked about by gatecrasher as of yet, from here the different cal regions can be set, hp tuners shows theres 3, also hjtrbo reminded me in his photo theres 3, so those can be setup. from what i know, the main cal should begin at 5c2000, and continue for x amount, i havent looked for length though im sure it can easily be found
same deal with the other cal regions, exact addresses for the other cal regions should be easy to find too
and then with the ram thats set, looking at the reference manual, i can now see how you got those addresses, beginning of calram is 0x3F 8000 = 0x7f8000
and the end of calram, theres 2 addresses, but im assuming the one you used is the right one which is 0x3F FFFF = 0x7fffff which also includes the 4kb overlay section (unsure if this should be included or not, im gonna assume so as its at the very end of the 2nd block)

and then i also get what your saying about not making the ram 300000, as other sections/control registers (not sure what to call all the other blocks haha) would be considered as "ram" when really there not, and when an address for one of those sections is referenced, it will just come up in the ram section, instead of what it actually is. hence why i should map them all out so it makes more sense when those areas are referenced

which im happy to do the other sections/control registers by hand, it shouldnt take to long and will give me a good feel for ghidra, i need to get more comfortable in it. i was the same with winols when i first started, and now i pump through it like its nothing, didnt take to long too.

i believe i understood everything right, correct me if im wrong. but its all starting to make good sense

[antus]

You still don't have the boot block, it's not there, but there is filler of the same size so you have less addresses to think about while you're working on the mapping.

[Gatecrasher]

Sounds like you're making solid progress. I need to look at the XDF file and try to figure out why the maps don't line up.

Where did you get the information that this is an MPC562? I was looking at the ME 9.6.1 function def document that was posted here a while ago, and it does mention internal flash areas on E69 and E77. It also mentions a 32k of external RAM, which would explain some oddball memory references I was seeing. I really wish someone had an internal photo of this thing.

What's the service part number on this ECM? Is it 12623327 by any chance?

[Lucasperks06]

I do have a spare e77, it’s not the same SW number but I ripped the cover off, that’s how I figured out it was a mpc562, it said it on the chip. It was from a 2007, mines a 2009 I doubt they would change it.

But I’ll set my file up properly later tonight and see how I go
And that’s wierd with the boot block, when you say filler do you mean like just ff?

[kur4o]

Here is some file that have the extra 512kb slave that are missing in. It is from e55 pcm but the structure of e77 is almost identical. All Bosch POS.

I do remember that hpt files for e77 don`t line up correctly because the bin is cut at some places and you don`t get full 2mb size. I need to find some files, that are ripped and fixed, but it will take some time to figure where they are. You will likely find no xref for tables in code, due to how they are accessed. Most calls are indexed table lookup. So you got one function that loads index of 100 tables and select from that index the actual table address. Really hard to trace and figure, some kind of obfuscation similar to dodge ngc POS.