Title really does say it all
Started looking at the write kernel used on the E38's from SPS, I was playing with my own VE and bascially programmed it up as a Pontiac G8, and noticed there were two kernels sent:
1) First was for OS and all other major cals
2) Second was for Slave OS and another cal labelled Engine in SPS, Im yet to compare where exactly that engine cal goes.. in the ECU. Im assumign on of the files actually updates the slave mcu, and the other updates the MPC slave segment.
Anyways, as far as Im aware, legaility wise there 'shouldnt' be an issue sharing the kernel bin, its more the fact of using it without permission. So anyone that wants to tinker and take a look at the kernel in ida, let me know and Ill shoot through a message
Now.. to the nitty gritty stuff... The MCU in the E38's is a MPC562, it has NO internal memory, and only has external memory, so to address the external memory, it needs to call to 0x80000000.
After decompiling the kernel in IDA, we see this:
Link to reference manual:
https://www.nxp.com/docs/en/data-sheet/MPC561RM.pdf
We have a good 6 regular functions which are all called from the top segment of instructions. I started commented every instruction.. but as I went along.. I started noticing the absence of the CAN register (TOU_CAN) and also calls to the external memory. Theres calls for all sorts of other registers including interrupt Mask2 register (SIMASK2 = 0x2FC048) and time base/control (TBSCR), but the entire CANbus register (0x307000 to 307800) never appears
Sub_74C, has a whole section in regards to addressing the QSMCM register (queues Serial Multi-Channel Module), memory address of 0x3050000. As far as I understand.. this might be the serial communication between the actual main CPU and slave CPU. Why its doing anything with that is beyond me.
So Iv come to the conclusion of:
1) Im going mad
2) Or, the memory addresses are actually offset.|
3) Somehow, It has not decompiled correctly, although it does it happily. May need to try something other than IDA and see if the same results are produced.
Even looking at the flow of the kernel.. I dont see enough for/while loops to be performing read/writing to CANbus and also flashing memory.
Seems the me9 ecus use the MPC chipset as well.
https://webcache.googleusercontent.com/ ... clnk&gl=au
This doesnt talk about kernels at all, but gives a quick indication on what to do with a full E38 bin for loading it properly into ida.
It does speak of configuring the base correctly as its offset to something like 0x400000... wonder if thats whats happening in the kernel too.
