RomRaider

Hello all! So I currently am using the A2L file to compare maps to my ROM and I've had tremendous success defining more maps for my ROM. But going to RAM addresses, it's all foreign to me. Some of the RAM addresses that show up in functions on IDA POTENTIALLY are located in the same functions for my ROM, but I haven't confirmed that yet. But certain RAM addresses (such as fKNOCK which is the knock flag RAM address. It's pretty important to have this one lol) don't appear in any function when you search in IDA. How would you all recommend finding new RAM addresses because it doesn't look like it'll be as simple as finding new maps haha

Since the RAM size is 48KB, I assume you are working with a SH7058.

In the early days of computers, memory banking was used to switch between RAM and ROM for the same address. I wonder if something like that is going on here?

These two items caught my eye:

From page 885 of the SH7058 Hardware Manual rev 3

Flash Memory Emulation in RAM
To provide real-time emulation in RAM of data that is to be written to the flash memory, a part of the RAM can be overlaid on an area of flash memory (user MAT) that has been specified by the RAM emulation register (RAMER). After the RAMER setting is made, the RAM is accessible in both the user MAT area and as the RAM area that has been overlaid on the user MAT area. Such emulation is possible in user mode and user program mode.



From page 942 of the SH7058 Hardware Manual rev 3

RAM Operation
The on-chip RAM is controlled by means of the system control register (SYSCR).
When the RAME bit in SYSCR is set to 1, the on-chip RAM is enabled. Accesses to addresses H'FFFF0000–H'FFFFBFFF are then directed to the on-chip RAM.
When the RAME bit in SYSCR is cleared to 0, the on-chip RAM is not accessed. A read will return an undefined value, and a write is invalid. If a transition is made to hardware standby mode after the RAME bit in SYSCR is cleared to 0, the contents of the on-chip RAM are held.
For details of SYSCR, see section 25.2.2, System Control Register1 (SYSCR1), in section 25, Power-Down State.

Nah, SH* has a nice flat memory space.



AFAIK it's not used in any Nissan ROMs.

For more on RAM refs, see https://nissanecu.miraheze.org/wiki/Fir ... references

For anyone curious, cross referencing ZB060 (IF ITS SIMILAR ENOUGH TO YOUR ROM) is perfect! Using ida and finding the same functions works incredibly well for it. I do think findrefs would be able to find the RAM addresses that aren’t converted by ida automatically but haven’t tested it much. If it does work as expected, then finding ram addresses would be a breeze!

I’d highly recommend adding the ram addresses to the logger so that you can have log overlay! A really cool feature tbh.