RomRaider

Does anyone have a copy of the ecu def.dtd file? I can't find a copy of it, and with out doing an insane amount of stuff to save a .dtd file, I thought I'd ask first!

I want to try to look at a carberry rom, not sure if that will change anything.

thanks!

There isn't one for the editor def, it only exists for the logger def file.

Ah okay so the original post is a little out of date. I will give it a shot with out the ecu def.dtd! Thanks Dschultz!

Let me correct myself. There is the one in the first post. It is not up to date but should satisfy the XmlToIdc application to allow it to run.

Dschultz, could you help me figure out how to get the SSM base of a carberry rom? I can't find much information that shows how to do it on a 16 bit, all the examples are of 32 bit.

I think its at 0x02DD00?


And my xmltidc string would be:

Or is there an easier way to do this since we already have definitions and a logger file?

That command worked for me using the posted CarBerry SDLogger.xml file.

Hi @NSFW I'm trying to open this XmlToIdc.exe only it comes up blank to me. Also is there a why of finding the numbers of the rom in ecuflash with out stripping down my ecu to find it

I'm only learning here so I might have my facts wrong

I would like the idea of finding tables and maybe even reverse engineer the Rom

Hi @NSFW ive tried clicking on your link XmlToIdc.exe but I'm only getting a blank page

Also I'm looking for the numbers in ecuflash that you refer to in info only I carnt see it . Is there a way of finding this with out stripping down my ecu

I'm interested in learning new things, finding new tables and maybe even reverse engineer my Rom.

I may have my facts a bit wrong here .I'm showing interest here .

the Ida I have is version 7 I carn't justify spending loads of money on something I no nothing about

The download link worked for me just now, but try this:
https://github.com/dschultzca/Definitio ... lToIdc.exe
There is a download button on that page.

I'm not sure which numbers you're looking for but if you can be more specific I'll be happy to help.

I'm using IDA 6.1 so 7 should be fine.

Hi first of all my problem lies with this I’ve quoted a bit down below .It says change processor type to Motorola series 6816 .So when I go to processor type it doesn't seem to be available in the drop down bar . Second of all you mention that if certain numbers carnt be found in ecuflash for then I would have to remove the cover off my ecu to get the number or serial number . I'm rubbish at explaining things so thanks for your patients . I'm also very new to this and trying to learn something and find new tables for the rom . If successful I will happily share with others as I find them. I enjoy things like this . Can I ask what your name is please? also I never got your reply on my phone I had to check on my laptop lol

I've created two scripts to help decode 16bit ROMs in IDA.
Source: Format16bitROM.idc

Here are the steps:
1.You will not need to convert your 160kb ROM to 192kb, either size can be opened and formatted by this process.
2.Open your ROM with IDA.
3.Change the processor type to Motorola Series: 6816.
4.No need to define a RAM segment just click OK to proceed.
5.Under the IDA File menu select Script file (Alt-F7)
6.Select the script named Format16bitROM.idc
7.Read the warning and press Yes to proceed formatting the ROM.

And also I have this . This is on ida 7 am I missing something with the Motorola code






Sent from my iPhone using Tapatalk

I think the problem there is that your version of IDA only supports the processors used in PCs. The full version has a much longer list of processors to choose from. It's also expensive, though.

However there is now a free competitor to IDA, called Ghidra (originally created by the NSA, and they open-sourced it). I don't know whether it supports the 6816 that you need, but it does support a long list of them, so it is definitely worth a look. I opened it up a while back just to have a look, but I didn't mess with it long for long enough to really figure it out. However I suspect it's probably better than IDA, because it has a decompiler in addition to a disassembler.

The drawback is that the setup scripts will need to be redone to work with Ghidra, since the IDC language that they use is unique to IDA. Ghidra is scriptable though, so it's feasible to create an XmlToGhidra script that writes out whatever Ghidra needs instead (Java, if I remember right).

So it's going to take some extra work to make the leap, but since it's $0 and apparently even better than IDA, I think Ghidra will eventually be THE tool for this kind of stuff.

All of the work I did was with 32-bit ROMs (and mostly just the ROM from my own car), so I don't actually know much about the 16-bit ones and I'm not familiar with the numbers you're referring to. I never had a need to open up my ECU.

That’s that idea out of the window then lol


Sent from my iPhone using Tapatalk

Hi

So if I was to look and to find and define a table would I need ida ? If so would the version of 6.1 work ? I tried the link on github and it seems to be really slow


Sent from my iPhone using Tapatalk

So i've looked at my Rom file and i looked at the injector latency shown below (This is just an example I'm using to better try and explain myself). I'm assuming here this is called the string?
And to get the injector latency to work is that it down below or is there another command that this has to be coupled with to work?

My other question is to even establish what injector latency is in the first place how do you actually com across it ? obviously any old numbers arnt just punched in and hope for the best.

My thinking is <table name= is needed to start ?

The name " injector Latency"

address to get it to work (command? address=

is this the formula? "287a2">

and end of the string </table>

if these numbers and letters are the formula "287a2"> what makes it the formula ?


<table name="Injector Latency" address="287a2"> </table>

Excuse me for trying to learn I may have many more questions