UTILITY: XmlToIdc generates IDC from ecu and logger defs

dschultz · **Posted:** Sat Apr 18, 2020 1:31 pm

Rick2014 wrote:

NSFW wrote:

I think the problem there is that your version of IDA only supports the processors used in PCs. The full version has a much longer list of processors to choose from. It's also expensive, though.

However there is now a free competitor to IDA, called Ghidra (originally created by the NSA, and they open-sourced it). I don't know whether it supports the 6816 that you need, but it does support a long list of them, so it is definitely worth a look. I opened it up a while back just to have a look, but I didn't mess with it long for long enough to really figure it out. However I suspect it's probably better than IDA, because it has a decompiler in addition to a disassembler.

The drawback is that the setup scripts will need to be redone to work with Ghidra, since the IDC language that they use is unique to IDA. Ghidra is scriptable though, so it's feasible to create an XmlToGhidra script that writes out whatever Ghidra needs instead (Java, if I remember right).

So it's going to take some extra work to make the leap, but since it's $0 and apparently even better than IDA, I think Ghidra will eventually be THE tool for this kind of stuff.

All of the work I did was with 32-bit ROMs (and mostly just the ROM from my own car), so I don't actually know much about the 16-bit ones and I'm not familiar with the numbers you're referring to. I never had a need to open up my ECU.

Hi

So if I was to look and to find and define a table would I need ida ? If so would the version of 6.1 work ? I tried the link on github and it seems to be really slow

Sent from my iPhone using Tapatalk

Ghidra doesn't seem to support the 6800 series, but they're looking for people to help extend this list. https://github.com/NationalSecurityAgen ... -questions

dschultz · **Posted:** Sat Apr 18, 2020 1:50 pm

Rick2014 wrote:

if these numbers and letters are the formula "287a2"> what makes it the formula ?

<table name="Injector Latency" address="287a2"> </table>

Excuse me for trying to learn I may have many more questions :lol:

This is only the part of the table definition that specific to your ROM, the address. The full table definition is in the "BASE" section which it inherited before applying your ROM specific attributes.

This is off topic to this thread, I suggest to look at a full RR Editor definition file. For example:
download/file.php?id=9915 to see how it's constructed. You don't need IDA to write a definition. I suggest NotePad++.

Rick2014 · **Joined:** Wed Feb 04, 2015 8:41 pm **Posts:** 163

dschultz wrote:

Rick2014 wrote:

if these numbers and letters are the formula "287a2"> what makes it the formula ?

<table name="Injector Latency" address="287a2"> </table>

Excuse me for trying to learn I may have many more questions :lol:

This is only the part of the table definition that specific to your ROM, the address. The full table definition is in the "BASE" section which it inherited before applying your ROM specific attributes.

This is off topic to this thread, I suggest to look at a full RR Editor definition file. For example:
http://www.romraider.com/forum/download ... hp?id=9915 to see how it's constructed. You don't need IDA to write a definition. I suggest NotePad++.

I here what your saying dale and thanks for your help .I will now have an idea how to write it but if I was to go looking for a table what then

Rick2014 · **Joined:** Wed Feb 04, 2015 8:41 pm **Posts:** 163

NSFW wrote:

The download link worked for me just now, but try this:
https://github.com/dschultzca/Definitio ... lToIdc.exe
There is a download button on that page.

I'm not sure which numbers you're looking for but if you can be more specific I'll be happy to help.

I'm using IDA 6.1 so 7 should be fine.

I tried clicking on the link again and this time was really slow. Did you have to pay ida 6.1

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

I yes, I bought the full version. I don't think they even had a free version at the time.

I also started out using a pirated version (running in a VM) because I didn't want to spend $1500 or whatever it cost until I knew I would be able to actually get something done with it. That's not legal but I figured it would end with me with giving up and never touching it again (no harm done) or buying a copy (which is what happened) so my conscience is clean.

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

dschultz wrote:

Ghidra doesn't seem to support the 6800 series, but they're looking for people to help extend this list. https://github.com/NationalSecurityAgen ... -questions

That's a shame. We're in the same situation with the GM computers in 1999-2007ish LS-powered cars. They use a variant of the Motorola 68k chip (which is supported) but it has some table-lookup instructions (not supported) that leave a lot of holes in the disassembly.

But since it's open source I think it's likely that this stuff will get done eventually.

Rick2014 · **Joined:** Wed Feb 04, 2015 8:41 pm **Posts:** 163

NSFW wrote:

I yes, I bought the full version. I don't think they even had a free version at the time.

I also started out using a pirated version (running in a VM) because I didn't want to spend $1500 or whatever it cost until I knew I would be able to actually get something done with it. That's not legal but I figured it would end with me with giving up and never touching it again (no harm done) or buying a copy (which is what happened) so my conscience is clean.

I may have to look for a pirate legal copy . I want to get into this

Sent from my iPhone using Tapatalk

dschultz · **Posted:** Sun Apr 19, 2020 12:03 am

Rick2014 wrote:

I may have to look for a pirate legal copy . I want to get into this

Sent from my iPhone using Tapatalk

No such thing.

Rick2014 · **Joined:** Wed Feb 04, 2015 8:41 pm **Posts:** 163

NSFW wrote:

Have you heard of olly dbg?

As far as I know, it only works for Intel x86 CPUs.

VEEGROVER · **Joined:** Fri Feb 05, 2021 1:12 am **Posts:** 6

Hi guys! how to run the program on windows 10? impossible to run on your PC!

professsor_jonny · **Joined:** Thu Apr 07, 2022 12:21 pm **Posts:** 2

Hi I have created some xml's for ecuflash for a h8 mitsi ecu by pattern matching simular roms, stitching together and testing incomplete maps found on the net and by the use of wols.

What I want to do is learn how to disasemble binary and verify my xml is correct.

I have done a bit of assembler in the 8088 20 years ago at tech and understand the basics.

I cant use gidera as I have a H8 ecu and there is no support for it and it is beyond my skill to create one.
I have a copy of IDA and have modified a script I found to run on a modern version here:.

https://github.com/professor-jonny/ecur ... ecurom.idc

The script seems to work now (well at least do something), but i'm wanting to pull in the defs and define structures to make things easier/ quicker than manually importing.

I'm guessing xmltoidc program only work with romraider format xml's?
I'm guessing if I patch my xml to be in the format of romraider defs it will work with this tool?
is there a tool to convert between xml formats?

I'm wondering if someone has converted an xml before and would possibly have a before and after as I'm unfimular with romraider?

How would I go about patching it to parse Ecuflash xml files i'm happy to do this if someone can point me in the corect direction what to do?
I see the logger.dtd logger.xml and ecudefs.dtd in the source tree these files are the base layout definitions for all the cars in rom raider ?
where do i find the actual memory adresses for the ecu's actual defs.

Ultimatly if someone had a h8 ecu ida project I could study it would make things a lot easier as i really dont understand the innerworkings of the ecy , i do understand asembler but i dont understand the way the ecu operates and how it figure out what is going on and it would be good ot be able to compair to my rom to help me narate it.

can someone offer me some advice?

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

The EcuFlash and RomRaider XML is very similar - RomRaider's XML is almost just a bunch of concatenated EcuFlash XMLs, so that everything goes into a single file rather than into a directory tree containing multiple files.

That makes EcuFlash XML easier to work with, so the XmlToIdc tool uses EcuFlash XML.

In other words, you won't need to convert.

professsor_jonny · **Joined:** Thu Apr 07, 2022 12:21 pm **Posts:** 2

nsfw wrote:

The EcuFlash and RomRaider XML is very similar - RomRaider's XML is almost just a bunch of concatenated EcuFlash XMLs, so that everything goes into a single file rather than into a directory tree containing multiple files.

I would have to create a fake cal_id and add a entry in my car in the cardefs for the tool to work or will it work directly if i select make all?

i guess i can have a play, seems like this program could be taken over by the python interperter built into IDA ill look into that.

alesv · **Joined:** Fri Aug 26, 2016 8:21 am **Posts:** 154

Does someone know where to get recent XmlToIdc sources? I got 1.2.7 binary. All I found is old 1.0 sources. I want to rewrite command line processing and to add options to support non-hardcoded definition and logger file names.

UPD
I took XmlToIdc ver 1.2.7 binary, decompiled it, added command line parser and recompiled it. You can get it here.

dschultz · **Posted:** Sat Feb 17, 2024 9:01 pm

You mean this?
https://github.com/dschultzca/DefinitionTools (master branch)

RomRaider

UTILITY: XmlToIdc generates IDC from ecu and logger defs

Who is online