Mazda RX-8 rom

PressY4Pie · **Posted:** Thu Nov 10, 2022 8:55 pm

Thanks, i don't usually take donations, but if you wanna buy me a coffee, i added sponsorships to the GitHub project [here](https://github.com/ConnorRigby/conescan)

As is tradition, i got a little bit carried away with this project - i was unhappy about having to upload the entire ROM at once, and needing several different programs to dump, modify and upload
a single change in the ROM so i started building my own.

Obviously still a major work in progress, but so far i can dump the ROM, open ECUFlash formatted definitions, modify the ROM, and upload back to the ECU all in one program. I also have a couple other features i've been trying to proof of concept - a live data viewer, inspired by ForScan, and a 3d table viewer inspired by TunerStudio. I briefly considered trying to add a log viewer as well, but i don't think anything i can do there would be better than existing options. It's been a few days since working on the rx8 kernel directly, but i've been writing some code on it - i originally used a fork of NPKern, but ultimately ended up starting a new project as there was not a ton leftover from the original project by the time i got it working on the RX8 ecu.

I've also been chatting with the developer of the NC miata tuning solution, since i have an NC ecu laying around still, i'm planning on adding support to that platform as well, i'm quite certain this will also apply to other Mazda ECUs, but i'm not sure which ones specifically. If anyone reading this in the future cares so much, i'd love to chat about it.

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

Do you have compiled binaries to share? Still having issues getting the build env sorted on my windows machine.

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

Nevermind, got it building.. just had to grab a few libs not included in the git clone and put them in the lib folder

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

Looks like it's downloading my bench ROM!

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

Been messing about with this a bit today.. I am terrible at reverse engineering, however I did find some interesting info which looks to configure the CAN TX/RX for the OBD addresses

Code:

void FUN_00001038(int always_1)

{
  undefined *puVar1;
  
  watchDogReset_maybe();
  configOBDCANIDs();
  FUN_000016dc(always_1);
  if (always_1 == 0) {
    puVar1 = &DAT_0000d204;
  }
  else {
    FUN_000012a2();
    puVar1 = &DAT_00001378;
  }
  FUN_00001090(puVar1);
  do {
                    /* WARNING: Do nothing block with infinite loop */
  } while( true );
}

Code:

byte configOBDCANIDs(void)

{
  int i;
  byte mcr_status;
  byte mcr_status_after_normal;
  
  resetMasterControlReg(&HCAN0_MCR_B);
  SetHCAN0(0xe,1,8,0,0x7e0,1,&HCAN0_MBCR_W,&HCAN0_MBIMR_W,&HCAN0_MD14[1]_B,&HCAN0_MC14[1]_B);
  SetHCAN0(0xf,0,8,0,0x7e8,1,&HCAN0_MBCR_W,&HCAN0_MBIMR_W,&HCAN0_MD15[1]_B,&HCAN0_MC15[1]_B);
  mcr_status = read_volatile_1(HCAN0_MCR_B);
  mcr_status = mcr_status & 0xfe;
  write_volatile_1(HCAN0_MCR_B,mcr_status);
                    /* Wait for register to report CAN as Normal */
  i = 4000;
  do {
    mcr_status_after_normal = read_volatile_1(HCAN0_GSR_B);
    if ((mcr_status_after_normal & 8) == 0) {
      return mcr_status;
    }
    i = i + -1;
  } while (i != 0);
  return mcr_status;
}

Code:

void SetHCAN0(uint MAILBOX_NUMBER,ushort RX_OR_TX,undefined DLC,char EXT_OR_STD,uint CAN_ID,
             char BUFFER_ISR_VAL,ushort *CONFIG_REG,ushort *MAILBOX_BUFFER_ISR_REG,
             undefined *DATA_REG,undefined *CNTRL_REG)

{
  uint reg_value_local;
  int n;
  uint i;
  ushort reg_final;
  
  reg_value_local = 1;
  reg_final = 1;
  for (i = (MAILBOX_NUMBER & 0xff) + 8 & 0xf; i != 0; i = i - 1) {
    reg_value_local = (reg_value_local & 0xffff) << 1;
    reg_final = (ushort)reg_value_local;
  }
  *CONFIG_REG = ~reg_final & *CONFIG_REG | (RX_OR_TX & 0xff) * reg_final;
  *MAILBOX_BUFFER_ISR_REG =
       *MAILBOX_BUFFER_ISR_REG & ~reg_final | ((short)BUFFER_ISR_VAL & 0xffU) * reg_final;
  *CNTRL_REG = DLC;
  if (EXT_OR_STD == '\0') {
    CNTRL_REG[4] = (char)CAN_ID * '\x20';
    CNTRL_REG[5] = (char)(CAN_ID >> 3);
  }
  else {
    CNTRL_REG[4] = ((byte)(CAN_ID >> 0x10) & 3) + (char)(CAN_ID >> 0x12) * ' ' + EXT_OR_STD * '\x08'
    ;
    CNTRL_REG[5] = (char)(CAN_ID >> 0x15);
    CNTRL_REG[6] = (char)CAN_ID;
    CNTRL_REG[7] = (char)(CAN_ID >> 8);
  }
  n = 8;
  do {
    n = n + -1;
    *DATA_REG = 0;
    DATA_REG = DATA_REG + 1;
  } while (n != 0);
  return;
}

Raw addresses, etc

Code:

                             **************************************************************
                             *                          FUNCTION                          *
                             **************************************************************
                             undefined configOBDCANIDs()
             undefined         r0:1           <RETURN>
             undefined4        r4:4           i                                       XREF[1]:     00001eba(W)  
             undefined4        Stack[-0x4]:4  local_4                                 XREF[2]:     0000109c(*), 
                                                                                                   000010fc(*)  
             undefined4        Stack[-0x8]:4  local_8                                 XREF[1]:     000010b2(*)  
             undefined4        Stack[-0xc]:4  local_c                                 XREF[1]:     000010b4(*)  
             undefined4        Stack[-0x10]:4 local_10                                XREF[1]:     000010b8(*)  
             undefined4        Stack[-0x14]:4 local_14                                XREF[1]:     000010be(*)  
             undefined4        Stack[-0x18]:4 local_18                                XREF[1]:     000010c0(*)  
             undefined4        Stack[-0x1c]:4 local_1c                                XREF[1]:     000010c6(*)  
             undefined4        Stack[-0x20]:4 local_20                                XREF[1]:     000010d8(*)  
             undefined4        Stack[-0x24]:4 local_24                                XREF[1]:     000010da(*)  
             undefined4        Stack[-0x28]:4 local_28                                XREF[1]:     000010dc(*)  
             undefined4        Stack[-0x2c]:4 local_2c                                XREF[1]:     000010e2(*)  
             undefined4        Stack[-0x30]:4 local_30                                XREF[1]:     000010e4(*)  
             undefined4        Stack[-0x34]:4 local_34                                XREF[1]:     000010ea(*)  
             undefined1        HASH:13f267b   mcr_status
             undefined1        HASH:13f7bf8   mcr_status_after_normal
                             configOBDCANIDs                                 XREF[1]:     FUN_00001038:00001042(c)  
        0000109c 4f 22           sts.l      pr,@-r15=>local_4

Not sure if this is useful at all, but for me it was exciting to be able to find a function and then define it back to make sense haha.

There seems to be a lot of other functions that are extremely similar to this one, but I wasn't able to confidently define all of them.

What's the best way to share my project so that everyone has the same starting point on this? Git?

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

Something that I find sort of odd is that there are no references to other CAN mailboxes or TX ACKs...

Is this an issue with the decompilation of the binary, or would they be using some sort of offset reference that doesn't catch the address of the peripheral?

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Always nice to make progress, indeed.

Looks like maybe you don't have the ROM area set as readonly ? If you're using my ghidra scripts it should do it for you. It should improve decompilation quality noticeably.

equinox92 wrote:

Something that I find sort of odd is that there are no references to other CAN mailboxes or TX ACKs...

Have you looked at any HCAN interrupts where it would set a flag in RAM, and other parts of the code which would check same flag ?

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

Yeah, I am using your ghidra scripts, should be set to read only.

There's a ton of RAM address data refs, so maybe I'll check out that HCAN interrupt stuff. Would make sense those are interrupt based and the OBD stuff may not be?? Not sure. It's always been a tossup in my OEM experience if CAN is interrupt based or polling

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

FYI some updates on some stuff..

Defs:
https://github.com/Rx8Man/RX8Defs

Flash tool:
https://github.com/Rx8Man/Rx8Man/releases

Note: I haven't gotten the flash tool to work, but running now.

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

confirmed flashing and defs are operational!

huge step!!!

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

congrats. What kernel did you end up using ?

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

I cannot take any credit for the work, other than just confirming flashes work on my bench.

The kernel is homemade and the owner doesn't want to release the source.

Defs are coming along, but certaintely could use work, as well as adding logger related defs

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

I'm not sure if the OBD logging protocol supports Mode 23 PIDs, but I do believe it's the best way to get data from the ECM.. not sure if there is a proper Mazda protocol found.

PressY4Pie · **Posted:** Tue Aug 15, 2023 1:25 am

i was able to dump the entire rom using this mode, as well as ram if i remember correctly. its been a while but i believe uou can read and write ram values.

equinox92 · **Joined:** Tue Nov 21, 2017 7:56 pm **Posts:** 82

Yep, you can read RAM, I was unable to write to it.. but that was likely a kernel issue when I was doing it

RomRaider

Mazda RX-8 rom

Who is online