UTILITY: XmlToIdc generates IDC from ecu and logger defs

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

=======================================================
Get the latest EXE here:
XmlToIdc.exe
=======================================================

This utility will only be useful to people who are reverse engineering their ECUs with IDA Pro. It uses ecu_defs.xml and logger.xml to call IDA's MakeName function for all of the defined Tables, SSM & Extended parameters. This makes reverse engineering far easier.
You will need the four files with these names all in the same directory as the application:

ecu_defs.xml
ecu_defs.dtd
logger.xml
logger.dtd

The source is C# code.
You'll need to compile it with Visual C# - the "Express" edition is free or MonoDevelop (Linux compatible)
If you run the utility with no arguments, it prints usage instructions:

Code:

Usage:
XmlToIdc.exe <category> <options>

Where <category> is one of the following:
    tables   <cal-id>
    stdparam <cpu> <target> <cal-id> <ssm-base>
    extparam <cpu> <target> <ecu-id>
    makeall  <target> <cal-id> <ssm-base>
    ecuf     <definitionFilename.xml>

Where <options> is the following as required by the category:
    <cal-id>   is the Calibration id, e.g. A2WC522N
    <cpu>      is the CPU bits identifier of the ECU, e.g. 16 or 32
    <target>   is the Car control module,
                 e.g. ecu (engine control unit) or tcu (transmission control unit)
    <ecu-id>   is the ECU identifier, e.g. 2F12785606
    <ssm-base> is the Base address of the SSM 'read' vector, e.g. 4EDDC

And you'll want to redirect stdout to a file, like:
XmlToIdc.exe ... > Whatever.idc

And here are some more concrete examples:

Code:

XmlToIdc.exe tables A2WC521N > Tables.idc
XmlToIdc.exe extparam 32 ecu 2F12785606 > ExtendedParams.idc
XmlToIdc.exe stdparam 32 ecu A2WC522N 4EDDC > StandardParams.idc
XmlToIdc.exe makeall ecu A2WC522N 4EDDC > AllTableAndParams.idc
XmlToIdc.exe ecuf A2WC521N.xml > Tables.idc

Each IDC file contains a function, which will be run automatically when you open the IDC file using the "IDC File..." menu item under IDA's "File" menu.

Updated 10/5/2010 with improvements by dschultz!

Fixed the missing Table reference creation for 3D tables
Changed space removal in names and replaced spaces with underscore for readability
Added the parameter ID into the names for both STD and EXT parameters

Updated 10/25/2010 with improvements by dschultz, and me

Whitespace in names is now represented as underscores (dschultz)
Switches are now partially supported (dschultz)
Fixed bug in 3D table naming (dschultz)
The IDC functions now run as soon as you open the IDC file (nsfw)

Update 8/28/2012 with more improvements by dschultz

Supports standard parameters 200 and higher
Removed attachments, added GitHub link

Update 12/15/2012 with more improvements by dschultz

It now handles 16 bit ECUs better. Note: not all table axis are marked as some data series have no axis info in the ROM.
SSM Switches are all correctly defined and duplicates removed.
Added a makeall option which will run all three tables, stdparams & extparams with only one invocation of XmlToIdc.
It can now read the Base ROM info to create tables from the inherited ROM

Update 4/24/2015 with more improvements by dschultz

Add conversion of EcuFlash def to tables IDC scripts

Source code is available here:
https://github.com/LegacyNsfw/XmlToIdc

dschultz · **Posted:** Fri Jun 04, 2010 1:17 pm

Thanks for this update (did you mean to post this in this forum?).

I used your old version of this utility and found the "issue" you mentioned about the inherited tables.
BTW: having the registers defined correctly in IDA, I've found a ROM will unfold almost 90% complete on the first run. Here's the registers post.

I've also been working on a way to identify the extended RAM parameters in simsh for easier viewing during simulation.

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

I mean to post it in this forum, but whether that was the right decision is debatable.

It's a utility, but it's not exactly a tuning utility. If any mods want to move the thread, go right ahead.

I had not seen your thread 'til now but it looks pretty cool. I'll give it a try.

dschultz · **Posted:** Wed Jun 23, 2010 5:39 pm

Is this utility extracting the "switch" definitions from the logger.xml for the stdparam option?

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

No, I didn't implement anything for the switches. There's an IDC function to make comments though, and it would be kind of cool to put comments in the function header with the names of the bits in each switch address. I think that's do-able, but it'll probably be a few days before I get around to it.

johnt2k7 · **Posted:** Fri Aug 06, 2010 12:20 am

im new to this all and i can get IDA pro to open the HEX with the correct processor and can get the ram assigned but from their im a lil confused on how i use this ???

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

If you have a 32-bit ECU, start here:
viewtopic.php?f=25&t=6303

If you have a 16-bit ECU, I can't help, but watch this space:
viewtopic.php?f=25&t=6452&p=62113#p62113

johnt2k7 · **Posted:** Fri Aug 06, 2010 4:21 am

NSFW wrote:

If you have a 32-bit ECU, start here:
viewtopic.php?f=25&t=6303

If you have a 16-bit ECU, I can't help, but watch this space:
viewtopic.php?f=25&t=6452&p=62113#p62113

im on a 32bit and i have read that i just dont understand step 5 which involves this ???

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

This utility will generate three .IDC files:
* one for standard parameters
* one for extended parameters
* one for table definitions

To generate them, put it in a directory with the logger.xml and ecu_defs.xml that RomRaider uses, and run it three times. See the first post for examples of how to run it.

Then use IDA to load the IDC files and run the functions in each file.

Which part do you need help with?

johnt2k7 · **Posted:** Fri Aug 06, 2010 9:42 am

NSFW wrote:

This utility will generate three .IDC files:
* one for standard parameters
* one for extended parameters
* one for table definitions

To generate them, put it in a directory with the logger.xml and ecu_defs.xml that RomRaider uses, and run it three times. See the first post for examples of how to run it.

Then use IDA to load the IDC files and run the functions in each file.

Which part do you need help with?

when i run the EXE the Console come up for a sec the closes before i can read it and thats all that it does i dont get IDC files ???

i have Logger.xml, ecu_defs.xml and the exe and the compiled C file all in a single folder ???

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

Are you familiar with running programs from a command line?

First, run cmd.exe, you'll find it at c:\windows\system32\cmd.exe
cd to the directory that has the xmltoidc.exe file and the XML files.
Run xmltoidc.exe and it will print usage instructions.

johnt2k7 · **Posted:** Fri Aug 06, 2010 11:28 am

NSFW wrote:

Are you familiar with running programs from a command line?

First, run cmd.exe, you'll find it at c:\windows\system32\cmd.exe
cd to the directory that has the xmltoidc.exe file and the XML files.
Run xmltoidc.exe and it will print usage instructions.

NVR mind i got CMD to run but what is my SSM 'read' vector ???

im assuming this is right 08 USDM AT

XmlToIdc.exe tables AZ1E401A > Tables.idc
XmlToIdc.exe extparam 5112584107 > ExtendedParams.idc
XmlToIdc.exe stdparam AZ1E401A ????? > StandardParams.idc

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

There are a couple ways to find it... One of them is described in the first post of the analysis thread.
See section 8, near the end:
viewtopic.php?f=25&t=6303

johnt2k7 · **Posted:** Fri Aug 06, 2010 7:37 pm

i read that and am trying but ???

when i load extended param i get a message 1:function declaration is expected ???

also i found A2 10 and the ECU id on lines D4BCD-D4BD4 but wich one d0 i XRef they all are derent

CSXRT4 · **Joined:** Fri Apr 17, 2009 5:19 am **Posts:** 42

every time I try to run the program I get an error

Code:

Unhandled Exception: System.TypeInitializationException: The type initializer fo
r 'NSFW.XmlToIdc.Program' threw an exception. ---> System.IO.FileNotFoundExcepti
on: Could not load file or assembly 'System.Core, Version=3.5.0.0, Culture=neutr
al, PublicKeyToken=b77a5c561934e089' or one of its dependencies. The system cann
ot find the file specified.
File name: 'System.Core, Version=3.5.0.0, Culture=neutral, PublicKeyToken=b77a5c
561934e089'
   at NSFW.XmlToIdc.Program..cctor()

WRN: Assembly binding logging is turned OFF.
To enable assembly bind failure logging, set the registry value [HKLM\Software\M
icrosoft\Fusion!EnableLog] (DWORD) to 1.
Note: There is some performance penalty associated with assembly bind failure lo
gging.
To turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fus
ion!EnableLog].

   --- End of inner exception stack trace ---
   at NSFW.XmlToIdc.Program.Main(String[] args)

RomRaider

UTILITY: XmlToIdc generates IDC from ecu and logger defs

Who is online