28F400 Specifications

[Keith@HPTuners]

Passing along some info

28F400 Datasheet PDF

- 256-KWords of 16 bits each

- Seven blocks, including:
- 1 protected boot block (16k)
- 2 parameter blocks (8k)
- 4 main blocks, one of 96k and three of 128k
- loads boot from either top or bottom

I am thinking its a bottom boot block. If my memory serves me correctly, my EMP-20 will only write the chip when I select -B and not -T.

[lmos]

Thanks for passing along the 28F400 summary and datasheet links, Magnus. Not that I'd like credit for that and other research either ;-) Seriously though, I am glad he can find time to post the information we are tossing around in the background.

In terms of '332 resources, the Moto Automotive Toolkit (http://e-www.motorola.com/collateral...300_CD_ZIP.zip) is a worthy download if you are serious about decoding the flash files.

Just some additional notes on the 09352809 file:

1. Yes, the boot block is at the top of the image.

2. Code is executed in place (ie. directly from flash) using hard vectors; its possible TPU instructions are copied to the protected sram (6k according to the Delphi datasheet).

3. First sections of the boot block contain exception vector tables, including reserved nmi, rst, supervisor rst and supervisor jmp vectors. The only one I am interested in right now is the reset vector, which will provide an address to jump to once the processor is initialized. In other words, the start address of the code executed by the cpu after the pcm is reset.

Translates to: Begin disassembly at address 0xfoobar and do not bother with the remaining vector code.
[edit: Vector table ends at 0x3FF, or 1024 bytes. Start disassembling at 1025 bytes into the boot block.]

4. Split the 0935 file into 16k/8k/8k/96k/128k/128k/128k to get a better feel for what you are looking at. If you lack the tools to do this, let me know. Trying to read the whole file over prolonged timespan can cause blindness and cancer in rats.

5. I have some suspicions of the 09372327 image file, but... an easy way to identify table boundaries, checksum locations, etc. is to compare (okay, "diff&quot the main blocks of two 98+ calibration files. Boot block function is obvious, parameter blocks contain calibration id and VIN data among other things, and the main blocks (1x96k, 3x128k) likely contain the tables, algorithms, checksums and other cpu32 code.

6. Side-note, and Magnus is probably the only person who will appreciate this based on earlier discussions. 28F400 organizes data as 16-bit, which results in 2 wasted cycles by the 332 in read/exec instructions. Not very efficient.. but I guess it does not need to be.

I have a lot of information to share, just not much time to present it. Should have a summary of what I am working on and findings "some time" later...

[RoboGeek]

what tools are you using to split the file? i feel blindness and cancer coming on even now..

hmm.. I'm getting lazy.. I could build something in VB pretty easily I guess.. lol ;D

[lmos]

Most of my "real work" on this project is done under Unix (thusfar, tables might be a different animal), so a shell script that uses the standard 'dd' utility is my method.

The core of the script looks like this:

dd if=$1 of=$name.1 bs=1024 skip=0 count=16
dd if=$1 of=$name.2 bs=1024 skip=16 count=8
dd if=$1 of=$name.3 bs=1024 skip=24 count=8
dd if=$1 of=$name.4 bs=1024 skip=32 count=96
dd if=$1 of=$name.5 bs=1024 skip=128 count=128
dd if=$1 of=$name.6 bs=1024 skip=256 count=128
dd if=$1 of=$name.7 bs=1024 skip=384 count=128

$1 is the first shell parameter after the script, $name is just the "base" filename I produced earlier in the script.
In other words, I execute "./splitbin.sh 09351234.bin" and the output is 09351234.1, 09351234.2, etc.
Its just the same for the process manually (dd if=09351234.bin of=09351234.1 bs=1024 skip=0 count=16).

To do this under win32, grab Cygwin or (even better imho) native ports of Unix utilities from http://unxutils.sourceforge.net/.

[Lee]

Thanks

Imos,Magnus,Robogeek

I'm reading all of this,But man is it over my head.But I sure Do THANK you'all.We need some more to come in
help out.

Want you'all to know I appec. the work and know how!

Thanks Lee

[RoboGeek]

Lee.. just smile and nod your head.. thats what I do.. lol

lmos: yea I spend about half my time under Linux anyways so i'll just shell script it to death then copy iy to my other partition..
Thanks for the idea