68332 disassembler

[Chris@HPTuners]

guys,

i'm embarking on writing a 68332 dasm - hopefully have some progress soon. Having never written one beofre it should be a good mix of insteresting/fun/painful/disastrous ;D

I've assembled as much info as i can about the 68332 instruction set and also the flash file format but from a dasm perspective all i can really do is pick an offset an go from there (i'll probably make it pick up the reset vector automatically).

anyways any info/feedback you want to give then now is a good time to do so.

hopefully soon i'll sort out the flash file checksums as well ???

[RoboGeek]

I suggest crazy glue - so you can re-install your hair after pulling it all out! ;D

Keep us posted!

[Guest]

What exactly are you trying to dissassemble?

[RoboGeek]

I think he means assembler - to assemble hex into readable code like the ASM11 does for the 6811 ECM's

[Chris@HPTuners]

eeerr well... when i went to school an assembler took assembly language and turned it into binary code. a disassembler did the opposite. ;D

Chris...

[RoboGeek]

yea, thats the way I learned it too.. but somewhere it all got switched around it seems. Or I'm just confused ;D
Wouldn't be the first time I was bass-ackwards

I think its because you disassemble a program to get code and asssemble binary to get code. But I'm no programmer - thats a well known fact! :

[Casey]

I don't want to sound like a di$#, but what's wrong
with IDA?

I don't see how somebody can manage a text file with
all of the indexed jumps and stack pointers used with
the 68k code.

If you want to write something "over the top", make it
a program that can write out a table with all of the
X,Y parameters that go along with it. This is the part where all disassemblers fail, and is the most time consuming. Once yout get the algo disassembled, you then need to make different "cal" files for different models.

It only took me 2 hours to get a legit/workable disassembly from the 09375577 file you guys have posted here. (Thanks for hosting those).

With that in mind, I don't have a PCM to play with so I can't tell what the external hardware is. Has anybody
figured this out yet?

Also, how did the BDM mode work out? There are a few progams on the net that you can use to read any ram or address location. Somebody could have all of the inputs/outputs labeled within a day.


Just a few thoughts and Q's,

Super Sport x2 ;D

[Guest]

IDA is by far the best way to go for disassembly. Why reinvent the wheel? (learning is a good excuse though). Besides, you can write additions for it.

What do you mean a table with all the x,y parameters? If you think you can understand the table dynamics just from a disassembly, then your disassembler better have a little mojo working for it. All it tells you is that there is a table there and what calulations are performed on it.

Even with BDM, the disassembly gives you all the addresses accessed, how could anything possibly tell you what they are? All the hardware on the board is unlabled and some custom. without a vehicle to test and a exhaustive list of tests, there is no telling what every address does. A day? Please. I don't care if you can read every address, you need to test, and that's tedious.

my thoughts back. ;D

[Casey]

What do you mean a table with all the x,y parameters? If you think you can understand the table dynamics just from a disassembly, then your disassembler better have a little mojo working for it. All it tells you is that there is a table there and what calulations are performed on it.

If you don't know what X,Y parameters are on a 3D table, it's a good time to learn. It's nice to have the entry number on the table as well as the decimal values.

I was not talking about using this to FIND tables, it's a way to DISPLAY a table after you figure it out.
And yes, I can tell all of the table dynamics from the disassembly. Table size and interpolation fraction are calculated just before the lookup.
That is not the disassemblers job, that is YOUR job.

Even with BDM, the disassembly gives you all the addresses accessed, how could anything possibly tell you what they are? All the hardware on the board is unlabled and some custom. without a vehicle to test and a exhaustive list of tests, there is no telling what every address does. A day? Please. I don't care if you can read every address, you need to test, and that's tedious.

What are you talking about? That is exactly how you determine what the inputs and outputs are.
Apparently you have never done this.

With all of the HC11 stuff I would write my own routine or modify what was in there so I could have control over the hardware addresses. With that and My real time Eprom emulator I could make all of the changes needed to identify the hardware. Right down to how to program the the PWM outputs.

And it only took me 1 day. That is with the HC11 and no
native BDM mode.
This was done on a test bench with plenty of test equipment. Function generator, scope, dvm, decade box, etc.

Do you mean to tell me you are not capable of sticking
a piece of test equipment or variable resistor on an A/D
input to tell what address it is and what resolution it is?
If not, then I guess you can't look at an I/O port and do the math on what bits are what lines.

I also don't need a vehicle. Go get a wiring digram for the PCM from Mitchell.

Listen Mr. [email protected], don't come over here fishing for answers.

Hey Mods, find out this persons IP address and ban him.
Display it also.
I have a feeling he is somebody who causes a lot of problems on a few other boards.

When people come around and tell you that it can't be done and it won't work, and there is no way you can tell from doing that, they are usually fishing for answers because they can't figure it out.


As for BDM software, Avocet and Cosmic come to mind.

Super Sport x2

[Chris@HPTuners]

I don't want to sound like a di$#, but what's wrong
with IDA?

I don't see how somebody can manage a text file with
all of the indexed jumps and stack pointers used with
the 68k code.

If you want to write something "over the top", make it
a program that can write out a table with all of the
X,Y parameters that go along with it. This is the part where all disassemblers fail, and is the most time consuming. Once yout get the algo disassembled, you then need to make different "cal" files for different models.

I have used IDA before for disassembling all kinds of win32 things but i never even thought it would do the 68332. Now i need to think very seriously about the US$399 road to a pain free few weeks... :

[Guest]

Hey Sport, I think you need to chill. If chalenging your position is worth being baned, well then excuse me for stating an opinion. Besides, I didn't say it couldn't be done, I just said not in a day. Now maybe I misunderstood exactly what it was that you could do in a day, my point was you trivialized a large task. A PCM ain't a 8-bit HC11.

There is a lot of unidentifiable hardware on a PCM. The best "wiring diagram" you're going to get is at best a pin out and some major components. I don't think GM makes the schematics to their PCMs available to the public.

Since Motorola uses a flat address space, many of the addresses will not just be simple I/O, they could be setup registers and the like for various hardware on the board.

As far as tables go, sure you can identify from the disassembly how the table is read, what calculations are performed on it, and where that data is wrote to. What it's not going to tell you is how many hex make a degree, what the RPM divisions are, and that the other axis is load based on mass air flow (using a Spark table as an example). That's what I meant by table dynamics, sorry if I misunderstood you.

Now, I ain't about to have a pissing contest as far as what I know, were are all here to exchange ideas (remember, it's a forum). If you don't want to tell me yours, don't.

I here Hypertech is looking for a good software guy, maybe you should apply. I'm sure they would love to know what you could figure out so easily.

Go Fish.

gameover:

IDA is worth the money if you do a lot of disassembly. It works for a bunch of different processors. You can also add to it if doesn't support a particular processor. It's a lot of fun and very powerful.

[Chris@HPTuners]

i'm going to finish what i started with this disassembler, i know IDA will do the job (although it still misses some of the opcodes for the proprietary version of the 332 apparently) but i guess you can call me a sucker for punishment i guess.

I like the idea of the table intelligence, as i agree that finding the tables once you have a valid dasm is not that hard but working out the unit translations and axes isn't so easy. Automating this one would be a real challenge.

NS, maybe we could trade disassemblys of a common bin for comparison once i get things working?

[Casey]

I'm chilled NS. ;D

I'm not talking about an HC11. I'm talking about any
external hardware on any CPU.

Hardware is going to be at a certain address location.
The CPU registers are going to be at 1 of 2 locations.
CS lines and address ranges are all spelled out in the CPU configuration.

Regardless of the configuration registers on the hardware, one needs to find the resolution bitrate of the A/D conversion and Msec/bit on other conversions.

All of the DRP and MAF timings are done outside of the CPU. You will see where the CPU accesses those external values to calculate both.

The built in table routines are standard for Mot. You are still going to have the same bit/entry number.
Checkout EB253.pdf at big M's site. All scaling and interpolation fractions of the data is before the lookups.

If you know how an input value is scaled, you can easily
find the table scaling.
I wrote this at the Corvette site for a few guys.
http://forums.corvetteforum.com/zerothread?id=547494
That was for the HC11.

Now as for finding what the table values mean, that is another back step process.

That is what I was talking about when I said you need to be able to read and have control over the hardware.

You can sure as heck see where the CPU reads and writes to the hardware. You can also see where values are limited. I have labeled many custom I/O/R, and PWM/Timing/Scaling IC's.

BTW, Mitchell has all of the pinouts for the ECM's/PCM's/VCM's.

;D

[RoboGeek]

sooo.. trying not to sound too stupid, but I can't find any info on it.. what is IDA?

[Keith@HPTuners]

Interactive Disassembler..

[Chris@HPTuners]

http://www.datarescue.com/idabase/

[RoboGeek]

Oboy!! a new toy to make me pull my hair out!! ;D

[Guest]

If you take a multimeter to a 332 based PCM (at least the one I have, '96 V6), you'll find that the analog inputs go to some analog muxes, and from there to a chip whose pinout is suspiciously similar to an HC11.

The crank and cam inputs go to an ASIC, and the SEFI and DIS outputs come from the same ASIC. There is a second ASIC that is connected to this one.

Figuring all this out IMO is going to be a complicated job.

Does IDA do code seeking? meaning does it follow branches to intelligently determine the difference between code and data?

[Guest]

It's cool Super Sport. I guess we just needed to get on the same page. 8) You make some good points. I'll check out the post when I have a little more time, looks a bit long! I know you can get pinouts (they're in the Helm service manuals too), I just wish we could get a hold of a full blown schematic. Wouldn't that be great?

country joe:
Yeah, IDA does. Depending on how the code was written, sometimes you get lucky and it will just crank through a disassembly. Other times it's a little more tedious. That's why it's Interactive though ;D

Sometimes you just got to guess code/data. With some practice you can usually tell when you accidentally turn data into code. The real challange would be to fully disassemble it and then try to reassemble it and put it back in a PCM and see if it works. I never actually tried that, though I would like to.

gameover:

I'll give a public bin a shot. Just let me know which one your after. It's actually been awhile since I worked on one.

[RoboGeek]

I've done the same kind of thing to identify a/d converters, etc.
And having my scope around is invaluable. Only prob I have is simulating all the inputs, outputs, sensors etc so the darn thing at least works half-arsed to even get a reading.

I'm having WAY too much fun with the old ones.. I refuse to even look at a newer one!