Search results

If the application only found one candidate then it's pretty certain the image will be OK. The 34 byte TechTom signature starts at 0x3FB8, which is the usual place. The vector table also looks OK. 0xC003 will be the address of unhandled interrupt handler, this is the same address as the...

I've knocked up a quick application that does a brute force descramble using the heuristics listed in my previous post. It correctly descrambles 2 of the TechTom images I have access to. The source code is available from...

It may be possible to descramble a TechTom ROM image without having the original ROM image. As Jon said, every ROM image must have a valid vector table in the last 32 bytes, so each address in the vector table must be in the D000-FFFF range (or C000-FFFF for later chips). In addition there are...

I've taken the opportunity to have a re-org/cleanup of the Assembla space. Now the 3S-GTE ECU Assembla space (http://www.assembla.com/wiki/show/3SGTE_ECU) just contains information & files relevant to the 3S range of ECUs. As a bonus I've also included the application source code to scramble...

That's a very good point actually, I don't think anyone has yet looked in to using the 'spare' data bus cycles for reading the RAM. It should theoretically be possible for a 2nd processor to read from/write to the RAM when the Denso MCU isn't using the data bus. A memory access cycle only...