Keep yourself on the loop and stay updated.

Articles and resources.

Join and split windows in Ghidra

Repeated question over and over again: How to split windows in Ghidra and how to switch them back to the main screen of the tool (e.g. Code Browser). This short video clarifies any doubts.

Ghidra

Calls instead of jumps

Have you thought about exploring an alternative method for adding custom code to an existing program? Using the CALL instruction can be a fantastic option compared to traditional jumps! While jumping techniques often involve inserting code into the processor’s FLASH memory and carefully managing register contents, the CALL instruction streamlines this process and makes it more efficient. By utilizing the correct registers in the UPPER CONTEXT, we can avoid the hassle of manual register management, making our code cleaner and easier to work with. It's true that while we can overwrite the original CALL instruction, we should be mindful of the potential address misalignment. A simple fix is to adjust the address accordingly to keep everything on track. Additionally, it’s vital to protect the LOWER CONTEXT registers, which are essential for passing variables and feedback, as this helps maintain system stability and prevents crashes. Overall, the CALL instruction method simplifies operations significantly, and with a bit of attention to register contexts, we can ensure smooth and effective functionality in our programs. Let’s embrace this method and boost our coding adventures!

Ghidra

WinOls

Free Guidance via Zoom

Ghidra and WinOls are not just topics, but essential tools that can significantly enhance your work. If you're unsure about what to learn, these are the ones you should be focusing on. If you are starting with Ghidra, choose the Ghidra Fundamental Course. Don't let the lack of guidance hold you back. You can always take advantage of our free online meetings. These meetings are designed to help you find the right training path and clear your doubts, all from the comfort of your own space. Haven't you spoken to me online yet? I'm eagerly looking forward to our Zoom meeting. Book an appointment, and I'll be there, ready to assist you in your learning journey!

Ghidra

Tricore code protection - obfuscating

Hello, fans of chip tuning and Ghidra. Today, I'd like to discuss securing your code from the curious. Once you've written your code for map switching, launch control or any other KAN-related function, you'd probably really like it to be secure enough that it doesn't immediately find its way into the offerings of others who instead of arriving at concrete solutions, just try to copy the ideas of others. Securing your solutions is essential. I added a lesson on securing code to the introductory G-Hydra course for Tricor, and there, I presented one of the more interesting and practical ideas for ensuring your code from unwanted analysis. I'm sure you've heard the words "code obfuscating." Securing programmes written for mobiles or PCs is necessary to prevent information leakage. The same is valid here. Also, a short video introducing the idea of obfuscating code in Tricore will soon appear here. For a full version, I invite you to my Ghidra Tricore training.

Merry Christmas & Happy Coding in New Year!

Ghidra

Avoid destroying the contents of registers. Or the program will die.

If you are adding your own code in Ghidra, you will, of course, need to install a jump out from the factory programme code into your code. A common method is to override mov instructions, as they update registers with new values and these registers can be freely used in your own code (e.g. mapswitching). In this example, overwriting two movs with the ‘J My_code’ command allows us to use the d15 and a2 registers. One thing to keep in mind - we need to put the piece of original code we ‘destroyed’ at the very end of our program, so that the d15 and a2 registers regain their correct factory content. If we need more registers (in fact, we always need them), having one data register and one address register is enough to store another in RAM and rebuild their contents at the end. It is essential to remember this, reverse-engineering geeks. 😉

Ghidra

Idea for Ghidra - WinOls mapswitching addresses synchronization

If you are doing a mapswitching project in Ghidra, try to mark important addresses in the programme code or maps by creating 4-byte ‘maps’ (or the size of the area being overwritten with your code). Also mark the beginning of your code (at a minimum), or even each function individually (e.g. read_buttons, display_on_dashboard, change_address_map_TQlimit_01, etc.). In turn, mark the maps as the entire area occupied by them, including their axes and lengths (for Ghidra purposes), and a second time with the initial text ‘MAP_’ as maps for editing in WinOls. This way you won't have a mess. I have been doing this for a long time and it works perfectly.

WinOls

Can zeroing the regeneration maps damage the EV engine?

I often read on forums that disabling regen (resetting the regen current maps to coast in the chosen car mode, be it Tesla, Nissan, Kia, Taycan etc.) can lead to engine damage. The manufacturers' recommendation not to tow an EV car on wheels is cited as an additional argument. Of course, we can imagine the phenomenon of auto-induction as a result of unleashing a deactivated engine (although this too is not so obvious and depends on its design) - this also comes up as an argument. However, this is flawed thinking, as the engine can operate in coasting mode during operation if only when the gear is shifted to the ‘N’ position. Nothing bad will happen. Why? Well, because the engine is still powered and controlled because the car is on. So you can tow the car running (preferably in N mode), and you can also reset the regen current maps, because they are used when the car is running, not when it is off. Also - no fear!

Ghidra

Ghidra does not start - you need Java.

If right after installing Ghidra it doesn't want to work, then you probably don't have the JRE (Java Runtime Environment) installed and after all Ghidra is written in Java. All you need to do before running Ghidra (by running ghidrarun.bat) is to open the page: https://www.oracle.com/java/technologies/javase/jdk17-archive-downloads.html and download Java. I recommend downloading DMG Installer (Mac) or Windows Installer (MS Windows). Installing this package should solve the problem.

Ghidra

Renesas: Strange commands with an underscore sign. Watch out!

If you are working on mapswitching in Ghidra, you are probably also doing something for Japanese cars, where very often the ECU is based on a Renesas microcontroller (various models). My students make their own attempts before they start learning with me. I have noticed that the most common problem and cause of failure is not understanding the commands preceded by an underscore: ‘_nop, _add, _mov, _extu, _mulr’ etc.). Often the first attempts were made on drivers from Tricore, or others with purely sequential writing. What is above - is done first. Here, unfortunately, it is different. To speed up the processor, Renesas added the following possibility to the core - two commands can be processed at once (some), whereby if the second one is written with ‘_’, it will be executed first. So if the second one is ‘_nop’ it doesn't change anything, of course. Any other function, on the other hand, does. We have to treat it as if it were written above its predecessor. Watch out for this - it's a really common error with Renesas analysis!

WinOls

Diesel tuning? Beware of cubic milimeters!

A common mistake in calculating the correct diesel ECU maps is failing to notice that the injection timing map (alternatively - injection duration) has the engine load axis scaled not in mg/cycle, but in millilitres/cycle (cubic millimetres). Since diesel fuel's density is less than that of water, one litre of diesel fuel weighs less (0.82kg) than one litre of water (1kg). By ignoring this fact and treating millilitres as milligrams, we are making a significant error. Some tuners know this, but claim that it is not a big difference when millilitres are treated as milligrams. However, this is an illusion. The error is (100/82)*100% = about 20%. Very bad :( Such an assumption means that the tuned, modified injection will start at a lower engine load, and we haven't added air then, because the boost pressure map has the load mostly just in mg/cycle (or in Nm). To correct this, remember to check the Damos/A2L files for the load unit in the Duration map. EDC17 is mostly in millilitres, and MD1 is already in milligrams (but not all). If you notice that they are, however, millilitres (mm^3) then instead of a factor of 0.01 (as for mg) enter 0.0082 and you already have milligrams. Simple and effective. Use this and you will avoid momentary smoke when kicking the accelerator, resulting from a lack of air for the increased fuel dose. Good luck!

We are a Car Tuning Academy centred around the Thomas Teaches Tuning project. We will teach you how to chip-tune your cars from the basics to the master level.

We will also teach you how to reverse-engineer ECUs and add your code to them.

Articles and resources.

Join and split windows in Ghidra

Calls instead of jumps

Free Guidance via Zoom

Tricore code protection - obfuscating

Merry Christmas & Happy Coding in New Year!

Avoid destroying the contents of registers. Or the program will die.

Idea for Ghidra - WinOls mapswitching addresses synchronization

Can zeroing the regeneration maps damage the EV engine?

Ghidra does not start - you need Java.

Renesas: Strange commands with an underscore sign. Watch out!

Diesel tuning? Beware of cubic milimeters!

FEATURED LINKS

WRITE TO US

Articles and resources.

Join and split windows in Ghidra

Calls instead of jumps

Free Guidance via Zoom

Tricore code protection - obfuscating

Merry Christmas & Happy Coding in New Year!

Avoid destroying the contents of registers. Or the program will die.

Idea for Ghidra - WinOls mapswitching addresses synchronization

Can zeroing the regeneration maps damage the EV engine?

Ghidra does not start - you need Java.

Renesas: Strange commands with an underscore sign. Watch out!

Diesel tuning? Beware of cubic milimeters!

FEATURED LINKS

WRITE TO US

Unsure where to start with Ghidra?

Crypto Accepted