search

esaulenka / ghidra_v850

Ghidra support for Renesas V850 MCUs
MIT License
60 stars 25 forks source link

Bad instruction - Truncating flow here #17

Closed RyanHope closed 1 year ago

RyanHope commented 3 years ago

I am working on a few V850 and RH850 based ECUs, 99% of the binaries seem to be disassembling fine but in a few instances bad instruction data is encountered.

Here is an example from an RH850: image

esaulenka commented 1 year ago

Ryan, sorry for a very late answer.

In a bitwise representation, your instruction looks like 0110 1111 (6f) 1111 0010 (f2) 0001 0000 (10) 0010 0000 (20), or if we use splitting as in Renesas reference, 01101 (op1115=0d) 111 111 (op0510=3f) 10010 (op0004=12) 00010 (op2731=02) 000001 (op2162=01) 00000 (op1620=00)

I didn't find such pattern in a documentation (here, page 424), but something similar I have already described in a v850e3.sinc - I think it is a LDSR.

I don't have access to closed Renesas specs, so I am not sure, what exactly core should be used. You can try disassembly your file as 850E3, but I never tested it in a real large projects.

bata24 commented 1 year ago

Maybe, the root cause is that the system registers definition of selID=2 in v850e3.sinc is wrong. It seems off by one.

wrong: mei ispr pmr icsr intcfg _ _ _ correct: mei _ ispr pmr icsr intcfg _ _

see: https://www.renesas.com/us/en/document/mas/rh850g3kh-users-manual-software p.58

esaulenka commented 1 year ago

thanks @bata24 ! yes, it is a LDSR R18, INTCFG, 2

Special thanks for RH850 specification. I couldn't find it several years ago.