Next, download "Free Hex Editor Neo" if you haven't already got a hex editor.
Looking at the Sub-nnnn.txt files output from the split program, I notice that the first subroutine starts at address 9300. (ie the lowest numbered file is Sub-9300.txt).
Open up the 64K 703315.bin file in the hex editor and scroll down to the start of the ROM at address 8000. Page down through the hex and just look at it. You can patterns in it, like this for example:
00008120 7D 7D 7D 7D 7E 7F 80 80 80 80 80 80 80 80 80 80 }}}}~...........
00008130 7D 7D 7D 7E 80 82 81 80 81 81 7F 7F 7F 7F 7F 7F }}}~............
00008140 7F 80 80 80 80 7F 80 7F 7F 80 7F 7E 7E 7E 7E 7E ...........~~~~~
00008150 7E 7E 7E 7F 7F 7F 7E 7E 7F 7F 7F 7F 7F 7F 7F 7F ~~~...~~........
00008160 7F 7F 7F 7E 7D 7C 7D 7E 7F 7F 7F 7E 7E 7E 7E 7E ...~}|}~...~~~~~
00008170 7E 7E 7E 7D 7C 7C 7C 7D 7E 7E 7E 7E 7E 7E 7E 7E ~~~}|||}~~~~~~~~
00008180 7D 7D 7D 7D 7C 7D 7D 7D 7E 7E 7E 7D 7D 7D 7E 7E }}}}|}}}~~~}}}~~
00008190 7C 7C 7C 7C 7B 7B 7B 7C 7D 7D 7D 7D 7D 7D 7D 7D ||||{{{|}}}}}}}}
000081A0 7C 7C 7C 7C 7C 7C 7C 7C 7D 7D 7E 7E 7D 7C 7C 7C ||||||||}}~~}|||
000081B0 7E 7E 7E 7D 7C 7C 7D 7E 7F 7E 7E 7D 7D 7C 7C 7C ~~~}||}~.~~}}|||
000081C0 7E 7E 7E 7D 7C 7D 7D 7E 7F 7F 7E 7E 7E 7E 7E 7E ~~~}|}}~..~~~~~~
000081D0 7E 7E 7E 7E 7E 7F 7F 7F 7F 80 7F 7F 7E 7E 7E 7E ~~~~~.......~~~~
000081E0 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7E 7E 7E 7E ............~~~~
000081F0 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7F 7E 7E 7E 7E ............~~~~
00008200 80 80 80 80 80 80 80 80 80 80 80 7F 7F 7F 7F 7F ................
00008210 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 80 ................
This is ROM data, where the the maps and constants are stored. When you get down to 9300, you will see a change, the data appears more random with no discernable patterns. This is program code.
00009300 C9 F0 F0 04 90 02 A9 F0 42 A9 00 80 1B C9 F8 F0 ........B.......
00009310 04 90 02 A9 F8 42 A9 00 80 11 C9 E0 F0 04 90 02 .....B..........
00009320 A9 E0 42 A9 00 4A 42 6A 4A 42 6A 4A 42 6A 4A 42 ..B..JBjJBjJBjJB
00009330 6A 4A 42 6A 42 48 D8 29 FF 00 78 8E 7A 40 18 6D jJBjBH.)..x.z@.m
00009340 7A 40 58 AA F8 42 68 F0 31 B5 01 38 F5 00 F0 2A z@X..Bh.1..8...*
00009350 B0 18 49 FF 3A 42 49 FF 42 3A 78 42 8D 7A 40 89 ..I.:BI.B:xB.z@.
00009360 0D 7A 40 58 89 28 18 75 01 60 78 42 8D 7A 40 89 .z@X.(.u.`xB.z@.
00009370 0D 7A 40 58 89 28 18 75 00 60 B5 00 42 A9 00 60 .z@X.(.u.`..B..`
At the end of the file, from addresses FFD4 onwards, is an important area called the interrupt vector table (IVT). The position and layout of this table can be found in the datasheet for the CPU. So it is the same for all ECUs that use the M37791 CPU.
0000FFD0 0D 05 07 FF 0E 97 D8 FE D8 FE 24 DC 0E 97 AE CE ..........$.....
0000FFE0 0E 97 5F CE 0E 97 E2 CE 27 CE 0E 97 0E 97 F9 CB .._.....'.......
0000FFF0 0E 97 0E 97 0E 97 A6 FF BD FF 0E 97 0E 97 0E 97 ................
The IVT is a list of 16 bit addresses that correspond to particular events that might occur. When one of these events occurs, the CPU stops whatever it is doing, looks up the appropriate address in the IVT and then runs the subroutine at that address. Later on, if it encounters an RTI instruction (return to interrupt), it will return and continue with what it was doing previously.
The layout of the IVT looks like this. I have filled in the addesses for you, but you can see how they match up with the hex data above. Notice that this CPU is "little-endian". That means that when a 16bit number is stored in the memory, it is stored with the lowest 8 bits first, then the highest 8 bits. For example, the address 970E is stored as "0E 97"
FFD4: A/D Interrupt control - 970E
FFD6: UART0 tx interrupt - FED8
FFD8: UART0 rx interrupt - FED8
FFDA: UART1 tx interrupt - DC24
FFDC: UART1 rx interrupt - 970E
FFDE: Timer D interrupt - CEAE
FFE0: PWM1 interrupt - 970E
FFE2: Timer B1 interrupt - CE5F
FFE4: TG2 interrupt - 970E
FFE6: TG1 interrupt - CEE2
FFE8: Timer B4 interrupt - CE27
FFEA: Timer B3 interrupt - 970E
FFEC: Timer C2 overflow - 970E
FFEE: Timer C1 overflow - CBF9
FFF0: Timer C2 strobe interrupt - 970E
FFF2: Timer C1 strobe interrupt - 970E
FFF4: External INT interrupt - 970E
FFF6: Watchdog timer - FFA6
FFF8: Debug - FFBD
FFFA: BRK instruction - 970E
FFFC: Divide by zero - 970E
FFFE: Reset vector - 970E
The most important one here is the "Reset Vector". This tells the CPU what to do when you first power it on. In this case, it runs the subroutine at 970E. You will notice that there are some other vectors pointing at 970E, Divide by zero, for example. Effectively this means, "Reboot if this event occurs".
The next thing to do is to label the subroutines called by these interrupt vectors. Starting at the beginning of the list we want to rename Sub-970E.txt to Sub-970E-Reset-Vector.txt. But we don't have a Sub-970E.txt because my split program hasn't split out the interrupt vectors. oops! If you open Sub-966D.txt and scroll down, you will see that subroutine 966D ends at 970D.
009709 A9FF00 lda ax, #0x00ff ; Branch target from 9702
00970C F8 sem ; m:1 x:0, Branch target from 9707
00970D 60 rts
VECTOR: A/D interrupt control address: 970E Length: 159 M:0 X:0
00970E D8 clm ; m:0 x:0
00970F A90000 lda ax, #0x0000
009712 5B tad
You could split these out manually, but to save you the trouble, I'll send you a fixed version of the split program. Just delete the Sub-nnnn.txt files and run the new split against your 703315.txt file.
