The 68hc916 has three 32k flash memory banks. They are downloaded by Bank address not by program address. The CPU has a 4M address space and the flash can be mapped to any 32k segment of that space.
In all the 16 bit Denso units seen so far the banks are assigned as follows
Edit: Does not apply to TLR, see below
Bank1 0001:0000 - 0001:7FFF Map data Bank2 0000:0000 - 0000:7FFF Lower Code area Bank3 0000:8000 - 0000:FFFF Upper Code area
Prog16z uploads each bank in a seperate .s19 file with an address offset of 0x00010000.
In order to disassemble the ECU in IDA pro you will need to merge these three files into a single binary image. Here is the procedure using mot2bin.exe
1) All three files must be named in the DOS 8.3 format (8 filename, 3 ext). Long windows filenames will not work with mot2bin.
2) convert the 32k2 bank first as it starts at 0000:0000.
c:\>mot2bin /o4294901760 ECU_32K2.s19 ECU.bin
3) merge the 32k3 bank as it starts at 0000:8000
c:\>mot2bin /o4294934528 /m ECU_32k3.s19 ECU.bin
4) merge the 32k1 bank, no offeset is required.
c:\>mot2bin /m ECU_32k1.s19 ECU.bin
ECU.bin is now a 96k bin file with all three banks merged.
NOTE: when you download the banks form the ECU using Prog16z be sure to name them so you know which bank is which (k1,k2, or k3)
TL1000R ECU
Apparently it only takes half as much software to run a twin than a four as the TLR ECU does not use the k3 bank at all an therefore move the map data down to 0000:8000. To merge a TLR file do the following
Bank1 0000:8000 - 0000:8FFF Map data Bank2 0000:0000 - 0000:7FFF Code area Bank3 blank
Prog16z uploads each bank in a seperate .s19 file with an address offset of 0x00010000.
In order to disassemble the ECU in IDA pro you will need to merge these three files into a single binary image. Here is the procedure using mot2bin.exe
1) All three files must be named in the DOS 8.3 format (8 filename, 3 ext). Long windows filenames will not work with mot2bin.
2) convert the 32k2 bank first as it starts at 0000:0000.
c:\>mot2bin /o4294901760 ECU_32K2.s19 ECU.bin
3) merge the 32k1 bank as it starts at 0000:8000
c:\>mot2bin /o4294934528 /m ECU_32k1.s19 ECU.bin
ECU.bin is now a 64k bin file with code and map data banks merged.
NOTE: when you download the banks form the ECU using Prog16z be sure to name them so you know which bank is which (k1,k2, or k3)
