TRACE32 C166 SIMULATOR -> need some help...

[oOXTCOo]

Can someone please be so kind and help me how to get started using TRACE C166 SIMULATOR Tool by Lauterbach?

i whant to simulate a infineon C166 based 4mb flash dump.

but this tool seems very complicated...
if someone could help me to understand that tool, would be realy great for me..

with IDA is not possible to simulate, but with trace32 should be possible.

what i need to set, how i need to load it?


hope some expert can give me some help with that tool...

thanks!

[mix3584]

Offtopic.
One question. On the infenion's site there are a few software for emulation and debugging:
Emulators/Debugger Development Systems - Infineon Technologies
What is this program TRACE32 better than others?

[oOXTCOo]

if another tool is able to simulate, i also would be happy..
its mutch more easy when i can simulate instead of static analyze.
so it seems that trace32 simulator is the most advanced tool for that.


so nobody can or whant help?

where are the good old siemens reversers?

[mix3584]

saw russans forums about siemens. but who cares about it now, only google cach

[karwos]

Craciing Xgold1 ?
Grab some original KEIl tools maybe.

[Gecko_UK]

you probably seen these already

https://www.keil.com/demo/eval/c166.htm
TASKING - Embedded software development tools from Altium

[oOXTCOo]

Originally Posted by karwos

Craciing Xgold1 ?
Grab some original KEIl tools maybe.

no... iam not interessted in nokia
i have some cheap ulc2 phones.. direct unlocking is easy.. but i whant to reverse the nck algo..

[karwos]

IDA support this CPU 100%
I was reversing Xgold1 Hash encryption - Reversing taking a little more, as this is generally 16-bit CPU, but addressing 24-bit addressing mode (something like 16bit mode on x86, diffrent pointer for data segment, diffrent pointer for 16-bit offset), so usually pointers are passed as two registers.

Example from 1616 RSA Verification routine:

mov [-r0], r15
mov r12, #0Fh ; Verify PKCS1 Header
mov [-r0], r12
mov r12, #0Ah
add r12, r0
and r12, #3FFFh
mov r13, DPP1
mov r14, r9
mov r15, r6
calls 0E5h, memcmp ; r8 - len, r14 r15-src ptr, r12 r13 - dst ptr
add r0, #2
mov r15, [r0+]
cmp r4, #0
jmpr cc_NZ, loc_C747A4

Read about Addressing mode for this CPU.
As far as I remember, addresing also depends of current set DPP, and for example is calculated like:
(R12 * 0x10000) + offset (R13)

but off course addressing varying from call to call. Read C166 docs and you will cleary see diffrence.

BTW - VERY ugly CPU



hope this helps.

[zulea]

Can use Keil.

BR,
Zulea