Question about V850 Memory mapping and codes like "jarl 0xffff6532"

Hi, I meet a problem when i try to reverse analyze my BIN file with IDA Pro.

In the code, i find some jarl instructions just like "jarl 0xffff6532"

some codes like this:

movea   2, r28, r8

mov     0xFFFF689C, r9

movea   0xDFB, r0, r6

mov     3, r7

jarl    0xFFFF6590, lp

cmp     r0, r10 movea   2, r28, r8
mov     0xFFFF689C, r9
movea   0xDFB, r0, r6
mov     3, r7
jarl    0xFFFF6532, lp
cmp     r0, r10

Whats the code is it in address 0xFFFF6532 and 0xFFFF689C?

Is this code generated by memory mapping? If so, where is it in my bin file, How can I associate this code with the real address in BIN file.

If not memory mapping, How can this happened?

Thanks for all.

  • jarl will move to address below your current PC.

    From the V850 Architecture User Manual:

    Saves the current PC value plus 4 to general-purpose register reg2, adds the current PC value and 22-bit displacement, sign-extended to word length, and transfers control to the PC. Bit 0 of the 22-bit displacement is masked by 0.

    Make sense?

    I am not sure which V850 core you are working with, but please reference the V850E1 architecture UM on the web:

    http://documentation.renesas.com/doc/DocumentServer/U14559EJ3V1UM00.pdf

    Gary

  • Thanks gmiler.

    From the documents i know this address with 0xFFFFxxxx prefix is used by self_lib.

    I cant find where the codes defined in the BIN files.

  • The self_lib is probably copying the code from a ROM area into RAM, before the jarl instructions execute.  Address 0xFFFFxxxx is a RAM area on a V850E or V850ES core device, for example with 40KB or more of internal SRAM.  Operations that modify flash memory must be executed from RAM while the flash is busy.