Quote:
Originally Posted by Terraphantm
Yeah that's the gist of it. I made a proof of concept python script that can correct the checksum ages ago, I'll see if I can dig it up.
Subtract the FFE (and sometimes it'll be FFF). With the MS45, the FFE and FFF prefixes are for the external flash while the internal flash is mapped directly. Of course when disassembling most addresses are derived by adding/subtracting from a table of contents, but that's a bit outside of the scope here.
FFE47340 (made up address) would map to 0x47340 in the external flash, or 0x7340 if you extracted the tune alone. Generally speaking I've found that the FFE prefixes are used to reference data within the parameter section and FFF for everything else on the external flash, but that's not a hard and fast rule.
|
No need to dig up the script, because I'm happy to report I've solved it! I built an Excel file that will solve for the checksum, and I verified it on several different software versions of MS45. THANK YOU!!! The information you gave me was the last critical piece.
