A2L-Transfer is a command-line tool designed to simplify the process of creating an A2L file for a given binary file. This tool takes two inputs โ a source binary file and an existing A2L file โ and generates a new A2L file for a target binary file.
- Ghidra installed
- BinDiff installed
- BinExport Plugin for Ghidra installed
Currently its optimized only for MED9.1 ECUs but it can be adopted to other ECUs as well. Just adjust main.py for your bins and then run it. Its recommended to run it step by step, as there might be errors during the process Thats why the things are commented out
- Bin_A Source Binary where you have a A2L
- Bin_B Target where you have dont have a A2L
-
1. Generating Ghidra Project for Bin_A
-
This step will generate a new Ghidra Project for the binary.
-
It will then define the memory map using "med9-install.py" and also move the binary to the right location in memory
-
It will define all "UndefinedFunctions" using "DefineUndefinedFunctions.py"
-
It will use ExportBinExport.py to export the Binary in a BinDiff compatible Format.
-
If you are using some other cpu than MED9, you will have to adjust the scripts according to your needs.
-
You can do this steps also manually
-
BinDiff Export can be done also using IDA Pro
-
2. Generating Ghidra Project for Bin_B
-
Step is doing exactly the same as Step1, but for Bin_B
-
3. Generating a2l.json
-
This step will take the provided A2L for Bin_A and generate a JSON file out it. Reason is that parsing A2Ls in ghidra is complicated because its using Python2. It will generate a Json like this:
"<Variable Name>": {
"name": "<Variable Name>",
"description": "Description from A2l",
"type": "map",
"addr": "<address of variable>",
"size": 1
},
- 4. Generating RefMap.json with help of A2L.json
- This step will take the json and use Ghidra to generate a RefMap of all A2L addresses in Bin_A. Refmap will be looking like this:
"<Variable Name>": {
"refs": [
{
"type": "READ",
"addr": "<Address of Instruction which is doing something with the Var in Bin_A>"
}
],
"name": "<Variable Name>",
"addr": "<Address of the Variable in Memory in Bin_A>"
},
-
Basically it will parse all accesses to the memory locations(xrefs) from ghidra and output them as JSON
-
5. Generating Bindiff DB
-
This step will run BinDiff with BinExport Files from 1 and 2. This is where all the magic is happening.
-
Bindiff will match up the functions together and provide a SQLite DB with the results. It will be used in the next step.
-
If its unclear what bindiff is doing, open up the Bindiff Gui and compare the two BinExport files manually.
-
6. Generating Target Instruction Map
-
Now we can iterate over the Refmap.json and try to find matching instructions in BinDiff Database for Bin_B
-
It will generate target_instruction_map.json, which will contain the a2l_name and the address of the instruction which read/writes to it in Bin_B
-
Attention: This step might take some time(5m). I havent figured out what the performance bottleneck is, but i suspect its the sqlite-database
-
Target Map looks like this:
{
"<Variable Name>": "<Address a instruction which changes the var in Bin_B>",
}
-
Key is the a2l-name
-
value is the address of a instruction where its getting changed in Bin_B
-
The process selects from the list of xrefs a matching instruction which is present in both binaries
-
Process can be modified in generate_targetmap.py
-
7. Generating Addressmap
-
We just need to match targetmap to the real addresses of var. This is done by running ghidra on Bin_B
{
"<Variable Name>": "<Address of the Variable in Memory in Bin_B>",
}
- 8. Generating A2L
- The process will just take 2 files and replace addresses in the target a2l with addresses from targetmap
- Its not very reliable this way as it might overwrite some addr, but i know that and for my hobbiest needs this is enough
- It should be improved, but i usually work with JSONs from 7 anyway :)
We welcome contributions! If you have ideas for improvements, bug fixes, or new features, please open an issue or submit a pull request.
This tool is licensed under the MIT License. Feel free to use, modify, and distribute it according to the terms of the license.
This tool is provided "as is" without any warranty. Use it at your own risk, and always make backups before performing any critical operations.
For any questions, issues, or feedback, please create an issue on the GitHub repository.
Thank you for using A2L-Transfer!