Post
So now I have a lot of loose threads to follow, but none of them seems immediately promising:
1) Build own 5-phase motor controller
2) Gain some key CAN logs to reverse engineer the #FBS4 personalization and activation procedure
3) Find a way to read the firmware dump to:
a) rev-eng FBS4
b) understand just enough of FBS4 to patch it out
4) ???
If somebody would be interested in helping me solve that firmware puzzle, I'd be very happy!
I got a bit more progress in on the #startergenerator.
Massive thanks to @SDRHoernchen for finding the exact ST SPC5 from the die marking and @blazra for the VLE hint.
(And ST for not putting the reference manual behind a NDA)
With that information I could start actually #reverseengineering the firmware in #Ghidra.
I already found some CAN handling.
The decompiler really struggles with the r2/r13 SDA/ToC registers and almost never resolves them to the actual memory address accesses though :/
![An excerpt of decompiled code with very few memory accesses, because many are not correctly decompiled from indirect accesses via r2/r13 (PPC SDA/ToC registers).
Like SDA[-0x4553] =...
They are set correctly in the Disassembly though.](https://assets.chaos.social/media_attachments/files/112/574/734/322/799/632/original/ab316b161769965e.jpg)