TI-TXT to Assembly Language converter - Page 1
Forum section: electronics / general

author: planc
author_rank: Regular Contributor
timestamp: January 03, 2023, 08:21:49 pm
content: What is the best app to convert the MSP430 TI-TXT machine code to Assembly Language?In the Motorola 68HC11, there was the m6811dis that can convert the hex s19 code to Assembly Language. How about in the TI-TXT?

author: Peabody
author_rank: Super Contributor
timestamp: January 03, 2023, 11:48:18 pm
content: The Naken Assembler (small, free) will disassemble .hex to MSP430 assembly. But I don't know if it will do TI-Txt.

author: mon2
author_rank: Frequent Contributor
timestamp: January 03, 2023, 11:53:59 pm
content: @Peabody, are you family ??

author: Peabody
author_rank: Super Contributor
timestamp: January 04, 2023, 05:13:16 am
content: Yes. I am Sherman.

author: planc
author_rank: Regular Contributor
timestamp: January 04, 2023, 10:10:48 am
content: It's not possible in Naken Assembler. But I think Srec_cat.exe could do it.https://www.ti.com/lit/an/slaa149h/slaa149h.pdfBut how do you insert the lines "srec_cat.exe Target_Code.txt -ti_txt -Output Target_Code.asm -asm -output_word -cl430" in latest CCS 12? Can anyone show how? I'm expecting there would be a file with assembly language code from the Ti Txt input, right? Thanks.

author: josip
author_rank: Regular Contributor
timestamp: January 04, 2023, 10:20:50 am
content: Quote from: planc on January 04, 2023, 10:10:48 amYou can not generate "readable" source code in assembler from binary (and ti txt format is binary). You can have view / listing with assembler instructions taken from binary. Don't know what you want to see in binary.AFAIK Ida is the best tool for analyzing binary code ...https://www.hex-rays.com/ida-pro/https://github.com/cseagle/msp430emuYou can also attach to free running device with debugger (without source code) to see what is going on in assembler code. If target device is unlocked.

author: planc
author_rank: Regular Contributor
timestamp: January 04, 2023, 11:25:34 am
content: Ti Txt is Hex, like this:

author: josip
author_rank: Regular Contributor
timestamp: January 04, 2023, 01:17:46 pm
content: Quote from: planc on January 04, 2023, 11:25:34 amI know. My question is what you want to do with it? How assembler code reversed from binary can help you?

author: planc
author_rank: Regular Contributor
timestamp: January 04, 2023, 03:14:53 pm
content: I use Motorola 68HC11 before, and there is a simulator called THRSiim11 that can easily convert between hex file to assembly. I wonder why the Msp430 is more difficult. And what software is ike it that can convert without connecting directly to the MCU. I'm only familiar with assembly. I don't know how to use C. I only do assembly.

author: josip
author_rank: Regular Contributor
timestamp: January 04, 2023, 03:24:08 pm
content: Quote from: planc on January 04, 2023, 03:14:53 pmI was using IAR Embedded Workbench for writing simple code (and simulation) in assembler without any external MSP430 related hardware. It is free for small sized projects. Don't know if there something better exist, because I didn't search.

author: pcprogrammer
author_rank: Super Contributor
timestamp: January 04, 2023, 03:59:25 pm
content: Ghidra can do MSP430 according tohttps://en.wikipedia.org/wiki/GhidraYou need to convert the TI-TXT to binary to be able to load it.Probably not as good as IDA Pro, but it is free and open source.

author: Peabody
author_rank: Super Contributor
timestamp: January 04, 2023, 05:23:29 pm
content: naken_util.exe -disasm will convert an IntelHex file to assembler. And it doesn't need CCS or IAR to work. But there are no labels generated, so it's not particularly easy to read. I have a VBS script that converts HEX to TI-TXT, but you would need it the other way around. Anyway, here's a sample output of the disassembly:Code:naken_util - by Michael KohnJoe DavissonWeb: http://www.mikekohn.net/Email: mike@mikekohn.netVersion: December 12, 2018Loaded hexfile scope.hex from 0xf800 to 0xffffType help for a list of commands.Addr Opcode Instruction Cycles------- ------ ---------------------------------- ------0xf800: 0x4031 mov.w #0x0280, SP 20xf802: 0x02800xf804: 0x40b2 mov.w #0x5a98, &0x0120 50xf806: 0x5a980xf808: 0x01200xf80a: 0x43c2 mov.b #0, &0x0002 40xf80c: 0x00020xf80e: 0x4215 mov.w &0x10fe, r5 30xf810: 0x10fe0xf812: 0x45c2 mov.b r5, &0x0056 40xf814: 0x00560xf816: 0x1085 swpb r5 10xf818: 0x45c2 mov.b r5, &0x0057 40xf81a: 0x00570xf81c: 0x43f2 mov.b #-1, &0x0022 40xf81e: 0x00220xf820: 0x43c2 mov.b #0, &0x0021 40xf822: 0x00210xf824: 0x43c2 mov.b #0, &0x0026 40xf826: 0x00260xf828: 0x43f2 mov.b #-1, &0x002a 40xf82a: 0x002a0xf82c: 0x43c2 mov.b #0, &0x0029 40xf82e: 0x00290xf830: 0x43c2 mov.b #0, &0x002e 40xf832: 0x002e0xf834: 0x4315 mov.w #1, r5 10xf836: 0x40f2 mov.b #0x40, &0x0026 50xf838: 0x00400xf83a: 0x00260xf83c: 0x40b2 mov.w #0x00ff, &0x0172 50xf83e: 0x00ff0xf840: 0x01720xf842: 0x40b2 mov.w #0x0080, &0x0174 50xf844: 0x00800xf846: 0x01740xf848: 0x40b2 mov.w #0x00e0, &0x0164 50xf84a: 0x00e00xf84c: 0x01640xf84e: 0x40b2 mov.w #0x0010, &0x0162 50xf850: 0x00100xf852: 0x01620xf854: 0x40b2 mov.w #0x0210, &0x0160 50xf856: 0x02100xf858: 0x01600xf85a: 0x4036 mov.w #0x0020, r6 20xf85c: 0x00200xf85e: 0xd032 bis.w #0x0018, SR 20xf860: 0x00180xf862: 0x3fff jmp 0xf862 (offset: -2) 20xf864: 0x8316 sub.w #1, r6 10xf866: 0x200a jne 0xf87c (offset: 20) 20xf868: 0x4036 mov.w #0x0020, r6 20xf86a: 0x00200xf86c: 0x4214 mov.w &0x0174, r4 30xf86e: 0x01740xf870: 0x9315 cmp.w #1, r5 10xf872: 0x2407 jeq 0xf882 (offset: 14) 20xf874: 0x9234 cmp.w #8, r4 10xf876: 0x2403 jeq 0xf87e (offset: 6) 20xf878: 0x8392 sub.w #1, &0x0174 40xf87a: 0x01740xf87c: 0x1300 reti 50xf87e: 0xe315 xor.w #1, r5 10xf880: 0x1300 reti 50xf882: 0x9034 cmp.w #0x00f8, r4 20xf884: 0x00f80xf886: 0x27fb jeq 0xf87e (offset: -10) 20xf888: 0x5392 add.w #1, &0x0174 40xf88a: 0x01740xf88c: 0x1300 reti 5Vectors:0xffe0: 0x0000 Vector 0 {}0xffe2: 0x0000 Vector 1 {}0xffe4: 0x0000 Vector 2 {}0xffe6: 0x0000 Vector 3 {}0xffe8: 0x0000 Vector 4 {}0xffea: 0x0000 Vector 5 {}0xffec: 0x0000 Vector 6 {}0xffee: 0x0000 Vector 7 {}0xfff0: 0x0000 Vector 8 {}0xfff2: 0xf864 Vector 9 {}0xfff4: 0x0000 Vector 10 {}0xfff6: 0x0000 Vector 11 {}0xfff8: 0x0000 Vector 12 {}0xfffa: 0x0000 Vector 13 {}0xfffc: 0x0000 Vector 14 {}0xfffe: 0xf800 Vector 15 {Reset/Watchdog/Flash}

author: planc
author_rank: Regular Contributor
timestamp: January 04, 2023, 07:25:57 pm
content: I was surprised to find out a certain gadget has no JTAG fuse blown. I thought most blow it. Are their certain regular chip output or other pins that won't work if JTAG was blown? If product is final, why don't all just blow it?I'm reading the JTAG just to learn it. In the Module There is no JTAG VCC pin but only the rest of the 4 JTAG pins and ground pin. So I have to hold the wire to from the MSP-FET430UIF to the pcb VCC so I don't like to do it again to use the MSP-FET430UIF to read the Intel Hex from main memory of the module. There must be an easy converter to convert Ti-Txt Hex to Intel Hex. Is there? It can convert it perfectly? If not, then I have to use the 430UIF and hold the wire to VCC again (I'm just afraid of risk of shorting the PCB with the wire).Another concern is that I read many reports about using MSP-FET430UIF and CCS on a chip which corrupted it unable to make chip run again. Even with JTAG fuse safety on, it can somehow blow the chip. In this case. Do you know of another FET reader that doesn't have fuse blown function but can read 4 wire JTAG? To avoid the bug or accidental activation of the fuse blower function. Some suspect even with JTAG safety on, the CCS can somehow blow it indrectly rendering the chip corrupted. Hence I want to run the firmware at Launchpad or another chip in case it got corrupted.

author: pcprogrammer
author_rank: Super Contributor
timestamp: January 04, 2023, 07:57:30 pm
content: I found this site with info about converting TI-TXT to binary.https://bincopy.readthedocs.io/en/latest/Also found this one about using cheaper ft232 modules instead of the MSP FET.https://github.com/parezj/BSL430.NET

author: planc
author_rank: Regular Contributor
timestamp: January 04, 2023, 11:09:29 pm
content: Programming via BSL can cause mass erase. I already have the USB hardware for it I bought at ebay and even have the MSPFET.EXE software that is considered the easiest to do. But before I access via BSL and cause mass erase. Please someone use all the shared links to convert the following BSL contents in Ti-Txt to Assembly. Because it is not just using *.bat command in DOS. I actually tried using Srec_cat.exe in dos but it is impossible as I later realised it is in *.exe One has to use it inside CSS for example which I don't know hence asking. So someone please convert the following Ti-Txt to Assembly code and share how you exactly do it (right) (for those with any msp430 chip, please check also if the BSL content is the same as the following). Thanks.@0C0006 0C 1E 0C FF 3F B2 40 40 A5 2C 01 B2 90 55 AABE FF FF 27 31 40 24 02 0B 43 C0 43 FA F5 32 C2F2 C0 32 00 00 00 B2 40 80 5A 20 01 0F 43 F2 4088 00 57 00 F2 40 80 00 56 00 E2 D3 21 00 E2 D322 00 E2 C3 26 00 E2 C2 2A 00 E2 C2 2E 00 B2 4000 A5 28 01 3B C0 7A 00 B0 12 86 0E 82 43 12 0209 43 36 40 0A 02 37 42 B0 12 54 0F C6 4C 00 0016 53 17 83 F9 23 2B B3 2E 20 55 42 0B 02 16 420E 02 E6 0F 17 42 10 02 75 90 12 00 79 24 75 9010 00 54 24 B0 12 58 0E 55 42 0B 02 75 90 18 0032 24 2B B2 18 24 75 90 20 00 1B 24 75 90 16 0028 24 75 90 14 00 A1 24 75 90 1A 00 1E 24 75 901C 00 32 24 75 90 21 00 09 24 05 3C 2B D2 B0 12E6 0E BD 3F 21 53 B0 12 EC 0E B9 3F 2F 00 0E 02F6 3F B0 12 E6 0E D2 42 0E 02 56 00 D2 42 0F 0257 00 D2 42 10 02 16 02 AA 3F B0 12 E6 0E 10 420E 02 15 43 05 3C B2 40 0E A5 10 02 35 40 0C 0092 42 10 02 28 01 40 18 B6 43 00 00 92 B3 2C 01FD 23 15 83 F5 23 D3 3F 35 43 40 18 75 96 03 2017 83 FB 23 CC 3F 82 46 00 02 CD 3F 36 40 E0 FF37 40 20 00 2B C2 B0 12 54 0F 7C 96 03 24 3B D040 00 02 3C 00 3C 00 3C 17 83 F5 23 B0 12 58 0E3B B0 40 00 B3 27 82 93 BE FF 07 24 31 40 00 1004 12 31 90 26 02 FC 23 C6 3F B0 12 EC 0E 67 3F2B B2 34 24 3B D0 10 00 B0 12 54 0F 2B B3 30 2096 00 00 10 07 2C 96 00 00 01 07 2C 40 18 C6 4C00 00 1D 3C B2 40 40 A5 28 01 16 B3 03 20 C2 4C14 02 15 3C C2 4C 15 02 4F 18 86 9A FD FF 01 242B D3 96 00 01 02 04 28 3B D2 3B B0 10 00 02 243B C0 32 00 1A 42 14 02 4F 18 86 4A FF FF A6 0001 00 17 83 D1 23 B0 12 58 0E 71 3F B0 12 54 0F17 83 FC 23 B0 12 58 0E 6E 3F B2 40 80 00 0A 02D2 42 10 02 0C 02 D2 42 10 02 0D 02 82 43 12 0209 43 0E 12 3E 40 0A 02 24 42 7C 4E B0 12 F0 0E14 83 FB 23 3E 41 96 00 00 01 05 28 40 18 7C 46B0 12 F0 0E 17 83 40 18 7C 46 B0 12 F0 0E 17 83F2 23 B2 E3 12 02 5C 42 12 02 B0 12 F0 0E 5C 4213 02 B0 12 F0 0E FB 3E 18 42 12 02 B0 12 54 0FC2 4C 12 02 B0 12 54 0F C2 4C 13 02 38 E3 3B B204 24 1A 96 FE FF 01 24 2B D3 18 92 12 02 2A 232B B3 28 23 30 41 E2 B2 28 00 FD 27 E2 B2 28 00FD 23 B2 40 24 02 60 01 E2 B2 28 00 FD 27 15 4270 01 05 11 05 11 05 11 82 45 02 02 05 11 82 4504 02 B2 80 1E 00 04 02 57 42 16 02 37 80 03 0005 11 05 11 17 53 FD 23 35 50 40 A5 82 45 2A 0135 42 B2 40 24 02 60 01 92 92 70 01 02 02 FC 2F15 83 F7 23 09 43 7C 40 90 00 02 3C 7C 40 A0 004D 43 C9 EC 12 02 19 E3 1B C3 45 4D 55 45 02 0F00 55 0C 2E 2E 2E 2E 2E 2E 2E 2E 1A 34 34 92 4270 01 72 01 B2 50 0C 00 72 01 07 3C 1B B3 0B 2082 43 62 01 92 B3 62 01 FD 27 E2 C3 21 00 0A 3C4C 11 F6 2B 1B E3 82 43 62 01 92 B3 62 01 FD 27E2 D3 21 00 92 52 02 02 72 01 5D 53 7D 90 0C 00D4 23 30 41 4E 43 1B C3 45 4E 55 45 60 0F 00 550C 56 56 56 56 56 56 56 56 36 74 00 E2 B2 28 00FD 23 92 42 70 01 72 01 92 52 04 02 72 01 82 4362 01 92 B3 62 01 FD 27 E2 B2 28 00 1E 28 2B D31C 3C 4C 10 1A 3C 82 43 62 01 92 B3 62 01 FD 27E2 B2 28 00 01 28 1B E3 1B B3 01 24 2B D3 C9 EC12 02 19 E3 0A 3C 82 43 62 01 92 B3 62 01 FD 27E2 B2 28 00 E6 2B 4C 10 1B E3 92 52 02 02 72 015E 53 C2 3F 82 43 62 01 92 B3 62 01 FD 27 E2 B228 00 01 2C 2B D3 30 41 FF FF FF FF FF FF FF FFF2 6F 07 60 00 00 00 00 00 00 02 13 01 00 F6 1Cq

author: Peabody
author_rank: Super Contributor
timestamp: January 05, 2023, 05:22:23 am
content: A while back I did some work on BSL flashing of the Value Line chips - the MSP430Gxxxx parts, and read out the BSL code at 0xC00, and converted it to assembler with Naken. Here's the first part of it:Code:Here is the beginning of the G2xx3's ROM BSL code:0c00: 0c06 .dw 0x0c06 ;Cold start vector0c02: 0c1e .dw 0x0c1e ;Warm start vector0c04: 3fff jmp 0x0c04 ;Endless loop0c06: 40b2 mov.w #0xa540, &FCTL3 ;Cold start: toggle LOCKA, reset LOCK0c08: a5400c0a: 012c0c0c: 90b2 cmp.w #0xaa55, &0xffde ;check key word - is BSL disabled?0c0e: aa550c10: ffde0c12: 27ff jeq 0x0c12 ;yes - infinite loop0c14: 4031 mov.w #0x0220, SP ;no - set stack pointer, etc.0c16: 02200c18: 430b mov.w #0, r110c1a: 43c0 mov.b #0, 0x02160c1c: f5fa0c1e: c232 dint -- bic.w #8, SR ;Warm start - clear interrupts, etc.0c20: c0f2 bic.b #0x32, &IE10c22: 00320c24: 0000-etc-I haven't checked all of it, but it starts out matching what you posted. This would be for an MSP430G2553. If you think that's what it is, I still have one of those chips, and should be able to read out the whole thing and disassemble it.I never installed CCS or IAR. I used TI's command line MSP430Flasher.exe, which does JTAG, not BSL.There is a risk of doing a mass erase, which would have the effect of erasing all the calibration data in Segment A. You might want to look through the PDF file in my Github repo on this subject:https://github.com/gbhug5a/MSP430-BSLBut remember this is for the old Value Line parts. Newer chips will be different.

author: planc
author_rank: Regular Contributor
timestamp: January 05, 2023, 06:25:45 am
content: To use Naken, did you use as input the format ti txt or intel hex? If it can't read ti txt. What application do you use to convert ti txt to intel hex? When you have time, pls convert the entire BSL code so I know if it is entirely similar to the F2617 I got it from.Also I read about srec_cat.exe but can't run it.https://srecord.sourceforge.net/I tried putting it as shortcut in desktop in Windows 10. For example:"C:\Program Files\srecord\bin\srec_cat.exe" outmain.txt -ti_txt -Output outmain.asm -asmI also put it as *.bat file. It just can't run.srec_cat.exe outmain.txt -ti_txt -Output outmain.asm -asmI read about it for half day. Can someone try it or point me to how to run it? Thanks.

author: planc
author_rank: Regular Contributor
timestamp: January 05, 2023, 09:12:27 am
content: I used Msp flasher to load the BSL in Intel Hex format. Is the following middle and end also identical to yours? I'd like to know if it is pure BSL subroutine in the F2617 or ordinary programs are also put in the BSL (is this possible?). And where to get the Msp430 BSL contents in the internet?Also when I ran the following in command prompt in windows 10, naken_util -disasm -msp430 outputbsl.hex, it will dump the intel hex contents in the dos directory. When I tried to use naken_util -disasm -msp430 outputbsl.hex > outputbsl.txt It mentioned "access is denied". So how do you save the disassembly output in a file?:100C0000060C1E0CFF3FB24040A52C01B29055AA25:100C1000BEFFFF27314024020B43C043FAF532C226:100C2000F2C032000000B240805A20010F43F2406F:100C300088005700F24080005600E2D32100E2D342:100C40002200E2C32600E2C22A00E2C22E00B24025:100C500000A528013BC07A00B012860E8243120222:100C6000094336400A023742B012540FC64C000006:100C700016531783F9232BB32E2055420B0216422D:100C80000E02E60F1742100275901200792475903B:100C900010005424B012580E55420B0275901800E3:100CA00032242BB21824759020001B247590160056:100CB000282475901400A12475901A001E247590A4:100CC0001C003224759021000924053C2BD2B0125F:100CD000E60EBD3F2153B012EC0EB93F2F000E02BD:100CE000F63FB012E60ED2420E025600D2420F027A:100CF0005700D24210021602AA3FB012E60E10426E:100D00000E021543053CB2400EA5100235400C0002:100D10009242100228014018B643000092B32C0101:100D2000FD231583F523D33F3543401875960320E3:100D30001783FB23CC3F82460002CD3F3640E0FFC5:100D4000374020002BC2B012540F7C9603243BD0B6:100D50004000023C003C003C1783F523B012580EC3:100D60003BB04000B3278293BEFF07243140001000:100D7000041231902602FC23C63FB012EC0E673FEE:100D80002BB234243BD01000B012540F2BB33020C0:100D900096000010072C96000001072C4018C64C46:100DA00000001D3CB24040A5280116B30320C24CF0:100DB0001402153CC24C15024F18869AFDFF0124FF:100DC0002BD39600010204283BD23BB01000022432:100DD0003BC032001A4214024F18864AFFFFA60099:100DE00001001783D123B012580E713FB012540F77:100DF0001783FC23B012580E6E3FB24080000A02E7:100E0000D24210020C02D24210020D0282431202A0:100E100009430E123E400A0224427C4EB012F00EEC:100E20001483FB233E4196000001052840187C46B0:100E3000B012F00E178340187C46B012F00E1783E4:100E4000F223B2E312025C421202B012F00E5C42D4:100E50001302B012F00EFB3E18421202B012540FF1:100E6000C24C1202B012540FC24C130238E33BB210:100E700004241A96FEFF01242BD3189212022A236F:100E80002BB328233041E2B22800FD27E2B228002C:100E9000FD23B24024026001E2B22800FD27154282:100EA00070010511051105118245020205118245E7:100EB0000402B2801E00040257421602378003006B:100EC000051105111753FD23355040A582452A0110:100ED0003542B24024026001929270010202FC2F5E:100EE0001583F72309437C409000023C7C40A0001E:100EF0004D43C9EC120219E31BC3454D5545020F82:100F000000550C2E2E2E2E2E2E2E2E1A34349242BA:100F100070017201B2500C007201073C1BB30B2030:100F20008243620192B36201FD27E2C321000A3CC1:100F30004C11F62B1BE38243620192B36201FD2741:100F4000E2D321009252020272015D537D900C00A7:100F5000D42330414E431BC3454E5545600F0055C9:100F60000C5656565656565656367400E2B228005F:100F7000FD23924270017201925204027201824377:100F8000620192B36201FD27E2B228001E282BD332:100F90001C3C4C101A3C8243620192B36201FD2753:100FA000E2B2280001281BE31BB301242BD3C9ECB8:100FB000120219E30A3C8243620192B36201FD27E7:100FC000E2B22800E62B4C101BE39252020272019F:100FD0005E53C23F8243620192B36201FD27E2B2D7:100FE0002800012C2BD33041FFFFFFFFFFFFFFFF45:100FF000F26F076000000000000002130100F61C01:00000001FF

author: josip
author_rank: Regular Contributor
timestamp: January 05, 2023, 09:31:43 am
content: Quote from: planc on January 05, 2023, 09:12:27 amBSL for F2xx is stored in ROM, and can not be changed. It is not TI open source like other updatable BSL's on F5xx/6xx familly. If not identical, it is similar for all F2xx devices, UART version based on timer. If you want to know BSL functions, they are explained in slau319.

author: Peabody
author_rank: Super Contributor
timestamp: January 05, 2023, 02:45:56 pm
content: I found my copy of the G2553 BSL, and it's not the same as your F2617. According to slau319x.pdf, the G2553 has BSL version 2.03, and the F2617 has version 2.13. See Table 21.I have Naken in its own folder (C:\Naken), and in Windows 10 there are no write restrictions there. So your naken_util command line with the redirected output works fine for me. Anyway, I copied your hex dump to a file and ran -disasm on it. Attached is the .asm file. Note that the first two lines are actually the cold start and warm start vectors.

author: Peabody
author_rank: Super Contributor
timestamp: January 05, 2023, 04:27:31 pm
content: I ran a multiple search and replace program using the definitions for the G2231, and the result is attached. It looks like most of the values are correct.

author: planc
author_rank: Regular Contributor
timestamp: January 05, 2023, 07:13:00 pm
content: what do you mean by definition of the G2231? Pls give one line where you replaced it so I know what you mean.Also do you know any diassembler with labels addresses shown (like C_Ref: 0xB699, 0xB6A0, 0xB6AF fully shown under say address B67D? That way it's nicer to know where the jump to and from coming from. My experience before were with the Motorola 68HC11. And there is this app m6811dis that can give all those but it is only for the HC11. What Msp430 disassemble do you know that can try it? Please try the Srec_CAT.exe above if it can do it. Thanks.

author: Peabody
author_rank: Super Contributor
timestamp: January 05, 2023, 09:43:46 pm
content: If you compare the two .asm files I posted, you can see the addresses that were replaced by the datasheet names of things. Basically it's just the register names, all of which fall below RAM at 0x0200. Attached is the list of the replacements. They are done one at a time through the entire file. What's not included are the names of the bit positions within the registers, which would be handy to have. I can't find a download site for the MultipleSearchandReplace .exe, but am attaching it below - but be sure to do whatever virus scan you think is appropriate. It's a Windows command line program. Of course you can edit the list to match your F2617 if needed.

author: planc
author_rank: Regular Contributor
timestamp: January 05, 2023, 10:38:41 pm
content: Thanks. Below is example of the Motorola 68HC11 assembly codes (disassembled from the m6811dis app) which I'm familiar about. In address B746 at the first line, there is a command to branch or jump to B76A. Now in B76A, there is a Cref 0xB746 at right. Which means the line has jump from other lines. This is very useful to have. It makes them so neat to track. Doesn't MSP430 disassembly have them too? Naken can't do it? What others can?'B746 8D 22 LB746: bsr LB76A ; CRef: 0xB741B76A ; ==================================================================B76A 37 LB76A: pshb ; CRef: 0xB73A,0xB746,0xB798B76B F6 B6 08 ldab LB608B76E C4 01 andb #0x01B770 26 04 bne LB776B772 4D tstaB773 26 01 bne LB776B775 4C incaB776 ; ------------------------------------------------------------------"

author: Peabody
author_rank: Super Contributor
timestamp: January 06, 2023, 04:35:47 am
content: I don't think Naken can do that. It's possible CCS will do something similar, but I've never installed it. Perhaps you could write a script that would analyze the Naken output and create the labels for all the branch destinations. But that still doesn't get you to a meaningful assembler source code. TI doesn't publish the BSL source code so far as I know. But you might ask about that on the TI forum.

author: josip
author_rank: Regular Contributor
timestamp: January 06, 2023, 06:57:08 am
content: Quote from: Peabody on January 06, 2023, 04:35:47 amTI factory ROM BSL source code for F2xx and FRAM is not public, but flash version for F5xx/6xx is open source (slau319). F5xx/6xx UART version is also based on timer like in 2xx family.I understand that planck looking for most readable version of binary, but don't understand why TI factory ROM BSL is so important. Main application is, ROM BSL should be irrelevant from my point of view.

author: planc
author_rank: Regular Contributor
timestamp: January 06, 2023, 07:03:45 am
content: The output of Naken is assembly language which is its own source code. In the Motorola 68HC11. I only know how to program in assembly language, I don't know any c+. Therefore why do you say it doesn't get you a meaningful assembler source code? Did you mean by source code as the higher language C? Can't one program the MSP430 with pure assembly language just l like the 68HC11?

author: josip
author_rank: Regular Contributor
timestamp: January 06, 2023, 07:19:54 am
content: There is nothing wrong with assembler. I am coding a lot in assembler.My point is that BSL is just factory ROM loader, software UART based on timer with basic flashing functions. What you except to find there (in BSL source)?

author: planc
author_rank: Regular Contributor
timestamp: January 06, 2023, 09:02:25 am
content: When I first got into MSP430 a month ago. I read a lot about not only JTAG fuse blown, but even BSL inaccessible.. all made by CCS itself or during debugging. Then I found out that only in the F5xxx series is the BSL not in ROM but in flash which can be erased. But still I read stuff like the following about "blank reset vector". Is this valid also for the ROM base BSL which can become inaccessible if you unplug the cable while flashing?Also please tell me. How come the newer MSP430 can have the BSL erased from flash (not in ROM) and even JTAG fuse recovered. Won't it make the earlier F2xx series more secure than the latter F5xx series??

author: Peabody
author_rank: Super Contributor
timestamp: January 06, 2023, 03:41:07 pm
content: What you've quoted from the TI docs relates to parts which have built-in USB peripherals. Your F2617 does not have that. Its BSL is covered in slau319x.pdf. And according to Table 1 in that document, the F2617 does not have the empty reset vector invoke function. BSL is only called with the special pattern on TEST and RESET. But that should work whether the reset vector is empty or not, so if flashing is interrupted it should still be possible to start over.To secure flash contents from prying eyes, if that's your concern, you can blow the JTAG fuse, and you can use the password function in BSL. But these protections will not stand up against a determined effort:

author: planc
author_rank: Regular Contributor
timestamp: January 06, 2023, 11:20:19 pm
content: (First let me mentioned that the forum rule acknowledge it is not jealous of other site like Texas Instrument so let me post it)(https://www.eevblog.com/forum/chat/forum-rules-please-read/- Open sharing of ideas and content is important. Links to and promotion of other forums and content IS ENCOURAGED! (this isn't a jealously protected forum, unlike some others)For ROM base BSL, is it really possible to set the FFFE to FFFF as FFFF like in blank chip even though the chip is fully used? The last lines FFFE to FFFF in main program of the chip I got the firmware from are all FFs, like in blank chip.:10FF0000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF01:10FF1000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF1:10FF2000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE1:10FF3000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFD1:10FF4000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFC1:10FF5000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFB1:10FF6000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFA1:10FF7000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF91:10FF8000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF81:10FF9000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF71:10FFA000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF61:10FFB000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF51:10FFC000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF41:10FFD000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF31:10FFE000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF21:10FFF000FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF11:00000001FFI know that FFE0h through FFFFh contain interrupt vector table entries. So how could they all be FFFFs??After hours of goggling, could the following trick work?https://e2e.ti.com/support/microcontrollers/msp-low-power-microcontrollers-group/msp430/f/msp-low-power-microcontroller-forum/524701/msp430-custom-bsl-passwordHow did they change the address of the interrupt vectors? Does it mean they leave FFFE to FFFF as all FFFFs.