We published an article about a processor that doesn’t exist in the manufacturer’s lineup. Inside a Fiat SRS unit we found a chip marked TMS470PV384, which per the documentation does not exist — it is a proprietary variant of the TMS470 family with a rearranged register map.
The core is ARM7TDMI, but the base addresses and Flash register offsets differed from the known TMS470R1. To reconstruct the register map we analysed ARM IAR Embedded Workbench header files, disassembled the SEGGER bootloader and ported it to C using a neural network and IDA.
A particular challenge was the level-2 security keys: the processor reads freely, but erasing and writing require the correct keys, whose storage address was unknown to us. By probing the sector size we finally gained write access.
In the end we wrote a working bootloader capable of erasing and programming these “unknown” processors — parts that have been on the market for over 15 years but that no publicly available programmer could write.