Goto Label xxx in other file...

Thanks for all your comments first !

Why I wanted to do so originated from the customer report issue - our firmware code failed if using downgrade product. Then We found if we can "skip" some tasks then this issue is solved.
But unfortunately these codes are all in ROM, we can not modify it ! So my first idea is to jump to some specific address in ROM and this can skip these tasks if available...

Assume N means "NG" code and O is "OK" code. Then N is small(in code size) and O is big(in code size) Besides, N and O are not functions,just code segments.

Code in ROM

void main()
{
// code N here
_xxx:  // label here
// code O here
// code O here
// code O here
// ...

 while(1)
 {
  // polling to receive command,execute command...
 }

}

If we use new function to replace the O part,then it will consume much code space. Besides we want the code transfer to the while(1) part to (polling,receive,and execute requests),like the normal case...

That is the reason why I want to try "jump" first because in this case:
#1 no need to pass parameters and local variables
#2 the "requirements" in this situation might be little(code N is simple)

I will try to reverse-engineer the exact behaviour of the relevant part of the ROM code then decide the better way...

Thanks !

liaoo

Thanks for all your comments first !

Why I wanted to do so originated from the customer report issue - our firmware code failed if using downgrade product. Then We found if we can "skip" some tasks then this issue is solved.
But unfortunately these codes are all in ROM, we can not modify it ! So my first idea is to jump to some specific address in ROM and this can skip these tasks if available...

Assume N means "NG" code and O is "OK" code. Then N is small(in code size) and O is big(in code size) Besides, N and O are not functions,just code segments.

Code in ROM

void main()
{
// code N here
_xxx:  // label here
// code O here
// code O here
// code O here
// ...

 while(1)
 {
  // polling to receive command,execute command...
 }

}

If we use new function to replace the O part,then it will consume much code space. Besides we want the code transfer to the while(1) part to (polling,receive,and execute requests),like the normal case...

That is the reason why I want to try "jump" first because in this case:
#1 no need to pass parameters and local variables
#2 the "requirements" in this situation might be little(code N is simple)

I will try to reverse-engineer the exact behaviour of the relevant part of the ROM code then decide the better way...

Thanks !

liaoo

But unfortunately these codes are all in ROM, we can not modify it !

How then will you then implement your "jump" change? I don't understand.

If you do what you intend to do, you will cause more damage than anything else. Ignoring calling convention, stack load etc. will get in into deadly trouble. Don't do it. Work on the software, change it and fix it. And above all: UNDERSTAND WHAT THE PROBLEM IS BEFORE STARTING!

How do y our program get started? You can't circumvent the bad part of early main() unless something before main() calls your new code stored somewhere else.

But yes - if you do reverse-engineer the bad section, then you can basically copy that instruction sequence into an assembler file. Modify to correct for bugs. Then perform a jump to the absolute address where the good code continues.

Just note that there may be a bit of overlapping between good/bad because the compiler optimization may have changed order of instructions.

This concept only works if you have the skill to:
- duplicate the route into main()
- finds a suitable target spot to jump to, where you have managed to lock down all assumtions made by the compiler for the following code. You need to understand exactly what happens earlier. And you need to know a bit about the following code too.
- duplicate any required registers, local and global variables the "good" code expects to have been assigned.

You can normally not do this in C, because you can't instruct the compiler to produce the exact conditions you need. You can - if you have the same compiler - write the code fix in C, to look at the generated instructions. But the bandage needs to be applied using assembler.

Patchning code like this have been done a number of times. The only two requirements are:
- the skills to understand exactly what happens and what is needed.
- a means to "steal" the execution. On a PC, programs are run in RAM so it's trivial to patch in a jump/call at start of the bad code or befure the bad code is about to be executed. With a microcontroller with the code in flash - and autostarting - it is very much trickier. All the way up to impossible depending on chip and code design.

Per,

What you described is Stuxnet stuff :-)