Firmware Fn prepareOutputForMap

prepareOutputForMap — TIMEx_Explorer::prepareOutputForMap

Part of Firmware Reversing.

• Address: 0x7c6184 (VA 0xf7053e78)
• Status: 🟢 Fully traced (prologue to blr, entirely self-contained — no boundary ambiguity)
• Confidence: doubly validated — this address is BOTH a real symbol-table entry (exact strict-prologue match) AND a confirmed real computed-call target (found via the call-target cross-reference tool). One of only 4 functions found this way with both properties in the entire reachable <9MB range.
• Full mangled name: prepareOutputForMap__14TIMEx_ExplorerR11TIMEx_inputR12TIMEx_output (TIMEx_input&, TIMEx_output& arguments — TMC traffic-message processing, directly relevant to this project's own eeu.tmc work)

Disassembly

0x7c6184: stwu     r1, -0x40(r1)
0x7c6188: mflr     r0
0x7c618c: stw      r27, 0x2c(r1)
0x7c6190: stw      r28, 0x30(r1)
0x7c6194: stw      r29, 0x34(r1)
0x7c6198: stw      r30, 0x38(r1)
0x7c619c: stw      r31, 0x3c(r1)
0x7c61a0: stw      r0, 0x44(r1)
0x7c61a4: or.      r31, r3, r3              ; arg1 tested for zero/null
0x7c61a8: lis      r9, -0x875
0x7c61ac: addi     r27, r9, -0x64b0
0x7c61b0: beq      0x7c62e8                 ; null -> skip most of the body
0x7c61b4: lis      r9, -0xb5
0x7c61b8: lwz      r3, 4(r31)
0x7c61bc: lis      r28, -0x86d
0x7c61c0: addi     r0, r9, -0x38d4
0x7c61c4: addi     r30, r28, 0x5f70
0x7c61d0: bne      0x7c62d4
0x7c61d4: lwz      r9, 0(r31)
0x7c61d8: lis      r3, -0x8c0
0x7c61dc: addi     r3, r3, -0x3788
0x7c61e0: stw      r31, 0x14(r30)
0x7c61e4: lwz      r11, 0(r9)
0x7c61e8: li       r4, 3
0x7c61f4: stw      r3, 0x5f70(r28)
0x7c6200: addi     r31, r9, -0x53d8
0x7c6204: lwz      r27, 4(r30)
0x7c6208: stw      r29, 0x14(r30)
0x7c620c: b        0x7c62dc
0x7c6210: lwz      r9, 0x18(r30)
0x7c6214: li       r28, 1
0x7c6218: stw      r28, 0x14(r1)
0x7c621c: addi     r3, r1, 0x10
0x7c6220: lwz      r0, 0x14(r9)
0x7c6224: lis      r11, -0x875
0x7c6228: addi     r31, r11, -0x539c
0x7c622c: lwz      r27, 4(r30)
0x7c6230: mtlr     r0
0x7c6234: li       r29, 0
0x7c6238: blrl                              ; virtual call
0x7c623c: lwz      r6, 0x10(r1)
0x7c6240: addi     r0, r6, -1
0x7c6244: cmplwi   r0, 1
0x7c6248: bgt      0x7c625c
0x7c624c: lwz      r0, 0x14(r1)
0x7c6250: xori     r0, r0, 1
0x7c6254: addic    r9, r0, -1
0x7c6258: subfe    r29, r9, r0              ; branchless boolean compute
0x7c625c: lis      r9, -0xd8
0x7c6260: lwz      r5, 0x14(r1)
0x7c626c: addi     r4, r4, -0x52d0
0x7c6270: ori      r3, r3, 0x1421
0x7c6274: crclr    cr1eq
0x7c6278: blrl                              ; virtual call
0x7c627c: cmpwi    r29, 0
0x7c6280: beq      0x7c62d4
0x7c6284: lis      r9, -0x8c0
0x7c6288: lwz      r0, 0x14(r1)
0x7c628c: addi     r11, r9, -0x4240
0x7c6290: stw      r0, 0x1c(r30)
0x7c6294: mtlr     r11
0x7c6298: li       r3, 0x13
0x7c629c: lis      r9, -0x86d
0x7c62a0: stw      r28, 0x5fac(r9)
0x7c62a4: blrl                              ; virtual call
0x7c62a8: lis      r9, -0x8c0
0x7c62ac: addi     r0, r9, 0xaec
0x7c62b0: li       r3, 0
0x7c62b4: mtlr     r0
0x7c62b8: blrl                              ; virtual call
0x7c62bc: b        0x7c62d4
0x7c62c0: lis      r9, -0x875               ; case A: pick one string/pointer
0x7c62c4: addi     r31, r9, -0x5384
0x7c62c8: b        0x7c62d4
0x7c62cc: lis      r9, -0x875               ; case B: pick a different one
0x7c62d0: addi     r31, r9, -0x5358
0x7c62dc: addi     r4, r4, -0x5270
0x7c62e0: mtlr     r0
0x7c62e4: mr       r5, r31                  ; the SELECTED pointer from above
0x7c62e8: mr       r6, r27
0x7c62ec: ori      r3, r3, 0x1571
0x7c62f0: crclr    cr1eq
0x7c62f4: blrl                              ; final virtual call -- format/output
0x7c62f8: lwz      r0, 0x44(r1)
0x7c62fc: mtlr     r0
0x7c6300: lwz      r27, 0x2c(r1)
0x7c6304: lwz      r28, 0x30(r1)
0x7c6308: lwz      r29, 0x34(r1)
0x7c630c: lwz      r30, 0x38(r1)
0x7c6310: lwz      r31, 0x3c(r1)
0x7c6314: addi     r1, r1, 0x40
0x7c6318: blr

(a handful of interstitial non-instruction words, same EH-descriptor pattern as elsewhere on this wiki, were skipped from this listing -- none of them affected the control-flow reading below.)

Analysis

Real, self-contained state/type dispatcher: tests arg1 for null (early-out path), then — via several beq/bne branches — selects ONE of (at least) 3 distinct computed pointers (0x7c61d4/0x7c6200, 0x7c6210/0x7c6228, 0x7c62c0/0x7c62c4, 0x7c62cc/0x7c62d0) to put in r31, all converging at 0x7c62d4/0x7c62e4, where r31 is passed as an argument (r5) to a FINAL virtual call (0x7c62f4) alongside arg2 (via r6, carried through as r27). Consistent with a real "pick the right output format/handler for this TIMEx input, then format it into the output" role, matching the function's own name. A branchless boolean computation (xori/addic/subfe at 0x7c624c-0x7c6258) feeds one of the branch decisions — the same idiom already seen in other traced functions on this wiki.

Callees

Not traced.