Intel HEX format and PIC Microcontrollers

[N1LAF]

Just for fun, I thought I'd look into the PIC Hex file and create my own disassembler, as a first step of a larger project. When you develop a program for the PIC microcontroller, including C, the program file created to program the microcontroller is in a Hex format. Microchip (creator of PIC Microcontrollers), uses the Intel Hex format. The Hex format is a standard used by many other microprocessor/microcontroller devices.

The Hex file looks like this...

:020000040000FA
:06000000CDEF01F012003B
:0600080022EF00F01200DF
:06002A0002001B040000AF
:10003000EF00000004000000B60300008000000094
:040040006500000057
:0C004400DACFE4FFE2CFDAFFE9CFE4FFFF
:10005000EACFE4FFE652AE50E66E0AD8E55200D091
:10006000E552E5CFEAFFE5CFE9FFE5CFDAFF110082
:10007000D9CFE6FFE1CFD9FFE4C0E9FFEA6AE9BEE4
:10008000EA68800EE926000EEA22FE0EDBCFEFFFC3
more...
:020000040030CA
:0C000200FCFFFAFFFFFFFFFFFFFF000004
:00000001FF


Every line starts with a colon.

The format of the file is as follows:

:nn aaaa tt dddddddddddddddd cc

nn is the data byte count - number of data bytes in that line (Record lenth)
aaaa is the address where the data is placed. This is really the offset address.
tt is the data type (Record Type)
dd is the byte data
cc is the checksum for the line

Checksum
Checksum = Twos complement(LSB(nn + aa + aa + tt + (all databytes)))


Record Type
tt - Definition
0 - Data Record
1 - End of File Record
2 - Extended Segment Address Record
3 - Start Segment Address Record
4 - Extended Linear Address Record
5 - Start Linear Address Record


Data

Data segment: d0 d1 d2 d3 d4 ... dn

The 16 bit data will be: 0xd0d1, 0xd2d3, 0xd4d5 ...

================

In the example:
:020000040030CA
:0C000200FCFFFAFFFFFFFFFFFFFF000004
:00000001FF

it contains an extended segment address
:020000040030CA

The upper address is 0x0030
for the total address segment: 0x0030aaaa

The next line contains configuration bits:
:0C000200FCFFFAFFFFFFFFFFFFFF000004

Configuration data starting at address 0x00300002 = FCFFFAFFFFFFFFFFFFFF0000

Looking at the linker file for the PIC 18F452: (18f452.lkr)
CODEPAGE NAME=config START=0x300000 END=0x30000D PROTECTED

The start of address is in fact 0x300000, and it is configuration data

0x30002 uses 4 of 8 bits, unused bits are usually set high. So the data byte FC "11111100"(LSb) in binary
bit 0: PWRTEN - Power up Timer Enable bit, is set to 0, which means it is enabled
bit 1: BOREN - Brown-out Reset Enable bit, is 0, so it is disabled
bit 3-2 BORV1:BORV0 - Brown out reset voltage, set to 11, which is set to 2.0 VDC

End of record:
:00000001FF

End of file.

[N1LAF]

in the previous post example, the line segments:
:020000040000FA
:06000000CDEF01F012003B

are as follows:

:020000040000FA

is the Segment address, which is set to 0x0000

Next line:
:06000000CDEF01F012003B

:nn aaaa tt d0 d1 d2 d3 d4 d5 cc

Has 6 data bytes, or 3 data words
Starts at address 0x0000

First dataword, 0xEFCD is decoded by looking up the 16 bit instruction word from the PIC 18F452 datasheet

0xEFCD is 1110 1111 1100 1101

on page 213 of the datasheet has 1110 1111 as a GOTO Operand. The operand uses 2 words
The first part of the address is 1100 1101.
The second data word is 1111 0000 0000 0001

According to Page 211 of the datasheet, the format of the GOTO is the following:
Data word 1: Bits 15:8 OPCODE = GOTO, Bits 7:0 is address 7:0
Data word 2: Bits 15:11 is 1111, and will disassemble as NOP, bits 11:0 is address 19:8

Putting the address together from EFCD F001 is 0x01CD. Since the address is is in bytes, multiple 0x1CD by 2, we get 0x39A as the actual address.
First instruction code is GOTO 0x039A

The next data word is 0x0012, or 0000 0000 0001 0010
This is Return from subroutine, with the format: 0000 0000 0001 001s, where s is a flag used internally. (page 241)