Firmware Fn mv lefthand traffic - krcenov/RNS510-Map-Viewer GitHub Wiki

mv_lefthand_traffic

Part of Firmware Reversing.

  • Naive symbol-table address: 0x75079c (VA 0xf6fde490)
  • True prologue start: 0x7503dc (VA 0xf6fde0d0)
  • Status: 🟡* Partially traced — now fully bounded: a verified-safe scan (checked for any embedded stwu belonging to a different function, none found) confirms the real end at 0x7507a4 (addi r1,r1,0x1a0, matching this function's own prologue frame size exactly), size 0x3c8 (968) bytes. This is the 8th confirmed instance of the "no locally-visible blr" anomaly documented centrally on Firmware Reversing — the frame pops cleanly but no blr follows. Real call-target evidence below covers the whole confirmed range; the internal branches/switch-like dispatch between them weren't individually traced line-by-line — disproportionate for what this pass needed.
  • Full mangled name: mv_lefthand_traffic__FP8position (2 real symbol-table records share this general name — see below)

The name undersells it — same pattern as mv_convert_slot_nr

Despite the "lefthand traffic" name, the traced portion shows this is a large, heavily-branching routine touching several real, substantial subsystems — not a narrow regional-driving-rule check. Early on it reads a byte at this+0x10 and compares it against 0x79 (ASCII 'y'), then a second byte at this+0x11 masked to its low 5 bits compared against 1/2 — real, concrete evidence of a small tagged-variant/enum dispatch at the top of the function, branching to very different handling per tag value.

Real, confirmed call targets found in the traced portion

Target What it suggests
setVAdasTimeDuration__20CfcTypeVadasOpOrTimePt17CfcUtilFixedArray1ZP24CfcTypeVAdasTimeDuration A second, separate real "VAdas" class (CfcTypeVadasOpOrTimePt/CfcTypeVAdasTimeDuration), alongside CArr_AdasMain found on mv_convert_slot_nr — strong, independent confirmation that a real ADAS-adjacent time/duration subsystem exists in this codebase, named VAdas this time rather than Adas
__nw__22CfcTypeMapVIPIconImageUi Operator new for a real CfcTypeMapVIPIconImage class — a "VIP icon" on the map, a real UI concept not previously catalogued
DeRegister_Section__9JR_ClientP28JR_Component_RegInfo_SectionP9RouteImpli Deregisters a route-related component section on a JR_Client (Journey/Route client — the same JR_Client/RBP_JR_Client class already known from the "gold standard" catalog)
clear__13RouteManeuver Clears a real RouteManeuver object — directly ties this function into maneuver-generation, consistent with its home subsystem
setJunctionId__16CfcTypeNavDBInfoi (called at least twice) The same real setter seen on mv_convert_slot_nr — confirms this is a shared, commonly-called primitive across the mv_* family, not unique to slot-number conversion
__nw__40CfcAspectAnnouncementCommandChangedEventUi Operator new for a real CfcAspectAnnouncementCommandChangedEvent — a real, previously-uncatalogued event class, plausibly tied to voice-guidance/announcement timing
getRoutes__11JourneyImpl Real accessor on JourneyImpl — fetches the current journey's route list
getRoadClassStatistic__9RouteInfoP22CfcTypePositionOnRouteT1 Same real road-class-statistic query family seen on mv_convert_slot_nr's getOffroadDistanceFromRouteToDestination
__vd__24PositioningDiagnosisImplPvUi Destructor of a real PositioningDiagnosisImpl class — a real GPS/position-diagnosis subsystem, previously uncatalogued
addParcels__26MDCacheParcelSpanContainerPC12ParcelToShowUl Adds map-data "parcels" to a real MDCacheParcelSpanContainer — ties this function into the same MDCache/tile-loading subsystem this wiki's own readNodeMP0/findNode__14MDCacheTIRTree targets belong to
matchedLength__C9CfcRegExp A real, internal regular-expression engine (CfcRegExp) — genuinely surprising to find regex matching inside maneuver-generation code; plausibly used for street-name pattern matching in voice-guidance text

Other, related symbol-table entries (not traced, listed for completeness)

The symbol table has multiple near-duplicate/overload records touching this name, at different addresses — a reminder that this table can contain real duplicate entries, not always a 1:1 name-to-function map:

  • mv_lefthand_traffic__FUl — file offset 0xb3ddf0 (11.79MB, unreachable, 9MB+)
  • lefthand_traffic__FP8position — file offset 0xaef49c (11.47MB, unreachable, 9MB+)

Net read

Like mv_convert_slot_nr, this function's name covers only a small slice of its real behavior. The traced portion alone touches 2 separate real ADAS-adjacent classes (CArr_AdasMain's sibling here is CfcTypeVadasOpOrTimePt/CfcTypeVAdasTimeDuration), a VIP-icon map UI class, journey/route deregistration, road-class statistics, GPS positioning diagnosis, tile-cache parcel loading, and an internal regex engine — consistent with the mv_* family being real, shared, heavily-used infrastructure functions rather than small single-purpose helpers.