If we could get the assembler working (Bez mentioned something about this, but I've not been able to find it) I would happily write a loop that we jump to that converts various word length data into more useful bytes to log. For example, an airflow that maxxed at 3200 Hz and a load that maxxed at 319 could both be done.

 

Yeah the truth is as soon as there's a complete decompiled and documented rom, and a way to recompile it without it fouling anything up, I plan on writing mods. But I just don't have the time to do the reverse engineering to get to that point at the moment.

 

I was thinking about patches first. But it is a major PITA looking up the individual op codes.

Since most of the code is relative and the jumps are usually from a data section near the appropriate code, it would be quite easy to compile some relocatable code if we had a working SH2 assembler.

 

jcbanks, thanks! that is awesome

 

Pretty Please?

 

ROM:00011FC0 loc_11FC0: ; CODE XREF: sub_11FA0+10j
ROM:00011FC0 mov.l @(h'2DC,pc), r10 ; [000122A0] = sub_400
ROM:00011FC2 jsr @r10 ; sub_400
ROM:00011FC4 nop
ROM:00011FC6 mov.l @(h'2D0,pc), r1 ; [00012298] = h'FFFF6B38
ROM:00011FC8 mov.w @r1, r1
ROM:00011FCA extu.w r1, r1
ROM:00011FCC mov.l @(h'254,pc), r2 ; [00012224] = h'FFFF70C6
ROM:00011FCE mov.w @r2, r2
ROM:00011FD0 extu.w r2, r2
ROM:00011FD2 mov.l @(h'24C,pc), r10 ; [00012220] = sub_41E
ROM:00011FD4 jsr @r10 ; sub_41E
ROM:00011FD6 nop
ROM:00011FD8 mov r1, r4
ROM:00011FDA mov.w @(h'32,pc), r5 ; [00012010] = h'401A
ROM:00011FDC mov r2, r6
ROM:00011FDE mov.l @(h'26C,pc), r10 ; [0001224C] = sub_68A
ROM:00011FE0 jsr @r10 ; sub_68A
ROM:00011FE2 nop
ROM:00011FE4 mov.l @(h'84,pc), r11 ; [0001206C] = h'FFFF6B6E
ROM:00011FE6 mov.w r0, @r11
ROM:00011FE8 mov.l @(h'80,pc), r4 ; [0001206C] = h'FFFF6B6E
ROM:00011FEA mov.w @r4, r4
ROM:00011FEC extu.w r4, r4
ROM:00011FEE mov #h'40, r5 ; '@'
ROM:00011FF0 mov.l @(h'74,pc), r10 ; [00012068] = sub_9B0
ROM:00011FF2 jsr @r10 ; sub_9B0
ROM:00011FF4 nop
ROM:00011FF6 extu.w r0, r4
ROM:00011FF8 mov.l @(h'34,pc), r10 ; [00012030] = sub_590
ROM:00011FFA jsr @r10 ; sub_590
ROM:00011FFC nop
ROM:00011FFE mov.l @(h'64,pc), r11 ; [00012064] = h'FFFF6B6A
ROM:00012000 mov.w r0, @r11
ROM:00012002
ROM:00012002 loc_12002: ; CODE XREF: sub_11FA0+1Cj
ROM:00012002 mov.l @r15+, r2
ROM:00012004 mov.l @r15+, r1
ROM:00012006 mov.l @r15+, r14
ROM:00012008 lds.l @r15+, pr
ROM:0001200A rts
ROM:0001200C nop
ROM:0001200C ; End of function sub_11FA0

The bold line shows the RAM address of the variable we want to log. The italic lines show it being divided by hex 40 (decimal 64) to be converted to the underlined section which writes it to the MUT logging airflow variable.

 

885900013/14/15: Hex address for airflow word is FFFF6B9E, taking 6B9E and converting it to decimal we get 27550 for the high byte and 27551 for the low byte.

88590013/885900014:
&H3EE6E=decimal 27550

&H3EE72=decimal 27551

88590015:
&H3EE8E=decimal 27550

&H3EE92=decimal 27551

 

John,

I think this is the same code, showing the location for my ROM. Am I correct?

ROM:00010F20 loc_10F20: ; CODE XREF: sub_10F00+10j
ROM:00010F20 mov.l @(h'54,pc), r10 ; [00010F78] = sub_400
ROM:00010F22 jsr @r10 ; sub_400
ROM:00010F24 nop
ROM:00010F26 mov.l @(h'2A4,pc), r1 ; [000111CC] = h'FFFF89C0
ROM:00010F28 mov.w @r1, r1
ROM:00010F2A extu.w r1, r1
ROM:00010F2C mov.l @(h'1E0,pc), r2 ; [00011110] = h'FFFF8F4A
ROM:00010F2E mov.w @r2, r2
ROM:00010F30 extu.w r2, r2
ROM:00010F32 mov.l @(h'284,pc), r10 ; [000111B8] = sub_41E
ROM:00010F34 jsr @r10 ; sub_41E
ROM:00010F36 nop
ROM:00010F38 mov r1, r4
ROM:00010F3A mov.w @(h'32,pc), r5 ; [00010F70] = h'401A
ROM:00010F3C mov r2, r6
ROM:00010F3E mov.l @(h'1F8,pc), r10 ; [00011138] = sub_68A
ROM:00010F40 jsr @r10 ; sub_68A
ROM:00010F42 nop
ROM:00010F44 mov.l @(h'88,pc), r11 ; [00010FD0] = h'FFFF89F6
ROM:00010F46 mov.w r0, @r11
ROM:00010F48 mov.l @(h'84,pc), r4 ; [00010FD0] = h'FFFF89F6
ROM:00010F4A mov.w @r4, r4
ROM:00010F4C extu.w r4, r4
ROM:00010F4E mov #h'40, r5 ; '@'
ROM:00010F50 mov.l @(h'78,pc), r10 ; [00010FCC] = sub_9B0
ROM:00010F52 jsr @r10 ; sub_9B0
ROM:00010F54 nop
ROM:00010F56 extu.w r0, r4
ROM:00010F58 mov.l @(h'30,pc), r10 ; [00010F8C] = sub_590
ROM:00010F5A jsr @r10 ; sub_590
ROM:00010F5C nop
ROM:00010F5E mov.l @(h'68,pc), r11 ; [00010FC8] = h'FFFF89F2
ROM:00010F60 mov.w r0, @r11
ROM:00010F62
ROM:00010F62 loc_10F62: ; CODE XREF: sub_10F00+1Cj
ROM:00010F62 mov.l @r15+, r2
ROM:00010F64 mov.l @r15+, r1
ROM:00010F66 mov.l @r15+, r14
ROM:00010F68 lds.l @r15+, pr
ROM:00010F6A rts
ROM:00010F6C nop
ROM:00010F6C ; End of function sub_10F00



Eric

 

Yes, so FFFF89F6 is the location of your 16 bit airflow. So you need FFFF89F6 and FFFF89F7 as the high and low bytes that you stick in your MUTtable as request ID 02 and 03 (8 bytes further on than request ID 00 and 01). Usually the FFFF are in there already, so you just need the 89F6 and 89F7 in the lower words of the long words.

sub_9B0 is a division routine by the way, so we're taking the value before it gets divided by hex 40 decimal 64 and logging the word so we get more resolution and range.

 

Jcsbanks, or anyone else...

Is there a conversion for Hz to Lb/Min or Cc/Min?

 

I know there is somewhere the ECU does the calculation and it is probably held in a variable, but this should hold you over until then.

When I was doing testing on the MAF scaling tables, I came up with this formula. This is how it appears in my LogWorks.

#Forumla to calculate g/s from airflow.baro.
#and intake temp
airdens=Atmospheric_Pressure /14.6956/.08026/(Intake_Air_Temp +273.15)*28.9
massaircalc=(-1*10^-08*AirFlow^3 + 2*10^-05*AirFlow^2+ 0.1228*AirFlow - 1) *airdens
massaircalc1600=(0.1339*AirFlow + 2*10^-12)*airdens
MC(airdens;g/L) = airdens
MC(massair-calc;g/s) = massaircalc
MC(massair-calc-1600;g/s)=massaircalc1600

Basically, you have to log your Hz, baro, and intake temp. Should get you pretty close.

In the equations above,
Atmospheric_Pressure is logged baro
Intake_Air_Temp is logged intake air temp
Airflow is logged Hz value

Eric

 

bump for C6C6CH3vo

 

Thanks man

 

C6 etc - 2 byte airflow for your ROM on request ID 2 and 3.

39FAA to 0x89E2
39FAE to 0x89E3

 

Thank you!