I put a hook in the request ID processing code:

ROM:000219D6 mov.l @(4,pc), r10 ; [000219DC] = unk_37000
ROM:000219D8 jmp @r10 ; unk_37000
ROM:000219DA nop
ROM:000219DA ; ---------------------------------------------------------------------------
ROM:000219DC off_219DC: .data.l unk_37000 ; DATA XREF: ROM:000219D6r
ROM:000219E0 ; ---------------------------------------------------------------------------

So I jump to my own routine at 37000 which I will post, along with Evoscan logs of it in action.

In this routine I check if the request ID is "E8" (which is unused).

If it is I XOR the octane value with 255. This toggles it between 0 and 100% - ie switches between the low and high octane fuel and timing maps.

So when the engine is running I can map switch.

I need to disable the increment/decrement octane value logic if I wanted to use this.

Usually with quite high knock sums the octane value doesn't move much, so this might be more useful for me switching between methanol and normal maps without reflashing each time.

Instead of toggling it you could of course have an increment/decrement, or switch between difference octane values.

It looks like there is some logic related to boost control that may affect things on the IX if you use ECU boost control.

 

How do you active this "hook"

 

I disassemble the ROM then assemble snippets of code which I insert with a hex editor, then I disassemble it again to make sure all is correct and then I flash it to the ECU.

 

ROM:00037000 ; ---------------------------------------------------------------------------
ROM:00037000
ROM:00037000 loc_37000: ; CODE XREF: ROM:000219D8j
ROM:00037000 ; DATA XREF: ROMff_219DCo
ROM:00037000 extu.w r1, r1
ROM:00037002 mov.w @(h'16,pc), r10 ; [0003701C] = h'E8
ROM:00037004 cmp/eq r10, r1
ROM:00037006 bf loc_37016
ROM:00037008 mov.l @(h'14,pc), r10 ; [00037020] = h'FFFF6072
ROM:0003700A mov.w @r10, r10
ROM:0003700C mov.w @(h'E,pc), r11 ; [0003701E] = h'FF
ROM:0003700E nop
ROM:00037010 xor r10, r11
ROM:00037012 mov.l @(h'C,pc), r10 ; [00037020] = h'FFFF6072
ROM:00037014 mov.w r11, @r10
ROM:00037016
ROM:00037016 loc_37016: ; CODE XREF: ROM:00037006j
ROM:00037016 mov.l @(h'C,pc), r10 ; [00037024] = loc_219E2
ROM:00037018 jmp @r10 ; loc_219E2
ROM:0003701A nop
ROM:0003701A ; ---------------------------------------------------------------------------
ROM:0003701C word_3701C: .data.w h'E8 ; DATA XREF: ROM:00037002r
ROM:0003701E word_3701E: .data.w h'FF ; DATA XREF: ROM:0003700Cr
ROM:00037020 dword_37020: .data.l h'FFFF6072 ; DATA XREF: ROM:00037008r
ROM:00037020 ; ROM:00037012r
ROM:00037024 off_37024: .data.l loc_219E2 ; DATA XREF: ROM:loc_37016r

 

What do you physically do to get it to switch.

 

Evoscan log

 

You enter "E8" as a custom request at the bottom of the Evoscan window.

With JoeBee's little board you could do it with that too.

If we find the locations of some of the switched inputs you could do it with a combination of defog switch, intercooler spray switch etc.

The setting is remember until the ECU is reflashed or disconnected, or the battery is disconnected.

 

that is awesome, great work

 

Amazing....

 

Good work JCS...use the code tags to make it more easily read. I think there can be something cleaner than a straight XOR with 255 that might work regardless of changing octane number (yes I saw the other options you have but this is a logic puzzle and they are always good entertainment)...I'll have to think about it...but I have to run out now .

 

Are these signed or unsigned bits? I see one or two tricks which may work depending on which one. I don't see any obvious one liners though. I mean this is where you stuff in the 255:

correct?

 

Yes. Logic puzzles are "fun" Unsigned.

This was quick and dirty, now I have this working there is plenty of space to do more interesting stuff. The 37000 area on my ECU probably has enough code space to put a man on the moon