ECU disassembling?
Thread Starter
Evolving Member
Joined: Sep 2006
Posts: 152
Likes: 0
From: Germany
ECU disassembling?
Hello to all.
Actual I'm disassembling my EVO VII Rom.
Can anybody of the cracks give me a tip, which routine or interrupt vector will be used when the ignition goes on?
When ignition is off, have somebody find out what the ecu/processor is doing? Is there an something like an idle queue?
How did you check ignition on/off in your ROM patches?
Another one
: How did you check the engine running? RPM Variable?
And a third : How did you check a time. For example press ICS Button for more than 2 sec?
Or are all these secrets?
By the way:
Meanwhile I have completely understand the fuel table lookup with all the interpolation.
If there is a need to add more rows/lines. It is possible.
Greetings
Joe
Actual I'm disassembling my EVO VII Rom.
Can anybody of the cracks give me a tip, which routine or interrupt vector will be used when the ignition goes on?
When ignition is off, have somebody find out what the ecu/processor is doing? Is there an something like an idle queue?
How did you check ignition on/off in your ROM patches?
Another one
: How did you check the engine running? RPM Variable?And a third
: How did you check a time. For example press ICS Button for more than 2 sec?Or are all these secrets?
By the way:
Meanwhile I have completely understand the fuel table lookup with all the interpolation.
If there is a need to add more rows/lines. It is possible.
Greetings
Joe
Evolved Member
Joined: May 2006
Posts: 2,399
Likes: 6
From: UK
I've mainly looked at the IO stuff as that has been my interest. However, it looks like there is a main loop that is called off the reset vectors, and some of the other stuff is called off timer interrupts IIRC.
I don't test for ignition on/off as my patches have been setup from MUT or serial receive interrupts and then run through serial or DMA interrupts.
Tephra calls his routine off the main loop replacing the call to the CEL routines, which he then calls after his patch has run. I also run off the same hook to test for a serial timeout to allow me to reset the DMA.
Tephra has done work on time, and basically seems to count the number of calls to his routine through the main loop which seems to be about 100Hz.
Do you have a plan to patch something that depends on whether the engine is running? I'll try to make suggestions of how I would approach it if you like.
I don't test for ignition on/off as my patches have been setup from MUT or serial receive interrupts and then run through serial or DMA interrupts.
Tephra calls his routine off the main loop replacing the call to the CEL routines, which he then calls after his patch has run. I also run off the same hook to test for a serial timeout to allow me to reset the DMA.
Tephra has done work on time, and basically seems to count the number of calls to his routine through the main loop which seems to be about 100Hz.
Do you have a plan to patch something that depends on whether the engine is running? I'll try to make suggestions of how I would approach it if you like.
Hello to all.
Actual I'm disassembling my EVO VII Rom.
Can anybody of the cracks give me a tip, which routine or interrupt vector will be used when the ignition goes on?
When ignition is off, have somebody find out what the ecu/processor is doing? Is there an something like an idle queue?
How did you check ignition on/off in your ROM patches?
Actual I'm disassembling my EVO VII Rom.
Can anybody of the cracks give me a tip, which routine or interrupt vector will be used when the ignition goes on?
When ignition is off, have somebody find out what the ecu/processor is doing? Is there an something like an idle queue?
How did you check ignition on/off in your ROM patches?
Another one : How did you check the engine running? RPM Variable?
: How did you check the engine running? RPM Variable?
And a third : How did you check a time. For example press ICS Button for more than 2 sec?
: How did you check a time. For example press ICS Button for more than 2 sec?
Or are all these secrets?
By the way:
Meanwhile I have completely understand the fuel table lookup with all the interpolation.
If there is a need to add more rows/lines. It is possible.
Meanwhile I have completely understand the fuel table lookup with all the interpolation.
If there is a need to add more rows/lines. It is possible.
HTH's
D.
sorry ^ correcto
um i presume that 5v which connects to one of the pins takes it out of "suspend" mode.
I take it you have the SH705x manuals? There is a section on suspend mode
um i presume that 5v which connects to one of the pins takes it out of "suspend" mode.
I take it you have the SH705x manuals? There is a section on suspend mode
Evolved Member
Joined: May 2006
Posts: 2,399
Likes: 6
From: UK
It is big and complex 
I just had the silly idea that I might think about how to write changes back to flash, but reading the chapter on the flash programming scared me silly The timers section is frightful too.
I just had the silly idea that I might think about how to write changes back to flash, but reading the chapter on the flash programming scared me silly
The timers section is frightful too.
Thread Starter
Evolving Member
Joined: Sep 2006
Posts: 152
Likes: 0
From: Germany
Thank you guys.
Ok, powerdown means the execution stops. So no detection necessary.
This 100Hz time is a good way. Thanks for that.
Where is this disassembly thread? I missed lot of stuff while done my Cisco CCNP.
Sometimes it is to hard for me to read these threads with 30 and more pages.
I say "secrets" because I have not find source codes.
Ok, powerdown means the execution stops. So no detection necessary.
This 100Hz time is a good way. Thanks for that.
Where is this disassembly thread? I missed lot of stuff while done my Cisco CCNP.
Sometimes it is to hard for me to read these threads with 30 and more pages.
I say "secrets" because I have not find source codes.
Trending Topics
Thread Starter
Evolving Member
Joined: Sep 2006
Posts: 152
Likes: 0
From: Germany
Code:
ROM:000099A4 POR_Reset: ; CODE XREF: ROM:000099D2j ROM:000099A4 ; DATA XREF: ROM:off_0o ... ROM:000099A4 mov.l @(h'14,pc), r15 ; [000099BC] = RAM_Stackpointe ROM:000099A6 mov.l @(h'18,pc), r0 ; [000099C0] = RAM_IRQ_Mem ROM:000099A8 mov.l @(h'18,pc), r1 ; [000099C4] = RAM_IRQ_Mem ROM:000099AA mov.l r1, @r0 ROM:000099AC mov #0, r0 ROM:000099AE ldc r0, vbr ROM:000099B0 ldc r0, gbr ROM:000099B2 mov.l @(h'14,pc), r0 ; [000099C8] = Main_Loop_Start ROM:000099B4 jsr @r0 ; Main_Loop_Start ROM:000099B6 nop ROM:000099B8 bra loc_99CC ROM:000099BA nop ROM:000099BA ; --------------------------------------------------------------------------- ROM:000099BC off_99BC: .data.l RAM_Stackpointe ; DATA XREF: ROM:POR_Resetr ROM:000099C0 off_99C0: .data.l RAM_IRQ_Mem ; DATA XREF: ROM:000099A6r ROM:000099C4 off_99C4: .data.l RAM_IRQ_Mem ; DATA XREF: ROM:000099A8r ROM:000099C8 off_99C8: .data.l Main_Loop_Start ; DATA XREF: ROM:000099B2r ROM:000099CC ; --------------------------------------------------------------------------- ROM:000099CC
Were do you place your vars in the ram?
Have you try/use the part behind "RAM_IRQ_Mem" (FFFF9BA0 for my rom)?
Evolved Member
Joined: May 2006
Posts: 2,399
Likes: 6
From: UK
1. Yes
2. FFFF8400 seems to be available on most/all ECUs for variables, Tephra is using that bit, I will use probably FFFF8480
3. The stack moves downwards, leave "enough" space for it. I've not measured its size.
2. FFFF8400 seems to be available on most/all ECUs for variables, Tephra is using that bit, I will use probably FFFF8480
3. The stack moves downwards, leave "enough" space for it. I've not measured its size.
Evolved Member
Joined: May 2006
Posts: 2,399
Likes: 6
From: UK
Thread Starter
Evolving Member
Joined: Sep 2006
Posts: 152
Likes: 0
From: Germany
Already read this thread (and post in it), but there is no information about the Switch "auto" position.
I have logged this morning all that Processor ports that where possible through mut, but no BIT change occure. I have found the change at PJDR Bit 0 for the led.
Now I am a little bit confused, because tephra is using it in his patches.
Where is this Bit? (LOL the search for ONE Bit in a world of Terabytes)
I have logged this morning all that Processor ports that where possible through mut, but no BIT change occure. I have found the change at PJDR Bit 0 for the led.
Now I am a little bit confused, because tephra is using it in his patches.
Where is this Bit? (LOL the search for ONE Bit in a world of Terabytes)
Last edited by JoeBee; Apr 5, 2008 at 08:16 AM.
Evolved Member
Joined: May 2006
Posts: 2,399
Likes: 6
From: UK
IIRC, I probed all the ports and found nothing to show auto position, only the state of the spray or the light.
Ask tephra for a disasm of his V5 patch and it will show how he handles restoring the status.
Ask tephra for a disasm of his V5 patch and it will show how he handles restoring the status.
I personally would LOVE to have a larger, more detailed fuel/timing map arrangement. This is the #1 argument any tuning shop will give you regarding an upgrade to a stand-alone. I hate plateau'ing large load areas with just one value and then have it JUMP to another plateau'd cell with a much higher/lower value. We'd be able to tune more accurately before the onset of knock, which translates to more reliable,consistent and powerful runs.
I personally would LOVE to have a larger, more detailed fuel/timing map arrangement. This is the #1 argument any tuning shop will give you regarding an upgrade to a stand-alone. I hate plateau'ing large load areas with just one value and then have it JUMP to another plateau'd cell with a much higher/lower value. We'd be able to tune more accurately before the onset of knock, which translates to more reliable,consistent and powerful runs.