EvolutionM - Mitsubishi Lancer and Lancer Evolution Community

Notices
ECU Flash

need Evo 9 owner to test rear O2 *heater* sim patch

   
Old Feb 18, 2009 | 11:27 AM
Share
  #91  
mrfred's Avatar
mrfred
Thread Starter
EvoM Guru
iTrader: (50)
 
Joined: Mar 2006
Posts: 9,675
Likes: 132
From: Tri-Cities, WA // Portland, OR
Originally Posted by acamus
I am speaking of sub_32946 in 88590015
Code:
ROM:00032956                 mov     r5, r2          ; r5' -> r2
ROM:00032958                 mov     r4, r1          ; r4' -> r1
ROM:0003295A                 mov     #0, r0
ROM:0003295C                 mov.w   r0, @(8,r14)
ROM:0003295E                 mov     #0, r9
ROM:00032960                 mov.w   r0, @(h'C,r14)
ROM:00032962                 extu.w  r2, r2
ROM:00032964                 extu.w  r2, r10
ROM:00032966                 tst     r10, r10
ROM:00032968                 bt      loc_32980
ROM:0003296A                 mov     r2, r0
ROM:0003296C                 cmp/eq  #1, r0
ROM:0003296E                 bt      loc_32980
ROM:00032970                 mov     r2, r0
ROM:00032972                 cmp/eq  #h'C, r0
ROM:00032974                 bt      loc_32980
ROM:00032976                 mov     r2, r0
ROM:00032978                 cmp/eq  #h'D, r0
ROM:0003297A                 bt      loc_32980
Keep looking further down in that sub. There are tests for other values e.g. 0x200, 0x400, etc for r4. r5 runs as high as 0xD or something like that. Its been a few weeks since I reviewed the range of values. Take a look at the OBD-II code table for the 88590015 ROM. That will show the range of values and how they correspond to OBD-II codes.
Reply
0
Old Feb 18, 2009 | 11:59 AM
Share
  #92  
acamus's Avatar
acamus
Evolved Member
 
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
I have been looking down the routine and even further
unk_FFFF61BE at the end of this routine is the completion status of non-continuous OBD checks,
this one is used in sub_3A834(one could call it PROCESS_OBD_MODE_1_REQUEST), PID 1 is then handled at
loc_3A8E6 and when you follow it at loc_3A928 is the copy to serial buffer D part of OBD request.

Now non-continuous OBD checks are handled within sub_32946 and unk_FFFF61BE is set here (one could call it SET_NON_CONTINUOUS_MONITOR_COMPLETION_STATUS).
unk_FFFF6180 bit coded DTC for lookup in OBD table is set in sub_3289C (one could call it SET_DTC_AND_NON_CONTINUOUS_MONITOR_COMPLETION_STAT US).

Maybe now we will understand each other
Last edited by acamus; Feb 18, 2009 at 12:16 PM.
Reply
0
Old Feb 18, 2009 | 12:35 PM
Share
  #93  
mrfred's Avatar
mrfred
Thread Starter
EvoM Guru
iTrader: (50)
 
Joined: Mar 2006
Posts: 9,675
Likes: 132
From: Tri-Cities, WA // Portland, OR
I don't have my PC handy with IDA, but I remember now that r5 ranges from 0 to F, and 0,1 and C,D are special values that correspond to bank 1 and bank 2 values. So if the car is a V6, I think 0 and C correspond to bank 1 codes and 1 and D correspond to bank 2 codes. That's why those values handled differently than the other r5 values.

There is a separate subroutine that is called when an OBD-II test does not pass. I forget the address, but maybe its one that you mention. I'll try to look this evening at the subroutines that you listed. I think you're getting pretty far ahead of me now in this area. I think that your work in OBD subroutine disassembly is paying off. :-)
Reply
0
Old Feb 19, 2009 | 12:30 AM
Share
  #94  
acamus's Avatar
acamus
Evolved Member
 
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Thumbs up
Yes, you are correct these values 0,1,C,D are something else.


EDIT: Please use Post #117 instead

But now I think we can change
Code:
00032D1C                 extu.w  r0, r10 
to
00032D1C                 mov  h'FF, r10  (mov     #-1, r10)
so speaking hex 6A0D to EAFF and all non-continuous monitors checks should pass.

Anyone with this ROM and capable OBD device to try this out?
Code:
<table name="OBD non-continuous monitor passed" address="32d1c" type="1D" level="1" scaling="Hex16"/>
Attached Thumbnails need Evo 9 owner to test rear O2 *heater* sim patch-passed.jpg  
Last edited by acamus; Nov 4, 2009 at 10:37 PM.
Reply
0
Old Feb 19, 2009 | 05:54 AM
Share
  #95  
travman's Avatar
travman
Evolved Member
iTrader: (26)
 
Joined: Oct 2005
Posts: 1,712
Likes: 0
From: Pittsburgh
This is awesome.....I have been hoping for something like this for a long time.

I can test it out asap because my front O2 would not complete and also I have egr disabled in the periphery so it would never complete either....

So I will check to see if the do in fact complete with this change.

Thanks
Reply
0
Old Feb 19, 2009 | 06:16 AM
Share
  #96  
acamus's Avatar
acamus
Evolved Member
 
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
I forgot to mention, but this should help only with non-continuous tests as stated below

Catalyst monitoring
Heated catalyst monitoring
Evaporative system monitoring
Secondary air system monitoring
A/C system refrigerant monitoring
Oxygen sensor monitoring
Oxygen heater sensor monitoring
EGR system monitoring
Reply
0
Old Feb 19, 2009 | 06:47 AM
Share
  #97  
travman's Avatar
travman
Evolved Member
iTrader: (26)
 
Joined: Oct 2005
Posts: 1,712
Likes: 0
From: Pittsburgh
Originally Posted by acamus
I forgot to mention, but this should help only with non-continuous tests as stated below

Catalyst monitoring
Heated catalyst monitoring
Evaporative system monitoring
Secondary air system monitoring
A/C system refrigerant monitoring
Oxygen sensor monitoring
Oxygen heater sensor monitoring
EGR system monitoring
And those are the ones that cause the most grief at inspection with all the rom mods and things we can disable in the periphery tables.
Reply
0
Old Feb 19, 2009 | 06:54 AM
Share
  #98  
acamus's Avatar
acamus
Evolved Member
 
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
I am mentioning that because there are also continuous monitoring checks available e.g. O2 sensor threshold tests as seen in ScanTech under Mode 5 Tab.
Reply
0
Old Feb 19, 2009 | 08:00 AM
Share
  #99  
mrfred's Avatar
mrfred
Thread Starter
EvoM Guru
iTrader: (50)
 
Joined: Mar 2006
Posts: 9,675
Likes: 132
From: Tri-Cities, WA // Portland, OR
Originally Posted by acamus
Yes, you are correct these values 0,1,C,D are something else.


But now I think we can change
Code:
ROM:00032D1C                 extu.w  r0, r10 
to
ROM:00032D1C                 mov  h'FF, r10  (mov     #-1, r10)
so speaking hex 6A0D to EAFF and all non-continuous monitors checks should pass.

Anyone with this ROM and capable OBD device to try this out?
Code:
<table name="OBD non-continuous monitor passed" address="32d1c" type="1D" level="1" scaling="Hex16"/>
Can you write this definition in blobbit format (like periphery bits) and associate each non-continuous test with its own bit? Then it would be possible to disable individual OBD-II tests with periphery bits and set monitor to pass with your blobbit definition for those disabled OBD-II tests.
Last edited by mrfred; Feb 19, 2009 at 08:04 AM.
Reply
0
Old Feb 19, 2009 | 09:34 AM
Share
  #100  
travman's Avatar
travman
Evolved Member
iTrader: (26)
 
Joined: Oct 2005
Posts: 1,712
Likes: 0
From: Pittsburgh
Ok went out and tested this with scantech monitors

Catalyst monitoring - Complete

Heated catalyst monitoring - N/A

Evaporative system monitoring - Complete

Secondary air system monitoring - N/A

A/C system refrigerant monitoring - N/A

Oxygen sensor monitoring - Complete

Oxygen heater sensor monitoring - Complete

EGR system monitoring - N/A

For some reason EGR is showing not supported now? but it is def. required for an OBD-II test on the evo. I believe the other N/A's are not supported from my memory (but could be wrong).....

So I would say it partially works at this moment.
Reply
0
Old Feb 19, 2009 | 10:31 AM
Share
  #101  
acamus's Avatar
acamus
Evolved Member
 
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Originally Posted by travman
Ok went out and tested this with scantech monitors

Catalyst monitoring - Complete

Heated catalyst monitoring - N/A

Evaporative system monitoring - Complete

Secondary air system monitoring - N/A

A/C system refrigerant monitoring - N/A

Oxygen sensor monitoring - Complete

Oxygen heater sensor monitoring - Complete

EGR system monitoring - N/A

For some reason EGR is showing not supported now? but it is def. required for an OBD-II test on the evo. I believe the other N/A's are not supported from my memory (but could be wrong).....

So I would say it partially works at this moment.
Great, thank you for testing, it works as expected.
The first part is easy. There are actually two parts of this,
one says what checks are available, and the second if they are passed.
The second we have already

I will try to find simple solution for the first part.



mrfred, ok will do
Reply
0
Old Feb 20, 2009 | 01:58 AM
Share
  #102  
acamus's Avatar
acamus
Evolved Member
 
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
EDIT: see post #117
Last edited by acamus; Feb 25, 2009 at 04:45 AM.
Reply
0
Old Feb 20, 2009 | 05:06 AM
Share
  #103  
travman's Avatar
travman
Evolved Member
iTrader: (26)
 
Joined: Oct 2005
Posts: 1,712
Likes: 0
From: Pittsburgh
Originally Posted by acamus
First apply the patches:

Code:
	<table name="Non-Continuous Monitor Availability Patch Part 1" category="OBD Inspection" address="3a90c" type="1D" level="1" scaling="Hex16"/>
	<table name="Non-Continuous Monitor Availability Patch Part 2" category="OBD Inspection" address="3a926" type="1D" level="1" scaling="Hex16"/>
	<table name="Non-Continuous Monitor Completion Patch" category="OBD Inspection" address="32d1c" type="1D" level="1" scaling="Hex16"/>
Non-Continuous Monitor Completion Patch
from 6A0D to EAFF

Non-Continuous Monitor Availability Patch Part 1
from 4019 to E020

Non-Continuous Monitor Availability Patch Part 2
from 2BA1 to EBFF



Once done one can use definitions for monitoring availability/completion
Code:
	<table name="Monitor Available(1)/Not Available(0)" category="OBD Inspection" address="3a927" type="2D" level="2" scaling="blobbits">
		<table name="Non-Continuous Monitor Availability Bits" type="Static Y Axis" flipy="true" elements="8">
			<data>EGR system</data>
			<data>Oxygen heater sensor</data>
			<data>Oxygen sensor</data>
			<data>A/C system refrigerant</data>
			<data>Secondary air system</data>
			<data>Evaporative system</data>
			<data>Heated catalyst</data>
			<data>Catalyst</data>
		</table>
	</table>

	<table name="Monitor Passed(1)/Failed(0)" category="OBD Inspection" address="32d1d" type="2D" level="2" scaling="blobbits">
		<table name="Non-Continuous Monitor Completion Bits" type="Static Y Axis" flipy="true" elements="8">
			<data>EGR system</data>
			<data>Oxygen heater sensor</data>
			<data>Oxygen sensor</data>
			<data>A/C system refrigerant</data>
			<data>Secondary air system</data>
			<data>Evaporative system</data>
			<data>Heated catalyst</data>
			<data>Catalyst</data>
		</table>
	</table>


travman can you retest extended patch? You already have Non-Continuous Monitor Completion Patch.
Will do....probably wont get to it till early evening (gotta go on a road trip for work today) - will post my findings.

Thanks!
Reply
0
Old Feb 20, 2009 | 07:12 AM
Share
  #104  
mrfred's Avatar
mrfred
Thread Starter
EvoM Guru
iTrader: (50)
 
Joined: Mar 2006
Posts: 9,675
Likes: 132
From: Tri-Cities, WA // Portland, OR
Sorry to keep asking for more detail, but:

P0401 code only? <data>EGR system</data>
Front or rear or both? (P0032, P0032 = front heater; P0037, P0038 = rear heater <data>Oxygen heater sensor</data>
Front or rear or both? Which tests? <data>Oxygen sensor</data>
For USDM, only P1530 is A/C related. Maybe this is for non-USDM cars? <data>A/C system refrigerant</data>
Is this the SAS anti-lag for JDM?<data>Secondary air system</data>
Which codes?<data>Evaporative system</data>
P0420? <data>Heated catalyst</data>
What code could this be? <data>Catalyst</data>
Reply
0
Old Feb 20, 2009 | 07:16 AM
Share
  #105  
acamus's Avatar
acamus
Evolved Member
 
Joined: Mar 2008
Posts: 730
Likes: 3
From: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Originally Posted by mrfred
Sorry to keep asking for more detail, but:

P0401 code only? <data>EGR system</data>
Front or rear or both? (P0032, P0032 = front heater; P0037, P0038 = rear heater <data>Oxygen heater sensor</data>
Front or rear or both? Which tests? <data>Oxygen sensor</data>
For USDM, only P1530 is A/C related. Maybe this is for non-USDM cars? <data>A/C system refrigerant</data>
Is this the SAS anti-lag for JDM?<data>Secondary air system</data>
Which codes?<data>Evaporative system</data>
P0420? <data>Heated catalyst</data>
What code could this be? <data>Catalyst</data>
mrfred, I have not gone into deep details of this, It does not remove the CEL, it just fools the inspection equipment to be able to pass your emission inspection, but one can track it backwards to DTC. Those routines are full-time man-month disassembly effort, which I do not see as necessary. As you remember I have been hunting for heater check for half a year
This patch allows you to "pass" inspection even if you have CEL. I mean together with unplugging the light, not to look suspicious in front of the inspector .


The names are as stated in ISO standard.
Last edited by acamus; Feb 20, 2009 at 07:34 AM.
Reply
0

Thread Tools
Search this Thread
Search this Thread:

Advanced Search

Advanced Search

All times are GMT -7. The time now is 02:50 PM.