NefMoto

Technical => Reverse Engineering => Topic started by: noice on May 02, 2018, 11:12:55 AM



Title: Disable KR during NLS/LC
Post by: noice on May 02, 2018, 11:12:55 AM
Hello folks, first post on this awesome forum to ask a question and, if my work is on the right direction, give a small contribution to the community.

So, I am trying to disable Knock Recognition when NLS/LC is active. I am doing this by forcing B_kr=0 if the NLS/LC routine is active. In my file B_kr is at FD72.

I have implemented an extra step on the NLS/LC routine that is available here on the forum that sets FDE8.3 if the routine is activate and clears it if it’s inactive. That was the easy part.

Next, I disassembled my binary and found where B_kr is set/cleared. (I think) I found the routine and B_kr is set at 873E14. At this point, I changed the bset and the subsequent jmpr (its an unconditional (cc_UC) jump) to a jmps pointing to an empty space in my file (8A1A00). I have attached two screenshots, one of the original file and one of the modified one.

At this addresses I have these instructions:

jb FDE8.3, 8A1A0A
bset FD72.3
jmps 873E1A
jmps 873E18

What I am willing to do is: check if FDE8.3 is set, if so,the routine will return to the address 873E18 and will continue with the normal execution (It will clear B_kr with the bclear from the original routine). If it is clear, it will set B_kr and return to the address 873E1A.

The big question: Is this going to work? If not, am I at least at the right direction?

I have found another instruction that sets B_kr at address 874AE4, but I didn’t had time to see what this routine is doing before this.

The car is a 2001 S3 8L 1.8T with AMK engine and 8N0906018AH ECU. I have attached my original bin.

English is not my primary language, so excuse any mistakes  ;D


Title: Re: Disable KR during NLS/LC
Post by: nyet on May 02, 2018, 11:31:22 AM
I haven't looked too closely, but in the FR it seems that B_kr can only be cleared by a single thing (it comes out of that big "&" in BBKR)

B_tmkr, LKRN/LKRAGRN/KRLAH/B_krldy, B_stend, NRKF ALL have to be true, so setting any one of those 0 should result in B_kr zero.

I don't know why you are seeing two paths to SETTING B_kr, because of the &



Title: Re: Disable KR during NLS/LC
Post by: noice on May 02, 2018, 11:45:39 AM
I haven't looked too closely, but in the FR it seems that B_kr can only be cleared by a single thing (it comes out of that big "&" in BBKR)

There is only one bclear for B_kr in the bin, so that’s correct.

B_tmkr, LKRN/LKRAGRN/KRLAH/B_krldy, B_stend, NRKF ALL have to be true, so setting any one of those 0 should result in B_kr zero.

I am hacking the original routine at the last step, after all of the other checks have been done. I choose this method because it is easier to implement, at least for me.

I don't know why you are seeing two paths to SETTING B_kr, because of the &

There is 2 bset to B_kr on my file, I will post a screenshot of the second location.




Sent from my iPhone using Tapatalk


Title: Re: Disable KR during NLS/LC
Post by: woj on May 02, 2018, 12:34:53 PM
(On a different ME7 ECU, so might not be applicable to your case at all). I solved it at the entry to the cascade of checks rather than at the end. One of the first checks is against CWKR, there I made it NLS flag dependent. Original code:

Code:
movb rl1, CWKR

Replaced it with a call to a function put in empty space:

Code:
calls modify_cwkr

At empty space:

Code:
modify_cwkr:
        movb    rl1, CWKR
        movb    rh1, nls_flag
        jmpr    cc_Z, cwkr_stock
        bclr    r1.0
cwkr_stock:
        rets

Works a treat, or so I am told, I was not the one that tested it.


Title: Re: Disable KR during NLS/LC
Post by: nyet on May 02, 2018, 12:37:15 PM
One of the first checks is against CWKR, there I made it NLS flag dependent.

yes, I think making it flag dependent is a better guarantee that the change is safe


Title: Re: Disable KR during NLS/LC
Post by: prj on May 04, 2018, 04:14:23 AM
The second set is for dynamic KR, you don't need to care about that, because that's only when you're making sharp throttle movements, and you're not in this case.
It's enough to patch only the routine.

I do it like this:
1. Create ram var lc_on, if lc or nls active - set to 1, else set to 0 in main routine
2. overwrite kr set with a call or jump. If lc_on then clear, else set.


Title: Re: Disable KR during NLS/LC
Post by: gt-innovation on May 04, 2018, 05:21:26 AM
+ 1 Exactly what i do on me7

and works perfectly.


Title: Re: Disable KR during NLS/LC
Post by: armageddon on May 04, 2018, 02:02:17 PM
wasn't this helpfull?? http://nefariousmotorsports.com/forum/index.php?topic=12583.15 


Title: Re: Disable KR during NLS/LC
Post by: noice on May 07, 2018, 06:27:41 AM
The second set is for dynamic KR, you don't need to care about that, because that's only when you're making sharp throttle movements, and you're not in this case.
It's enough to patch only the routine.

I do it like this:
1. Create ram var lc_on, if lc or nls active - set to 1, else set to 0 in main routine
2. overwrite kr set with a call or jump. If lc_on then clear, else set.

Nice, prj. That is exactly what I am doing!

yes, I think making it flag dependent is a better guarantee that the change is safe

I don´t see the difference on changing CWKR or changing B-kr directly. Can you elaborate more?

(On a different ME7 ECU, so might not be applicable to your case at all). I solved it at the entry to the cascade of checks rather than at the end. One of the first checks is against CWKR, there I made it NLS flag dependent. Original code:

Code:
movb rl1, CWKR

Replaced it with a call to a function put in empty space:

Code:
calls modify_cwkr

At empty space:

Code:
modify_cwkr:
        movb    rl1, CWKR
        movb    rh1, nls_flag
        jmpr    cc_Z, cwkr_stock
        bclr    r1.0
cwkr_stock:
        rets

Works a treat, or so I am told, I was not the one that tested it.

Thanks for sharing your work, man.

+ 1 Exactly what i do on me7

and works perfectly.

Great!

Thanks everyone for the feedback!


Title: Re: Disable KR during NLS/LC
Post by: Bische on May 13, 2018, 02:46:51 PM
In my own LC/NLS routine, I just made a few jumps in regards of TMKR lookup & has it FF'ed when LC/NLS is active :)