NefMoto

Technical => Reverse Engineering => Topic started by: 6L20vt on March 26, 2016, 11:20:02 PM



Title: Knock warning
Post by: 6L20vt on March 26, 2016, 11:20:02 PM
hello, is there any way to insert the blink of  knock warning without having to disassemble the entire file? similar to the phila_dot routine? Here is my ori thanks


Title: Re: Knock warning
Post by: 6L20vt on April 19, 2016, 10:56:08 AM
hello again, compared to other file posted in the forum, hw equal but different software version. it is implemented routine warning knock, and I have found the byte where is the value for the flashing condition. from there on way indicates the xrefs me and take me to the dwkrz_0, 1,2,3 labels. I'm on the road? as I can know which part should I use ?.


seg003:AC7B4 loc_8AC7B4:                             ; CODE XREF: sub_8AC7A0+10j
seg003:AC7B4                 exts    #8Bh, #1 ; 'ï'
seg003:AC7B8                 movb    rl4, byte_8B0067
seg003:AC7BC                 exts    #8Bh, #1 ; 'ï'
seg003:AC7C0                 movb    rh4, byte_8B0066 <------------- I suspect this is the value of condition
seg003:AC7C4                 cmpb    rl4, dwkrz_0
seg003:AC7C8                 jmpr    cc_SGE, loc_8AC830
seg003:AC7CA                 cmpb    rl4, dwkrz_1
seg003:AC7CE                 jmpr    cc_SGE, loc_8AC830
seg003:AC7D0                 cmpb    rl4, dwkrz_2
seg003:AC7D4                 jmpr    cc_SGE, loc_8AC830
seg003:AC7D6                 cmpb    rl4, dwkrz_3
seg003:AC7DA                 jmpr    cc_SGE, loc_8AC830
seg003:AC7DC                 cmpb    rh4, dwkrz_0
seg003:AC7E0                 jmpr    cc_SGE, loc_8AC888
seg003:AC7E2                 cmpb    rh4, dwkrz_1
seg003:AC7E6                 jmpr    cc_SGE, loc_8AC888
seg003:AC7E8                 cmpb    rh4, dwkrz_2
seg003:AC7EC                 jmpr    cc_SGE, loc_8AC888
seg003:AC7EE                 cmpb    rh4, dwkrz_3
seg003:AC7F2                 jmpr    cc_SGE, loc_8AC888
seg003:AC7F4                 exts    #38h, #1 ; '8'
seg003:AC7F8                 movb    rl4, byte_386023







seg003:B0066 byte_8B0066:    db 0ECh                 ; CODE XREF: sub_8B0072+72j    <---------------------- condition value
seg003:B0066                                         ; DATA XREF: sub_8AC7A0+20r
seg003:B0067 byte_8B0067:    db 0F4h                 ; DATA XREF: sub_8AC7A0+18r
seg003:B0068
seg003:B0068 ; =============== S U B R O U T I N E =======================================
seg003:B0068
seg003:B0068
seg003:B0068 sub_8B0068:
seg003:B0068                 bset    r15.15
seg003:B006A                 bset    r15.15
seg003:B006C                 bset    r15.15
seg003:B006E                 bset    r15.15
seg003:B006E ; End of function sub_8B0068


Title: Re: Knock warning
Post by: littco on April 21, 2016, 09:35:50 AM
hello again, compared to other file posted in the forum, hw equal but different software version. it is implemented routine warning knock, and I have found the byte where is the value for the flashing condition. from there on way indicates the xrefs me and take me to the dwkrz_0, 1,2,3 labels. I'm on the road? as I can know which part should I use ?.


seg003:AC7B4 loc_8AC7B4:                             ; CODE XREF: sub_8AC7A0+10j
seg003:AC7B4                 exts    #8Bh, #1 ; 'ï'
seg003:AC7B8                 movb    rl4, byte_8B0067
seg003:AC7BC                 exts    #8Bh, #1 ; 'ï'
seg003:AC7C0                 movb    rh4, byte_8B0066 <------------- I suspect this is the value of condition
seg003:AC7C4                 cmpb    rl4, dwkrz_0
seg003:AC7C8                 jmpr    cc_SGE, loc_8AC830
seg003:AC7CA                 cmpb    rl4, dwkrz_1
seg003:AC7CE                 jmpr    cc_SGE, loc_8AC830
seg003:AC7D0                 cmpb    rl4, dwkrz_2
seg003:AC7D4                 jmpr    cc_SGE, loc_8AC830
seg003:AC7D6                 cmpb    rl4, dwkrz_3
seg003:AC7DA                 jmpr    cc_SGE, loc_8AC830
seg003:AC7DC                 cmpb    rh4, dwkrz_0
seg003:AC7E0                 jmpr    cc_SGE, loc_8AC888
seg003:AC7E2                 cmpb    rh4, dwkrz_1
seg003:AC7E6                 jmpr    cc_SGE, loc_8AC888
seg003:AC7E8                 cmpb    rh4, dwkrz_2
seg003:AC7EC                 jmpr    cc_SGE, loc_8AC888
seg003:AC7EE                 cmpb    rh4, dwkrz_3
seg003:AC7F2                 jmpr    cc_SGE, loc_8AC888
seg003:AC7F4                 exts    #38h, #1 ; '8'
seg003:AC7F8                 movb    rl4, byte_386023







seg003:B0066 byte_8B0066:    db 0ECh                 ; CODE XREF: sub_8B0072+72j    <---------------------- condition value
seg003:B0066                                         ; DATA XREF: sub_8AC7A0+20r
seg003:B0067 byte_8B0067:    db 0F4h                 ; DATA XREF: sub_8AC7A0+18r
seg003:B0068
seg003:B0068 ; =============== S U B R O U T I N E =======================================
seg003:B0068
seg003:B0068
seg003:B0068 sub_8B0068:
seg003:B0068                 bset    r15.15
seg003:B006A                 bset    r15.15
seg003:B006C                 bset    r15.15
seg003:B006E                 bset    r15.15
seg003:B006E ; End of function sub_8B0068

Yes, I have a knock light that you can set to work when certain CF occurs and flashes the MIL  but I never actually got it too work and gave up on it.. I'll post it up and maybe you can take another look and see what I missed..



Title: Re: Knock warning
Post by: 6L20vt on May 01, 2016, 10:58:08 PM
Yes, I have a knock light that you can set to work when certain CF occurs and flashes the MIL  but I never actually got it too work and gave up on it.. I'll post it up and maybe you can take another look and see what I missed..



can you help me to implement only the warning in my file?


Title: Re: Knock warning
Post by: dream3R on May 03, 2016, 06:24:06 PM
Just cmp wkrm and set the mil_on,

Personally I'd fine a free interrupt to brance to and just code it in hex in IDA it's a quick one


Title: Re: Knock warning
Post by: 6L20vt on May 03, 2016, 11:02:06 PM
Just cmp wkrm and set the mil_on,

Personally I'd fine a free interrupt to brance to and just code it in hex in IDA it's a quick one


do not quite understand what you mean, could you give me an example ?. thanks for your answer


Title: Re: Knock warning
Post by: 6L20vt on May 16, 2016, 10:30:59 AM
Hello, I've been doing several tests with this file in my car and I changed the value stayed b0066 and I managed to make light of _mil flashing.
  someone can help me isolate the code related to that function ?. this file is not specifically for my car, and I would like to transfer this function to only my own modified file.

One explanation is sufciente for me, I do not intend to do it for me, but I fail to understand how to do it by myself in one way. and I have disassembled the file, but not sure which parts should copy

thanks


Title: Re: Knock warning
Post by: dream3R on May 17, 2016, 05:30:30 PM
Hello, I've been doing several tests with this file in my car and I changed the value stayed b0066 and I managed to make light of _mil flashing.
  someone can help me isolate the code related to that function ?. this file is not specifically for my car, and I would like to transfer this function to only my own modified file.

One explanation is sufciente for me, I do not intend to do it for me, but I fail to understand how to do it by myself in one way. and I have disassembled the file, but not sure which parts should copy

thanks

you need the mil on bit defined, then just branch to a new bit of code from a spare interrupt to free space, type the asm in hex in IDA at that space then use reti iirc, taking it further you could implement a timer too if wkrm > for 2 secs then mil on, you see this type of asm a lot in me7 otherwise I guess if it's a 40ms interrupt lol it could be setting/unsetting the bit a lot lol.

You'll need the instruction set sheet for he c167 and knowledge of asm/c minimum.  wkrm is what I'd compare.


Title: Re: Knock warning
Post by: 6L20vt on May 17, 2016, 09:49:06 PM
you need the mil on bit defined, then just branch to a new bit of code from a spare interrupt to free space, type the asm in hex in IDA at that space then use reti iirc, taking it further you could implement a timer too if wkrm > for 2 secs then mil on, you see this type of asm a lot in me7 otherwise I guess if it's a 40ms interrupt lol it could be setting/unsetting the bit a lot lol.

You'll need the instruction set sheet for he c167 and knowledge of asm/c minimum.  wkrm is what I'd compare.

thanks for your answer. someone could give me some advice to find the bit where _mil staying, I managed to define other names using the methods explained in the various post on the forum, but I can not find this.thanks


Title: Re: Knock warning
Post by: 6L20vt on June 16, 2016, 06:35:53 PM
you need the mil on bit defined, then just branch to a new bit of code from a spare interrupt to free space, type the asm in hex in IDA at that space then use reti iirc, taking it further you could implement a timer too if wkrm > for 2 secs then mil on, you see this type of asm a lot in me7 otherwise I guess if it's a 40ms interrupt lol it could be setting/unsetting the bit a lot lol.

You'll need the instruction set sheet for he c167 and knowledge of asm/c minimum.  wkrm is what I'd compare.

Hello, I think this in 0x00fd24 b_mil as I indicated me7 info. I looking at the function of the file that I put above, I see no call to b_mil, or anything related to that direction, but really light blinks under knock. I'm lost. you can help?



Title: Re: Knock warning
Post by: dream3R on August 03, 2016, 03:40:15 PM
Could you repeat that I don't understand lol


Title: Re: Knock warning
Post by: 6L20vt on August 03, 2016, 03:53:59 PM
I mean that in the disassembled file, I searched 0x00fd24, and have not found any function that relates to knock warning. you can help create a simple function for this?


Title: Re: Knock warning
Post by: dream3R on August 03, 2016, 04:00:00 PM
There has to be code to the MIL_ON bit :)

You're missing something.


Title: Re: Knock warning
Post by: 6L20vt on September 24, 2016, 11:37:33 AM
hello again, after several tests with the other code, I do not get it to work, so I decided to try using the code that I have exposed phila dot in the post multimap.
However, once disassembled files (including ori audi s4 for comparison) I believe I have located the functions that handle this.

I have also located the variables in the file:


                                                  PHILA´S FILE                                            CUPRA´S FILE


B_MIL------------------------------         0X00FD22    -------------------------------       0X00FD24

WKRMA ---------------------------         0X00F9B3    -------------------------------       0X00F9D7

WKRMA THRESHOLD ------------          0X17129     --------------------------------      Yet undefined


well, I leave the full-featured text file. They are extracted from disassembled. tamnien I attached two photos with the diagram of the three files.
I hope someone can help me with this and so we can help more users learn how to implement this feature in your file.

thanks


Title: Re: Knock warning
Post by: Khendal on January 20, 2017, 03:16:11 PM
This is an interested thread...i have a Leon Cupra R 1.8T Bam...  8)


Title: Re: Knock warning
Post by: TijnCU on January 20, 2017, 03:52:28 PM
Wkrma threshold is a variable that you need to make. It will not be in your stock bin. For example the value 3. Then compare wkrma (ram) to this adress (flash) and if wkrma is higher than the variable, you trigger b_mil (bset b_mil). Dont forget to tell the ecu to stop the light when the threshold is not (or no longer) met (bclr b_mil). It can be usefull to study other peoples work, but you still need to understand how the processor works before you can write stuff like this...