|
Title: new problem for the launch control guru's Post by: vwnut8392 on December 24, 2016, 12:45:19 PM i've been working on a friends 2001 audi TT 180hp quattro car and he asked if i could add launch control and flat shift to it and i of course said yes, thats no problem. i started with using the latest auto patcher PHP script and i keep getting is warning "FTOMN found: FTOMN ATTENTION: find multiple FTOMN offsets, will be using 0x165b5. i sort of disregarded this error because after i compared to a known functioning 512k patched file from a beetle it matches the same line of code. now i learned from the beetle 512k file that setting FTOMN to 01 makes it function properly. i tried FTOMN 00, 01 and 02 with this TT but keep pushing through to the rev limiter. i can hear the ignition interruption at 4500RPM but it just keeps revving to the limiter. the ECU in this car is 8N0906018S. i even looked at the file in IDA rather quickly and everything seems to be in place as well. this isnt a new problem to me as the beetle 512k ECU's have done this pushing through but changing FTOMN to 01 fixed the problem. anyone have any insight on this one?
i attached the output file from the launch.php script. the checksum is corrected on it as well. the .ECU file i generated is attached as well. Title: Re: new problem for the launch control guru's Post by: TijnCU on December 24, 2016, 01:54:23 PM I have done some mods to a similar case, moving the function to another location solved the problem. I would suggest to place both function and variables all the way at the end of the file.
Btw I have not opened your files, I'm reading from my phone. And make sure you set 01 at the actual ftomn adress. Title: Re: new problem for the launch control guru's Post by: vwnut8392 on December 24, 2016, 02:57:26 PM I have done some mods to a similar case, moving the function to another location solved the problem. I would suggest to place both function and variables all the way at the end of the file. Btw I have not opened your files, I'm reading from my phone. And make sure you set 01 at the actual ftomn adress. Thank you, i will try this. i have tried FTOMN at 00, 01 and 02 all give the same end result with it cutting spark but still hitting the rev limiter so it goes beyond 4500RPM. Title: Re: new problem for the launch control guru's Post by: vwnut8392 on December 24, 2016, 04:27:15 PM so i tried moving the main code and it did not work. my revised file is attached.
Title: Re: new problem for the launch control guru's Post by: TijnCU on December 26, 2016, 02:37:58 AM If it is cutting but revs climb, most likely the ignition cut is too short.. what happens if you increase the ignition cut duration variable? Maybe the counter is not being read correctly
Title: Re: new problem for the launch control guru's Post by: vwnut8392 on December 26, 2016, 12:47:06 PM when i looked at the ignition cut duration in IDA it looked like it was only the time to cut spark between shifts when using no lift shift. the igniton cut duration does not seem to affect the launch control code at all.
Title: Re: new problem for the launch control guru's Post by: TijnCU on December 26, 2016, 01:45:15 PM that is how it should be yes. Strange problem..
Title: Re: new problem for the launch control guru's Post by: vwnut8392 on December 26, 2016, 11:29:44 PM i think i found a true case where patching the binary from this ECU just flat out will not work.
Title: Re: new problem for the launch control guru's Post by: TijnCU on January 03, 2017, 01:00:28 PM Don't know if you are still working on this, but I just came up with another idea:
The nls function utilizes a counter in ram. It is located at 0x384FF0 by default. Maybe you can check if this ram adress is not used by some other function in your ecu? Log it with me7logger on a stock file to see if it is used or 0. The adress is implemented in the code on line 6, 8 and 9. I am also not sure if the script adresses the variable correctly, because it writes extended segment (D7 00 38 00). You could try to replace those parts of the code with D7 40 E0 00 and the ram adress as F0 4F (if 384FF0, else any other ram adress that you chose). Good luck :) Title: Re: new problem for the launch control guru's Post by: TijnCU on January 08, 2017, 07:09:47 AM I have to correct my statement above, after studying the code, the counter is only working for single interruption of NLS. If you have the file loaded in ida you can look for tsrldyn and hook in the function there? The only possibility the code is partially working, is if the ecu places a new coil opening time in tsrldyn after it jumps out of the function or if you are not setting dwell low enough in some other way.
Title: Re: new problem for the launch control guru's Post by: vwnut8392 on January 08, 2017, 09:19:40 PM I have to correct my statement above, after studying the code, the counter is only working for single interruption of NLS. If you have the file loaded in ida you can look for tsrldyn and hook in the function there? The only possibility the code is partially working, is if the ecu places a new coil opening time in tsrldyn after it jumps out of the function or if you are not setting dwell low enough in some other way. I did try FTOMN at 00, 01 and 02. it doesnt make any sense to me as to why it will not work with this ECU as it looks like everything is in all the right places in IDA. Title: Re: new problem for the launch control guru's Post by: TijnCU on January 09, 2017, 02:12:27 AM Log szrl_w to find out what your dwell is. Maybe you have kftsdyn interfering? if you have the file open in ida, you can check the path around tsrldyn. This also helps to confirm your ftomn adress.
Title: Re: new problem for the launch control guru's Post by: TijnCU on January 09, 2017, 06:53:58 AM Here is a part of code from my own ecu:
Code: seg010:F1B0 loc_9F1B0: ; CODE XREF: sub_9F0CA+E0j Maybe this helps you locate the maps that can possibly influence your dwell time! |