NefMoto

Technical => Reverse Engineering => Topic started by: rajivc666 on January 13, 2012, 12:24:48 AM



Title: Memory addr 480000
Post by: rajivc666 on January 13, 2012, 12:24:48 AM
THe following subroutine is taken from a stock SJ box. The section in BOLD seems to be writing to memory location 48003Eh (120h*4000h+3Eh).
Which is that memory location, or what am I doing wrong.
Thanks
; =============== S U B R O U T I N E =======================================
seg010:728DC
seg010:728DC
seg010:728DC sub_8728DC:                             ; CODE XREF: seg010:22AD6P
seg010:728DC                                         ; seg010:22D50P
seg010:728DC                 movb    rl4, word_FDCC
seg010:728E0                 mov     r10, #3Eh ; '>'
seg010:728E4                 mov     r11, #120h
seg010:728E8                 extp    r11, #1
seg010:728EA                 movb    [r10], rl4

seg010:728EC                 mov     r4, #42h ; 'B'
seg010:728F0                 mov     r5, #120h
seg010:728F4                 extp    r5, #1
seg010:728F6                 movb    rl3, [r4]
seg010:728F8                 movbz   r4, rl3
seg010:728FA                 mov     word_FDD8, r4
seg010:728FE                 movb    rl4, word_FDCE
seg010:72902                 mov     r10, #44h ; 'D'
seg010:72906                 mov     r11, #120h
seg010:7290A                 extp    r11, #1
seg010:7290C                 movb    [r10], rl4
seg010:7290E                 mov     r4, #48h ; 'H'
seg010:72912                 mov     r5, #120h
seg010:72916                 extp    r5, #1
seg010:72918                 movb    rl3, [r4]
seg010:7291A                 movbz   r4, rl3
seg010:7291C                 mov     word_FDDA, r4
seg010:72920                 rets
seg010:72920 ; End of function sub_8728DC


Title: Re: Memory addr 480000
Post by: setzi62 on January 13, 2012, 09:51:17 AM
You aren't doing anything wrong.
The cpu accesses the CC650 via memory mapped I/O
at 0x480000 - 0x48007F for 1MB ME7.5 (or 0x400000 - 0x40007F for 512kB ME7.5).

The CC650 is mainly the knock-signal evaluation IC and it has also digital I/O and ADC's on it.
I think there is no information about the CC650 around, but the knock signal part is
similar to the CC195, for which some information can be found.


Title: Re: Memory addr 480000
Post by: rajivc666 on January 15, 2012, 10:24:07 AM
Thank you Setzi. I am trying to learn how to switch the boost map with the cruise control switch. My plan is to convert the boost map into a 3D map and use the Y-axis as the selector of each map. (y =1 is map1, y=2 is map2....). And control the value of Y with the cruise control set button when cruise control is off. Long way to go.. :-[


Title: Re: Memory addr 480000
Post by: gremlin on January 15, 2012, 01:48:30 PM
Thank you Setzi. I am trying to learn how to switch the boost map with the cruise control switch. Long way to go.. :-[

If you want to short this long way it's much easier (IMHO) to use free ADC-channel input present on pins of ME7.5  connector as control point.
Adding some wires and 1 poti or rotary switch is not to high extra price for simplicity of software patches.
Also that will be useful for cars without CCS.
 
 


Title: Re: Memory addr 480000
Post by: rajivc666 on January 17, 2012, 09:45:06 AM
I had this passion for assembly coding as a teenager. Just trying to rekindle it in this project. ;D