|
Title: MED9 launch control reversing Post by: vwnut8392 on March 07, 2018, 02:45:41 AM was poking around on a forum and found a random file someone had posted that claimed to have a launch control and map switching, i looked through it and didnt find any major brand name or tuner in it so i figured id share it for everyone trying to crack the MED9 mystery. i did a little bit of poking around in IDA with it and i think i have deciphered the launch control code from the map switching code.
Entry to the code i think is launch control Code: ROM:00596E08 # --------------------------------------------------------------------------- Second Part of this code Code: ROM:00596DB0 # --------------------------------------------------------------------------- Attached are the BIN file i found. have fun guys and enjoy! Title: Re: MED9 launch control reversing Post by: gt-innovation on March 07, 2018, 03:00:37 AM was poking around on a forum and found a random file someone had posted that claimed to have a launch control and map switching, i looked through it and didnt find any major brand name or tuner in it so i figured id share it for everyone trying to crack the MED9 mystery. i did a little bit of poking around in IDA with it and i think i have deciphered the launch control code from the map switching code. Entry to the code i think is launch control Code: ROM:00596E08 # --------------------------------------------------------------------------- Second Part of this code Code: ROM:00596DB0 # --------------------------------------------------------------------------- Attached are the BIN file i found. have fun guys and enjoy! The code you are looking at is 100% the one that BC consulting is using thus the non commercial file posting rule applies. As for the signature you just didn`t pay attention to the XOR command with the 0xBCBC string.If i remember correctly the vin is also included. This code is utilizing the same method that has been described by basano years ago by switching to different LDRXN maps.In any case that is not a mutlimap that has many options. Just ldrxn is useless in order to make a proper good tune. Title: Re: MED9 launch control reversing Post by: gt-innovation on March 07, 2018, 03:34:53 AM Forgot to mention that the lc function is probably not what you are looking for.It is a kind of 2 step but without bangs and most important it will not produce the boost you are going to need in big turbo applications.It is safe for catalytic systems though..
Title: Re: MED9 launch control reversing Post by: vwnut8392 on March 07, 2018, 01:44:42 PM Thanks for sharing. i dont know very little about disassembling MED9, im just starting to learn it. i was just looking for branding like normal commercial tuners add to files.
as for the launch control i have a feeling your right about it not being the hard cut version. either way its a starting point to learn how the code works and can be modified. i really want to use the spark cut version but anyone who has ever talked about it/developed it publically pulled all their info because tuners took the info and was selling it which in turn made these guys mad i guess. Title: Re: MED9 launch control reversing Post by: gt-innovation on March 07, 2018, 02:18:49 PM There was never a public code for med9.1 and at least here no one took back anything.
This is not a good way to start and i would suggest to go into basano`s posts about med9.1 because those will help. For the als nls there are many ways to approach it but you need to do plenty of things to get a fireball going as it is not like me7. A simple lc and nls function though is not very hard to do once you get things going with small code parts.If you don`t have your own test car it will be much harder to make something satisfying. It would be good to ask Nyet about the commercial file post as you could just keep the parts of code you already posted. Good luck. Title: Re: MED9 launch control reversing Post by: vwnut8392 on March 07, 2018, 04:52:11 PM There was never a public code for med9.1 and at least here no one took back anything. This is not a good way to start and i would suggest to go into basano`s posts about med9.1 because those will help. For the als nls there are many ways to approach it but you need to do plenty of things to get a fireball going as it is not like me7. A simple lc and nls function though is not very hard to do once you get things going with small code parts.If you don`t have your own test car it will be much harder to make something satisfying. It would be good to ask Nyet about the commercial file post as you could just keep the parts of code you already posted. Good luck. From past experience at looking at the spark cut launch control in other motronics like ME7 and even old M2.3.2 it seems that forcing a false value on anything close to SWOUT or ZWOUT in RAM give the desired effect. i have not looked at the MED9 function sheet yet to see how the ignition system actually functions it seems to me that the apple never fell far from the tree when it came to motronic. it evolved but never really changed a ton because it worked well in the beginning so why try and re-invent the wheel. know what i mean. im sure MED9 has a lot more fail safes than previous motronics and it gets worse as it evolves too. im going to look into it though and use this file as a learning file. i do get that you said most of it is sort of useless but i can now see the difference between hand added code from a human and the bosch machine generated code from when the ECU was developed/manufacturered. i have read through a few of basano's posts already and they are helping too. very well educated man. I will mesaage him or maybe he will chime in on this post about the file and if its valid. i have no problems removing it if its not valid. My only issue at the moment that would help a lot is identifying what is what in RAM. a few of basano's post talked about finding things but im still having problems finding the stuff that relates to the ignition system. there was one generator that would identify some of the RAM but nothing important as to what im focusing on. it gave me like wped, B_kuppl, and a few other variables like that which helped. what i was doing was trying to use the one map that everyone uses for spark cut RPM limiter in ME7 to locate the RAM ignition interruption. this map is still in MED9 and i think it will lead me to the end result. in all honesty i hate that solution for hard RPM limiter in ME7 lol. it sucks. i re-purposed the coolant temp check for a hard RPM limiter in ME7 instead, it just seems like a better solution. oh well enough rambling, back to looking at this stuff. thanks for the help and info. Title: Re: MED9 launch control reversing Post by: gt-innovation on March 20, 2018, 11:46:35 AM From past experience at looking at the spark cut launch control in other motronics like ME7 and even old M2.3.2 it seems that forcing a false value on anything close to SWOUT or ZWOUT in RAM give the desired effect. Why force a false one when you can give it exactly what it needs????? on med9 it is simple li r30, 0 sth r30, szout_w But again that is not the only thing you need.This will act like a hard cut limiter but no bangs will happen.First you need to retard the ignition for around 160rpm before this happens. Title: Re: MED9 launch control reversing Post by: vwnut8392 on June 17, 2018, 02:24:32 PM what else is needed?
|