NefMoto

Technical => Reverse Engineering => Topic started by: kacperoooni on December 18, 2019, 10:40:06 AM



Title: RPM CAN variable
Post by: kacperoooni on December 18, 2019, 10:40:06 AM
Hi,

Is there any CAN variable like in edc15? I wanted to display some through rpm gauge. Same question for consumption display :D


Title: Re: RPM CAN variable
Post by: prj on December 18, 2019, 10:47:14 AM
It would help if you would actually post the ECU and car.

Otherwise:
Yes.


Title: Re: RPM CAN variable
Post by: kacperoooni on December 18, 2019, 10:58:13 AM
It would help if you would actually post the ECU and car.

Otherwise:
Yes.
ymmm yes, hahah. Our lovely ME7.5 1.8t 1mb flash


Title: Re: RPM CAN variable
Post by: prj on December 18, 2019, 11:17:21 AM
Search for CW_CAN_S in FR, it will show which messages are under what bit, you can check if they are enabled, and right after it are the descriptions with the formats of all the messages.
Motor 1 should always be on.


Title: Re: RPM CAN variable
Post by: BWF on April 10, 2020, 04:25:22 AM
I am also researching to use the rpm meter.
My intention is to look up bytes 3 and 4 of the can ID280, which are RPM.

As seen in images r13 I suppose it is the ID, and r12 r14 and r15 uses it in sub_83E778.

Inside the subroutine it does some calculations with r12, to later add it with # 0EF10h. I think the result is the address for ID280.

Is all this correct?


Title: Re: RPM CAN variable
Post by: fknbrkn on April 10, 2020, 05:00:59 AM
Can bytes are the simply memory adresses in iram tipycally in 0xF8xx area
Look in FR-CAN, there is a 0x280 msg and you see there is nmot_w goes to byte 3 and 4 as a word
The easiest tracking way in that case is to find pretty rare used variable near yours
So there is also mifab_w going to byte 5 as i said this var used only about 10 times in flash (x for crosslinks)
Jump on those crosslinks and search for something like

mov r4, mifab_w
shr, #8
movb 0F826, rl4

so this 0xF826 is 0x280 byte 5
and right above should be the similar routine with 0xF825 and 0xF824 for a byte 4 and 3 with nmot_w goes in it


Title: Re: RPM CAN variable
Post by: BWF on April 11, 2020, 07:05:06 AM
Thank you it has been a great help