Print Page - EDC15 Mapswitchnig by brake and TPS

Hi
I'm trying to do map switching in edc15 with TPS and brake. Unfortunately, I have a problem with finding or reading the correct gas pedal value. According to FR, the TPS value is in CAN 280 - Bit addr 40, 8-bit (byte) value. That's byte 6. It have only 1 xref (other than setting ONES).

Code:

MEM_EXT:0000CB16 can280:         ds 2                    ; DATA XREF: seg009:00094148↓w
MEM_EXT:0000CB18 unk_CB18:       ds 1                    ; DATA XREF: seg009:000945CA↓w
MEM_EXT:0000CB18                                         ; seg009:0009461E↓w ...
MEM_EXT:0000CB19 unk_CB19:       ds 1                    ; DATA XREF: seg009:0009466A↓w
MEM_EXT:0000CB19                                         ; seg009:0009473E↓w
MEM_EXT:0000CB1A unk_CB1A:       ds 1                    ; DATA XREF: seg009:0009466E↓w
MEM_EXT:0000CB1A                                         ; seg009:00094768↓w
MEM_EXT:0000CB1B unk_CB1B:       ds 1                    ; DATA XREF: seg009:00094672↓w
MEM_EXT:0000CB1B                                         ; seg009:00094770↓w
MEM_EXT:0000CB1C unk_CB1C:       ds 1                    ; DATA XREF: seg009:00094676↓w
MEM_EXT:0000CB1C                                         ; seg009:000947F4↓w ...
MEM_EXT:0000CB1D can280tps:      ds 1

Code:

seg009:00094886 loc_94886:                              ; CODE XREF: seg009:0009487E↑j
seg009:00094886                 mov     r4, #0FEh
seg009:0009488A                 mov     [-r0], r4
seg009:0009488C                 mov     r4, #0
seg009:0009488E                 mov     [-r0], r4
seg009:00094890                 mov     r12, ram_tps?_C420
seg009:00094894                 mov     r4, word_F141A
seg009:00094898                 mov     r13, [r4+#8]
seg009:0009489C                 mov     r14, #2710h
seg009:000948A0                 mov     r15, [r4+#0Ah]
seg009:000948A4                 calls   9, sub_94002
seg009:000948A8                 add     r0, #4
seg009:000948AA                 movb    can280tps, rl4

I think word_C420 is ram value of tps.

I managed to find the address of the global TPS variable. But I'm not entirely sure if C0BCi s the correct address. This function is not far from the brake status variables, so I assume it is rather correct.

Code:

seg009:00094364                 movb    rl5, breakeC364
seg009:00094368                 movb    breake, rl5
seg009:0009436C                 movb    rl4, unk_C365
seg009:00094370                 movb    unk_C488, rl4
seg009:00094374                 mov     r4, word_C19E
seg009:00094378                 mov     unk_C414, r4
seg009:0009437C                 mov     r5, unk_C102
seg009:00094380                 mov     unk_C416, r5
seg009:00094384                 mov     r2, word_C0C8
seg009:00094388                 mov     unk_C41A, r2
seg009:0009438C                 movb    rl4, dword_C390+4
seg009:00094390                 movb    unk_C48C, rl4
seg009:00094394                 mov     r4, unk_C0D0
seg009:00094398                 mov     unk_C41C, r4
seg009:0009439C                 mov     r3, tpsglob_C0BC
seg009:000943A0                 mov     ram_tps?_C420, r3

On another forum I found information that full throttle has a value of 0x2710.

So i write my code

Code:

movb rl1, 0xC364  ;brake
jnb r1.0, needle 
mov r1, 0xC0BC ;tps adress
cmp r1, #0x2710 ;tps 100 value
jmpr cc_nz, xyz 
movb rl1, #1
movb 0xC822, rl1
jmpr cc_uc, needle

and it doesn't work
when i use clutch instead of TPS it work.

Code:

movb rl1, 0xC364  ;brake
jnb r1.0, needle 
movb rl1, 0xC361  ; clutch
jnb r1.0, xyz
movb rl1, #1
movb 0xC822, rl1
jmpr cc_uc, needle

Does anyone have an idea why it doesn't work and where I am making a mistake? I don't know much about programming and reverse engineering so any help would be appreciated.

NefMoto

Technical => Reverse Engineering => Topic started by: barex on February 11, 2023, 06:09:56 AM