NefMoto

Technical => Reverse Engineering => Topic started by: DT on November 05, 2015, 04:34:32 PM



Title: Direct access to ME7 output pin
Post by: DT on November 05, 2015, 04:34:32 PM
Can anyone explain or guide me to right place in code to allow me to directly change output of for example P7.3/POUT3 of C167 CPU1 , N80 evap in Mbox(?). I need for the output to change directly when I want, not waiting for ECU to see B_xxxxx and set output register of CPU.
Information about communication to CPU2 would also be of use to be able to set some outputs there too. But I'm not sure the 2nd C167 gets it's commands quick enough for my needs.



Title: Re: Direct access to ME7 output pin
Post by: _nameless on November 06, 2015, 06:49:56 AM
Nice first post... Give me give me.


Title: Re: Re: Direct access to ME7 output pin
Post by: DT on November 06, 2015, 07:49:32 AM
Nice first post... Give me give me.
Posts+1=396 soon you reach 400 if you keep it up.

Did you have something to say about topic? I'm planning a nice new thing for the public, it's been to long now since map switching or als/nls.


Title: Re: Direct access to ME7 output pin
Post by: seishuku on November 06, 2015, 08:40:33 AM
This wasn't on an me7, but the last time I did this I just stole the pin away from the main program and kept setting the output at the top of my function. So if the main did reset the pin(s), it would just be set back on next function call.

A bit crude, but it worked for me. Just depends on if the me7 program is agressive about pin setting.


Title: Re: Direct access to ME7 output pin
Post by: ddillenger on November 06, 2015, 08:44:17 AM
Nice first post... Give me give me.

I think this was a good first post. He asked an intelligent question. Not "My ELM327 bluetooth dongle is not working with nefmoto"

lol.


Title: Re: Re: Direct access to ME7 output pin
Post by: DT on November 06, 2015, 09:31:29 AM
This wasn't on an me7, but the last time I did this I just stole the pin away from the main program and kept setting the output at the top of my function. So if the main did reset the pin(s), it would just be set back on next function call.

A bit crude, but it worked for me. Just depends on if the me7 program is agressive about pin setting.
Well in this case I will need a more secure output. But sure, since the ME7 function will be disabled by codeword or patch but it might keep output reset every cycle.  I might need to use a logic analyzer or oscilloscope to be sure that i don't get faulty output.

It does not need to be info about the specific 551m ecu.

Dd:
:D


Title: Re: Direct access to ME7 output pin
Post by: seishuku on November 06, 2015, 02:52:45 PM
If you have to be absolutely sure it won't touch the pin, then you may have to find any references to that pin and 'nop' it out.


Title: Re: Direct access to ME7 output pin
Post by: DT on November 06, 2015, 03:03:44 PM
If you have to be absolutely sure it won't touch the pin, then you may have to find any references to that pin and 'nop' it out.
Well, the problem is that I cannot find where it is actually set, only where b_xxxx is set. Somewhere b_xxxx is read and then the hardware register is written to alter output state. I'm quite sure that it's not enough to NOP the writes to b_xxxx


Title: Re: Direct access to ME7 output pin
Post by: DT on November 08, 2015, 05:37:34 AM
Not mentioned above is that I assume that most hardware access like this is handled by Ercos which often is included as the first 32kb of binary file. My problem is that I cannot find which routine in ercos read b_xxxxx and sets the hardware output accordingly.
 Can somebody share some light on the structure of long lists of calls in ercos? If I recall some(all?) of those are associated with hw interrupts but it was a few years ago I looked at them now.


Title: Re: Direct access to ME7 output pin
Post by: DT on November 18, 2015, 12:59:47 PM
I think I have outputs relatively well covered but i've not tested it fully yet. At the moment I've stumbled upon another problem, jmps/call to routine in another segment.

link to thread http://nefariousmotorsports.com/forum/index.php?topic=9300

I think it is better to keep this thread on topic


Title: Re: Direct access to ME7 output pin
Post by: DT on November 22, 2015, 04:45:17 PM
The code to access output pins at hardware level seems to work, real world test soon.