Hi
I'm trying to do map switching in edc15 with TPS and brake. Unfortunately, I have a problem with finding or reading the correct gas pedal value. According to FR, the TPS value is in CAN 280 - Bit addr 40, 8-bit (byte) value. That's byte 6. It have only 1 xref (other than setting ONES).
MEM_EXT:0000CB16 can280: ds 2 ; DATA XREF: seg009:00094148↓w
MEM_EXT:0000CB18 unk_CB18: ds 1 ; DATA XREF: seg009:000945CA↓w
MEM_EXT:0000CB18 ; seg009:0009461E↓w ...
MEM_EXT:0000CB19 unk_CB19: ds 1 ; DATA XREF: seg009:0009466A↓w
MEM_EXT:0000CB19 ; seg009:0009473E↓w
MEM_EXT:0000CB1A unk_CB1A: ds 1 ; DATA XREF: seg009:0009466E↓w
MEM_EXT:0000CB1A ; seg009:00094768↓w
MEM_EXT:0000CB1B unk_CB1B: ds 1 ; DATA XREF: seg009:00094672↓w
MEM_EXT:0000CB1B ; seg009:00094770↓w
MEM_EXT:0000CB1C unk_CB1C: ds 1 ; DATA XREF: seg009:00094676↓w
MEM_EXT:0000CB1C ; seg009:000947F4↓w ...
MEM_EXT:0000CB1D can280tps: ds 1
seg009:00094886 loc_94886: ; CODE XREF: seg009:0009487E↑j
seg009:00094886 mov r4, #0FEh
seg009:0009488A mov [-r0], r4
seg009:0009488C mov r4, #0
seg009:0009488E mov [-r0], r4
seg009:00094890 mov r12, ram_tps?_C420
seg009:00094894 mov r4, word_F141A
seg009:00094898 mov r13, [r4+#8]
seg009:0009489C mov r14, #2710h
seg009:000948A0 mov r15, [r4+#0Ah]
seg009:000948A4 calls 9, sub_94002
seg009:000948A8 add r0, #4
seg009:000948AA movb can280tps, rl4
I think word_C420 is ram value of tps.
I managed to find the address of the global TPS variable. But I'm not entirely sure if C0BCi s the correct address. This function is not far from the brake status variables, so I assume it is rather correct.
seg009:00094364 movb rl5, breakeC364
seg009:00094368 movb breake, rl5
seg009:0009436C movb rl4, unk_C365
seg009:00094370 movb unk_C488, rl4
seg009:00094374 mov r4, word_C19E
seg009:00094378 mov unk_C414, r4
seg009:0009437C mov r5, unk_C102
seg009:00094380 mov unk_C416, r5
seg009:00094384 mov r2, word_C0C8
seg009:00094388 mov unk_C41A, r2
seg009:0009438C movb rl4, dword_C390+4
seg009:00094390 movb unk_C48C, rl4
seg009:00094394 mov r4, unk_C0D0
seg009:00094398 mov unk_C41C, r4
seg009:0009439C mov r3, tpsglob_C0BC
seg009:000943A0 mov ram_tps?_C420, r3
On another forum I found information that full throttle has a value of 0x2710.
So i write my code
movb rl1, 0xC364 ;brake
jnb r1.0, needle
mov r1, 0xC0BC ;tps adress
cmp r1, #0x2710 ;tps 100 value
jmpr cc_nz, xyz
movb rl1, #1
movb 0xC822, rl1
jmpr cc_uc, needle
and it doesn't work
when i use clutch instead of TPS it work.
movb rl1, 0xC364 ;brake
jnb r1.0, needle
movb rl1, 0xC361 ; clutch
jnb r1.0, xyz
movb rl1, #1
movb 0xC822, rl1
jmpr cc_uc, needle
Does anyone have an idea why it doesn't work and where I am making a mistake? I don't know much about programming and reverse engineering so any help would be appreciated.
