NefMoto > Technical > Reverse Engineering > Haldex Controllers Thinking.....
Pages: 1 ... 22 23 [24] 25 26 ... 29
« previous next »
Author Topic: Haldex Controllers Thinking.....  (Read 276119 times)
Swat Cat
Newbie
*

Karma: +2/-0
Offline Offline

Posts: 8
« Reply #345 on: February 03, 2016, 01:33:46 AM »
so i guess after reading all the pages , gen 1 tuning is still in development?
Logged
prj
Hero Member
*****

Karma: +1072/-480
Offline Offline

Posts: 6035
« Reply #346 on: February 03, 2016, 03:33:16 AM »
UC...
Logged
PM's will not be answered, so don't even try.
Log your car properly - WinOLS database - Tools/patches
dream3R
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 1194
« Reply #347 on: February 06, 2016, 04:07:08 PM »
Quote from: DT on January 30, 2016, 08:03:43 PM
Code:
ROM:47E6
ROM:47E6 ; =============== S U B R O U T I N E =======================================
ROM:47E6
ROM:47E6
ROM:47E6 sub_47E6:                               ; CODE XREF: ROM:42FAp
ROM:47E6                 mov     [-r0], r13
ROM:47E8                 mov     [-r0], r12
ROM:47EA                 mov     [-r0], r9
ROM:47EC                 mov     [-r0], r8
ROM:47EE                 mov     [-r0], r7
ROM:47F0                 mov     [-r0], r6
ROM:47F2                 mov     r6, r14
ROM:47F4                 mov     r7, r15
ROM:47F6                 mov     r9, #0
ROM:47F8
ROM:47F8 loc_47F8:                               ; CODE XREF: sub_47E6+B2j
ROM:47F8                 mov     r4, r9
ROM:47FA                 shl     r4, #2
ROM:47FC                 sub     r4, r9
ROM:47FE                 shl     r4, #2
ROM:4800                 mov     r10, [r4+418Ch]
ROM:4804                 mov     r11, [r4+418Eh]
ROM:4808                 mov     r4, [r0+8]
ROM:480C                 mov     r5, [r0+0Ah]
ROM:4810                 sub     r4, r10
ROM:4812                 subc    r5, r11
ROM:4814                 jmpr    cc_C, loc_4894
ROM:4816                 mov     r4, #4190h
ROM:481A                 mov     r5, r9
ROM:481C                 shl     r5, #2
ROM:481E                 sub     r5, r9
ROM:4820                 shl     r5, #2
ROM:4822                 add     r4, r5
ROM:4824                 mov     r10, [r4+]
ROM:4826                 mov     r11, [r4]
ROM:4828                 mov     r4, [r0+8]
ROM:482C                 mov     r5, [r0+0Ah]
ROM:4830                 sub     r4, r10
ROM:4832                 subc    r5, r11
ROM:4834                 jmpr    cc_NC, loc_4894
ROM:4836                 mov     r12, r9
ROM:4838                 callr   sub_478C
ROM:483A                 mov     r8, r4
ROM:483C                 cmp     r4, #0
ROM:483E                 jmpr    cc_Z, loc_4844
ROM:4840                 mov     r4, r8
ROM:4842                 jmpr    cc_UC, loc_489E
ROM:4844 ; ---------------------------------------------------------------------------
ROM:4844
ROM:4844 loc_4844:                               ; CODE XREF: sub_47E6+58j
ROM:4844                 mov     r4, r9
ROM:4846                 shl     r4, #2
ROM:4848                 sub     r4, r9
ROM:484A                 shl     r4, #2
ROM:484C                 mov     r10, [r4+4190h]
ROM:4850                 mov     r11, [r4+4192h]
ROM:4854                 sub     r10, r6
ROM:4856                 subc    r11, r7
ROM:4858                 jmpr    cc_ULE, loc_485E
ROM:485A                 mov     r4, #0
ROM:485C                 jmpr    cc_UC, loc_489E
ROM:485E ; ---------------------------------------------------------------------------
ROM:485E
ROM:485E loc_485E:                               ; CODE XREF: sub_47E6+72j
ROM:485E                 add     r9, #1
ROM:4860                 jmpr    cc_UC, loc_4890
ROM:4862 ; ---------------------------------------------------------------------------
ROM:4862
ROM:4862 loc_4862:                               ; CODE XREF: sub_47E6+ACj
ROM:4862                 mov     r1, r9
ROM:4864                 shl     r1, #2
ROM:4866                 sub     r1, r9
ROM:4868                 shl     r1, #2
ROM:486A                 mov     r4, [r1+418Ch]
ROM:486E                 mov     r5, [r1+418Eh]
ROM:4872                 sub     r4, r6
ROM:4874                 subc    r5, r7
ROM:4876                 jmpr    cc_UGT, loc_488E
ROM:4878                 mov     r4, [r1+4190h]
ROM:487C                 mov     r5, [r1+4192h]
ROM:4880                 sub     r4, r6
ROM:4882                 subc    r5, r7
ROM:4884                 jmpr    cc_ULE, loc_488E
ROM:4886                 mov     r12, r9
ROM:4888                 calla   cc_UC, sub_478C
ROM:488C                 jmpr    cc_UC, loc_489E
ROM:488E ; ---------------------------------------------------------------------------
ROM:488E
ROM:488E loc_488E:                               ; CODE XREF: sub_47E6+90j
ROM:488E                                         ; sub_47E6+9Ej
ROM:488E                 add     r9, #1
ROM:4890
ROM:4890 loc_4890:                               ; CODE XREF: sub_47E6+7Aj
ROM:4890                 cmp     r9, #5
ROM:4892                 jmpr    cc_C, loc_4862
ROM:4894
ROM:4894 loc_4894:                               ; CODE XREF: sub_47E6+2Ej
ROM:4894                                         ; sub_47E6+4Ej
ROM:4894                 add     r9, #1
ROM:4896                 cmp     r9, #5
ROM:4898                 jmpr    cc_C, loc_47F8
ROM:489A                 mov     r4, #0FFFCh
ROM:489E
ROM:489E loc_489E:                               ; CODE XREF: sub_47E6+5Cj
ROM:489E                                         ; sub_47E6+76j ...
ROM:489E                 mov     r6, [r0+]
ROM:48A0                 mov     r7, [r0+]
ROM:48A2                 mov     r8, [r0+]
ROM:48A4                 mov     r9, [r0+]
ROM:48A6                 add     r0, #4
ROM:48A8                 ret
ROM:48A8 ; End of function sub_47E6
ROM:48A8
ROM:48AA
ROM:48AA ; =============== S U B R O U T I N E =======================================
ROM:48AA
ROM:48AA
ROM:48AA sub_48AA:                               ; CODE XREF: ROM:4248p
ROM:48AA                 mov     r12, #0
ROM:48AC
ROM:48AC loc_48AC:                               ; CODE XREF: sub_48AA+40j
ROM:48AC                 mov     r13, r12
ROM:48AE                 shl     r13, #2
ROM:48B0                 sub     r13, r12
ROM:48B2                 shl     r13, #2
ROM:48B4                 mov     r4, [r13+418Ch]
ROM:48B8                 mov     r5, [r13+418Eh]
ROM:48BC                 sub     r4, word_41C8
ROM:48C0                 subc    r5, word_41CA
ROM:48C4                 jmpr    cc_UGT, loc_48E0
ROM:48C6                 mov     r4, [r13+4190h]
ROM:48CA                 mov     r5, [r13+4192h]
ROM:48CE                 sub     r4, word_41C8
ROM:48D2                 subc    r5, word_41CA
ROM:48D6                 jmpr    cc_ULE, loc_48E0
ROM:48D8                 movb    rl4, #1
ROM:48DA                 movb    [r12+0F768h], rl4
ROM:48DE                 jmpr    cc_UC, loc_48E6
ROM:48E0 ; ---------------------------------------------------------------------------
ROM:48E0
ROM:48E0 loc_48E0:                               ; CODE XREF: sub_48AA+1Aj
ROM:48E0                                         ; sub_48AA+2Cj
ROM:48E0                 movb    rl4, #0
ROM:48E2                 movb    [r12+0F768h], rl4
ROM:48E6
ROM:48E6 loc_48E6:                               ; CODE XREF: sub_48AA+34j
ROM:48E6                 add     r12, #1
ROM:48E8                 cmp     r12, #5
ROM:48EA                 jmpr    cc_C, loc_48AC
ROM:48EC                 ret
ROM:48EC ; End of function sub_48AA
ROM:48EC
ROM:48EE
ROM:48EE ; =============== S U B R O U T I N E =======================================
ROM:48EE
ROM:48EE
ROM:48EE sub_48EE:                               ; CODE XREF: ROM:434EP
ROM:48EE                                         ; ROM:43DCP ...
ROM:48EE                 push    r5
ROM:48F0                 push    r4
ROM:48F2                 rets
ROM:48F2 ; End of function sub_48EE
ROM:48F2
ROM:48F4
ROM:48F4 ; =============== S U B R O U T I N E =======================================
ROM:48F4
ROM:48F4
ROM:48F4 sub_48F4:                               ; CODE XREF: sub_46DA+3AP
ROM:48F4                                         ; sub_4738+26P
ROM:48F4                 exts    r5, #1
ROM:48F6                 mov     r10, [r4]
ROM:48F8                 add     r4, #2
ROM:48FA                 addc    r5, #0
ROM:48FC                 exts    r5, #1
ROM:48FE                 mov     r11, [r4]
ROM:4900                 rets
ROM:4900 ; End of function sub_48F4

I'd love to see the IDB for that checksum bit out of pure curiosity, might also be able to get you a non code patch, there might be  different checksum for code block for example.
Logged


How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
DT
Full Member
***

Karma: +20/-1
Offline Offline

Posts: 184
« Reply #348 on: February 10, 2016, 11:13:42 AM »
Quote from: dream3R on February 06, 2016, 04:07:08 PM
I'd love to see the IDB for that checksum bit out of pure curiosity, might also be able to get you a non code patch, there might be  different checksum for code block for example.
I'll pm you something to look at.
I guess these more thorough checks that I posted might only run when flashing over obd without boot mode. I've not checked yet myself.
To be able to flash over obd without boot mode we need a haldexchksum.exe and I was hoping that someone with eyes for chksum code easily could see what is needed to correct a flash.bin
Logged
Try ME7idatool http://nefariousmotorsports.com/forum/index.php?topic=21130.0
dream3R
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 1194
« Reply #349 on: February 10, 2016, 11:36:33 AM »
Quote from: DT on February 10, 2016, 11:13:42 AM
I'll pm you something to look at.
I guess these more thorough checks that I posted might only run when flashing over obd without boot mode. I've not checked yet myself.
To be able to flash over obd without boot mode we need a haldexchksum.exe and I was hoping that someone with eyes for chksum code easily could see what is needed to correct a flash.bin

Cool tell me IDB version too lol.
Logged


How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
john9357
Full Member
***

Karma: +10/-1
Offline Offline

Posts: 54
« Reply #350 on: March 01, 2016, 12:34:18 AM »
All picture in Filedropper are down  Cry
Logged
dream3R
Hero Member
*****

Karma: +18/-8
Offline Offline

Posts: 1194
« Reply #351 on: March 13, 2016, 06:40:21 PM »
I loaded a Volvo VBF into EVC and it obvious the maps section.

Anyway, IDB I'm legit so can't help hacked ones sorry.
.
Logged


How to work out values from an A2L Smiley

http://nefariousmotorsports.com/forum/index.php?topic=5525.msg52371#msg52371


Starting Rev's http://nefariousmotorsports.com/forum/index.php?topic=5397.msg51169#msg51169

noobs read this before asking http://nefariousmotorsports.com/forum/index.php?topic=9014.0title=


ORGORIGINAL 05 5120 creator for Volvo
ORIGINAL Datalogger (Freeware) Author
ORGINAL finder of the 'extra' torque' limits
I don't have ME7.01 A2L I just use ID
edgy
Full Member
***

Karma: +2/-0
Offline Offline

Posts: 66
« Reply #352 on: August 08, 2016, 06:06:50 PM »
End of October, 2016, all we have to do is ask Haldex AB for the magic word to access the controller... I have a feeling they may bounce the responsibility back and forth between themselves and VAG, but we'll have full access in short order.
Logged
2002 S4 full stg 3
2001 S4 stg 2
2001 TT 225 stg 2
1988 80q 4.2
2005 A4 (the wife's)
DT
Full Member
***

Karma: +20/-1
Offline Offline

Posts: 184
« Reply #353 on: August 09, 2016, 12:12:41 AM »
Quote from: edgy on August 08, 2016, 06:06:50 PM
End of October, 2016, all we have to do is ask Haldex AB for the magic word to access the controller... I have a feeling they may bounce the responsibility back and forth between themselves and VAG, but we'll have full access in short order.
?

My work has been on hold since February.
Logged
Try ME7idatool http://nefariousmotorsports.com/forum/index.php?topic=21130.0
gman86
Hero Member
*****

Karma: +45/-128
Offline Offline

Posts: 705
« Reply #354 on: August 09, 2016, 02:53:05 AM »
Quote from: edgy on August 08, 2016, 06:06:50 PM
End of October, 2016, all we have to do is ask Haldex AB for the magic word to access the controller... I have a feeling they may bounce the responsibility back and forth between themselves and VAG, but we'll have full access in short order.

 Huh Huh
Logged
fknbrkn
Hero Member
*****

Karma: +185/-23
Offline Offline

Posts: 1454


mk4 1.8T AUM
« Reply #355 on: August 09, 2016, 05:41:42 AM »
http://corporate.haldex.com/en/media/press-releases/2016/statement-by-the-board-of-directors-of-haldex-in-relation-to-the-public-cash-offer-by-zf
Logged
gman86
Hero Member
*****

Karma: +45/-128
Offline Offline

Posts: 705
« Reply #356 on: August 09, 2016, 06:16:36 AM »
Quote from: fukenbroken on August 09, 2016, 05:41:42 AM
http://corporate.haldex.com/en/media/press-releases/2016/statement-by-the-board-of-directors-of-haldex-in-relation-to-the-public-cash-offer-by-zf



So ZF are buying Haldex. How does that mean there will be access to the controllers?
Logged
fknbrkn
Hero Member
*****

Karma: +185/-23
Offline Offline

Posts: 1454


mk4 1.8T AUM
« Reply #357 on: August 09, 2016, 09:36:38 AM »
Quote from: gman86 on August 09, 2016, 06:16:36 AM
So ZF are buying Haldex. How does that mean there will be access to the controllers?
good question for edgy
idk
Logged
markpowell35
Jr. Member
**

Karma: +4/-1
Offline Offline

Posts: 34
« Reply #358 on: August 10, 2016, 02:35:36 AM »
Hi guys i found this pdf online, it goes into some detail about the hardware & software in the Haldex ECU it maybe useless i'm not sure.

Also is there a working method to do this off the car, i'm not too fussed about doing it over OBD at the moment, if there is would someone kindly post a how to (alot of the pics in this thread are missing now - connection info etc)

Many Thanks Smiley
Logged
k0mpresd
Hero Member
*****

Karma: +146/-54
Offline Offline

Posts: 1655
« Reply #359 on: August 12, 2016, 10:50:59 AM »
 Smiley

Quote
*Loader file Prepare
*Minimon file Prepare
*send Byte  0+ Loader + MinimonCore
*RECEIVE - MC-Identifier: C5
*RECEIVE - LoaderACK 01 received
*RECEIVE - Minimon ACK 03 received
*Minimon successfully launched
*Reset: BUSCON0=0680
*Reset: SYSCON=0410
*Reset Configuration: External Bus enabled
*Reset Configuration: 16 Bit demultiplexed Bus
*Reset Configuration: WR# and BHE# retain their normal function (P0H.0=0)
*Reset Configuration: On chip watchdog timer is enabled (RD#=1)
*Reset Configuration: Lengthened ALE signal
*Initialisation: Write to SYSCON
*Initialisation: Write to BUSCON0
*Initialisation: Write to BUSCON1
*Initialisation: Write to ADDRSEL1
*Initialisation: Write to BUSCON2
*Initialisation: Write to ADDRSEL2
*Initialisation: Write to BUSCON3
*Initialisation: Write to ADDRSEL3
*Initialisation: Write to BUSCON4
*Initialisation: Write to ADDRSEL4
*Initialisation: Enable X-Peripherals via SYSCON
Logged
Pages: 1 ... 22 23 [24] 25 26 ... 29
  Print  
« previous next »
 
Jump to:  

Navigation
Personal Tools
  • November 22, 2024, 07:21:47 PM
  • Welcome, Guest. Please login or register.
    Did you miss your activation email?

    Login with username, password and session length
Search
 
Advanced Search
About Disclaimer
All Rights Reserved 2010 Nefarious Motosports
Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.03 seconds with 17 queries. (Pretty URLs adds 0.001s, 0q)