So.. ive been testing a "wotbox" for a few days, and this thing is awesome..

..and so i came across a thread here where i found ppl have been able to implement these 2 functions into the me7.x.. now i find this REALLY interesting and i would love to learn how to do this, and also i would like to modify the function a bit to suite my needs for this car.

Im working on this me 7.5, 06A906032HN box, original bin attached.

now my knowledge in assembler is very rusty, but higher levels i have a better understanding of, so i went thru the routine that zetzi wrote, v2, and his pseudo code for this one, and that is pretty much what i want to accomplish.. except for a few minor tweaks.

i understand patching asm isnt really an easy task, and so ive been gathering info.


ive located unused space to place the new data for setting the conditions of this new function, the new variables added in setzis pseudo code, and placed them starting at 0x17E00:

SpeedThreshold: 0x17E00
LaunchRPM: 0x17E02
IgnitionCutDuration: 0x17E04
RPMThreshold: 0x17E06
AccPedalThreshold: 0x17E08


FTOMN is located at: 0x1A43D

then ive tried to locate the adresses of the RAM variables needed, and came up with this after some basic research:

tsrldyn: 0x380BB7
B_kuppl: 0x00FD4E
vfil_w: 0x381C0C
nmot_w: 0x00F89E
wped: 0x3809B1
B_brems: - i cannot find this one atm, any help would be appreciated.


now the next step would be to dissassemble the image.. and ive been using IDA Pro.. using the siemens c166 family cpus, and more specific the c167, trying to dissasemble this into something understandable where i could fetch the adresses of needed variables, and where to link-in and put the code..

i have used an oem bin for reference and then one with launch control/NLS implemented.


skipping ahead to the new function.. i would eventually like to place it somewhere around A9C00, as this space seems to be free to use, from my limited understanding, as i cannot find any cross references to this area, pls correct me if im wrong.

it will take some tinkering to write the actual function in asm, and to assemble it with a c167 assembler, that im sure of..
(ive read setzis thread about code patching, and how to figure out where to place local variables etc.. many thanks for this info!)

any help in this will be greatly appreciated, this custom code-patching really opens up the potential of the me 7.x.  

I would love to help, but I am still lost in adding code. I'll read some more and see if I can provide any help.

This is the assembler I have used in the past: Keil uVision http://www.keil.com/uvision/ The free version limits the size of the file you can assemble, but you only need to assemble one function to make your change.

User setzi62 made the ME7Logger tool which can generate the variable RAM locations for you from your bin file.

I read this thread now but can not help cause i am confused a bit while reading the disassembled code.
Although i am familiar with C i still cant figure a way to implement the routine for those functions.
Its a matter of time 

You should contact user setzi62 and sweet talk him into getting involved in this forum thread.

Personally I would just try to take the block of compiled code that was already written by setzi, and then paste it into your file. Then just manually replace the different instructions referencing memory addresses.

Also, if you write your assembly code only using relative jumps, then the code should be safe to locate anywhere.

It's not correct.
There are both flags present.
b_brems is at 0x00FD4E.C - "brake pedal pressed"
And b_br is used for brake switch checking - "brake test pressed"

update: loads of more tinkering.. and a strange binary produced.. in some strange way.. got the code.. patched it.. and now the NoLiftShift works 100%, it literally shifts like butter.. success! 

But the launch still wont work.. and im beginning to question an adress in my code, or rather the format of the function fetching it..
in the 0x380xxx range the values are easily fetched using word_8xxx.. just cutting out the 0..
but the vfil_w value is located in the 0x381xxx range, so.. what would that fetch be? still word_8xxx? or word 1xxx?
im assuming this is the part where i screwed up.. the call to the new function works great, and all other params seem to work great, the dwelltime and all rpm functions included in the NLS..

..but this vfil_w is trouble.. anyone know what the correct "word_" fetch would be for an 0x381xxx adress?

im getting dizzy from looking at this asm code 24/7.. now i want to get this launch working! 

Simple.
380000 ... 383FFF are remaped as 8000...BFFF