Also does anyone know where I can locate FTOMN on a AG ecu?

Just a Edit, I found 1 typing errors in my code which I have corrected. Going to test the new bin and see if LC works !

Edit again, Could FTOMN be located at 01A2D0 byte 12?

Thanks Littco, that is noted. So my Speedthreshold should be set alot lower instead of higher, I thought it limited the speed that NLS would be active to its target, so anything under "300" it would still be active.

Do you perhaps know if I could be right with FTOMN?

Thank you so much for the response Littco. Much Appriciated.

Still alot of learning to do on HEX  .

So keen to test now, will post result in the morning. 

  Alright, got My LC working.


Faults I have made so far, didnt tick LSB in my XDF on the created addresses, rescanned my code and I have a question. I used the ME7.XX PDF and professors updated PDF for his 032KP.

Now my question is does Line 3 have to have B_br swapp with B_Kuppl as in Snook's pdf Quote below or should my line be the same as Professors PDF and have B_br and B_Kuppl?

40 49 FD 03 F7 8E AC 8D 0D 2F 9A 2B 29 80 8A 2B

"Line 3, first we have the tsrldyn located at bits 6-7, as "AC 8D",which reversed is 8DAC as in 0x380DAC, switch this for your own. remember those "jnb"(9A) and "jb"(8A)functions i mentioned we would run into earlier, well here we have them. you recognize the value after 9A? yes, that is the value you calculated earlier, and the same B_kuppl,swap it for the same adress as you did earlier.. and remember to also correct the bitmask like earlier which is stored in that 80. now wait, there is an 8A here.. followed by another 2B.. this is the B_brems you are seeing, and as it is located in the same registry, swap this adress to the same as B_kuppl, BUT remember to enter the correct bitmask!(see Line 4)"

Professor's PDF




This is my Coding so far.

tsrldyn         0x380B96    0b96 -> 8B96 -> 96 8B
B_kuppl         0x00FD4C.3  0X0008 -> 30 4C -> 26
vfil_w      0x381BC8    1BC8 -> 9BC8 -> C8 9B
nmot_w      0x00F89C    F89C -> 9C F8
wped      0x38099C    099C -> 899C -> 9C 89
B_brems      0x00FD4A.15 0X8000 -> 15:F0 4a - 25
counter_NoLiftShift:    0x383A0A A0 3A


Function Parameters:
-------------------
SpeedThreshold:      0x17EC0 size 2, 16bit LSB
LaunchRPM:       0x17EC2 size 2, 16bit LSB
IgnitionCutDuration:   0x17EC4 size 2, 16bit LSB
RPMThreshold:       0x17EC6 size 2, 16bit LSB
AccPedalThreshold:    0x17EC8 size 1, 8bit LSB

Revised Function:
----------------
9A 26 13 30 F2 F4 C8 9B D7 00 81 00 F2 F9 C0 7E
40 49 9D 0B F2 F4 9C F8 D7 00 81 00 F2 F9 C2 7E
40 49 FD 03 F7 8E 96 8B 0D 2F 9A 26 29 30 8A 26
22 F0 F2 F4 9C F8 D7 00 81 00 F2 F9 C6 7E 40 49
FD 1A C2 F4 9C 89 D7 00 81 00 C2 F9 C8 7E 40 49
FD 12 D7 00 38 00 F2 F4 A0 3A D7 00 81 00 F2 F9
C4 7E 40 49 9D 11 F7 8E 96 8B 08 41 D7 00 38 00
F7 F8 A0 3A 0D 09 D7 00 38 00 F6 8F F0 4F 0D 04
D7 00 38 00 F6 8E A0 3A F3 F8 90 89 DB 00 FF FF

My Call 8A 00 9C

Function: 0xA9C00

From my previous code or from the PDF's 0x384FF0?

I cant find a 0x384FF0 in my .ecu file, and I just redid the entire coding for a fresh start.

From what I understand in the PDF one can substitute the 0x384FF0 for any clean address found in the .ecu file?

B_br is NOT to be used at all, its B_brems you should be using, which usually is located in the same registry as B_kuppl.

you have them listed in different registrys as in:


looking at your code, you still use the FD4C.15 adress in line 3 to reference B_brems.. but im thinking this is your B_br found in .ecu file.. right?


the NLS-counter can be placed at any FREE adress, just make sure it is just that, free.
if you could find the adress in your .ecu where you placed the counter, then it isnt free, 384FF0 usually is.

yes, you missunderstood that.. B_br is used in a brake-test, and B_brems is the actual pedal-switch for the brake.

iv found the B_brems to often be located -2 in the bitregistry where the B_kuppl is.. that is, if the kuppl is at FD4C.E, then B_brems would often be located at FD4C.C

but that is not allways the case, need to dissassemble and have a look at the code to be sure.


i will write a revised function with better functionality and release here when i have the time to spare.. might also include a function-writer where you simply enter your values and it spits out the complete function.


sorry if the PDF is a bit dim, it was my first attempt at dissassembling these ecus, assembler and altering instructions.. ive advanced quite a bit in these fields since then.. just wish i had the time to really dig into the code..