janne
Full Member
Karma: +2/-0
 Offline
Posts: 50
|
 |
« Reply #255 on: November 29, 2014, 05:54:35 AM »
|
|
|
Hi.
I use that script what does this function.
But I think it does something wrong?
My inj code is not long enought right?
I have read.read.read , but I really cant understand those adress things.
Can someone push me into right direction.
Thanks
|
|
|
|
|
Logged
|
|
|
|
KmosK04
Full Member
Karma: +5/-10
Offline
Posts: 97
|
|
« Reply #256 on: November 29, 2014, 07:14:25 AM »
|
|
|
I didn't see your file but those are the steps that I follow:
1. Make an .ecu file from your bin with me7logger
2. Find empty spaces in your bin to put the variables and the code
3. Write down the adresses
4. Put in one folder the script, ecu file and bin.
5. Launch the script from cmd
6. Type launch.exe YOURFILE.bin YOURFILE.ecu 0xCODE ADRESS 0xVARIABLES ADRESS
|
|
|
|
|
Logged
|
|
|
|
pOwy
Full Member
Karma: +0/-0
Offline
Posts: 52
|
|
« Reply #257 on: October 01, 2016, 04:58:32 AM »
|
|
|
hello!
i'm trying to implement the launch control and nls. I have the pdf from the forum and i think i understand. BUT:) in the first line bit 3 is the bit mask of what? i dont get it, because my b_brems is fd4a.3 and b_kuppl is fd4a.7, fd4a=25 but which bit mask i need in line 1 bit 3? from brems? or kuppl?
i checked many files what posted the others but i cant find it out:D
thanks for help
|
|
|
|
|
Logged
|
|
|
|
|
KasperH
|
|
« Reply #258 on: December 09, 2016, 04:16:27 PM »
|
|
|
i've tried to implement this and last time i got a permanent DTC  can anybody tell me if there is a mistake, cause i cant seem to see it myself? ECU is 06A906032HN V002
Addresses:
tsrldyn: 0x380BB7 0x0000
b_kuppl: 0x00FD4E.14 0x4000
vfil_w: 0x381C0C 0x0000
nmot_w: 0x00F89E 0x0000
wped: 0x3809B1 0x0000
b_brems: 0x00FD4C.12 0x1000
counter: 0x384FF0
SpeedThreshold: 0x17EC0
LaunchRPM: 0x17EC2
IgnitionCutDuration: 0x17EC4
RPMThreshold: 0x17EC6
AccPedalThreshold: 0x17EC8
FTOMN: 0x01A43D
Main Function: 0x0B3000
Call Address: F3 F8 9D 89 -> DA 8B 00 30 [0x0A6062]
9A 27 13 E0 F2 F4 0C 9C D7 00 81 00 F2 F9 C0 7E
40 49 9D 0B F2 F4 9E F8 D7 00 81 00 F2 F9 C2 7E
40 49 FD 03 F7 8E B7 8B 0D 2F 9A 27 29 E0 8A 27
22 C0 F2 F4 9E F8 D7 00 81 00 F2 F9 C6 7E 40 49
FD 1A C2 F4 B1 89 D7 00 81 00 C2 F9 C8 7E 40 49
FD 12 D7 00 38 00 F2 F4 F0 4F D7 00 81 00 F2 F9
C4 7E 40 49 9D 11 F7 8E B7 8B 08 41 D7 00 38 00
F7 F8 F0 4F 0D 09 D7 00 38 00 F6 8F F0 4F 0D 04
D7 00 38 00 F6 8E F0 4F F3 F8 9D 89 DB 00 FF FF
Thanks in advance |
|
|
|
|
Logged
|
|
|
|
|
KasperH
|
|
« Reply #259 on: January 04, 2017, 04:44:59 AM »
|
|
|
I think i found the error, the NLS counter was smack dab in the middle of some used ram adresses, i have now moved it to empty ram space. im going to try and flash this and see if it works, unless anyone has noticed any other errors? Addresses:
tsrldyn: 0x380BB7
b_kuppl: 0x00FD4E.14 0x4000
vfil_w: 0x381C0C
nmot_w: 0x00F89E
wped: 0x3809B1
b_brems: 0x00FD4C.12 0x1000
counter: 0x388100
SpeedThreshold: 0x17EC0
LaunchRPM: 0x17EC2
IgnitionCutDuration: 0x17EC4
RPMThreshold: 0x17EC6
AccPedalThreshold: 0x17EC8
FTOMN: 0x01A43D
Main Function: 0x0B3000
Call Address: F3 F8 9D 89 -> DA 8B 00 30 [0x0A6062]
9A 27 13 E0 F2 F4 0C 9C D7 00 81 00 F2 F9 C0 7E
40 49 9D 0B F2 F4 9E F8 D7 00 81 00 F2 F9 C2 7E
40 49 FD 03 F7 8E B7 8B 0D 2F 9A 27 29 E0 8A 27
22 C0 F2 F4 9E F8 D7 00 81 00 F2 F9 C6 7E 40 49
FD 1A C2 F4 B1 89 D7 00 81 00 C2 F9 C8 7E 40 49
FD 12 D7 00 38 00 F2 F4 00 81 D7 00 81 00 F2 F9
C4 7E 40 49 9D 11 F7 8E B7 8B 08 41 D7 00 38 00
F7 F8 00 81 0D 09 D7 00 38 00 F6 8F 00 81 0D 04
D7 00 38 00 F6 8E 00 81 F3 F8 9D 89 DB 00 FF FF
|
|
|
|
|
Logged
|
|
|
|
|
KasperH
|
|
« Reply #260 on: January 06, 2017, 05:15:39 AM »
|
|
|
So this thread is officially dead?
|
|
|
|
|
Logged
|
|
|
|
Khendal
Full Member
Karma: +9/-8
Offline
Posts: 226
|
|
« Reply #261 on: January 07, 2017, 03:46:51 PM »
|
|
|
So this thread is officially dead?
Mhhh... i hope not. All of these threads are old... and it's not easy to follow and understand what to do now...which is the right way for nls, lc .. in 2017  |
|
|
|
|
Logged
|
|
|
|
TijnCU
Hero Member
Karma: +60/-4
Offline
Posts: 690
flying brick
|
|
« Reply #262 on: January 08, 2017, 08:03:36 AM »
|
|
|
Study this disassembled code, I have written exactly how the function works in the comments behind. Disclaimer: this is the Philadot Mbox code, so all adresses below are ONLY for that ecu and need to be replaced with your own. But it can help you understand what you are writing. LC:
seg018:E800 jnb word_FD56.8, loc_8E82A ;if b_kuppl is not set, jump to NLS
seg018:E804 mov r4, word_8E40 ;move vfil_w to r4
seg018:E808 exts #81h, #1
seg018:E80C mov r9, 7E00h ;move speed_threshold to r9
seg018:E810 cmp r4, r9 ;compare r4 to r9
seg018:E812 jmpr cc_NC, loc_8E82A ;jump to NLS if vfil_w is larger than speed_threshold
seg018:E814 mov r4, word_F87A ;move nmot_w to r4
seg018:E818 exts #81h, #1
seg018:E81C mov r9, 7E02h ;move launch rpm to r9
seg018:E820 cmp r4, r9 ;compare r4 to r9
seg018:E822 jmpr cc_ULE, loc_8E82A ;jump to EXIT if rpm is less or equal to launch_rpm
seg018:E824 movb byte_8DAC, ZEROS ;zeros tsrldyn (interrupt spark)
seg018:E828 jmpr cc_UC, loc_8E888 ;jump to EXIT unconditionally
NLS:
seg018:E82A loc_8E82A:
seg018:E82A
seg018:E82A jnb word_FD56.8, loc_8E880 ;if b_kuppl is not set, jump to UNSET RAMCOUNTER
seg018:E82E jb word_FD56.6, loc_8E876 ;if b_br is set, jump to SET RAMCOUNTER
seg018:E832 mov r4, word_F87A ;move nmot_w to r4
seg018:E836 exts #81h, #1
seg018:E83A mov r9, 7E06h ;move rmp threshold to r9
seg018:E83E cmp r4, r9 ;compare r4 to r9
seg018:E840 jmpr cc_ULE, loc_8E876 ;jump to SET RAMCOUNTER if rpm is less or equal to rpm_threshold
seg018:E842 movbz r4, byte_8B02 ;move wped to r4
seg018:E846 exts #81h, #1
seg018:E84A movbz r9, 7E08h ;move pedal_threshold to r9
seg018:E84E cmp r4, r9 ;compare r4 to r9
seg018:E850 jmpr cc_ULE, loc_8E876 ;jump to SET RAMCOUNTER if wped is less or equal to pedal_threshold
seg018:E852 exts #38h, #1
seg018:E856 mov r4, 4FF0h ;move ramcounter to r4
seg018:E85A exts #81h, #1
seg018:E85E mov r9, 7E04h ;move cut_duration to r9
seg018:E862 cmp r4, r9 ;compare r4 to r9
seg018:E864 jmpr cc_NC, loc_8E888 ;jump to EXIT if no carry (ramcounter value is larger than cut_duration)
seg018:E866 movb byte_8DAC, ZEROS ;zeros tsrldyn
seg018:E86A add r4, #1 ;add 1 to r4 (increments ramcounter value with 1)
seg018:E86C exts #38h, #1
seg018:E870 movb 4FF0h, rl4 ;move rl4 to ramcounter
seg018:E874 jmpr cc_UC, loc_8E888 ;jump to EXIT unconditionally
SET RAMCOUNTER:
seg018:E876 loc_8E876:
seg018:E876
seg018:E876 exts #38h, #1
seg018:E87A mov 4FF0h, ONES ;Ones in ramcounter 384FF0h (FFFF hex or 65535 dec)
seg018:E87E jmpr cc_UC, loc_8E888
UNSET RAMCOUNTER:
seg018:E880 loc_8E880:
seg018:E880 exts #38h, #1
seg018:E884 mov 4FF0h, ZEROS ;Zeros in ramcounter 384FF0h (0000 hex or 0 dec)
EXIT:
seg018:E888 loc_8E888:
seg018:E888
seg018:E888 movb rl4, byte_8AF3 ;restore original code that was replaced with call
seg018:E88C rets ;jump back to call adress
seg018:E88C ; -------------------------------------------------------------------------- |
|
|
|
« Last Edit: January 08, 2017, 08:25:21 AM by TijnCU »
|
Logged
|
|
|
|
|
KasperH
|
|
« Reply #263 on: January 21, 2017, 07:55:25 AM »
|
|
|
Got it working now, and it's glorious  Going to upload a video soon |
|
|
|
|
Logged
|
|
|
|
|
KasperH
|
|
« Reply #264 on: January 22, 2017, 11:54:39 AM »
|
|
|
And it just threw a permanent DTC regarding memory checksum error  Nothing seems out of place in the code and it has worked flawless in multiple drives  Anybody else experienced the problem? |
|
|
|
|
Logged
|
|
|
|
TijnCU
Hero Member
Karma: +60/-4
Offline
Posts: 690
flying brick
|
|
« Reply #265 on: January 22, 2017, 12:12:13 PM »
|
|
|
RSA checksum error maybe, check eeprom. Try another ram adress, for example 382ff0. (check if this adress holds 0 in me7logger) or disassemble file and verify xrefs to ram.
|
|
|
|
|
Logged
|
|
|
|
|
KasperH
|
|
« Reply #266 on: January 25, 2017, 05:36:24 PM »
|
|
|
RSA checksum error maybe, check eeprom. Try another ram adress, for example 382ff0. (check if this adress holds 0 in me7logger) or disassemble file and verify xrefs to ram.
i'll try and log 384ff0 and 382ff0 tomorrow and see if anything shows up during a drive to work |
|
|
|
|
Logged
|
|
|
|
Kacza
Full Member
Karma: +20/-7
Offline
Posts: 216
|
|
« Reply #267 on: January 26, 2017, 06:33:13 AM »
|
|
|
LC+AL works. Thanks. Good joob.  |
|
|
|
« Last Edit: January 30, 2017, 02:20:12 PM by Kacza »
|
Logged
|
|
|
|
|
armageddon
|
|
« Reply #268 on: February 22, 2017, 03:28:44 AM »
|
|
|
Hi all,
As asking doesn't hurt.....
Did anyone add other conditions to the function?
I'm trying to disable knock recognition during nls using b_kr
b_kr is at FD8A.8.
What I did was just add right after trsldyn "movb byte_FD8A, ZEROS" in hex F7 8E 8A FD just to test if the function will still work.
The function works as before, so maybe I'm not complitly wrong, but I need to get the right convertion for b_kr address to test if this wil work.
Any help/coment would be grateful
|
|
|
|
|
Logged
|
|
|
|
TijnCU
Hero Member
Karma: +60/-4
Offline
Posts: 690
flying brick
|
|
« Reply #269 on: February 22, 2017, 04:59:42 AM »
|
|
|
hey, that does not work, you should remove that code from the function because 1) It is not the right way to disable a bit (you are treating it as a byte) and 2) the bit adress is not correctly adressed. You are actually zero-ing something else.
Besides the coding mistake, it is not as simple to disable kr by unsetting b_kr in this routine, you need to make a new function that jumps from a few kr code points and keep me7 from entering kr mode.
|
|
|
|
|
Logged
|
|
|
|
|
