NefMoto > Technical > Reverse Engineering > Disable KR during NLS/LC
Pages: [1]
« previous next »
Author Topic: Disable KR during NLS/LC  (Read 6541 times)
noice
Newbie
*

Karma: +16/-3
Offline Offline

Posts: 23
« on: May 02, 2018, 11:12:55 AM »
Hello folks, first post on this awesome forum to ask a question and, if my work is on the right direction, give a small contribution to the community.

So, I am trying to disable Knock Recognition when NLS/LC is active. I am doing this by forcing B_kr=0 if the NLS/LC routine is active. In my file B_kr is at FD72.

I have implemented an extra step on the NLS/LC routine that is available here on the forum that sets FDE8.3 if the routine is activate and clears it if it’s inactive. That was the easy part.

Next, I disassembled my binary and found where B_kr is set/cleared. (I think) I found the routine and B_kr is set at 873E14. At this point, I changed the bset and the subsequent jmpr (its an unconditional (cc_UC) jump) to a jmps pointing to an empty space in my file (8A1A00). I have attached two screenshots, one of the original file and one of the modified one.

At this addresses I have these instructions:

jb FDE8.3, 8A1A0A
bset FD72.3
jmps 873E1A
jmps 873E18

What I am willing to do is: check if FDE8.3 is set, if so,the routine will return to the address 873E18 and will continue with the normal execution (It will clear B_kr with the bclear from the original routine). If it is clear, it will set B_kr and return to the address 873E1A.

The big question: Is this going to work? If not, am I at least at the right direction?

I have found another instruction that sets B_kr at address 874AE4, but I didn’t had time to see what this routine is doing before this.

The car is a 2001 S3 8L 1.8T with AMK engine and 8N0906018AH ECU. I have attached my original bin.

English is not my primary language, so excuse any mistakes  Grin
« Last Edit: May 02, 2018, 11:15:02 AM by henrique.filho » Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12233


WWW
« Reply #1 on: May 02, 2018, 11:31:22 AM »
I haven't looked too closely, but in the FR it seems that B_kr can only be cleared by a single thing (it comes out of that big "&" in BBKR)

B_tmkr, LKRN/LKRAGRN/KRLAH/B_krldy, B_stend, NRKF ALL have to be true, so setting any one of those 0 should result in B_kr zero.

I don't know why you are seeing two paths to SETTING B_kr, because of the &
Logged
ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
noice
Newbie
*

Karma: +16/-3
Offline Offline

Posts: 23
« Reply #2 on: May 02, 2018, 11:45:39 AM »
Quote from: nyet on May 02, 2018, 11:31:22 AM
I haven't looked too closely, but in the FR it seems that B_kr can only be cleared by a single thing (it comes out of that big "&" in BBKR)

There is only one bclear for B_kr in the bin, so that’s correct.

Quote from: nyet on May 02, 2018, 11:31:22 AM
B_tmkr, LKRN/LKRAGRN/KRLAH/B_krldy, B_stend, NRKF ALL have to be true, so setting any one of those 0 should result in B_kr zero.

I am hacking the original routine at the last step, after all of the other checks have been done. I choose this method because it is easier to implement, at least for me.

Quote from: nyet on May 02, 2018, 11:31:22 AM
I don't know why you are seeing two paths to SETTING B_kr, because of the &

There is 2 bset to B_kr on my file, I will post a screenshot of the second location.




Sent from my iPhone using Tapatalk
Logged
woj
Hero Member
*****

Karma: +41/-3
Offline Offline

Posts: 500
« Reply #3 on: May 02, 2018, 12:34:53 PM »
(On a different ME7 ECU, so might not be applicable to your case at all). I solved it at the entry to the cascade of checks rather than at the end. One of the first checks is against CWKR, there I made it NLS flag dependent. Original code:

Code:
movb rl1, CWKR

Replaced it with a call to a function put in empty space:

Code:
calls modify_cwkr

At empty space:

Code:
modify_cwkr:
        movb    rl1, CWKR
        movb    rh1, nls_flag
        jmpr    cc_Z, cwkr_stock
        bclr    r1.0
cwkr_stock:
        rets

Works a treat, or so I am told, I was not the one that tested it.
Logged
nyet
Administrator
Hero Member
*****

Karma: +604/-166
Offline Offline

Posts: 12233


WWW
« Reply #4 on: May 02, 2018, 12:37:15 PM »
Quote from: woj on May 02, 2018, 12:34:53 PM
One of the first checks is against CWKR, there I made it NLS flag dependent.

yes, I think making it flag dependent is a better guarantee that the change is safe
Logged
ME7.1 tuning guide (READ FIRST)
ECUx Plot
ME7Sum checksum checker/corrrector for ME7.x

Please do not ask me for tunes. I'm here to help people make their own.

Do not PM me technical questions! Please, ask all questions on the forums! Doing so will ensure the next person with the same issue gets the opportunity to learn from your experience.
prj
Hero Member
*****

Karma: +915/-426
Offline Offline

Posts: 5835
« Reply #5 on: May 04, 2018, 04:14:23 AM »
The second set is for dynamic KR, you don't need to care about that, because that's only when you're making sharp throttle movements, and you're not in this case.
It's enough to patch only the routine.

I do it like this:
1. Create ram var lc_on, if lc or nls active - set to 1, else set to 0 in main routine
2. overwrite kr set with a call or jump. If lc_on then clear, else set.
Logged
PM's will not be answered, so don't even try.
Log your car properly.
gt-innovation
Sr. Member
****

Karma: +60/-89
Offline Offline

Posts: 443
« Reply #6 on: May 04, 2018, 05:21:26 AM »
+ 1 Exactly what i do on me7

and works perfectly.
Logged
armageddon
Sr. Member
****

Karma: +20/-3
Offline Offline

Posts: 348
« Reply #7 on: May 04, 2018, 02:02:17 PM »
wasn't this helpfull?? http://nefariousmotorsports.com/forum/index.php?topic=12583.15 
Logged
noice
Newbie
*

Karma: +16/-3
Offline Offline

Posts: 23
« Reply #8 on: May 07, 2018, 06:27:41 AM »
Quote from: prj on May 04, 2018, 04:14:23 AM
The second set is for dynamic KR, you don't need to care about that, because that's only when you're making sharp throttle movements, and you're not in this case.
It's enough to patch only the routine.

I do it like this:
1. Create ram var lc_on, if lc or nls active - set to 1, else set to 0 in main routine
2. overwrite kr set with a call or jump. If lc_on then clear, else set.

Nice, prj. That is exactly what I am doing!

Quote from: nyet on May 02, 2018, 12:37:15 PM
yes, I think making it flag dependent is a better guarantee that the change is safe

I don´t see the difference on changing CWKR or changing B-kr directly. Can you elaborate more?

Quote from: woj on May 02, 2018, 12:34:53 PM
(On a different ME7 ECU, so might not be applicable to your case at all). I solved it at the entry to the cascade of checks rather than at the end. One of the first checks is against CWKR, there I made it NLS flag dependent. Original code:

Code:
movb rl1, CWKR

Replaced it with a call to a function put in empty space:

Code:
calls modify_cwkr

At empty space:

Code:
modify_cwkr:
        movb    rl1, CWKR
        movb    rh1, nls_flag
        jmpr    cc_Z, cwkr_stock
        bclr    r1.0
cwkr_stock:
        rets

Works a treat, or so I am told, I was not the one that tested it.

Thanks for sharing your work, man.

Quote from: gt-innovation on May 04, 2018, 05:21:26 AM
+ 1 Exactly what i do on me7

and works perfectly.

Great!

Thanks everyone for the feedback!
« Last Edit: May 07, 2018, 06:45:39 AM by henrique.filho » Logged
Bische
Sr. Member
****

Karma: +25/-4
Offline Offline

Posts: 397



WWW
« Reply #9 on: May 13, 2018, 02:46:51 PM »
In my own LC/NLS routine, I just made a few jumps in regards of TMKR lookup & has it FF'ed when LC/NLS is active Smiley
Logged
Pages: [1]
  Print  
« previous next »
 
Jump to:  

Navigation
Personal Tools
  • April 18, 2024, 10:50:30 PM
  • Welcome, Guest. Please login or register.
    Did you miss your activation email?

    Login with username, password and session length
Search
 
Advanced Search
About Disclaimer
All Rights Reserved 2010 Nefarious Motosports
Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.036 seconds with 17 queries. (Pretty URLs adds 0s, 0q)