Pages: 1 ... 9 10 [11] 12
Author Topic: Multi map selection using cruz control  (Read 150340 times)
TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #150 on: December 08, 2016, 11:57:42 AM »

Has anybody tried to implement/configure boost limit depending of a gear? For example substitute different LDRXN [1..4] profiles depending of a gear calculated using vehicle speed & RPM? Multimap selection might be a good basis for this new function. Or there is another way to implement this?
I have been working on this function for my own ecu today, and I substituted the new ldrxn code for KFMDBRGR (torque limit by gear and rpm). You can find it in Ida if you search for the adress of the axis size data. For now, I would be happy with just this limiter. Ultimately I want to switch my exhaust valve too, but I am still figuring out how to take final control of a 12v output (fan control/rear o2 heater/sai pump outputs are the options I am considering. rear o2 seems to be the smallest function to alter but still....)

The ecu boots fine, however I have not been able to test if the function works properly. I have no mil light in my dash, I tried to read b_mil over me7logger but it stays at 0. I cant see 3830FAh changing either... it gives out a raw value of 128. I'll report back once I fix it!
I am currently testing the ecu on the bench, could be the code is not running through torque control since the engine is off..
I am logging the adresses 383000h, 383002h, 383008h and 3830FAh. From my understanding once the code has ran at least once, there has to be 1234h in 383002h. I'll try some other location to call the function just to test :-)


« Last Edit: December 08, 2016, 02:16:27 PM by TijnCU » Logged

TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #151 on: December 09, 2016, 03:55:52 PM »

Did some in car testing this evening, and its still not working. The values in ram dont seem to stick. Could be my coding is flawed, but I tried to set ones and zeros in 2 unused adresses (0x00E0B0 and 0x383060) for a quick test and they both remain unchanged. Maybe I'm not using the right commands, but checked with Rajivc's code the function is really the same apart from the variables. Switching function is also not running because I don't get any response from b_mil. First task for the weekend: save a specific value in ram Roll Eyes
Logged

TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #152 on: December 13, 2016, 03:31:35 AM »

I found out my selected ram was not empty, there where no xrefs in Ida but with the logger I found data. Definitely worth it to doublecheck...
There was some parts of the code that I did not like (for example without activating the switch, it would select map 3 as default) and there where parts that could be coded more efficient. I have modified the code to my liking, consider it a hybrid between the Philadot mapswitching and the original from Rajivc666. Preset mapset is #1 (in this code below, the mapsets consist of only 1 "map". If you need more, you need to add more ram adresses and data that suit your needs).

It sometimes requires you to make a call before the lookup routine of your map of choice, depending on current DPP.
In my example I have used KFMDBGRG as a switchable torque limiter, the lookup of this map is in a section DPP0 so there is no space to put the dedicated ram adress in place of the 16bit data.
  
The call to the original function needs to come from somewhere in the code when the processor is on page #0E1h (DPP2).
In my example, it comes from the rear o2 section (ushk).
Code:
millight @ 0X8A5A00:
          mov  r5,word_3828F6
          sub  r5,#1H
          mov  word_3828F6,r5
          cmp r5,#0H  
          jmpr cc_nz , retmil
          mov  r5,#010h
          mov  word_3828F6,r5    
          mov  r5,word_3828D4
          cmp  r5,#0h
          jmpr cc_z,retmil
          sub  r5,#1h
          mov  word_3828D4,r5
          jb  b_mil, resisset
          bset b_mil
          jmpr cc_uc, retmil
resisset:
          bclr b_mil
retmil:                    
          rets  

Code:
kfmdbgrg sub @ 0x8A5A40:             ;call from 0x88AF24
extp #0E1h, #1
mov r12, word_3828F2
extp #0E1h, 1#
mov r13, word_3828E8
rets

Code:
Function @ 0x8A5A60  ;call  from 0x8050586
     mov [-r0], r5
     mov [-r0], r7
     mov [-r0], r8
     mov [-r0], r9
     mov r5,word_3828CE
     cmp r5,#1234h
     jmpr cc_z, stage_1
     mov  word_3828D4,ZEROS
     mov r5,#010h
     mov  word_3828F6,r5
     mov r5,#1234h
     mov  word_3828CE,r5
     mov  r5,#1H
     mov  word_3828FA,r5
     jb s_fgrsv,cc_isset
     mov  word_3828CC, ZEROS
     jmpr cc_uc, stage_1
cc_isset:
     mov  word_3828CC, ONES
stage_1:
     mov  r5,word_3828CC
     cmp  r5, ZEROS
     jmpr cc_z, CC_notset
     jb   s_fgrsv, exit
     mov  word_3828CC, ZEROS
     jmpr  cc_uc,exit
CC_notset:
     jnb  s_fgrsv, exit
     mov  word_3828CC, ONES
     jnb B_kuppl.11, exit
     mov  r5,word_3828FA
     cmp  r5,#1H
     jmpr CC_nz,I
     mov r5,#2h
     jmpr CC_uc,set_boost
  I:
     cmp  r5,#2H
     jmpr CC_nz,II
     mov r5,#3h
     jmpr CC_uc,set_boost
II:    
     mov r5,#1h
set_boost:    
     mov word_3828FA,r5
     shl r5,#1h
     mov word_3828D4,r5
exit:
     calls 0x8A5A00h ;calls millight
     mov r5,word_3828FA
     cmp r5,#2h
     jmpr CC_z,mapset2
     cmp r5,#3h
     jmpr CC_z,mapset3
mapset1:
   mov     r9, #207h
   mov     word_3828E8, r9
   mov     r9, #39B8h
   mov     word_3828E4, r9
   rets  
mapset2:
   mov     r7, #229h
   mov     word_3828E8, r7
   mov     r7, #0DC6h
   mov     word_3828F2, r7
   rets  
mapset3:
   mov     r8, #229h
   mov     word_3828E8, r8
   mov     r8, #0E18h
   mov     word_3828F2, r8
   rets  
« Last Edit: December 13, 2016, 03:55:14 AM by TijnCU » Logged

soldjah
Newbie
*

Karma: +0/-1
Offline Offline

Posts: 2


« Reply #153 on: July 14, 2017, 02:11:38 AM »

hello,

Is it possible to create for S3 8l?
« Last Edit: February 24, 2018, 06:57:03 PM by soldjah » Logged
4ringpieces
Full Member
***

Karma: +4/-4
Offline Offline

Posts: 232


« Reply #154 on: July 14, 2017, 02:16:53 PM »


extp #0E1h, #1
     mov r4,3002h
     cmp r4,#1234h
     jmpr cc_z, stage_1
     mov r4,#1234h
     extp #0E1h, #1
     mov  3002h,r4
     mov  r4,#14H
     extp #0E1h, #1
     mov  30fah,r4                      
     jb 0xfd10h.4,cc_isset
     extp #0E1h, #1
     mov  3000h, 0xff1c
     jmpr cc_uc, stage_1
cc_isset:  
     extp #0E1h, #1
     mov  3000h, 0xff1e
stage_1:
     extp #0E1h, #1
     mov  r4,3000h
     cmp  r4, 0xff1c
     jmpr cc_z, CC_notset
     JB   0xfd10h.4, exit
     extp #0E1h, #1
     mov  3000h, 0xff1c
     jmpr  cc_uc,exit
CC_notset:
     jnb  0xfd10h.4, exit
     extp #0E1h, #1
     mov  3000h, 0xff1e
     jnb 0xfd4eh.3, Exit
     extp #0E1h, #1
     mov  r4,30fah
     cmp  r4,#0aH
     jmpr CC_nz,I
     mov r4,#14h
     jmpr CC_uc,set_boost
  I:
     cmp  r4,#14H
     jmpr CC_nz,II
     mov r4,#3ch
     jmpr CC_uc,set_boost
 II:
     cmp  r4,#3cH
     jmpr CC_nz,III
     mov r4,#64h
     jmpr CC_uc,set_boost
 III:
     cmp  r4,#64H
     jmpr CC_nz,Iv
     mov r4, #0C8h
     jmpr CC_uc,set_boost
Iv:    
     mov r4,#0ah
set_boost:    
     extp #0e1h,#1
     mov 30fah,r4
exit:
    mov r12, #0e400h
    mov r13, #23fh
    extp #0e1h, #1
    movbz r14, 30fah
    mov r15, 0f89eh
    calls 82h,5ef0h
    rets
ldrxnzk:    
     extp #0E1h, #1
     mov r4,3002h
     cmp r4,#1234h
     jmpr cc_z, stage_11
     mov r4,#1234h
     extp #0E1h, #1
     mov  3002h,r4
     mov  r4,#14H
     extp #0E1h, #1
     mov  30fah,r4                      
     jb 0xfd10h.4,cc_isset1
     extp #0E1h, #1
     mov  3000h, 0xff1c
     jmpr cc_uc, stage_11
cc_isset1:  
     extp #0E1h, #1
     mov  3000h, 0xff1e
stage_11:
     extp #0E1h, #1
     mov  r4,3000h
     cmp  r4, 0xff1c
     jmpr cc_z, CC_notset1
     JB   0xfd10h.4, exit1
     extp #0E1h, #1
     mov  3000h, 0xff1c
     jmpr  cc_uc,exit1
CC_notset1:
     jnb  0xfd10h.4, exit1
     extp #0E1h, #1
     mov  3000h, 0xff1e
     jnb 0xfd4eh.3, Exit1
     extp #0E1h, #1
     mov  r4,30fah
     cmp  r4,#0aH
     jmpr CC_nz,I1
     mov r4,#14h
     jmpr CC_uc,set_boost1
  I1:
     cmp  r4,#14H
     jmpr CC_nz,II1
     mov r4,#3ch
     jmpr CC_uc,set_boost1
 II1:
     cmp  r4,#3cH
     jmpr CC_nz,III1
     mov r4,#64h
     jmpr CC_uc,set_boost1
 III1:
     cmp  r4,#64H
     jmpr CC_nz,Iv1
     mov r4, #0C8h
     jmpr CC_uc,set_boost1
Iv1:    
     mov r4,#0ah
set_boost1:    
     extp #0e1h,#1
     mov 30fah,r4
exit1:
    mov r12, #0e4d0h
    mov r13, #23fh
    extp #0e1h, #1
    movbz r14, 30fah
    mov r15, 0f89eh
    calls 82h,5ef0h
    rets
 



Anyone care to break down this code into simple terms, I understand 0xFD10.4 is the cruise control status
Logged
TijnCU
Hero Member
*****

Karma: +60/-4
Offline Offline

Posts: 690


flying brick


« Reply #155 on: July 16, 2017, 04:02:39 AM »

sure, in simple terms:
Check if code has ran, if not insert 10h for mil flash counter and insert 1234h as check value. Check if cruise is pressed, if not skip to active mapset, if so, check if clutch is depressed. Ram is set to FFFF when this has been done to avoid looping. Then check mapnumber, switch to the next number. Copy map number to mil code and double the number. Call mil code, flash mil according to mapnumber with timer (10ms mil on, 10ms mil off, hence the double number), return to  code. ldrxn is using 3d map lookup function and the Y axis is the mapnumber.
Logged

4ringpieces
Full Member
***

Karma: +4/-4
Offline Offline

Posts: 232


« Reply #156 on: July 16, 2017, 07:49:31 AM »

What is extp? I can find explanations for cmp, mov etc but "extp" is alluding me

Logged
nihalot
Full Member
***

Karma: +40/-3
Offline Offline

Posts: 116


« Reply #157 on: July 16, 2017, 10:31:42 AM »

What is extp? I can find explanations for cmp, mov etc but "extp" is alluding me



http://www.keil.com/dd/docs/datashts/infineon/c166ism.pdf
Logged

www.tangentmotorsport.com

multimap/LC/rolling antilag for MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU
4ringpieces
Full Member
***

Karma: +4/-4
Offline Offline

Posts: 232


« Reply #158 on: July 16, 2017, 01:39:47 PM »

That's perfect! Thanks gives me some lunch time reading
Logged
Cadensdad14
Full Member
***

Karma: +8/-1
Offline Offline

Posts: 134


« Reply #159 on: May 30, 2018, 03:43:44 PM »

How does the map swap work.  I have a ram location I wan to use a Jmpr cc_nz on.  If ram location is greater than 0 alternate maps are used.  If location is 0 stock maps are used.  Ive worked my way through the Multimaps disassembly, but dont have enough knowledge to make sense of a lot of what's going on. 
Logged
vwdubNam
Jr. Member
**

Karma: +1/-0
Offline Offline

Posts: 27


« Reply #160 on: December 20, 2018, 08:02:09 AM »

Interesting topic,

I'm a nood, and want to make a suggestion, it might be of use or not.
display the selected map could be additional added to a user customized interface on the cluster, given the cluster code read the specific register containing the map number.
but this would only be possible if the instrument cluster has been changed?

video of instrument cluster.
https://www.youtube.com/watch?v=gOG9OQvDFNQ&t=182s

anythoughts of my idea?
using a custom instrument cluster to display map selection?

flashing lights are cool
Logged
adam-
Hero Member
*****

Karma: +122/-33
Offline Offline

Posts: 2177


« Reply #161 on: February 21, 2019, 08:22:03 AM »

That is ColorFIS.  Would need to code it all together.  It's not set up for that.
Logged
Lechuga
Jr. Member
**

Karma: +4/-0
Offline Offline

Posts: 41


« Reply #162 on: March 05, 2020, 01:45:33 AM »

Sorry to wake up an old thread but I am very interested (even if it is somewhat over my head right now).

If I get this right:

Code:
kfmdbgrg sub @ 0x8A5A40:             ;call from 0x88AF24
extp #0E1h, #1
mov r12, word_3828F2
extp #0E1h, 1#
mov r13, word_3828E8
rets

You have 3 different copies of the KFMDBGRG map in different addresses (being original, 3828F2 and 3828E8?) and select it by cruise control and clutch?

And how do you compile these snippets? Is there any freeware tool? (I will look for one)

I would like to adapt it to my 18CB

Cheers!
« Last Edit: March 05, 2020, 01:59:52 AM by Lechuga » Logged
meandyoujane
Newbie
*

Karma: +2/-2
Offline Offline

Posts: 12


« Reply #163 on: November 20, 2020, 01:51:19 PM »

I have tried the hj with flashing mil. Works well, it seems better to change and then switch the engine on and off again, although thinking about it maybe at ignition.
Changing on the fly seems to create flat spots although I am not fully used to it yet.
But fabulous work well done, I am going to try and get through the code to see how you have done it.
Logged
Dejw0089
Full Member
***

Karma: +2/-6
Offline Offline

Posts: 100



« Reply #164 on: July 03, 2021, 04:59:19 AM »

hi, its a 1.8t 06A906032hj ecu, though can be coded for any ecu. Its running fine on my car.
Here is the code at 0x8ffd40
 
extp #0E1h, #1
     mov r4,3002h
     cmp r4,#1234h
     jmpr cc_z, stage_1
     mov r4,#1234h
     extp #0E1h, #1
     mov  3002h,r4
     mov  r4,#14H
     extp #0E1h, #1
     mov  30fah,r4                      
     jb 0xfd10h.4,cc_isset
     extp #0E1h, #1
     mov  3000h, 0xff1c
     jmpr cc_uc, stage_1
cc_isset:  
     extp #0E1h, #1
     mov  3000h, 0xff1e
stage_1:
     extp #0E1h, #1
     mov  r4,3000h
     cmp  r4, 0xff1c
     jmpr cc_z, CC_notset
     JB   0xfd10h.4, exit
     extp #0E1h, #1
     mov  3000h, 0xff1c
     jmpr  cc_uc,exit
CC_notset:
     jnb  0xfd10h.4, exit
     extp #0E1h, #1
     mov  3000h, 0xff1e
     jnb 0xfd4eh.3, Exit
     extp #0E1h, #1
     mov  r4,30fah
     cmp  r4,#0aH
     jmpr CC_nz,I
     mov r4,#14h
     jmpr CC_uc,set_boost
  I:
     cmp  r4,#14H
     jmpr CC_nz,II
     mov r4,#3ch
     jmpr CC_uc,set_boost
 II:
     cmp  r4,#3cH
     jmpr CC_nz,III
     mov r4,#64h
     jmpr CC_uc,set_boost
 III:
     cmp  r4,#64H
     jmpr CC_nz,Iv
     mov r4, #0C8h
     jmpr CC_uc,set_boost
Iv:    
     mov r4,#0ah
set_boost:    
     extp #0e1h,#1
     mov 30fah,r4
exit:
    mov r12, #0e400h
    mov r13, #23fh
    extp #0e1h, #1
    movbz r14, 30fah
    mov r15, 0f89eh
    calls 82h,5ef0h
    rets
ldrxnzk:    
     extp #0E1h, #1
     mov r4,3002h
     cmp r4,#1234h
     jmpr cc_z, stage_11
     mov r4,#1234h
     extp #0E1h, #1
     mov  3002h,r4
     mov  r4,#14H
     extp #0E1h, #1
     mov  30fah,r4                      
     jb 0xfd10h.4,cc_isset1
     extp #0E1h, #1
     mov  3000h, 0xff1c
     jmpr cc_uc, stage_11
cc_isset1:  
     extp #0E1h, #1
     mov  3000h, 0xff1e
stage_11:
     extp #0E1h, #1
     mov  r4,3000h
     cmp  r4, 0xff1c
     jmpr cc_z, CC_notset1
     JB   0xfd10h.4, exit1
     extp #0E1h, #1
     mov  3000h, 0xff1c
     jmpr  cc_uc,exit1
CC_notset1:
     jnb  0xfd10h.4, exit1
     extp #0E1h, #1
     mov  3000h, 0xff1e
     jnb 0xfd4eh.3, Exit1
     extp #0E1h, #1
     mov  r4,30fah
     cmp  r4,#0aH
     jmpr CC_nz,I1
     mov r4,#14h
     jmpr CC_uc,set_boost1
  I1:
     cmp  r4,#14H
     jmpr CC_nz,II1
     mov r4,#3ch
     jmpr CC_uc,set_boost1
 II1:
     cmp  r4,#3cH
     jmpr CC_nz,III1
     mov r4,#64h
     jmpr CC_uc,set_boost1
 III1:
     cmp  r4,#64H
     jmpr CC_nz,Iv1
     mov r4, #0C8h
     jmpr CC_uc,set_boost1
Iv1:    
     mov r4,#0ah
set_boost1:    
     extp #0e1h,#1
     mov 30fah,r4
exit1:
    mov r12, #0e4d0h
    mov r13, #23fh
    extp #0e1h, #1
    movbz r14, 30fah
    mov r15, 0f89eh
    calls 82h,5ef0h
    rets
 

Mybe stupid question but need change something more than ori routine to this function?
Of course I know I need change ram adress and maps adres (if they are in other place than your). I start work with ida pro and can diassemble bin file to see your code in IDA but want to learn more and change code to work with my ecu.
Logged
Pages: 1 ... 9 10 [11] 12
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.055 seconds with 16 queries. (Pretty URLs adds 0.001s, 0q)