TijnCU
Hero Member
Karma: +60/-4
 Offline
Posts: 690
flying brick
|
 |
« Reply #150 on: December 08, 2016, 11:57:42 AM »
|
|
|
Has anybody tried to implement/configure boost limit depending of a gear? For example substitute different LDRXN [1..4] profiles depending of a gear calculated using vehicle speed & RPM? Multimap selection might be a good basis for this new function. Or there is another way to implement this?
I have been working on this function for my own ecu today, and I substituted the new ldrxn code for KFMDBRGR (torque limit by gear and rpm). You can find it in Ida if you search for the adress of the axis size data. For now, I would be happy with just this limiter. Ultimately I want to switch my exhaust valve too, but I am still figuring out how to take final control of a 12v output (fan control/rear o2 heater/sai pump outputs are the options I am considering. rear o2 seems to be the smallest function to alter but still....) The ecu boots fine, however I have not been able to test if the function works properly. I have no mil light in my dash, I tried to read b_mil over me7logger but it stays at 0. I cant see 3830FAh changing either... it gives out a raw value of 128. I'll report back once I fix it! I am currently testing the ecu on the bench, could be the code is not running through torque control since the engine is off.. I am logging the adresses 383000h, 383002h, 383008h and 3830FAh. From my understanding once the code has ran at least once, there has to be 1234h in 383002h. I'll try some other location to call the function just to test :-) |
|
|
|
« Last Edit: December 08, 2016, 02:16:27 PM by TijnCU »
|
Logged
|
|
|
|
|
|
TijnCU
Hero Member
Karma: +60/-4
Offline
Posts: 690
flying brick
|
|
« Reply #152 on: December 13, 2016, 03:31:35 AM »
|
|
|
I found out my selected ram was not empty, there where no xrefs in Ida but with the logger I found data. Definitely worth it to doublecheck... There was some parts of the code that I did not like (for example without activating the switch, it would select map 3 as default) and there where parts that could be coded more efficient. I have modified the code to my liking, consider it a hybrid between the Philadot mapswitching and the original from Rajivc666. Preset mapset is #1 (in this code below, the mapsets consist of only 1 "map". If you need more, you need to add more ram adresses and data that suit your needs). It sometimes requires you to make a call before the lookup routine of your map of choice, depending on current DPP. In my example I have used KFMDBGRG as a switchable torque limiter, the lookup of this map is in a section DPP0 so there is no space to put the dedicated ram adress in place of the 16bit data. The call to the original function needs to come from somewhere in the code when the processor is on page #0E1h (DPP2). In my example, it comes from the rear o2 section (ushk). millight @ 0X8A5A00:
mov r5,word_3828F6
sub r5,#1H
mov word_3828F6,r5
cmp r5,#0H
jmpr cc_nz , retmil
mov r5,#010h
mov word_3828F6,r5
mov r5,word_3828D4
cmp r5,#0h
jmpr cc_z,retmil
sub r5,#1h
mov word_3828D4,r5
jb b_mil, resisset
bset b_mil
jmpr cc_uc, retmil
resisset:
bclr b_mil
retmil:
rets
kfmdbgrg sub @ 0x8A5A40: ;call from 0x88AF24
extp #0E1h, #1
mov r12, word_3828F2
extp #0E1h, 1#
mov r13, word_3828E8
rets
Function @ 0x8A5A60 ;call from 0x8050586
mov [-r0], r5
mov [-r0], r7
mov [-r0], r8
mov [-r0], r9
mov r5,word_3828CE
cmp r5,#1234h
jmpr cc_z, stage_1
mov word_3828D4,ZEROS
mov r5,#010h
mov word_3828F6,r5
mov r5,#1234h
mov word_3828CE,r5
mov r5,#1H
mov word_3828FA,r5
jb s_fgrsv,cc_isset
mov word_3828CC, ZEROS
jmpr cc_uc, stage_1
cc_isset:
mov word_3828CC, ONES
stage_1:
mov r5,word_3828CC
cmp r5, ZEROS
jmpr cc_z, CC_notset
jb s_fgrsv, exit
mov word_3828CC, ZEROS
jmpr cc_uc,exit
CC_notset:
jnb s_fgrsv, exit
mov word_3828CC, ONES
jnb B_kuppl.11, exit
mov r5,word_3828FA
cmp r5,#1H
jmpr CC_nz,I
mov r5,#2h
jmpr CC_uc,set_boost
I:
cmp r5,#2H
jmpr CC_nz,II
mov r5,#3h
jmpr CC_uc,set_boost
II:
mov r5,#1h
set_boost:
mov word_3828FA,r5
shl r5,#1h
mov word_3828D4,r5
exit:
calls 0x8A5A00h ;calls millight
mov r5,word_3828FA
cmp r5,#2h
jmpr CC_z,mapset2
cmp r5,#3h
jmpr CC_z,mapset3
mapset1:
mov r9, #207h
mov word_3828E8, r9
mov r9, #39B8h
mov word_3828E4, r9
rets
mapset2:
mov r7, #229h
mov word_3828E8, r7
mov r7, #0DC6h
mov word_3828F2, r7
rets
mapset3:
mov r8, #229h
mov word_3828E8, r8
mov r8, #0E18h
mov word_3828F2, r8
rets |
|
|
|
« Last Edit: December 13, 2016, 03:55:14 AM by TijnCU »
|
Logged
|
|
|
|
soldjah
Newbie
Karma: +0/-1
Offline
Posts: 2
|
|
« Reply #153 on: July 14, 2017, 02:11:38 AM »
|
|
|
hello,
Is it possible to create for S3 8l?
|
|
|
|
« Last Edit: February 24, 2018, 06:57:03 PM by soldjah »
|
Logged
|
|
|
|
4ringpieces
Full Member
Karma: +4/-4
Offline
Posts: 232
|
|
« Reply #154 on: July 14, 2017, 02:16:53 PM »
|
|
|
extp #0E1h, #1
mov r4,3002h
cmp r4,#1234h
jmpr cc_z, stage_1
mov r4,#1234h
extp #0E1h, #1
mov 3002h,r4
mov r4,#14H
extp #0E1h, #1
mov 30fah,r4
jb 0xfd10h.4,cc_isset
extp #0E1h, #1
mov 3000h, 0xff1c
jmpr cc_uc, stage_1
cc_isset:
extp #0E1h, #1
mov 3000h, 0xff1e
stage_1:
extp #0E1h, #1
mov r4,3000h
cmp r4, 0xff1c
jmpr cc_z, CC_notset
JB 0xfd10h.4, exit
extp #0E1h, #1
mov 3000h, 0xff1c
jmpr cc_uc,exit
CC_notset:
jnb 0xfd10h.4, exit
extp #0E1h, #1
mov 3000h, 0xff1e
jnb 0xfd4eh.3, Exit
extp #0E1h, #1
mov r4,30fah
cmp r4,#0aH
jmpr CC_nz,I
mov r4,#14h
jmpr CC_uc,set_boost
I:
cmp r4,#14H
jmpr CC_nz,II
mov r4,#3ch
jmpr CC_uc,set_boost
II:
cmp r4,#3cH
jmpr CC_nz,III
mov r4,#64h
jmpr CC_uc,set_boost
III:
cmp r4,#64H
jmpr CC_nz,Iv
mov r4, #0C8h
jmpr CC_uc,set_boost
Iv:
mov r4,#0ah
set_boost:
extp #0e1h,#1
mov 30fah,r4
exit:
mov r12, #0e400h
mov r13, #23fh
extp #0e1h, #1
movbz r14, 30fah
mov r15, 0f89eh
calls 82h,5ef0h
rets
ldrxnzk:
extp #0E1h, #1
mov r4,3002h
cmp r4,#1234h
jmpr cc_z, stage_11
mov r4,#1234h
extp #0E1h, #1
mov 3002h,r4
mov r4,#14H
extp #0E1h, #1
mov 30fah,r4
jb 0xfd10h.4,cc_isset1
extp #0E1h, #1
mov 3000h, 0xff1c
jmpr cc_uc, stage_11
cc_isset1:
extp #0E1h, #1
mov 3000h, 0xff1e
stage_11:
extp #0E1h, #1
mov r4,3000h
cmp r4, 0xff1c
jmpr cc_z, CC_notset1
JB 0xfd10h.4, exit1
extp #0E1h, #1
mov 3000h, 0xff1c
jmpr cc_uc,exit1
CC_notset1:
jnb 0xfd10h.4, exit1
extp #0E1h, #1
mov 3000h, 0xff1e
jnb 0xfd4eh.3, Exit1
extp #0E1h, #1
mov r4,30fah
cmp r4,#0aH
jmpr CC_nz,I1
mov r4,#14h
jmpr CC_uc,set_boost1
I1:
cmp r4,#14H
jmpr CC_nz,II1
mov r4,#3ch
jmpr CC_uc,set_boost1
II1:
cmp r4,#3cH
jmpr CC_nz,III1
mov r4,#64h
jmpr CC_uc,set_boost1
III1:
cmp r4,#64H
jmpr CC_nz,Iv1
mov r4, #0C8h
jmpr CC_uc,set_boost1
Iv1:
mov r4,#0ah
set_boost1:
extp #0e1h,#1
mov 30fah,r4
exit1:
mov r12, #0e4d0h
mov r13, #23fh
extp #0e1h, #1
movbz r14, 30fah
mov r15, 0f89eh
calls 82h,5ef0h
rets
Anyone care to break down this code into simple terms, I understand 0xFD10.4 is the cruise control status |
|
|
|
|
Logged
|
|
|
|
TijnCU
Hero Member
Karma: +60/-4
Offline
Posts: 690
flying brick
|
|
« Reply #155 on: July 16, 2017, 04:02:39 AM »
|
|
|
sure, in simple terms:
Check if code has ran, if not insert 10h for mil flash counter and insert 1234h as check value. Check if cruise is pressed, if not skip to active mapset, if so, check if clutch is depressed. Ram is set to FFFF when this has been done to avoid looping. Then check mapnumber, switch to the next number. Copy map number to mil code and double the number. Call mil code, flash mil according to mapnumber with timer (10ms mil on, 10ms mil off, hence the double number), return to code. ldrxn is using 3d map lookup function and the Y axis is the mapnumber.
|
|
|
|
|
Logged
|
|
|
|
4ringpieces
Full Member
Karma: +4/-4
Offline
Posts: 232
|
|
« Reply #156 on: July 16, 2017, 07:49:31 AM »
|
|
|
What is extp? I can find explanations for cmp, mov etc but "extp" is alluding me
|
|
|
|
|
Logged
|
|
|
|
|
|
4ringpieces
Full Member
Karma: +4/-4
Offline
Posts: 232
|
|
« Reply #158 on: July 16, 2017, 01:39:47 PM »
|
|
|
That's perfect! Thanks gives me some lunch time reading
|
|
|
|
|
Logged
|
|
|
|
Cadensdad14
Full Member
Karma: +8/-1
Offline
Posts: 134
|
|
« Reply #159 on: May 30, 2018, 03:43:44 PM »
|
|
|
How does the map swap work. I have a ram location I wan to use a Jmpr cc_nz on. If ram location is greater than 0 alternate maps are used. If location is 0 stock maps are used. Ive worked my way through the Multimaps disassembly, but dont have enough knowledge to make sense of a lot of what's going on.
|
|
|
|
|
Logged
|
|
|
|
vwdubNam
Jr. Member
Karma: +1/-0
Offline
Posts: 27
|
|
« Reply #160 on: December 20, 2018, 08:02:09 AM »
|
|
|
Interesting topic, I'm a nood, and want to make a suggestion, it might be of use or not. display the selected map could be additional added to a user customized interface on the cluster, given the cluster code read the specific register containing the map number. but this would only be possible if the instrument cluster has been changed? video of instrument cluster. https://www.youtube.com/watch?v=gOG9OQvDFNQ&t=182sanythoughts of my idea? using a custom instrument cluster to display map selection? flashing lights are cool |
|
|
|
|
Logged
|
|
|
|
|
adam-
|
|
« Reply #161 on: February 21, 2019, 08:22:03 AM »
|
|
|
That is ColorFIS. Would need to code it all together. It's not set up for that.
|
|
|
|
|
Logged
|
|
|
|
Lechuga
Jr. Member
Karma: +5/-0
Offline
Posts: 41
|
|
« Reply #162 on: March 05, 2020, 01:45:33 AM »
|
|
|
Sorry to wake up an old thread but I am very interested (even if it is somewhat over my head right now). If I get this right: kfmdbgrg sub @ 0x8A5A40: ;call from 0x88AF24
extp #0E1h, #1
mov r12, word_3828F2
extp #0E1h, 1#
mov r13, word_3828E8
rets
You have 3 different copies of the KFMDBGRG map in different addresses (being original, 3828F2 and 3828E8?) and select it by cruise control and clutch? And how do you compile these snippets? Is there any freeware tool? (I will look for one) I would like to adapt it to my 18CB Cheers! |
|
|
|
« Last Edit: March 05, 2020, 01:59:52 AM by Lechuga »
|
Logged
|
|
|
|
meandyoujane
Newbie
Karma: +2/-2
Offline
Posts: 12
|
|
« Reply #163 on: November 20, 2020, 01:51:19 PM »
|
|
|
I have tried the hj with flashing mil. Works well, it seems better to change and then switch the engine on and off again, although thinking about it maybe at ignition.
Changing on the fly seems to create flat spots although I am not fully used to it yet.
But fabulous work well done, I am going to try and get through the code to see how you have done it.
|
|
|
|
|
Logged
|
|
|
|
Dejw0089
Full Member
Karma: +2/-6
Offline
Posts: 100
|
|
« Reply #164 on: July 03, 2021, 04:59:19 AM »
|
|
|
hi, its a 1.8t 06A906032hj ecu, though can be coded for any ecu. Its running fine on my car.
Here is the code at 0x8ffd40
extp #0E1h, #1
mov r4,3002h
cmp r4,#1234h
jmpr cc_z, stage_1
mov r4,#1234h
extp #0E1h, #1
mov 3002h,r4
mov r4,#14H
extp #0E1h, #1
mov 30fah,r4
jb 0xfd10h.4,cc_isset
extp #0E1h, #1
mov 3000h, 0xff1c
jmpr cc_uc, stage_1
cc_isset:
extp #0E1h, #1
mov 3000h, 0xff1e
stage_1:
extp #0E1h, #1
mov r4,3000h
cmp r4, 0xff1c
jmpr cc_z, CC_notset
JB 0xfd10h.4, exit
extp #0E1h, #1
mov 3000h, 0xff1c
jmpr cc_uc,exit
CC_notset:
jnb 0xfd10h.4, exit
extp #0E1h, #1
mov 3000h, 0xff1e
jnb 0xfd4eh.3, Exit
extp #0E1h, #1
mov r4,30fah
cmp r4,#0aH
jmpr CC_nz,I
mov r4,#14h
jmpr CC_uc,set_boost
I:
cmp r4,#14H
jmpr CC_nz,II
mov r4,#3ch
jmpr CC_uc,set_boost
II:
cmp r4,#3cH
jmpr CC_nz,III
mov r4,#64h
jmpr CC_uc,set_boost
III:
cmp r4,#64H
jmpr CC_nz,Iv
mov r4, #0C8h
jmpr CC_uc,set_boost
Iv:
mov r4,#0ah
set_boost:
extp #0e1h,#1
mov 30fah,r4
exit:
mov r12, #0e400h
mov r13, #23fh
extp #0e1h, #1
movbz r14, 30fah
mov r15, 0f89eh
calls 82h,5ef0h
rets
ldrxnzk:
extp #0E1h, #1
mov r4,3002h
cmp r4,#1234h
jmpr cc_z, stage_11
mov r4,#1234h
extp #0E1h, #1
mov 3002h,r4
mov r4,#14H
extp #0E1h, #1
mov 30fah,r4
jb 0xfd10h.4,cc_isset1
extp #0E1h, #1
mov 3000h, 0xff1c
jmpr cc_uc, stage_11
cc_isset1:
extp #0E1h, #1
mov 3000h, 0xff1e
stage_11:
extp #0E1h, #1
mov r4,3000h
cmp r4, 0xff1c
jmpr cc_z, CC_notset1
JB 0xfd10h.4, exit1
extp #0E1h, #1
mov 3000h, 0xff1c
jmpr cc_uc,exit1
CC_notset1:
jnb 0xfd10h.4, exit1
extp #0E1h, #1
mov 3000h, 0xff1e
jnb 0xfd4eh.3, Exit1
extp #0E1h, #1
mov r4,30fah
cmp r4,#0aH
jmpr CC_nz,I1
mov r4,#14h
jmpr CC_uc,set_boost1
I1:
cmp r4,#14H
jmpr CC_nz,II1
mov r4,#3ch
jmpr CC_uc,set_boost1
II1:
cmp r4,#3cH
jmpr CC_nz,III1
mov r4,#64h
jmpr CC_uc,set_boost1
III1:
cmp r4,#64H
jmpr CC_nz,Iv1
mov r4, #0C8h
jmpr CC_uc,set_boost1
Iv1:
mov r4,#0ah
set_boost1:
extp #0e1h,#1
mov 30fah,r4
exit1:
mov r12, #0e4d0h
mov r13, #23fh
extp #0e1h, #1
movbz r14, 30fah
mov r15, 0f89eh
calls 82h,5ef0h
rets
Mybe stupid question but need change something more than ori routine to this function? Of course I know I need change ram adress and maps adres (if they are in other place than your). I start work with ida pro and can diassemble bin file to see your code in IDA but want to learn more and change code to work with my ecu. |
|
|
|
|
Logged
|
|
|
|
|
