Pages: [1]
Author Topic: me7.5 Disassemble change rpm  (Read 3763 times)
Sagishm
Jr. Member
**

Karma: +1/-0
Offline Offline

Posts: 26


« on: July 13, 2021, 02:12:40 AM »

Hi All,
After a lot of time and learn, i successfully get switch map on my car.
I trying to change the rpm by map but all i did not worked.
i tried to change the nmot but nothing, also nmot_um, any idea what i missed?
Thanks

my function:
Code:
 change_rpm_8FFA70:                      ; CODE XREF: Seg0x22c@8b0000:02B2P
                 extp    #0E1h, #1 ; '_'
                 mov     r4, selected_map_word_3870FA
                 cmp     r4, #1
                 jmpr    cc_NZ, loc_8FFA84
                 cmp     r4, #2
                 jmpr    cc_NZ, loc_8FFA90
                 cmp     r4, #3
                 jmpr    cc_NZ, loc_8FFA9C

FA84 loc_8FFA84:                             ; CODE XREF: change_rpm_8FFA70+Aj
                 extp    #0E1h, #1 ; '_'
                 mov     r5, #4B0h
                 mov     word_F89E, r5
FA90 loc_8FFA90:                             ; CODE XREF: change_rpm_8FFA70+Ej
                 extp    #0E1h, #1 ; '_'
                 mov     r5, #898h
                 mov     word_F89E, r5

FA9C loc_8FFA9C:                             ; CODE XREF: change_rpm_8FFA70+12j
                 extp    #0E1h, #1 ; '_'
                 mov     r5, #0C80h
                 mov     word_F89E, r5

Thanks
Logged
fknbrkn
Hero Member
*****

Karma: +186/-24
Offline Offline

Posts: 1455


mk4 1.8T AUM


« Reply #1 on: July 13, 2021, 04:09:50 AM »

Do not touch nmot!
You should change can-bus byte for nmot and not the nmot itself

Open FR on a can-bus message, find message with nmot.
For example its a 0x280 byte 2
Now check the the same 0x280 id for the rare used variables (mdverl or something like that)
Lets say its 0x280 byte 5
Now find a mdverl in ida and check for cross-reference
Youll see some kind of
Movb rl4, mdverl
Movb 0xF828, rl4 // usually canbytes stored here

And the key is the bytes in can-bus message has same order as in the FR so if mdverl is on the byte 5 in FR then nmot should be at byte 2 (F828-3=F825)
Just scroll up a bit and youll see ~ movb rl4, nmot movb F825, rl4
This is the place you should call your routine to change rl4 with your nmot value

As for code
I believe cc_z should be used here not cc_nz
Didnt see timer here - when you change the map tacho displays the rpm for a while and then return to original rpm
Extp - why? Its just a value not an offset
Logged
Sagishm
Jr. Member
**

Karma: +1/-0
Offline Offline

Posts: 26


« Reply #2 on: July 13, 2021, 04:44:32 AM »

thanks for the response, i think I found the function is calling to CAN, looks like F824 AND F825, so need to set a value of them?
Regarding cc_nz, from the c166 doc, i understood cc_nz == NonZero so basically if r4 != 0 it will go to the function? or it mistake?
Also about the timer, i tried to find in c166 doc how to add a timer, i didn't find it, what is the right way to do it?
thanks!
Logged
fknbrkn
Hero Member
*****

Karma: +186/-24
Offline Offline

Posts: 1455


mk4 1.8T AUM


« Reply #3 on: July 13, 2021, 06:30:36 AM »

Yep iirc can-bus uses 2 bytes to store word nmot_w
and stock function looks like that

mov r4, nmot
movb 0xF825, rl4
movb 0xF824, rh4

Change wih

calls #8Ch, #1000h
movb 0xF825, rl4
movb 0xF824, rh4


Your routine @0xC1000

<...some calculations>
ends with

loc_1:
mov r4, #1234h ; use value equal to 1000rpm, 1234 just for example
rets

loc_2:
mov r4, #5678h ;equal 2000rpm
rets

loc_def:
mov r4, nmot_w ; actual nmot to canbus
rets


----
as for cmp its just a subtraction operation iirc, so if you need to know values are equal to each other just use cc_z
as for timer - its a counter (ram variable) which you init, add value to it and reset if its reaching its maximum value
initialize timer in main multimap routine (timer=0) due to unused ram are typically FF
i believe youve made a simple trigger to switch maps only once when button was pressed to prevent a switching loop
use this trigger in your can-bus routine to start the timer

so basically your routine shold looks like that

1. check for map swiching event. if its present, start the timer. just add 1 to the timer
2. check if timer is running. if timer value > 0 and value < threshold, add 1 to timer and mov selected map to the cluster. if timer >= threshold, mov nmot to the cluster (stock path) and reset the timer (mov timer, zeros).

result would be smooth af
https://youtu.be/3__up1h4xn4


And btw
Beware of using canbus nmot hook on the go when the car equipped with AT/ESP/Haldex
Safety cap of rl_w or vss should be used aswell to prevent inadequate reaction of those modules




« Last Edit: July 13, 2021, 06:38:57 AM by fukenbroken » Logged
Sagishm
Jr. Member
**

Karma: +1/-0
Offline Offline

Posts: 26


« Reply #4 on: July 14, 2021, 03:25:17 AM »

Thanks you, that’s very good explanation, i got it works!

Thanks again!
Logged
Sagishm
Jr. Member
**

Karma: +1/-0
Offline Offline

Posts: 26


« Reply #5 on: July 14, 2021, 04:59:28 AM »

I have another question, how I can get/check bit from EPROM? i know is possible but i didnt understand how.
Logged
Pages: [1]
  Print  
 
Jump to:  

Powered by SMF 1.1.21 | SMF © 2015, Simple Machines Page created in 0.016 seconds with 16 queries. (Pretty URLs adds 0s, 0q)