krazydbiker
Full Member
Karma: +4/-1
 Offline
Posts: 202
|
 |
« Reply #45 on: July 23, 2012, 05:53:24 PM »
|
|
|
i cant thank you enough, seriously? honestly, i dont mind working, i have been since i made this post, someday i would really like to understand how you got those
im going to put a calls to the address i picked D7000
im going to overwite the part of the function that is originally calls 4, sub_41876 to calls 8Dh, 7000h ; 8D7000h
EDIT : upon further review, this is totally different then the other 6 files stock and modified, huh?
|
|
|
|
« Last Edit: July 23, 2012, 06:11:45 PM by krazydbiker »
|
Logged
|
|
|
|
krazydbiker
Full Member
Karma: +4/-1
Offline
Posts: 202
|
|
« Reply #46 on: July 23, 2012, 06:57:41 PM »
|
|
|
there is some odd differences in the volvo code ive noticed, D7 is calls on vag? but on mine its DA?
im getting there, just trying to figure out which one is which, put in all my new locations, my brain is shot, maybe ill wait till tomorrow
|
|
|
|
|
Logged
|
|
|
|
|
matchew
|
|
« Reply #47 on: July 23, 2012, 07:15:09 PM »
|
|
|
|
|
|
|
|
Logged
|
|
|
|
krazydbiker
Full Member
Karma: +4/-1
Offline
Posts: 202
|
|
« Reply #48 on: July 23, 2012, 07:29:13 PM »
|
|
|
so cool, but so complicated, im going to take a break till tomorrow, i have gotten pretty far, codes in, redirects in, variables are in, next part is inputting the memory locations into the code, i really appreciate the help, i could have not gotten this far without that, i had been working on that one part for hours
edit - do i need tsrldyn?
|
|
|
|
« Last Edit: July 23, 2012, 07:37:21 PM by krazydbiker »
|
Logged
|
|
|
|
|
matchew
|
|
« Reply #49 on: July 23, 2012, 07:43:57 PM »
|
|
|
im going to overwite the part of the function that is originally calls 4, sub_41876 to calls 8Dh, 7000h ; 8D7000h
Why did you chose to call your routine from there? |
|
|
|
|
Logged
|
|
|
|
krazydbiker
Full Member
Karma: +4/-1
Offline
Posts: 202
|
|
« Reply #50 on: July 24, 2012, 04:23:53 AM »
|
|
|
to be honest kind of a shot in the dark, i just noticed in the other files i examined, they had it call out to the other routine right away, after thinking about it, im deleting a routine in the process by doing that so that might not be the right way to go
still really confused on how you got those memory locations, i know this is far over my head, but i try to understand as much as i can
|
|
|
|
« Last Edit: July 24, 2012, 04:26:46 AM by krazydbiker »
|
Logged
|
|
|
|
|
prj
|
|
« Reply #51 on: July 24, 2012, 04:46:52 AM »
|
|
|
You can find those memory locations even automatically using an offset/pattern search. But manually - you take a base file where you have figured out a certain function and that it accesses certain ram variables you need. You take the raw hex of that function and mask all the specific locations and addresses. You then match that pattern with the offsets masked to the mystery binary. If the function is present in the mystery binary you will get the locations. This is also how you write code injection into programs, that survives multiple patches, etc (this tells a bit about my background)  |
|
|
|
|
Logged
|
|
|
|
|
matchew
|
|
« Reply #52 on: July 24, 2012, 06:36:52 AM »
|
|
|
to be honest kind of a shot in the dark, That is what is going to brick your ECU. still really confused on how you got those memory locations, i know this is far over my head, but i try to understand as much as i can
I took a file where I knew all the ram locations. found routines that used the ram locations. Then searched for similar routines/maps in your file, this then gave me the ram locations in your file. It is the most obvious thing to do, there is no magic about it. |
|
|
|
|
Logged
|
|
|
|
krazydbiker
Full Member
Karma: +4/-1
Offline
Posts: 202
|
|
« Reply #53 on: July 24, 2012, 06:57:25 AM »
|
|
|
matchew, thanks for the help, i know ill probably brick it :-P, but seeing as i have to flash through boot mode anyways, i guess its not the worst thing that can happen, i have another idea as to where i can put the call, ill post it up later on
prj i think i understand what your saying, ill have to give it a shot after work
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #54 on: July 24, 2012, 02:07:52 PM »
|
|
|
Back up 95040 as well before you flash anything.
|
|
|
|
|
Logged
|
|
|
|
krazydbiker
Full Member
Karma: +4/-1
Offline
Posts: 202
|
|
« Reply #55 on: July 24, 2012, 04:28:00 PM »
|
|
|
already have  , i wish argdub's tool worked on mine, but i had to use an eeprom reader and clamp it, the reason ive already had to do it was i managed to fry my original ECU, apparently wool socks were not a good thing to wear when touching a circuit board |
|
|
|
|
Logged
|
|
|
|
lulu2003
Full Member
Karma: +11/-1
Offline
Posts: 242
|
|
« Reply #56 on: July 25, 2012, 01:56:21 AM »
|
|
|
btw: is there any special reason to tweak only the ign dwell and not the injection?
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #57 on: July 26, 2012, 01:19:10 PM »
|
|
|
Best way is to retard timing heavily and cut spark sequentially so that some fuel is dumped into the exhaust manifold, where it explodes due to retarded timing and quickly spins up the turbo.
|
|
|
|
|
Logged
|
|
|
|
lulu2003
Full Member
Karma: +11/-1
Offline
Posts: 242
|
|
« Reply #58 on: July 27, 2012, 11:56:14 AM »
|
|
|
but is it important for NLS (0,1-0,2 Sek.)?
it can be useful for anti lag like in rally cars when going off throttle in corners but I speak about only shifting.
|
|
|
|
|
Logged
|
|
|
|
|
prj
|
|
« Reply #59 on: July 27, 2012, 03:34:15 PM »
|
|
|
Well the problem is, cutting fuel is not as quick.
Think about it - fuel injectors basically spray all the time, especially at higher loads.
So if you want to cut everything you always will have to wait for some amount, worst case 2 revolutions, or otherwise you can melt the engine.
Whereas with spark cut, you can just cut all power instantly.
|
|
|
|
|
Logged
|
|
|
|
|
