ok, i started over using setzi's code. i think i can make some sense of his code.

here is my routine:

ROM:8FFA60 sub_8FFA60:
ROM:8FFA60                 jnb     word_FD48.9, loc_8FFA88
ROM:8FFA64                 mov     r4, word_9C40
ROM:8FFA68                 exts    #81h, #1 ; 'ü'
ROM:8FFA6C                 mov     r9, word_817E00
ROM:8FFA70                 cmp     r4, r9
ROM:8FFA72                 jmpr    cc_NC, loc_8FFA88
ROM:8FFA74                 mov     r4, word_F87A
ROM:8FFA78                 exts    #81h, #1 ; 'ü'
ROM:8FFA7C                 mov     r9, word_817E02
ROM:8FFA80                 cmp     r4, r9
ROM:8FFA82                 jmpr    cc_ULE, loc_8FFA88
ROM:8FFA84                 movb    byte_8BA4, ZEROS
ROM:8FFA88
ROM:8FFA88 loc_8FFA88:                             ; CODE XREF: sub_8FFA60j
ROM:8FFA88                                         ; sub_8FFA60+12j ...
ROM:8FFA88                 exts    #38h, #1 ; '8'
ROM:8FFA8C                 movb    rl4, byte_384FF2
ROM:8FFA90                 jmpr    cc_NZ, loc_8FFAA0
ROM:8FFA92                 jnb     word_FD48.9, loc_8FFAD4
ROM:8FFA96                 exts    #38h, #1 ; '8'
ROM:8FFA9A                 movb    byte_384FF2, ONES
ROM:8FFA9E                 jmpr    cc_UC, loc_8FFAD4
ROM:8FFAA0 ; ---------------------------------------------------------------------------
ROM:8FFAA0
ROM:8FFAA0 loc_8FFAA0:                             ; CODE XREF: sub_8FFA60+30j
ROM:8FFAA0                 jnb     word_FD48.9, loc_8FFAC8
ROM:8FFAA4                 exts    #38h, #1 ; '8'
ROM:8FFAA8                 mov     r4, word_384FF0
ROM:8FFAAC                 exts    #81h, #1 ; 'ü'
ROM:8FFAB0                 mov     r9, word_817E04
ROM:8FFAB4                 cmp     r4, r9
ROM:8FFAB6                 jmpr    cc_NC, loc_8FFAD4
ROM:8FFAB8                 movb    byte_8DAC, ZEROS
ROM:8FFABC                 add     r4, #1
ROM:8FFABE                 exts    #38h, #1 ; '8'
ROM:8FFAC2                 movb    word_384FF0, rl4
ROM:8FFAC6                 jmpr    cc_UC, loc_8FFAD4
ROM:8FFAC8 ; ---------------------------------------------------------------------------
ROM:8FFAC8
ROM:8FFAC8 loc_8FFAC8:                             ; CODE XREF: sub_8FFA60:loc_8FFAA0j
ROM:8FFAC8                 exts    #38h, #2 ; '8'
ROM:8FFACC                 mov     word_384FF0, ZEROS
ROM:8FFAD0                 movb    byte_384FF2, ZEROS
ROM:8FFAD4
ROM:8FFAD4 loc_8FFAD4:                             ; CODE XREF: sub_8FFA60+32j
ROM:8FFAD4                                         ; sub_8FFA60+3Ej ...
ROM:8FFAD4                 movb    rl4, byte_899C
ROM:8FFAD8                 rets
ROM:8FFAD8 ; End of function sub_8FFA60

i used the 17e00 and 17e04 from his patched file and 17e02 i set to 803e (4000rpm). i tried to reverse the m box code to find the locations of the bytes in my file and update them in the code. however, the antilag still does not work. can someone maybe give me a pointer as to where my code is incorrect? i attached the original file.

k0mpresd, do you have Hex-Rays?  It's a simple plugin that will render some C code equivalent to the disassembly you're looking at.  Not sure if it will work for these binaries but it works for x86 binaries so it's worth a shot.

Looking at C code instead of ASM will undoubtedly make your life much, much easier.

Any progress on the 1.8T porting?

Any more info on the blown coils caused by these mods?

There is no "1.8T" port working for all 1.8T cars. Added code runs only on the
specific box it was made for. If you want to get some custom added code running
on another image, you have to find out several addresses of internal variables.
These addresses vary with each image. Then assemble the code again,
using the updated variable addresses and link it into the existing code.
So for every new image, the work starts again. No copy-and-paste of
custom code is possible  .

Regarding the blown coils: the "hack" of setting the closing time to zero is
not working with older version of the ignition driver software in the ecu.
The sw driver doesn't handle this correctly and produces "illegal" ignition pulses,
leading to high current in the ignition system. If you have an ecu with old
ignition driver software, you have to implement the interruption of ignition
in a different way, otherwise you will risk your coils (or just blow a fuse if you are lucky).

Without dissasmebly, afraid not.

Rick

by the way, looks like VNMX location isn't correct   Please someone help me to locate it.... Addresses in 16xxx looks OK. Don't know about CWDNMAX also  

UPDATE:
Found possible CWDNMAX @ 11872 and two possible locations of TNMXH @ 16173 and 161B5... Also looking deeper at the TMOTNMX revealed that it might also be incorrect...

Please read at least the last few posts

What is this?