EEC V file conversion

[jsa]

I can't seem to find either one, I'm not sure what i am doing wrong. IECT may just not be present because it uses a CHT sensor instead.

See if you can find ACT_CNTS or ACT_CNTS.
_CNTS suffix may be used instead of i Prefix.

[ATPCR]

I searched the RZASA def file and came up with this

CaptureiECT.PNG

(7.23 KiB) Not downloaded yet

[jsa]

FIECT cane be found in the CDAN strategy document which is on github.
https://github.com/OpenEEC-Project/Strategy-Documents

- FIECT_3_SH = ECT to force alternate fire, high load.

[jsa]

but I can't seem to be able to find the MAF transfer function either,

Well lets name the MAF Transfer Function in EQE3.

Add this line to your DIR and run SAD again.

Code: Select all

FUN 12254 122CB "uuwFn036_MAF_Transfer" :W V +4096 :W V +1 P +5      # Mass Air Flow meter transfer function.

Have a look at the SAD help document to see what that command is doing. I'm questioning my choice of 4096 which would suit other bins.

You should end up with this.

Code: Select all

   uuwFn036_MAF_Transfer:
12254: ff,ff,dd,11        func         16    ,      4573    
12258: c0,ec,65,0e        func         14.8  ,      3685    
1225c: 00,e0,53,0c        func         14    ,      3155    
12260: c0,d1,4a,0a        func         13.11 ,      2634    
12264: 80,c9,41,09        func         12.59 ,      2369    
12268: 40,c0,36,08        func         12.02 ,      2102    
1226c: c0,b6,32,07        func         11.42 ,      1842    
12270: c0,a5,8e,05        func         10.36 ,      1422    
12274: 40,9c,be,04        func          9.77 ,      1214    
12278: 80,96,4e,04        func          9.41 ,      1102    
1227c: 00,91,e8,03        func          9.06 ,      1000    
12280: 00,8b,82,03        func          8.69 ,       898    
12284: 00,84,14,03        func          8.25 ,       788    
12288: c0,7c,ae,02        func          7.8  ,       686    
1228c: c0,73,41,02        func          7.23 ,       577    
12290: c0,6f,13,02        func          6.98 ,       531    
12294: 40,6a,db,01        func          6.64 ,       475    
12298: 40,64,a3,01        func          6.27 ,       419    
1229c: 00,5f,74,01        func          5.94 ,       372    
122a0: 00,58,3c,01        func          5.5  ,       316    
122a4: 00,50,05,01        func          5    ,       261    
122a8: c0,4b,ea,00        func          4.73 ,       234    
122ac: 80,48,d7,00        func          4.53 ,       215    
122b0: 80,3d,9f,00        func          3.84 ,       159    
122b4: 80,37,83,00        func          3.47 ,       131    
122b8: 80,30,68,00        func          3.03 ,       104    
122bc: c0,2a,55,00        func          2.67 ,        85    
122c0: 80,24,42,00        func          2.28 ,        66    
122c4: 00,00,00,00        func          0    ,         0    
122c8: 00,00,00,00        func          0    ,         0    

And this

Code: Select all

83c0e: b0,19,47           ldb   R47,R19          R47 = LSSI_C;
83c11: b0,17,46           ldb   R46,R17          R46 = LSSI_B;
83c14: b0,15,36           ldb   R36,R15          R36 = LSSI_A;
83c17: fb                 ei                     interrupts ON;
83c18: 93,3b,70,6d,39     orb   R39,[R3a+6d70]   R39 |= [R3a+16d70];
83c1d: 98,39,36           cmpb  R36,R39          
83c20: d7,c8              jne   83bea            if (R36 != R39) goto 83bea;
83c22: c0,cd,46           stw   R46,R1cc         R1cc = R46;
83c25: ef,4d,f6           call  83275            SLU83275_UUWFn (
83c28: f4,01                    #arg 1              uuwFn036_MAF_Transfer,
83c2a: 46,00                    #arg 2              46 );
83c2c: c3,e8,e2,3c        stw   R3c,[Re8+e2]     [11362] = R3c;
83c30: f3                 popp                   PSW = pop();
83c31: f0                 ret                    return;

R1CC would appear to be the location for iMAF. It is a payload that could be logged.
11362 or 1362 (without bank prefix) would appear to be MAF as it receives the output of the lookup. Again a payload that could be logged.

You can read about AICE in the previously mentioned manuals and in the CRAI8 strategy available on github.
https://github.com/OpenEEC-Project/Strategy-Documents

at least not with anything defined in the xdf, It is weird because his def can not be wrong seeing as how he uses it regularly. Some addresses seem wrong as well. Maybe because I am using one of his bins and not a stock read? I am using his xdf file and the PDN0 maurader file with 4r70w bin file.

Looking at the RZASA bin I have here;
Scouting for a 30 row function;

Code: Select all

   Func_12328:
12328: ff,ff,13,e6        func  65535, 58899
1232c: 60,f5,6b,c6        func  62816, 50795
12330: 78,ef,b8,b7        func  61304, 47032
12334: a4,e1,53,9a        func  57764, 39507
12338: 60,d1,ee,7c        func  53600, 31982
1233c: df,c2,e2,66        func  49887, 26338
12340: 27,b8,2f,58        func  47143, 22575
12344: f1,ab,7d,49        func  44017, 18813
12348: 4f,a5,24,42        func  42319, 16932
1234c: 90,96,71,33        func  38544, 13169
12350: d1,8e,18,2c        func  36561, 11288
12354: ab,85,be,24        func  34219,  9406
12358: 7a,81,ce,21        func  33146,  8654
1235c: 73,7a,65,1d        func  31347,  7525
12360: a0,77,ed,1b        func  30624,  7149
12364: 9c,75,75,1a        func  30108,  6773
12368: a2,6d,0c,16        func  28066,  5644
1236c: 7d,67,1b,13        func  26493,  4891
12370: 59,5c,b3,0e        func  23641,  3763
12374: 59,58,3a,0d        func  22617,  3386
12378: 56,4f,4a,0a        func  20310,  2634
1237c: fd,49,d2,08        func  18941,  2258
12380: a2,3c,e1,05        func  15522,  1505
12384: e6,34,69,04        func  13542,  1129
12388: 85,30,ad,03        func  12421,   941
1238c: 37,2b,f1,02        func  11063,   753
12390: ff,24,34,02        func   9471,   564
12394: 3e,22,e9,01        func   8766,   489
12398: 99,06,00,00        func   1689,     0
1239c: 00,00,00,00        func      0,     0

Searching for the address 12328 turns up the default function name being used.

Code: Select all

9c01c: b0,19,47           ldb   R47,R19          TMP0H = LSI_EXP_C;
9c01f: b0,17,46           ldb   R46,R17          TMP0L = LSI_EXP_B;
9c022: b0,15,36           ldb   R36,R15          TMP2L = LSI_EXP_A;
9c025: fb                 ei                     interrupts ON;
9c026: 93,3b,d4,91,39     orb   R39,[R3a+91d4]   TMP3H |= [TMP4L+AICES_AD_FINI];
9c02b: 98,39,36           cmpb  R36,R39          
9c02e: d7,c6              jne   9bff6            if (TMP2L != TMP3H) goto 9bff6;
9c030: c0,7f,46           stw   R46,R17e         IMAF = TMP0L;
9c033: a1,28,23,36        ldw   R36,2328         TMP2L = Func_12328;
9c037: a0,46,38           ldw   R38,R46          TMP3L = TMP0L;
9c03a: ef,9d,6b           call  92bda            SLU92BDA_UUWFn ();
9c03d: 6d,44,44,3c        ml2w  R3c,4444         TMP5L *= 4444;
9c041: 4f,ce,38,3e,40     ml3w  R40,R3e,[Rce+38] TMP7L = TMP6L * [CKINDEX+38];
9c046: 08,01,3e           shrw  R3e,1            TMP6L >>= 1;
9c049: a4,00,3e           adcw  R3e,R0           TMP6L += CY;
9c04c: c3,01,c8,17,3e     stw   R3e,[R0+17c8]    MAF__A = TMP6L;
9c051: 64,40,40           ad2w  R40,R40          TMP7L += TMP7L;
9c054: a4,00,42           adcw  R42,R0           TMP8L += CY;
9c057: c3,e6,f0,42        stw   R42,[Re6+f0]     MAF = TMP8L;
9c05b: f3                 popp                   PSW = pop();
9c05c: f0                 ret                    return;

RZASA iMAF is R17E, again a payload.
RZASA MAF is [RE6+F0] = 1370 or 11370 with bank prefix. Again a payload.

Searching RZASA XDF

Code: Select all

<XDFFUNCTION uniqueid="0xB7B" flags="0x0">
    <title>SP** Mass Airflow Transfer - FN036M (MAF Transfer)</title>
    <description>FN036M - Airmeter [(LBM/MIN)/IMAF] transfer function&#013;&#010;PURPOSE: Calculate MAF__A&#013;&#010;INPUT: MAF sensor voltage IMAF, Units = COUNTS&#013;&#010;OUTPUT: Mass Air Flow, Units = lbm/min</description>
    <CATEGORYMEM index="0" category="3" />
    <XDFAXIS id="x" uniqueid="0x0">
      <EMBEDDEDDATA mmedtypeflags="0x02" mmedaddress="0x12328"
      

[BOOSTEDEVERYTHING]

RZASA MAF is [RE6+F0] = 1370 or 11370 with bank prefix. Again a payload.

Ok, I follow up to here. That is major progress for me, I think. LOL. I see the maf transfer function and see it is assigning a name and address range for the function, I will look into it more after work, as far as exactly what the commands are doing. But I do not understand how you got the above results. I see where maf is [RE6+F0], I see that part in the code now that you laid it out for me. What I do not see is how you got the address for the payload, the = 1370 part. I do understand that with multibank bins you have to add the bank number to the address as a prefix to tell it what bank to look in. Where did you come up with the 1370 part?
Also my wife has had me very busy in the evenings so I have not had a chance to add this and the previous entries to my dir file yet, but I do plan to and report my findings and "translations" as directed. Please don't think I am not following your directions. I appreciate your time and understand that it is very valuable. Thanks very much.

[jsa]

RZASA MAF is [RE6+F0] = 1370 or 11370 with bank prefix. Again a payload.

But I do not understand how you got the above results. I see where maf is [RE6+F0], I see that part in the code now that you laid it out for me. What I do not see is how you got the address for the payload, the = 1370 part.

First up you should look up the opcode C3 to find out what address mode applies, then you should read about that address mode in the manuals. Report back with what address mode it is.

These days I don't have to do anything, SAD is doing the math without intervention on my part.
Look in MSG to find

Code: Select all

rbase e6 11380 

If you look in the raw LST, meaning a LST without the use of DIR or CMT you will find;

Code: Select all

9c057: c3,e6,f0,42        stw   R42,[Re6+f0]     [11370] = R42;

I have used a SYM command in DIR to name the address 11370 as MAF, as you see in the sample code above.

Having read up on the address mode you will find that F0 is a signed number.
For signed bytes, 0x00 to 0x7F are positive and 0x80 to 0xFF are negative.

If you use a hex calculator that does signed math, adding 11380 and F0 will give you 11370. Drop the bank prefix for 1370.

[ATPCR]

@jsa What is "DIR" and "CMT"?
I see that SAD produced a 2nd file named "MSG". What is it for?

[jsa]

@jsa What id "DIR" and "CMT"?
I see that SAD produced a 2nd file named "MSG". What is it for?

DIRective and CoMmenT.

Have a look at the DIR and CMT from here;
https://github.com/OpenEEC-Project/EEC-IV_A9L

They are using V3 syntax.

V4 syntax examples here;
https://github.com/OpenEEC-Project/EEC- ... -Test-Bins

The SAD docs should be read, to better understand usage.
https://github.com/OpenEEC-Project/EEC- ... aster/Docs

The DIRective file is used to DIRect SAD on how the user would like the disassembly to be done and also to name stuff and convert values.

The CMT file can have what ever you like in it, for the purpose of it being output to the LST file.
Both DIR and CMT can have text in them that do not direct SAD or get output to LST.

The user creates the DIR and CMT manually as text files. The file name needs to be binname_dir.txt and binname_cmt.txt.
They are input files read by SAD.



DIR example;
The first line instructs SAD to apply an rbase value over an address range.
The second line uses a # as a way to comment out a dir command
The third line onward has DIR commands with comments at the end.
The comments in DIR are not output to LST.

Code: Select all

rba   32 DB78 40BE 40C2
# rbase 42 26   8B15 8B19
SYM 44  "HSO_Ch*_Stt"                  #W # Control bit for each HSO Channel
SYM  44  "HSO_Ch0_Stt"                :B0 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch1_Stt"                :B1 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch2_Stt"                :B2 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch3_Stt"                :B3 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch4_Stt"                :B4 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch5_Stt"                :B5 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch6_Stt"                :B6 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch7_Stt"                :B7 # HSO Channel 0 Off On State

CMT example;
Line one is commented out by the # as the first character on the line, so it will not be output to LST
Line two onward are all output to LST.

Code: Select all

# 20230303 Commence editing for SAD4.09
2022 # Calibration pointer 1 Contained in Rf0\n
2024 # Calibration pointer 2 Contained in Rf2\n
2026 # Calibration pointer 3 Contained in Rf4\n
2028 # Calibration pointer 4 Contained in Rf6\n
202A # Calibration pointer 5 Contained in Rf8\n
202C # Calibration pointer 6 Contained in Rfa\n
202E # Calibration pointer 7 Contained in Rfc\n
2030 # Calibration pointer 8 Contained in Rfd\n

MSG is output from SAD to inform the user of warnings, errors found and commands used in the disassembly. Commands can be copied to DIR and edited to suit user requirements. It's a good reference on how to write commands for DIR...MSG bug permitting.

[jsa]

@jsa What is "DIR" and "CMT"?

Extract the DIR and the CMT from this ZIP and place it in the same folder as the BIN above, then run SAD.

REAC4.zip

(545.03 KiB) Downloaded 330 times

The BIN is here;
viewtopic.php?p=12275#p12275

[BOOSTEDEVERYTHING]

I'll give it a shot. Sorry, I've been super busy the last few days around the house. I will give this a try tonight when I get home. I will also post up my results from the previous few tasks that you gave me to learn on. Thanks