BOOSTEDEVERYTHING wrote: ↑2023 Oct 08, 22:12
but I can't seem to be able to find the MAF transfer function either,
Well lets name the MAF Transfer Function in EQE3.
Add this line to your DIR and run SAD again.
Code: Select all
FUN 12254 122CB "uuwFn036_MAF_Transfer" :W V +4096 :W V +1 P +5 # Mass Air Flow meter transfer function.
Have a look at the SAD help document to see what that command is doing. I'm questioning my choice of 4096 which would suit other bins.
You should end up with this.
Code: Select all
uuwFn036_MAF_Transfer:
12254: ff,ff,dd,11 func 16 , 4573
12258: c0,ec,65,0e func 14.8 , 3685
1225c: 00,e0,53,0c func 14 , 3155
12260: c0,d1,4a,0a func 13.11 , 2634
12264: 80,c9,41,09 func 12.59 , 2369
12268: 40,c0,36,08 func 12.02 , 2102
1226c: c0,b6,32,07 func 11.42 , 1842
12270: c0,a5,8e,05 func 10.36 , 1422
12274: 40,9c,be,04 func 9.77 , 1214
12278: 80,96,4e,04 func 9.41 , 1102
1227c: 00,91,e8,03 func 9.06 , 1000
12280: 00,8b,82,03 func 8.69 , 898
12284: 00,84,14,03 func 8.25 , 788
12288: c0,7c,ae,02 func 7.8 , 686
1228c: c0,73,41,02 func 7.23 , 577
12290: c0,6f,13,02 func 6.98 , 531
12294: 40,6a,db,01 func 6.64 , 475
12298: 40,64,a3,01 func 6.27 , 419
1229c: 00,5f,74,01 func 5.94 , 372
122a0: 00,58,3c,01 func 5.5 , 316
122a4: 00,50,05,01 func 5 , 261
122a8: c0,4b,ea,00 func 4.73 , 234
122ac: 80,48,d7,00 func 4.53 , 215
122b0: 80,3d,9f,00 func 3.84 , 159
122b4: 80,37,83,00 func 3.47 , 131
122b8: 80,30,68,00 func 3.03 , 104
122bc: c0,2a,55,00 func 2.67 , 85
122c0: 80,24,42,00 func 2.28 , 66
122c4: 00,00,00,00 func 0 , 0
122c8: 00,00,00,00 func 0 , 0
And this
Code: Select all
83c0e: b0,19,47 ldb R47,R19 R47 = LSSI_C;
83c11: b0,17,46 ldb R46,R17 R46 = LSSI_B;
83c14: b0,15,36 ldb R36,R15 R36 = LSSI_A;
83c17: fb ei interrupts ON;
83c18: 93,3b,70,6d,39 orb R39,[R3a+6d70] R39 |= [R3a+16d70];
83c1d: 98,39,36 cmpb R36,R39
83c20: d7,c8 jne 83bea if (R36 != R39) goto 83bea;
83c22: c0,cd,46 stw R46,R1cc R1cc = R46;
83c25: ef,4d,f6 call 83275 SLU83275_UUWFn (
83c28: f4,01 #arg 1 uuwFn036_MAF_Transfer,
83c2a: 46,00 #arg 2 46 );
83c2c: c3,e8,e2,3c stw R3c,[Re8+e2] [11362] = R3c;
83c30: f3 popp PSW = pop();
83c31: f0 ret return;
R1CC would appear to be the location for iMAF. It is a payload that could be logged.
11362 or 1362 (without bank prefix) would appear to be MAF as it receives the output of the lookup. Again a payload that could be logged.
You can read about AICE in the previously mentioned manuals and in the CRAI8 strategy available on github.
https://github.com/OpenEEC-Project/Strategy-Documents
at least not with anything defined in the xdf, It is weird because his def can not be wrong seeing as how he uses it regularly. Some addresses seem wrong as well. Maybe because I am using one of his bins and not a stock read? I am using his xdf file and the PDN0 maurader file with 4r70w bin file.
Looking at the RZASA bin I have here;
Scouting for a 30 row function;
Code: Select all
Func_12328:
12328: ff,ff,13,e6 func 65535, 58899
1232c: 60,f5,6b,c6 func 62816, 50795
12330: 78,ef,b8,b7 func 61304, 47032
12334: a4,e1,53,9a func 57764, 39507
12338: 60,d1,ee,7c func 53600, 31982
1233c: df,c2,e2,66 func 49887, 26338
12340: 27,b8,2f,58 func 47143, 22575
12344: f1,ab,7d,49 func 44017, 18813
12348: 4f,a5,24,42 func 42319, 16932
1234c: 90,96,71,33 func 38544, 13169
12350: d1,8e,18,2c func 36561, 11288
12354: ab,85,be,24 func 34219, 9406
12358: 7a,81,ce,21 func 33146, 8654
1235c: 73,7a,65,1d func 31347, 7525
12360: a0,77,ed,1b func 30624, 7149
12364: 9c,75,75,1a func 30108, 6773
12368: a2,6d,0c,16 func 28066, 5644
1236c: 7d,67,1b,13 func 26493, 4891
12370: 59,5c,b3,0e func 23641, 3763
12374: 59,58,3a,0d func 22617, 3386
12378: 56,4f,4a,0a func 20310, 2634
1237c: fd,49,d2,08 func 18941, 2258
12380: a2,3c,e1,05 func 15522, 1505
12384: e6,34,69,04 func 13542, 1129
12388: 85,30,ad,03 func 12421, 941
1238c: 37,2b,f1,02 func 11063, 753
12390: ff,24,34,02 func 9471, 564
12394: 3e,22,e9,01 func 8766, 489
12398: 99,06,00,00 func 1689, 0
1239c: 00,00,00,00 func 0, 0
Searching for the address 12328 turns up the default function name being used.
Code: Select all
9c01c: b0,19,47 ldb R47,R19 TMP0H = LSI_EXP_C;
9c01f: b0,17,46 ldb R46,R17 TMP0L = LSI_EXP_B;
9c022: b0,15,36 ldb R36,R15 TMP2L = LSI_EXP_A;
9c025: fb ei interrupts ON;
9c026: 93,3b,d4,91,39 orb R39,[R3a+91d4] TMP3H |= [TMP4L+AICES_AD_FINI];
9c02b: 98,39,36 cmpb R36,R39
9c02e: d7,c6 jne 9bff6 if (TMP2L != TMP3H) goto 9bff6;
9c030: c0,7f,46 stw R46,R17e IMAF = TMP0L;
9c033: a1,28,23,36 ldw R36,2328 TMP2L = Func_12328;
9c037: a0,46,38 ldw R38,R46 TMP3L = TMP0L;
9c03a: ef,9d,6b call 92bda SLU92BDA_UUWFn ();
9c03d: 6d,44,44,3c ml2w R3c,4444 TMP5L *= 4444;
9c041: 4f,ce,38,3e,40 ml3w R40,R3e,[Rce+38] TMP7L = TMP6L * [CKINDEX+38];
9c046: 08,01,3e shrw R3e,1 TMP6L >>= 1;
9c049: a4,00,3e adcw R3e,R0 TMP6L += CY;
9c04c: c3,01,c8,17,3e stw R3e,[R0+17c8] MAF__A = TMP6L;
9c051: 64,40,40 ad2w R40,R40 TMP7L += TMP7L;
9c054: a4,00,42 adcw R42,R0 TMP8L += CY;
9c057: c3,e6,f0,42 stw R42,[Re6+f0] MAF = TMP8L;
9c05b: f3 popp PSW = pop();
9c05c: f0 ret return;
RZASA iMAF is R17E, again a payload.
RZASA MAF is [RE6+F0] = 1370 or 11370 with bank prefix. Again a payload.
Searching RZASA XDF
Code: Select all
<XDFFUNCTION uniqueid="0xB7B" flags="0x0">
<title>SP** Mass Airflow Transfer - FN036M (MAF Transfer)</title>
<description>FN036M - Airmeter [(LBM/MIN)/IMAF] transfer function
PURPOSE: Calculate MAF__A
INPUT: MAF sensor voltage IMAF, Units = COUNTS
OUTPUT: Mass Air Flow, Units = lbm/min</description>
<CATEGORYMEM index="0" category="3" />
<XDFAXIS id="x" uniqueid="0x0">
<EMBEDDEDDATA mmedtypeflags="0x02" mmedaddress="0x12328"