EEC V file conversion

[jsa]

If you are unable to open one of Decipha's xdf's in anything other than tunerpro, you need to save an unpassworded version out or tunerpro.
What's the password you ask... DONOTEDIT
viewtopic.php?p=5523&hilit=DONOTEDIT#p5523

So once you have an unpassworded xdf from this site, the tunerpro site or where ever, you can open it in a text editor like notepad or whatever.
Better options are;
XML Copy Editor
https://xml-copy-editor.sourceforge.io/
XML Notepad
https://microsoft.github.io/XmlNotepad/

You should be able to open it or import it into excel, but maybe the file extension needs to change from xdf to xml.


To compare, edit and view bins I'm using 010 Editor.
https://www.sweetscape.com/

In one of the Ford Documents in openeec on github, descriptions for Scalars, Functions and Tables are provided. While not really a how to find in LST, it explains what they are.

Basically a function uses an input value to lookup an output value, so you get two columns of data.
The first column of data always goes from maximum to minimum, starting at the hex maximum value and ending at the hex minimum value.

SAD gets most of them and has been getting better at it as releases roll out.

Some examples from your LST.
This is an unsigned word size function.

Code: Select all

   Func_120bc:
120bc: ff,ff,00,09        func  65535,         9    
120c0: 40,51,00,09        func  20800,         9    
120c4: d0,07,00,00        func   2000,         0    
120c8: 00,00,00,00        func      0,         0    
120cc: 00,00,00,00        func      0,         0    
120d0: 00,00,00,00        func      0,         0    
120d4: 00,00,00,00        func      0,         0    

This is an unsigned byte size function.

Code: Select all

   Func_120f4:
120f4: ff,f3              func  255, 243
120f6: e6,f3              func  230, 243
120f8: cd,7a              func  205, 122
120fa: b3,52              func  179,  82
120fc: 9a,3e              func  154,  62
120fe: 80,32              func  128,  50
12100: 57,27              func   87,  39
12102: 05,14              func    5,  20
12104: 00,10              func    0,  16
12106: 00,10              func    0,  16
12108: 00,10              func    0,  16

This is a signed word size function.

Code: Select all

   Func_1256c:
1256c: ff,7f,c3,75        func   32767, 30147
12570: 6e,00,c3,75        func     110, 30147
12574: 4b,00,9a,79        func      75, 31130
12578: 19,00,66,86        func      25, 34406
1257c: f6,ff,3d,8a        func     -10, 35389
12580: 00,80,3d,8a        func  -32768, 35389
12584: 00,80,3d,8a        func  -32768, 35389

This is a signed byte size function.

Code: Select all

   Func_12142:
12142: 7f,19              func   127,  25
12144: 75,00              func   117,   0
12146: 50,00              func    80,   0
12148: 1e,1f              func    30,  31
1214a: 0a,26              func    10,  38
1214c: f6,32              func   -10,  50
1214e: 80,32              func  -128,  50
12150: 80,32              func  -128,  50

If you look in your MSG you will see all the ones SAD has found and the default DIR commands SAD used.
You can copy these to DIR, then change the names and change the conversion.

Code: Select all

func    120bc 120d7: UW X 10 : UW X 10 V 256 

sym 120bc  "Func_120bc"                  # auto

From your MSG, these are the default commands SAD used to identify the subroutines that access function and table data.
You can copy these to DIR, change their names or even add your own additional ones.

Code: Select all

# ------------ Subroutine list----------
sub  83202  "SUYFuncLU_83202"   $ F suyflu 36
sub  83208  "SSYFuncLU_83208"   $ F ssyflu 36
sub  8320d  "USYFuncLU_8320d"   $ F usyflu 36
sub  83212  "UUYFuncLU_83212"   $ F uuyflu 36
sub  83219  "UUYFuncLU_83219"   $ F uuyflu 36
sub  83265  "SUWFuncLU_83265"   $ F suwflu 36
sub  8326b  "SSWFuncLU_8326b"   $ F sswflu 36
sub  83270  "USWFuncLU_83270"   $ F uswflu 36
sub  83275  "UUWFuncLU_83275"   $ F uuwflu 36
sub  8327c  "UUWFuncLU_8327c"   $ F uuwflu 36
sub  833dc  "SYTabLU_833dc"   $ F sytlu 3c 38
sub  833e1  "UYTabLU_833e1"   $ F uytlu 3c 38
sub  833ee  "SYTabLU_833ee"   $ F sytlu 3c 38
sub  833f3  "UYTabLU_833f3"   $ F uytlu 3c 38

This is from your LST. Sub 83275 is looking up Function 120bc using the input value contained in register 186.
The output is saved to register R34.

Code: Select all

080d7: 10,08              rombk 8
080d9: ef,99,b1           call  83275            UUWFuncLU_83275 (
080dc: 5c,00                    #arg 1              Func_120bc,
080de: 86,01                    #arg 2              186 );
080e0: a0,3c,34           ldw   R34,R3c          R34 = R3c;

Very early SAD missed a lot of Functions and Tables so it became second nature to spot functions starts and ends in the byte code. The repetitive use of certain subroutines also guides you on where to look. These days SAD does not miss many.

Having read the available tech documents you will have found that the MAF function is 30 rows long, which also happens to be the longest function.
SAD has found it.

Code: Select all

   Func_12254:
12254: ff,ff,dd,11        func  65535,  4573
12258: c0,ec,65,0e        func  60608,  3685
1225c: 00,e0,53,0c        func  57344,  3155
12260: c0,d1,4a,0a        func  53696,  2634
12264: 80,c9,41,09        func  51584,  2369
12268: 40,c0,36,08        func  49216,  2102
1226c: c0,b6,32,07        func  46784,  1842
12270: c0,a5,8e,05        func  42432,  1422
12274: 40,9c,be,04        func  40000,  1214
12278: 80,96,4e,04        func  38528,  1102
1227c: 00,91,e8,03        func  37120,  1000
12280: 00,8b,82,03        func  35584,   898
12284: 00,84,14,03        func  33792,   788
12288: c0,7c,ae,02        func  31936,   686
1228c: c0,73,41,02        func  29632,   577
12290: c0,6f,13,02        func  28608,   531
12294: 40,6a,db,01        func  27200,   475
12298: 40,64,a3,01        func  25664,   419
1229c: 00,5f,74,01        func  24320,   372
122a0: 00,58,3c,01        func  22528,   316
122a4: 00,50,05,01        func  20480,   261
122a8: c0,4b,ea,00        func  19392,   234
122ac: 80,48,d7,00        func  18560,   215
122b0: 80,3d,9f,00        func  15744,   159
122b4: 80,37,83,00        func  14208,   131
122b8: 80,30,68,00        func  12416,   104
122bc: c0,2a,55,00        func  10944,    85
122c0: 80,24,42,00        func   9344,    66
122c4: 00,00,00,00        func      0,     0
122c8: 00,00,00,00        func      0,     0

[BOOSTEDEVERYTHING]

Ok. thanks. Again, I really do appreciate your time in helping me understand this more. I thought that might be the MAF function when I was going through. The numbers did not look right to me though, are those counts and flow? If so, what units are the flow numbers in? And now with those functions in mind, how would i go about knowing exactly what they do and put them into an XDF file? Again, I am so sorry if all these questions are very trivial or sound stupid, and I really do appreciate your time and effort. I would be happy to pay you for your time somehow. I will check out those programs. Maybe they will make things a little easier for me. Can you think of any other programs I should look into for doing this sort of thing? I do have a licensed version of BE, but I wasn't sure if it still let you build your own def files and add code now that CORE took it over. I did read a lot of the documents you pointed out, it is just a ton of information, I am going to print some of the sections out so I can reference the info while attempting to build this xdf. I am a bit confused on how to find the registers and subroutines in the disassembled file. I was thinking the left most column in the txt was the address of the routines but have found out that can't be correct. I have tried the search function but usually don't get much. Is there something I am missing? Is there a specific template I should download and use for the software recommended? I am guessing you would recommend paying for the personal license for the software?
On a side note, I see you are in Australia, I love the Ford FPV vehicles over there, I wish they would bring that stuff over here. I have been trying to get the emblems for my dad. He wants them for his 1998 ranger. Which is the vehicle this file is for. V8 swapped with explorer 302 cu in pushrod engine with the 4r70w. 2 wheel drive. GT40P heads, small cam and finally found a gt40 intake manifold to put on it. He is a retired Ford senior master tech. I am also a Ford Senior Master tech. If you need any service publications or anything like that let me know, I'd be happy to help in any way I can. Thanks again!!!!

[jsa]

I thought that might be the MAF function when I was going through. The numbers did not look right to me though, are those counts and flow?

Use a calculator to do a hex to decimal conversion, what do you get?

Find the func command in msg that SAD used for the MAF function, then look in the SAD help document to see what the default options were used. What were the default options used by sad to convert from hex?

More later...

[jsa]

And now with those functions in mind, how would i go about knowing exactly what they do

You could leverage the hard work of those that have gone before. Compare your disassembly to others like the GUFB one TVRfan has done. You want to find code sequences that are largely the same, then name your functions to match the function lookup code.

You could find code sequences in your bin that work as described in the strategy documents from openeec.
There are 4 strategy documents over there;
* GUFB
* LHBH1
* CDAN2
* CRAI8

You could find input and output code, identifying what register and ram addresses hold the values of the inputs and outputs. Then look at where those register and ram addresses are used to look up functions or are the result of lookups.

You could read Decipha's guide and use his rules of thumb to identify functions.

Inevitably, you are going to have to be able to read the code and understand what a line of code does and what a block of code does.

and put them into an XDF file?

You could start entering the details from the disassembly into a new xdf using tunerpro.

You could take another 4 bank xdf, say RZASA for example, and change addresses and whatever else is needed to suit your disassembly.

You could use SADX to export an XDF, then edit it as necessary.

First step, learn how to use the software tools such as SAD, SADX, Tunerpro, even BE if you wish.

Can you think of any other programs I should look into for doing this sort of thing?

UltraCompare is another I use for comparing disassemblies.

I do have a licensed version of BE, but I wasn't sure if it still let you build your own def files and add code now that CORE took it over. I

I prefer BE myself, but not every one does. Yes you can still build your own def regardless of CORE. Have a look at the test bins link from above. There is a BE definition included for running the test bins on a QH/EEC.

did read a lot of the documents you pointed out, it is just a ton of information

Yes, and you'll find yourself referring to them a lot.

I was thinking the left most column in the txt was the address of the routines but have found out that can't be correct.

Post an example or screen grab. I'm uncertain about what you are referring too.

I have tried the search function but usually don't get much. Is there something I am missing?

Sounds like it.

Is there a specific template I should download and use for the software recommended?

No

I am guessing you would recommend paying for the personal license for the software?

I use some pay for software because I found the free alternatives lacking in some way.
The choice is yours.

On a side note, I see you are in Australia, I love the Ford FPV vehicles over there, I wish they would bring that stuff over here.

Funny isn't it, we all desire something from somewhere else. The ol' grass is greener over there.

I have been trying to get the emblems for my dad. He wants them for his 1998 ranger. Which is the vehicle this file is for. V8 swapped with explorer 302 cu in pushrod engine with the 4r70w. 2 wheel drive. GT40P heads, small cam and finally found a gt40 intake manifold to put on it. He is a retired Ford senior master tech. I am also a Ford Senior Master tech.

Cool.

If you need any service publications or anything like that let me know, I'd be happy to help in any way I can. Thanks again!!!!

The GHAJ0 strategy document would be handy to have, if it could be found on some dusty old ford server somewhere.
I have most other general service info for the Cosworth.


This might be worth a look;
https://eectuning.org/forums/viewtopic. ... 92#p134910

With an end goal of identifying a function, search your LST for AD_Cmd
Post up each line with AD_Cmd in it.
You should find three.

[BOOSTEDEVERYTHING]

Code: Select all

 Sub_02eb5:
02eb5: f2                 pushp                  push(PSW);
02eb6: af,d8,b2,4a        ldzbw R4a,[Rd8+b2]     wR4a = [10432];
02eba: 41,03,00,4a,4c     an3w  R4c,R4a,3        R4c = R4a & 3;
02ebf: 9b,f5,f0,01,00     cmpb  R0,[Rf4+1f0]     
02ec4: df,26              je    02eec            if ([1277a] != 0)  {
02ec6: b3,4d,88,74,04     ldb   R4,[R4c+7488]    AD_Cmd = [R4c+17488];
02ecb: 33,0a,fd           jnb   B3,Ra,02ecb      if (AD_Ready = 0) goto 02ecb;
02ece: 51,0f,04,49        an3b  R49,R4,f         R49 = AD_Low & f;
02ed2: 9b,4d,88,74,49     cmpb  R49,[R4c+7488]   
02ed7: d7,ed              jne   02ec6            if (R49 != [R4c+17488]) goto 02ec6;
02ed9: 51,f0,04,4e        an3b  R4e,R4,f0        R4e = AD_Low & f0;
02edd: b0,05,4f           ldb   R4f,R5           R4f = AD_High;
02ee0: c3,4d,20,04,4e     stw   R4e,[R4c+420]    [R4c+10420] = R4e;
02ee5: c3,4b,00,04,4e     stw   R4e,[R4a+400]    [R4a+10400] = R4e;
02eea: 20,49              sjmp  02f35            goto 02f35; }

First instance of AD_cmd

Code: Select all

 Sub_8316e:
8316e: a1,8a,6d,34        ldw   R34,6d8a         R34 = 6d8a;
83172: fb                 ei                     interrupts ON;
83173: 56,34,00,04        ad3b  R4,R0,[R34]      AD_Cmd = [R34];
83177: de,21              jlt   8319a            if (AD_Cmd >= 0)  {
83179: 33,0a,fd           jnb   B3,Ra,83179      if (AD_Ready = 0) goto 83179;
8317c: fa                 di                     interrupts OFF;
8317d: 51,0f,04,38        an3b  R38,R4,f         R38 = AD_Low & f;
83181: 9a,34,38           cmpb  R38,[R34]        
83184: d7,ec              jne   83172            if (R38 != [R34]) goto 83172;
83186: 51,f0,04,38        an3b  R38,R4,f0        R38 = AD_Low & f0;
8318a: b0,05,39           ldb   R39,R5           R39 = AD_High;
8318d: 07,34              incw  R34              R34++;
8318f: b2,35,36           ldb   R36,[R34++]      R36 = [R34++];
83192: b2,35,37           ldb   R37,[R34++]      R37 = [R34++];
83195: c2,36,38           stw   R38,[R36]        [R36] = R38;
83198: 27,d8              sjmp  83172            goto 83172; }

8319a: 07,34              incw  R34              R34++;
8319c: af,f0,02,46        ldzbw R46,[Rf0+2]      wR46 = [12062];
831a0: 08,01,46           shrw  R46,1            R46 >>= 1;
831a3: 56,34,00,38        ad3b  R38,R0,[R34]     R38 = [R34];
831a7: de,41              jlt   831ea            if (R38 >= 0)  {
831a9: c4,39,38           stb   R38,R39          R39 = R38;
831ac: 93,47,6a,6d,38     orb   R38,[R46+6d6a]   R38 |= [R46+16d6a];
831b1: 28,38              scall 831eb            Sub_831eb ();
831b3: b1,03,42           ldb   R42,3            R42 = 3;
831b6: e0,42,fd           djnz  R42,831b6        R42--;
                                                 if (R42 != 0) goto 831b6;
831b9: b0,15,36           ldb   R36,R15          R36 = LSSI_A;
831bc: 73,47,6c,6d,36     an2b  R36,[R46+6d6c]   R36 &= [R46+16d6c];
831c1: 9b,47,6e,6d,36     cmpb  R36,[R46+6d6e]   
831c6: df,f1              je    831b9            if (R36 = [R46+16d6e]) goto 831b9;
831c8: fa                 di                     interrupts OFF;
831c9: b0,19,3b           ldb   R3b,R19          R3b = LSSI_C;
831cc: b0,17,3a           ldb   R3a,R17          R3a = LSSI_B;
831cf: b0,15,36           ldb   R36,R15          R36 = LSSI_A;
831d2: fb                 ei                     interrupts ON;
831d3: 93,47,70,6d,39     orb   R39,[R46+6d70]   R39 |= [R46+16d70];
831d8: 98,39,36           cmpb  R36,R39          
831db: d7,c6              jne   831a3            if (R36 != R39) goto 831a3;
831dd: 07,34              incw  R34              R34++;
831df: b2,35,36           ldb   R36,[R34++]      R36 = [R34++];
831e2: b2,35,37           ldb   R37,[R34++]      R37 = [R34++];
831e5: c2,36,3a           stw   R3a,[R36]        [R36] = R3a;
831e8: 27,b9              sjmp  831a3            goto 831a3; }

831ea: f0                 ret                    return;

Second and third instance.
Are these examples above 2 different subroutines? Meaning is the whole copy paste in the second "pasting" just one routine?
the numbers to the far left, are those addresses in the code, if not what are their significance? I'm think i am just having issues wrapping my head around "code" period.

Code: Select all

Sub_8316e:
8316e: a1,8a,6d,34        ldw   R34,6d8a         R34 = 6d8a;

these lines for example.... The first line is the "name" of the subroutine for the block of code, correct? and the second line just looses me really, Having issues understanding what it is actually doing, I guess.
I'm so sorry if my questions seem stupid, I honestly want to learn this, but maybe it is over my head? I am looking through the strategy docs for a way to tell what the sub_8316e actually does and can't find anything. I did however find this in the GUFB doc:

Code: Select all

For 1988 and beyond, the procedure has been  changed  to  make  this  process

      easier.   The  new  process  removes  CALID  and replaces it with ROM_TO.  In

      addition, VERID has been deleted and a new parameter "FIXSUM" has been added.

      FIXSUM should always be set to 0.  Specifically:





      1.  The non-modifiable Vector  parameter  "ROM_TO"  replaces  the  old  CALID

          parameter  as  the ROM chip identifier.  The ROM_TO value is generated by

          Vector during a calibration release and is located  at  200A  HEX.   This

          value  is  the complement of the ROM pattern CHECKSUM and is also used to

          perform the EEC-IV diagnostic "CHECKSUM Memory Test".



      2.  The new parameter "FIXSUM" is a Vector calibration parameter  located  at

          2004  HEX  and should always be set to 0.  This parameter will be used to

          assure the ROM_TO values are unique and will only be changed by the  SWDV

          engineer if a duplicate ROM_TO value is found.

I noticed some talk going on about that in the post you linked for me to read.
Again, I'm sorry if I am bugging you or anything like that, I appreciate all the help you have been giving me and the patience you have shown me as well. Thanks again so much!!

[jsa]

Let's deal with the basics first...

Code: Select all

Sub_8316e:
8316e: a1,8a,6d,34        ldw   R34,6d8a         R34 = 6d8a;

these lines for example.... The first line is the "name" of the subroutine for the block of code, correct?

The first line is the default name given to the subroutine by SAD. It's the prefix Sub_ and the address of the start of the subroutine.

and the second line just looses me really, Having issues understanding what it is actually doing, I guess.

I'll be referring to the software manual and hardware manual;
https://github.com/OpenEEC-Project/Usef ... Manual.pdf
https://github.com/OpenEEC-Project/Usef ... erence.pdf

8316e: Is the bank number and hex address. That is Bank 8, Hex address 316e in Bank 8.

A1 The first hex byte is always an operation code. The opcode determines what operation the processor will do.
See page 6-100 of the hardware manual for Table 6-25 of opcodes. See A1 is LDW, short for Load Word.
See page 6-101 of the hardware manual for Table 6-26 of opcodes. See LDW A1 address mode is Immediate.
Immediate means an inline hex value is loaded directly. You will need to understand address modes eventually.
Start reading at 5-5.2.1 on Page 5-52 of the hardware manual.
Start reading at 6-8.2.1 on Page 6-54 of the hardware manual.
Start reading at 3-2.1 on Page 3-4 of the software manual.
Start reading Page 3-94 of the software manual for LDW.

8a,6d Is the inline immediate value 0x6d8a that is loaded. Two bytes long because it's a word.
Read about endianess;
https://en.wikipedia.org/wiki/Endianness

34 Is the destination register, In fact R34 and R35 are used because a word is being loaded. 8a is loaded into R34 and 6d is loaded into R35.

ldw R34,6d8a Is a pseudo code representation of opcode and operands.

R34 = 6d8a Informs you that R34 contains the hex value 0x6d8a

but maybe it is over my head?

If you have no decimal/hex/bin coding knowledge, it's going to take time time understand the basics then build on that.

I am looking through the strategy docs for a way to tell what the sub_8316e actually does and can't find anything.

Not all Subs are detailed exactly. Some require understanding the code.
Read from 6-5.14 on page 6-70 of the hardware manual.
Search GUFB and the other strategy documents for A/D

These are analog to digital conversion subroutines. Analog values must be read and converted to digital values so they can be used as inputs to look up functions.

More later, likely after the weekend. Bathurst is on this weekend.

[BOOSTEDEVERYTHING]

Where do I find the destination registers? Thanks you so much for the break down. It helps tremendously. I will sit down and read the recommended sections of the manuals and see if I can get further. Thank you again.

[jsa]

Read and you will find the answer.

[ATPCR]

@jsa is this a downloadable tool? https://github.com/tvrfan/EEC-IV-disas ... _4.012.exe and where is the download button?

[jsa]

Click on View raw to start the download.