EFIDynoTuning Forum

hello guys,
after days of reading through many and every post it seems im now here for my first post.
to cut to the chase if u dont want to read the whole post ;
Q. [HOW DO WE PATCH THE CODE FOR DATALOGGING?]

car 1999 ford falcon au series 1.5 EEC-V WANA catch code ..

im seeking how to do datalogging as specifically applied on australian 6cyl AU falcons using TPRT and QH.

there are numerous people here running the v8s in their AU falcons which have fair support but no one seems to have cracked QH datalogging for the 6 cyls..

I have the bin and a basic xdf sorted .. i got the bin from my own vehicle using the QH and the xdf is one from ti-performance website library (brilliant of those guess to give anyone access FOR FREE!!) issue was though that the xdf from ti was a mess with tables for the AF and Spark having incorrect address.. well i was able to fix that by looking at other xdfs and bins for similar 6cyls from their library and seeing what they should look like... i then went through the binaries and found the tables and adjusted them (this took me considerable time) .. things now look a lot better..
if u like u can see the original (but wrong) ti xdf here -> https://www.tiperformance.com.au/Defini ... XL1_v4.xdf .. i will try to attatch my modified xdf to this post so you can compare it if you like and use it if anyone wants..

i can modify the bin now no problem but the issue is data collection.. i would like to be able to see target AF as well as KAMRFs... i have been using an ELM327 and forscan to get LTFT and park adv but it has no access to target AF that i know of..

NOW TO THE POINT

WHAT I WANT TO DO IS ENABLE QH DATALOGGING / LIVE DATA..

I have followed decipha's step guides here : Datalogging / Standardized ADX (find on main page http://www.efidynotuning.com ) as well as the How To: Getting Started ( http://www.efidynotuning.com/started.htm )..

BUT THERE DOESNT APPEAR TO BE INFO FOR SOMEONE LIKE IN MY CASE..

what i think i need to do is create an ADX file and "patch" the binary so to shift a copy of the EECs "payload" parameters into the QH .. as far as i can tell this is done by a patch via the XDF file.. the XDF patches the binary - i think..

SO HOW DO I patch the binary? HOW DO I add the patch to my XDF?

I have tried to look into the decypha xdfs but they are password protected so that is no help..
i have downloaded and tried a couple of the available BIN XDF and ADX ([A1C] Strategy Files) and followed the Datalogging / Standardized ADX page
but when it comes to this step ...

4 "fourth, load your current .bin tune file into tunerpro and hold the Ctrl button on the keyboard and press F to bring up FIND
5 -fifth, type in: datalogging and press enter. Double click on the Enable Datalogging Patch and PATCH your tune file."

or following the getting started page :

Enable Datalogging (Quarterhorse ONLY)
For realtime tuning with a Quarterhorse, to datalog you must first enable datalogging in your custom tune file. In TunerPro hold down Ctrl and press the F key to bring up the Find/Search box. Type in "Univ" and press enter, you will see the Universal ADX Datalogging Patch show up in the listing box. Double click on it and the Universal ADX Patch will now pop up. Click on "Patch" to enable Datalogging and then click "Apply" to verify you want to save your changes.


well it doesnt find the file..

so first question is HOW DO WE PATCH THE CODE FOR DATALOGGING?

thanks for reading..

the password is DONOTEDIT

It sounds like you havent dont any disassembly so your not going to be able to.

But after you disassemble the file, first you need to identify all the ram addresses for the payloads you want to log. Then find the console routine. Usually a disassembly search for 1f1c will find the tail end of the console routine. You can remove the raminit flag immediately after that and put a call there to an area in rom with null filler. You can then use my patch code from RZASA. Be sure the raminit flag gets put in the new code. You have to verify the bank references are the same and your listing address is correct. The listing address is another area in rom of null filler you put the actual ram addresses in to shadow. This is the Ops List function.

Your best option would be to try to find a DMR list for your strategy.

ok i have begun the disassembly..

following decipha instructions from : http://www.efidynotuning.com/dis.htm

1. "Run the Disassembler
Now is the time to run your binary through the disassembler. Simply drag and drop the bin file over the SAD executable and it will begin."..

I did this using SAD Version 4.0.6, i guess this is the correct one to use?

2. "SAD - _msg.txt - Messages
- - First things first, open up the message file stock_msg.txt and make sure theres no major errors."
so far so good, but really i have no idea if there are errors or not..

3. " Scroll on down to the 2nd rbase list toward the end of the messages file."
OK ... PROBLEM : there is no 2nd rbase list, only one rbase list and it is near the top..

rbase 62 680
rbase 64 780
rbase 66 880
rbase 68 980
rbase 6a a80
rbase 6c b80
rbase 6e d94
rbase 70 1080
rbase 72 1180
rbase f0 12060 # cmd
rbase f2 126bc # cmd
rbase f4 134fa # cmd
rbase f6 14832 # cmd
rbase f8 1502c # cmd
rbase fa 1577e # cmd
rbase fc 15bbe # cmd
rbase fe 17c8a # cmd
# ------------ Subroutine list----------
lots
# ------------ Symbol list ----
lots
# ----- END of disassembly run -----

4. "Now click just above it and scroll back up to the top, hold down the Shift button and Press A to select all of it and press backspace, you'll now see the rbase list at the top of the msgs file in notepad. Now scroll on down to the end of the subroutine list just beaneath it and deleted everything after the end of the subroutine list. You can do a simple Ctrl + F and pop up the find type in "---" and delete the entire line that those comments are noted. Now save the file as stock_dir.txt You now have a directive file to begin tinkering."

PROBLEM -- i really have no idea what the the directive file should look like and what it should contain..

5. "Now scroll on down to the end of the subroutine list just beaneath it and deleted everything after the end of the subroutine list."

SO i will be deleting the "symbol" list.. hmm ok .. really just flying blind following instructions..
question .. what is the directive file meant to contain at this stage?

I have included the msg file in attachments ... it is WANA_msg.bin .. i had to change the extension to .bin because the forum was giving me a "not valid filetype" message.. to view just swap it back to .txt..

now when i ran teh SAD it produced a _lst file without doing what your instructions suggest... is this normal?

in addition after i ran the SAD i had had look in the _lst file... it seems to have found about 70 tables.. (this was before actually following the decipha instructions. .. all i had done was run the SAD and it produced the lst and the msg files)

so went through them and compared them to where i thought some of my tables should be,...

i found my addaptive update table wasnt a table (as list in _lst).. lst just reports it as "14130 -> 1415f = 0x3 ## fill ## "
so i had the adaptive table as just all 3's.. yes it seemed strange .. but hey how do i know what is normal..

i believe the addaptive update table should be 10x9... _lst found 4 lots of 10x9 tables but when looking at the data contained in them they dont look right.. eg the 10x9 table at 147D8 has 4 cells with -128 values ... this makes no sense as -128 would mean reference row 12 column 8 presumably or heck it could even mean row 1 column 28 ... there are not 12 rows and there are not 12 columns either in this table..

my other options dont look right either..
ive attached pics of the tables if you want to look at them..

but it does seem i half right on the track..

little update..
i ran it with SAD 4.0.7.16..

and i only get 43 tables..

when i ran it with SAD 4.0.6 i got 70 tables..

how is the newer version working worse for this..

not sure what i am doing wrong..

thats cool now you need to go through the listing file and make sense of the code to figure out what its doing so you can identify those tables functions etc...

OzFalcon wrote: ↑2022 Feb 17, 11:27 little update..
i ran it with SAD 4.0.7.16..
and i only get 43 tables..
when i ran it with SAD 4.0.6 i got 70 tables..
how is the newer version working worse for this..
not sure what i am doing wrong..

SAD 4.0.7.16 is the latest beta release and the best version for 8065 Bins because of a number of fixes relating to memory access modes. The various methods being used to discover functions and tables were getting it wrong in earlier releases so they have been removed to make way for a different approach.

Even though it is a beta release it is less buggy than all before it.

Semi Automated Dissassembler, SAD, means end user input required by using the DIR file. You are not doing anything wrong, you just need to do the non automated stuff.

If you work through all calls and jumps to the lookup subroutines you will find addresses for all the functions and tables.

If you are convinced earlier SAD versions are getting functions and tables correct, copy the FUN and TAB commands from those MSG files to your 40716 DIR file.

You can also use SAD 806x as a way of finding addresses of parameters.

OzFalcon wrote: ↑2022 Feb 17, 08:58 1.
I did this using SAD Version 4.0.6, i guess this is the correct one to use?

Use SAD 4.07.16 and SAD 806x v1.4-20211122.
https://github.com/tvrfan/EEC-IV-disass ... evelopment
https://github.com/OpenEEC-Project/SAD8 ... 4-20211122

2. "SAD - _msg.txt - Messages
- - First things first, open up the message file stock_msg.txt and make sure theres no major errors."
so far so good, but really i have no idea if there are errors or not..

It will have entries that say ERROR or WARNING. None in the MSG then don't worry about it.

3. " Scroll on down to the 2nd rbase list toward the end of the messages file."
OK ... PROBLEM : there is no 2nd rbase list, only one rbase list and it is near the top..

Instructions written for earlier SAD, obviously.
Not all information has kept up with the changes to SAD.

4. PROBLEM -- i really have no idea what the the directive file should look like and what it should contain..

SAD has been written with a golden rule in mind...the user is ALWAYS correct.
The DIR file is intended to DIRect SAD toward correct disassembly.
Only put commands in the DIRective file that you know to be 100% correct or temporarily as a trial.
Copying all MSG commands to DIR used to be necessary in early versions, but not so with current versions.
Putting everything from MSG to DIR without scrutiny is counterproductive when SAD gets it wrong.

Read the 'outdated' help file, as well as the versions files.
https://github.com/tvrfan/EEC-IV-disass ... aster/Docs
https://github.com/tvrfan/EEC-IV-disass ... rsions.txt

These test bins have examples of what goes into DIR and CMT files.
There is a bug in the BIN, you get bonus point if you find it!
The 4.07.12 DIR and CMT are suitable examples for 4.07.16.
https://github.com/OpenEEC-Project/EEC- ... -Test-Bins

These were completed with earlier versions of SAD, so the command syntax is out of date, but it gives you an idea of what can be put in DIR and CMT.
https://github.com/OpenEEC-Project/EEC-IV_A9L
https://github.com/OpenEEC-Project/EEC-IV_AA
https://github.com/OpenEEC-Project/EEC-IV_M0M2
There are more on OpenEEC.

now when i ran teh SAD it produced a _lst file without doing what your instructions suggest... is this normal?

Normally a LST is produced every time SAD runs on a BIN.

If you get stuck with current command syntax, post up here.

OzFalcon wrote: ↑2022 Feb 17, 09:17
i found my addaptive update table wasnt a table (as list in _lst).. lst just reports it as "14130 -> 1415f = 0x3 ## fill ## "
so i had the adaptive table as just all 3's.. yes it seemed strange .. but hey how do i know what is normal..

Yep, hence 40716 dropped the faulty function and table methods.

i believe the addaptive update table should be 10x9... _lst found 4 lots of 10x9 tables but when looking at the data contained in them they dont look right.. eg the 10x9 table at 147D8 has 4 cells with -128 values ... this makes no sense as -128 would mean reference row 12 column 8 presumably or heck it could even mean row 1 column 28 ... there are not 12 rows and there are not 12 columns either in this table..

my other options dont look right either..
ive attached pics of the tables if you want to look at them..

but it does seem i half right on the track..

Functions scale the row and column counts. Work backwards from the table lookup inputs to find the row and column counts.
Once you know exactly what they are put commands in the DIR.

ok thanks heaps for all that ..

what i have decided to try and do is sort the DEF file out first and not focus on the datalogging patch just yet..
i think i will have more luck with solving that if i first learn the basics of finding tables and functions.. and scalars (but those seem daunting, trying to work out what 1 byte does amoungst 256K of them)..

dont know if i should start a new topic of def creation using SAD because that is what i am basically doing now... here or on EECtuning.. or maybe elsewhere..