Australian AU falcon 6cyl QH datalogging PATCH CODE

[jsa]

There are buckets of threads already on eectuning, a couple here.
tack on to an existing one or start afresh with questions as you see fit.

I don't think TVRfan and Pym are members here since the forum crashed.

[OzFalcon]

i just ran SAD406 and SAD407_16 on another known good def and bi n from the tiperformance page... the 12BEbin and NGIC9.xdf..

and guess what... the older SAD406 version found all the main tables.. but the newer SAD407_16 didnt..

something is seriously wrong with either me or the software..

the older software is producing much better table results..so am i just going to continue using the older SAD for now..

OK OK

so i am sure that the tables are correct... how do i take the next step and put them in the directives file?

If you are convinced earlier SAD versions are getting functions and tables correct, copy the FUN and TAB commands from those MSG files to your 40716 DIR file.

sounds good ,, how do i do that?

[OzFalcon]

looking in the msg file..

these are the tables i am sure are right.. in this case of the 12BE bin..

table 13792 137eb "Table_13792" : O 10 UY -- -- this is the fuel base table ,, do i replace "Table_13792" with "fuel base table"???
table 13726 13791 "Table_13726" : O 12 UY
table 137ec 1383b "Table_137ec" : O 10 UY
table 13966 139d1 "Table_13966" : O 12 UY

etc etc..

do i just past them into an empty notepad file and save the file as 12BE_dir.txt (or WANA_dir.txt for my bin).. and then rerun SAD?

[decipha]

correct

[jsa]

i just ran SAD406 and SAD407_16 on another known good def and bi n from the tiperformance page... the 12BEbin and NGIC9.xdf..
and guess what... the older SAD406 version found all the main tables.. but the newer SAD407_16 didnt..
something is seriously wrong with either me or the software..
the older software is producing much better table results..so am i just going to continue using the older SAD for now..

SAD 4.0.7.16 is the latest beta release and the best version for 8065 Bins because of a number of fixes relating to memory access modes. The various methods being used to discover functions and tables were getting it wrong in earlier releases so they have been removed to make way for a different approach.

Even though it is a beta release it is less buggy than all before it.

Bug reports are welcome.

The reasons why you get differences were covered above already. However, no use continuously bitching and moaning about the disassemblers, they are a work in progress. Learn to work with them, help improve them, or write your own. For a bit of perspective try this early SAD version or the BL disassembler and see how far you get.
BL's is on github openeec. Here's the early SAD;

sad20130610.zip

(200.06 KiB) Downloaded 228 times

so i am sure that the tables are correct... how do i take the next step and put them in the directives file?

looking in the msg file..

these are the tables i am sure are right.. in this case of the 12BE bin..

table 13792 137eb "Table_13792" : O 10 UY -- -- this is the fuel base table ,, do i replace "Table_13792" with "fuel base table"???
table 13726 13791 "Table_13726" : O 12 UY
table 137ec 1383b "Table_137ec" : O 10 UY
table 13966 139d1 "Table_13966" : O 12 UY

etc etc..

do i just past them into an empty notepad file and save the file as 12BE_dir.txt (or WANA_dir.txt for my bin).. and then rerun SAD?

Any text editor will do, so long as the file name matches the bin name with _DIR.txt ending.
Yes, 12BE_DIR.txt is correct for 12BE.bin and they need to be in the same folder.
Yes, rerun SAD.

You will need to change the addresses to suit WANA's layout.
You will need to name it to suit the WANA.bin name and have it in the same folder as the bin.

You can add a divisor V if you know what the scaling is.
You can change the print layout P if you like.

Code: Select all

tab 13792 137eb "T.FN1362_FuelBaseTable"         :O10 UY V128 P1  # OzFalcon says this is the fuel base table
tab 13726 13791 "T.13726"                        :O12 UY 
tab 137ec 1383b "T.137ec"                        :O10 UY 
tab 13966 139d1 "T.13966"                        :O12 UY 

[OzFalcon]

But after you disassemble the file, first you need to identify all the ram addresses for the payloads you want to log.

i have disassembled the bin, but am still none the wiser as to how to find those. i guess i will reread your dis and datalogging guides..

Then find the console routine. Usually a disassembly search for 1f1c will find the tail end of the console routine.

yes think i found it... yay i did something that worked lol
Sub_8f40a:
8f40a: a1,62,20,24 ldw R24,2062 R24 = 2062;
--------many lines etc etc-------------
8f441: b3,01,1c,1f,38 ldb R38,[R0+1f1c] R38 = [1f1c];
8f446: 99,f2,38 cmpb R38,f2
8f449: d7,03 jne 8f44e if (R38 = f2) {
8f44b: ef,ce,2a call 1f1c 1f1c (); } } }
8f44e: 71,7f,80 an2b R80,7f B7_R80 = 0;
8f451: f0 ret return;

You can remove the raminit flag immediately after that and put a call there to an area in rom with null filler.

sorry, where is the "raminit" flag??
how do i "put a call there"? yes i can probably safely find a an area of filler..

You can then use my patch code from RZASA.

ok sounds straight forward.. will look for it

Be sure the raminit flag gets put in the new code.

same issue, no sure where that is or what it is called

You have to verify the bank references are the same and your listing address is correct.

ok, ill get to that when the time comes

The listing address is another area in rom of null filler you put the actual ram addresses in to shadow.

This is the Ops List function.

"Ops List function"... nope, sorry u lost me..

Your best option would be to try to find a DMR list for your strategy.

"DMR list"... haha sorry again .. u lost me..

thanks for fielding questions like this from an absolute nonce..

[decipha]

You have to go through the code line by line and figure out what its doing. Usually takes a few years to complete if you stick with it a few hours a week.

8f44e: 71,7f,80 an2b R80,7f B7_R80 = 0;

Thats the raminit flag. You replace this with a jump to some free memory then put that line back and put the patch code.

the ops list function is the address where you have the operations list for the ram address you want to datalog.

DMR list is a ford listing of all of the payloads with their addresses. This comes from the ford service site and used to be $25 for the list per strategy. If someone has it they will usually share it as I don't believe ford offers these anymore for the older strategies.

[OzFalcon]

Q. I am using an ELM327 generic OBD2 scan tool and Forscan to access live data on this ECU. there are a lot of Parameters being access .. .RPM is one, ECT, LTFT, spark adv etc etc..
am i right in assuming that these are the same things and in the same memory address as what the "payloads" that the QH is attempting to read..
if it is then does that mean forscan knows the addresses? how does it know them if that is the case?
really the only one i can think of that it isnt reporting is targetAF..

[decipha]

yes

no

forscan polls generic obd2 data so the ecu is looking up what its asking for and giving it.