EEC V file conversion

[efloth]

The XDF defines memory locations/lengths/types for each broken out parameter in the bin. The disassembler will take a bin and convert it to readable code but it's up to you to find the parameters you want to be able to edit in tunerpro. The XDF looks like this:

Code: Select all

<!-- Written 06/23/2021 16:15:49 -->
<XDFFORMAT version="1.60">
  <XDFHEADER>
    <flags>0x1</flags>
    <fileversion>200702</fileversion>
    <deftitle>A1C_EFI-SD4X</deftitle>
    <description>A1C, Z2D, Z2D1&#013;&#010;Speed Density</description>
    <author>decipha</author>
    <BASEOFFSET offset="8192" subtract="1" />
    <DEFAULTS datasizeinbits="8" sigdigits="2" outputtype="1" signed="0" lsbfirst="1" float="0" />
    <REGION type="0xFFFFFFFF" startaddress="0x0" size="0xE000" regionflags="0x0" name="Binary File" desc="This region describes the bin file edited by this XDF" />
    <CATEGORY index="0x0" name="BP" />
    <CATEGORY index="0x1" name="Monitor" />
    <CATEGORY index="0x2" name="VE Model" />
    <CATEGORY index="0x3" name="Axle" />
    <CATEGORY index="0x4" name="Fan" />
    <CATEGORY index="0x5" name="Fueling" />
    <CATEGORY index="0x6" name="Adaptives" />
    <CATEGORY index="0x7" name="DFSO" />
    <CATEGORY index="0x8" name="Cranking" />
    <CATEGORY index="0x9" name="Fuel Injector" />
    <CATEGORY index="0xA" name="Closed Loop" />
    <CATEGORY index="0xB" name="Fuel Pump" />
    <CATEGORY index="0xC" name="Transient Fuel" />
    <CATEGORY index="0xD" name="ISC Control" />
    <CATEGORY index="0xE" name="Knock Sensor" />
    <CATEGORY index="0xF" name="O2" />
    <CATEGORY index="0x10" name="Limiters" />
    <CATEGORY index="0x11" name="Security" />
    <CATEGORY index="0x12" name="Ignition" />
    <CATEGORY index="0x13" name="Error Codes" />
    <CATEGORY index="0x14" name="OBD-II" />
    <CATEGORY index="0x15" name="Scaling Normalizer" />
    <CATEGORY index="0x16" name="Temperature" />
    <CATEGORY index="0x17" name="2 Speed" />
    <CATEGORY index="0x18" name="Manual Trans" />
    <CATEGORY index="0x19" name="VCT" />
    <CATEGORY index="0x1A" name="Unused" />
    <CATEGORY index="0x1B" name="Components" />
    <CATEGORY index="0x1C" name="H/W Configuration" />
    <CATEGORY index="0x1D" name="Console PIDs" />
    <CATEGORY index="0x1E" name="Transmission" />
    <CATEGORY index="0x1F" name="Mass Air" />
    <CATEGORY index="0x20" name="Temporary / Unknown" />
    <CATEGORY index="0x21" name="Misc" />
    <CATEGORY index="0x22" name="VID Block" />
    <CATEGORY index="0x23" name="Catalytic Converter" />
    <CATEGORY index="0x24" name="TQ Modulation" />
    <CATEGORY index="0x25" name="Line Pressure" />
    <CATEGORY index="0x26" name="TCC Control" />
    <CATEGORY index="0x27" name="Shifting" />
    <CATEGORY index="0x28" name="Dyno" />
    <CATEGORY index="0x29" name="Templates" />
    <CATEGORY index="0x2A" name="Reference Data" />
    <CATEGORY index="0x2B" name="Canister Purge" />
    <CATEGORY index="0x2C" name="ECU Clock" />
    <CATEGORY index="0x2D" name="Decipha Hacks" />
    <CATEGORY index="0x2E" name="Engine Oil" />
    <CATEGORY index="0x2F" name="Traction Assist" />
    <CATEGORY index="0x30" name="Alternator" />
    <CATEGORY index="0x31" name="PWF / Performance Mode" />
    <CATEGORY index="0x32" name="ETC" />
    <CATEGORY index="0x33" name="Fuel Tank" />
    <CATEGORY index="0x34" name="EGR / Exhaust" />
    <CATEGORY index="0x35" name="FAOSC" />
    <CATEGORY index="0x36" name="Misfire" />
    <CATEGORY index="0x37" name="CCM" />
    <CATEGORY index="0x38" name="Oscillation Modulation" />
    <CATEGORY index="0x39" name="Anticipation" />
    <CATEGORY index="0x3A" name="Scheduling" />
    <CATEGORY index="0x3B" name="MBT Spark" />
    <CATEGORY index="0x3C" name="Borderline Knock" />
    <CATEGORY index="0x3D" name="Lugging" />
    <CATEGORY index="0x3E" name="Lost Fuel" />
    <CATEGORY index="0x3F" name="Crank Fuel" />
    <CATEGORY index="0x40" name="DSDRPM Adder" />
    <CATEGORY index="0x41" name="Suspension" />
    <CATEGORY index="0x42" name="ICP" />
    <CATEGORY index="0x43" name="SC Bypass" />
    <CATEGORY index="0x44" name="Starter Control" />
    <CATEGORY index="0x45" name="Ambient" />
    <CATEGORY index="0x46" name="HSF" />
    <CATEGORY index="0x47" name="LSF" />
    <CATEGORY index="0x48" name="VSF" />
    <CATEGORY index="0x49" name="Turbo Controls" />
    <CATEGORY index="0x4A" name="Dashpot" />
    <CATEGORY index="0x4B" name="Cruise Control" />
    <CATEGORY index="0x4C" name="Base Fuel" />
    <CATEGORY index="0x4D" name="Flex Fuel" />
    <CATEGORY index="0x4E" name="Economy" />
    <CATEGORY index="0x4F" name="PID Control" />
    <CATEGORY index="0x50" name="Stroke" />
    <CATEGORY index="0x51" name="HVAC" />
    <CATEGORY index="0x52" name="Heater" />
    <CATEGORY index="0x53" name="PSP" />
    <CATEGORY index="0x54" name="Datalogging" />
    <CATEGORY index="0x55" name="Tip-In" />
    <CATEGORY index="0x56" name="Engine Temperature" />
    <CATEGORY index="0x57" name="O2 Rear" />
    <CATEGORY index="0x58" name="DOL" />
    <CATEGORY index="0x59" name="Fuel Pressure" />
    <CATEGORY index="0x5A" name="IMRC" />
    <CATEGORY index="0x5B" name="depreciated" />
    <CATEGORY index="0x5C" name="Manifold Dynamics" />
    <CATEGORY index="0x5D" name="Trans Engagement" />
    <CATEGORY index="0x5E" name="OSC Substitution" />
    <CATEGORY index="0x5F" name="Knock Event" />
    <CATEGORY index="0x60" name="Knock Threshold" />
    <CATEGORY index="0x61" name="Knock Window" />
    <CATEGORY index="0x62" name="Knock Duration" />
    <CATEGORY index="0x63" name="Knock Sensitivity" />
    <CATEGORY index="0x64" name="Knock Advance" />
    <CATEGORY index="0x65" name="Knock Retard" />
    <CATEGORY index="0x66" name="Base Spark" />
    <CATEGORY index="0x67" name="Idle FBS Spark" />
    <CATEGORY index="0x68" name="CSSRE Spark" />
    <CATEGORY index="0x69" name="Piston Protection" />
    <CATEGORY index="0x6A" name="Upshift Lamp" />
    <CATEGORY index="0x6B" name="Cold Shifting" />
    <CATEGORY index="0x6C" name="Shift Compensation" />
    <CATEGORY index="0x6D" name="Combustion Pressure" />
    <CATEGORY index="0x6E" name="Trans Oil Temp" />
    <CATEGORY index="0x6F" name="Injector Timing" />
    <CATEGORY index="0x70" name="WOT Fuel" />
    <CATEGORY index="0x71" name="Decel Spark" />
    <CATEGORY index="0x72" name="HES Detection" />
    <CATEGORY index="0x73" name="Stabilized Fuel" />
    <CATEGORY index="0x74" name="4x4L" />
    <CATEGORY index="0x75" name="Power Take Off" />
    <CATEGORY index="0x76" name="Throttle Position" />
    <CATEGORY index="0x77" name="Coil Control" />
    <CATEGORY index="0x78" name="Skip-Shift" />
    <CATEGORY index="0x79" name="Piston Slap" />
    <CATEGORY index="0x7A" name="TQ Model" />
    <CATEGORY index="0x7B" name="VCT" />
    <CATEGORY index="0x7C" name="Emissions" />
    <CATEGORY index="0x7D" name="Stability" />
    <CATEGORY index="0x7E" name="Optimum Power" />
    <CATEGORY index="0x7F" name="Driveability" />
    <CATEGORY index="0x80" name="Phaser Control" />
    <CATEGORY index="0x81" name="Mapped Points" />
    <CATEGORY index="0x82" name="Launch Control" />
    <CATEGORY index="0x83" name="Emulation" />
    <CATEGORY index="0x84" name="Brakes" />
  </XDFHEADER>
  <XDFCHECKSUM uniqueid="0x2E5F" flags="0x1">
    <title>1CLR</title>
    <REGION>
      <datastart>0x2004</datastart>
      <dataend>0x2005</dataend>
      <datasizebits>0x10</datasizebits>
      <storeaddress>0x200A</storeaddress>
      <calculationmethod>0x0</calculationmethod>
    </REGION>
  </XDFCHECKSUM>
  <XDFCHECKSUM uniqueid="0x65BD" flags="0x1">
    <title>2CSUM</title>
    <REGION>
      <datastart>0x2000</datastart>
      <dataend>0xBFFF</dataend>
      <datasizebits>0x10</datasizebits>
      <storeaddress>0x200A</storeaddress>
      <calculationmethod>0x1</calculationmethod>
    </REGION>
  </XDFCHECKSUM>
  <XDFPATCH uniqueid="0x6E0B">
    <title>Disable MIL Check Engine Light</title>
    <description>patched = disables the MIL light permanently.</description>
    <XDFPATCHENTRY name="pcm pin mil off" address="0x9E5E" datasize="0x2" patchdata="9120" basedata="71DF" />
  </XDFPATCH>
  <XDFCONSTANT uniqueid="0x4944">
    <title>ROM_TO - (Checksum)</title>
    <description>this is automagically updated by TunerPro when your bin is saved</description>
    <CATEGORYMEM index="0" category="28" />
    <CATEGORYMEM index="1" category="30" />
    <EMBEDDEDDATA mmedtypeflags="0x02" mmedaddress="0x200A" mmedelementsizebits="16" mmedmajorstridebits="0" mmedminorstridebits="0" />
    <units>hex</units>
    <outputtype>3</outputtype>
    <decimalpl>0</decimalpl>
    <datatype>0</datatype>
    <unittype>0</unittype>
    <DALINK index="0" />
    <MATH equation="X">
      <VAR id="X" />
    </MATH>
  </XDFCONSTANT>
  <XDFCONSTANT uniqueid="0x78CF">
    <title>Ignition Degrees Per PIP - DEGPIP (Unactual)</title>
    <description>changes the value used for v8, not the actual degpip if numcyl is changed&#013;&#010;&#013;&#010;DEGPIP - The number of crank degrees per PIP interval. 90 = 8 cylinder, 120 = 6 cylinder, 180 = 4 cylinder</description>
    <CATEGORYMEM index="0" category="29" />
    <EMBEDDEDDATA mmedtypeflags="0x02" mmedaddress="0x2E68" mmedelementsizebits="16" mmedmajorstridebits="0" mmedminorstridebits="0" />
    <units>degrees</units>
    <decimalpl>0</decimalpl>
    <datatype>0</datatype>
    <unittype>0</unittype>
    <DALINK index="0" />
    <MATH equation="X/4">
      <VAR id="X" />
    </MATH>
  </XDFCONSTANT>
  <XDFCONSTANT uniqueid="0x50FA">
    <title>FMEM MAP Default Value</title>
    <description>MAP value when map sensor has failed and engine is not running.</description>
    <EMBEDDEDDATA mmedtypeflags="0x02" mmedaddress="0x3F91" mmedelementsizebits="16" mmedmajorstridebits="0" mmedminorstridebits="0" />
    <units>in hg</units>
    <decimalpl>3</decimalpl>
    <datatype>0</datatype>
    <unittype>0</unittype>
    <DALINK index="0" />
    <MATH equation="X / 8">
      <VAR id="X" />
    </MATH>
  </XDFCONSTANT>
  ...

[BOOSTEDEVERYTHING]

Ok, thanks. Do I write the xdf in a text file and convert it somehow to the xdf, or is it created directly in tunerpro? ( I put my values into the xdf editor in tunerpro under new def? ) The directives file.....Is that something for me to follow to input the addresses into tunerpro or does it create the xdf file when using the directives file with sad? So sorry for all the stupid questions, just have not been able to find anything on actually creating the xdf file. The disassembly write up is great as far as how to locate some of the parameters in the bin, but I am not sure where to go from there with the directives file and comments file and how to actually build the xdf file that is used by tunerpro. Again I am very sorry if these are all stupid questions. I really just want to understand this better. I would love to say that i wrote the xdf file for my eqe3 pcm. also would love to be able to contribute somehow to the community That I have learned so much from. Also, are the directives and comments files something i create from scratch or are they something that sad is supposed to output and i am doing something incorrectly. I am not getting a directives or comments file when i disassemble a bin. thanks

[efloth]

I would start by defining the parameters you want to break out. I would start with one like injector high slope since that will likely be needed. Once you have that list you can read the available documents/review other strategies to find the parameters' memory location in your strategy. You will reference the lst file that SAD produces. This is a slow process but you will get better at identifying patterns and commonalities in the code. Like Michael stated this can take many years if you want to break it out completely.

Once you have found all the memory addresses, I would use tuner pro to create the XDF. You can do it by hand as well if you find that easier for you.

[BOOSTEDEVERYTHING]

so what is the directives file for? In trying to follow along with the write up he states several times to put things in a directive file but i dont have one. Is it just a txt file that i create and cut and copy things into? Im guessing the comments file goes hand in hand with the dir file to have in common terms what is going on in the dir file? thanks again for the help. I feel stupid asking some of these questions, but I honestly want to learn this and not have it handed to me.

[efloth]

The directives file is handy because once you have the memory addresses named, you can rerun sad and it will produce an updated LST file that includes the names of the parameter instead of memory address. You can use the directives file as a seed for creating the XDF later. Personally, I like to read the code raw and put the data in the XDF as I find it.

[BOOSTEDEVERYTHING]

Ok, is there a write up for building and using the directive file somewhere? And how to make the directives file into the xdf? Or do I just go into tuner pro and go to new xdf and just start adding stuff one by one?

[jsa]

Would you happen to have an open source xdf file that I can look at in the editor so I can get a good idea of what I’m trying to do to build one for my pcm?

There are a number on this forum, here is one of them;
download/file.php?id=4524

There are a number on the tunerpro site;
https://www.tunerpro.net/download/bindefs/Ford/GUFB.xdf

I’m not sure when I’m disassembling when I’m putting data into the Directive file, what I’m actually supposed to be putting in there and why,

Have a look at the DIR and CMT from here;
https://github.com/OpenEEC-Project/EEC-IV_A9L

They are using V3 syntax, but it will show you how they affect LST and the LST is relevant to the XDF's linked above.

V4 syntax examples here;
https://github.com/OpenEEC-Project/EEC- ... -Test-Bins

This thread on the other forum, while BE centric, has examples of V4 syntax.
http://eectuning.org/forums/viewtopic.p ... 52#p134599

The SAD docs should be read, to better understand usage.
https://github.com/OpenEEC-Project/EEC- ... aster/Docs

also not sure if that is building the xdf file or if I then have to manually enter in all the data from the directive file into the xdf editor in tunerpro.

Ok, thanks. Do I write the xdf in a text file and convert it somehow to the xdf, or is it created directly in tunerpro? ( I put my values into the xdf editor in tunerpro under new def? ) The directives file

so what is the directives file for?

The DIRective file is used to DIRect SAD on how the user would like the disassembly to be done and also to name stuff and convert values. Tunerpro is not DIRective aware.

The XDF is a Tunerpro file, that is normally created manually by the user entering the data.
SAD does not the have the ability to convert the DIR to XDF definition format.
With a little forethought, the DIR can be arranged so that excel formula's can be used to convert the DIR to a layout suitable for a Binary Editor definition. A Binary Editor definition contains the same info as a Tunerpro defintion but the file formats are different.

You should also give SADX a go, as it can export XDF files. SADX also has SAD DIR and CMT import functionality.
There are BINS that SADX will not disassemble but SADX disassembles EQE3.
I prefer SAD and Binary Editor.

SADX is available from here;
https://github.com/OpenEEC-Project/SAD806x
It has a manual that is worth reading.

I’d really like to learn this stuff and honestly think it would help in my daily job to understand this better as well.

If you are serious about getting into disassembly, you will want to read all the technical literature from here
https://github.com/OpenEEC-Project/

Also, are the directives and comments files something i create from scratch or are they something that sad is supposed to output and i am doing something incorrectly. I am not getting a directives or comments file when i disassemble a bin.

Is it just a txt file that i create and cut and copy things into?

The user creates the DIR and CMT manually as text files. the file name needs to be binname_dir.txt and binname_cmt.txt.
They are input files read by SAD.

Im guessing the comments file goes hand in hand with the dir file to have in common terms what is going on in the dir file?

Yes.
The CMT file can have what ever you like in it, for the purpose of it being output to the LST file.
Both DIR and CMT can have text in them that do not direct SAD or get output to LST.

DIR example;
The first line instructs SAD to apply an rbase value over an address range.
The second line uses a # as a way to comment out a dir command
The third line onward has DIR commands with comments at the end.
The comments in DIR are not output to LST.

Code: Select all

rba   32 DB78 40BE 40C2
# rbase 42 26   8B15 8B19
SYM 44  "HSO_Ch*_Stt"                  #W # Control bit for each HSO Channel
SYM  44  "HSO_Ch0_Stt"                :B0 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch1_Stt"                :B1 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch2_Stt"                :B2 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch3_Stt"                :B3 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch4_Stt"                :B4 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch5_Stt"                :B5 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch6_Stt"                :B6 # HSO Channel 0 Off On State
SYM  44  "HSO_Ch7_Stt"                :B7 # HSO Channel 0 Off On State

CMT example;
Line one is commented out by the # as the first character on the line, so it will not be output to LST
Line two onward are all output to LST.

Code: Select all

# 20230303 Commence editing for SAD4.09
2022 # Calibration pointer 1 Contained in Rf0\n
2024 # Calibration pointer 2 Contained in Rf2\n
2026 # Calibration pointer 3 Contained in Rf4\n
2028 # Calibration pointer 4 Contained in Rf6\n
202A # Calibration pointer 5 Contained in Rf8\n
202C # Calibration pointer 6 Contained in Rfa\n
202E # Calibration pointer 7 Contained in Rfc\n
2030 # Calibration pointer 8 Contained in Rfd\n

[jsa]

As it happens this bin needs a DIR as SAD has failed to handle the arg count correctly.

If you look in your MSG you will find this;

Code: Select all

Invalid opcode at 1e8f6 [5]

It's a double bug, the real address of the issue is at 0e8f6.

@TVRfan has been working on a future release of SAD that will overcome a number of issues around args.
In the meantime the user has to be able to recognise the issue/s and direct SAD to the correct solution.

Adding this command to the DIR will get the correct number of args.

Code: Select all

args    0E8DF 0E8E8 :O 2 UW  :O 2 UY :UW :UY

I have just mimicked the arg size that SAD applied to the previous block of args. SAD does not always get that right either but I don't have time to check it right now.

Directive file

eqe3_ml2_8a1a_stock read burn1fnb_dir.zip

(262 Bytes) Downloaded 309 times

The bugs have been reported to TVRfan.

[BOOSTEDEVERYTHING]

Thanks you so much for all of the help. I appreciate it a ton. My grandfather could program in c like you would not believe. He sat me down quite a few times when I was a lot younger and I picked up a few things from him but I was a kid and was thinking I’d never use it. If you can believe it, it makes me feel a little closer to him trying to learn this stuff. I’m really glad there are people like you with enough patience for people like me. I appreciate you dumbing it down for me a bit so I can wrap my head around it. I may try and find an xdf that is open sourced and find the bin for it and maybe start there and try to find what the xdf is referring to when I disassemble the bin. I think I found the maf transfer function following the write up but I honestly can’t tell where it ends and I have no idea what to do with it now that I have found it. I may ask Michael if he would be willing to give me an open xdf that I can look at to compare. I know he spent a ton of time on them though so I am not expecting anything. His REAC4 xdf opens some reasonable stuff on my EQE3 bin but there is a lot missing and the data logging is all gibberish. But it may be something where I can find what is working and that may lead me to be able to find what isn’t and have a stepping stone instead of starting from 0. Not sure how the best way to actually start into it would be. I will read all that you posted. I may print it all out so I can flip back and forth through it too. I keep getting lost flipping through on computer screens. Thanks again. You help is greatly appreciated. And I am glad I found some real world application for me, for something that my grandfather tried to teach me a long time ago. I’m even seeing if I can get my aunt to find some of his old c and c++ books that he had.

[BOOSTEDEVERYTHING]

Is there a way to open a tunerpro def file in a text format other than in tunerpro? To see the whole listed xdf like the gufb.xdf opens when you click on the link? Also, what software were you using to compare the bin files in the post linked above from eectuning? And to actually find the functions in the disassembly, is there a chart somewhere that says what the functions look like in the lst file, or is that something you just learn what the functions look like?