EEC V file conversion

All hardware related, disassembly / programming and code discussions belong here.
ATPCR
Posts: 152
Joined: 2023 Feb 18, 22:25
Location: Hazel Green Alabama USA
Vehicle Information: 1997 Mountaineer 5.0 that originally had a wasted spark ignition system. I'm converting to coil-near-plug. I will use a 4.6 Luxury Sedan PCM & modified powertrain harness. It will be reprogrammed to operate the Windsor 5.0.

Re: EEC V file conversion

Unread post by ATPCR »

@jsa Do I need to join github for it to work? It acts like it wants to download, then doesn't seem to do anything. I don't mean to be any trouble. This should be simple...
ADDED: Windows Defender was blocking it. If it is a public file it Github, you don't have to join to download. I now have it downloaded. When I open it, it looks like an old DOS program sort of. What do I do with it now?
BOOSTEDEVERYTHING
Posts: 235
Joined: 2023 Sep 06, 13:11
Location: Charlotte NC , USA
Vehicle Information: 1999 Ford Ranger with 2000 Explorer v8 swap, FLN0
2003 Ford F150 Harley Davidson, Built 5.4L SOHC with 3.4L Whipple and Built 4R100

Re: EEC V file conversion

Unread post by BOOSTEDEVERYTHING »

Ok, So I think I got the destination register thing, I was looking in the code for the value that the code was loading into a register. Now I get that the register is not in the code at all, It is in the hardware and looking for the value that is loaded into a register in the software is not going to get me anywhere because it isn't there at all. Still very confused on how to determine what the subroutine is actually doing though, Are the subroutines all the same throughout all of the EEC IV and EEC V computers? example: subroutine sub_021b6 in the RZAZA code seems to be a PATS subroutine(if I am reading correctly), does that mean that in all code it will be a PATS subroutine? and how far does PATS actually go? ie: does it have more than 1 subroutine? thanks again for all the help. Still reading and trying to make sense of the A/D routines in the code. I am using Deciphas def file for RZAZA and the stock bin he posted for PDN0 that i disassembled with SAD to try and get a feel for where the definition file is pointing to in the LST and MSG files, Is this a good way to learn or is that leading me in the wrong direction?
EDIT: So I think I am heading in the wrong direction here...I can not seem to find many other functions by searching for the hex address listed in the def file in the lst or msg files. So I guess it is back to the drawing board on that one.
jsa
Posts: 274
Joined: 2021 Feb 16, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: EEC V file conversion

Unread post by jsa »

ATPCR wrote: 2023 Oct 07, 21:35 When I open it, it looks like an old DOS program sort of. What do I do with it now?
It's a windows command line executable. There is a GUI front end for it on github.

I just drag and drop the bin on the sad exe, it will then do a disassembly run placing a lst and msg file in the same folder as the bin.
jsa
Posts: 274
Joined: 2021 Feb 16, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: EEC V file conversion

Unread post by jsa »

R34 is the destination register in the code line above.

Yes a register is a hardware address for memory within the microprocessor. Certain register and ram addresses will be payloads for logging. We'll get to that.
BOOSTEDEVERYTHING wrote: 2023 Oct 07, 23:09 Are the subroutines all the same throughout all of the EEC IV and EEC V computers?
Many are, some have minor differences, others are the result of new features being added to newer strategies.
example: subroutine sub_021b6 in the RZAZA code seems to be a PATS subroutine(if I am reading correctly), does that mean that in all code it will be a PATS subroutine? and how far does PATS actually go? ie: does it have more than 1 subroutine?

I'm not familiar with PATS in later bins nor do I have RZASA at hand right now. The address will often be different, but the subroutine will be common to many bins.
Still reading and trying to make sense of the A/D routines in the code
I'll post some more tomorrow on the a/d.

I am using Deciphas def file for RZAZA and the stock bin he posted for PDN0 that i disassembled with SAD to try and get a feel for where the definition file is pointing to in the LST and MSG files, Is this a good way to learn or is that leading me in the wrong direction?
Yes it will help you. See if you can find iACT and iECT in the xdf then find it in lst.
ATPCR
Posts: 152
Joined: 2023 Feb 18, 22:25
Location: Hazel Green Alabama USA
Vehicle Information: 1997 Mountaineer 5.0 that originally had a wasted spark ignition system. I'm converting to coil-near-plug. I will use a 4.6 Luxury Sedan PCM & modified powertrain harness. It will be reprogrammed to operate the Windsor 5.0.

Re: EEC V file conversion

Unread post by ATPCR »

Here is what I see after opening SAD
CaptureSAD10=08-23.PNG
jsa
Posts: 274
Joined: 2021 Feb 16, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: EEC V file conversion

Unread post by jsa »

ATPCR wrote: 2023 Oct 08, 07:57 Here is what I see after opening SAD
CaptureSAD10=08-23.PNG
Type in the bin pathname and filename then hit enter.

If you have sad and the bin in the same folder then just type in the filename then hit enter.

Drag and drop is easier.
BOOSTEDEVERYTHING
Posts: 235
Joined: 2023 Sep 06, 13:11
Location: Charlotte NC , USA
Vehicle Information: 1999 Ford Ranger with 2000 Explorer v8 swap, FLN0
2003 Ford F150 Harley Davidson, Built 5.4L SOHC with 3.4L Whipple and Built 4R100

Re: EEC V file conversion

Unread post by BOOSTEDEVERYTHING »

I can't seem to find either one, I'm not sure what i am doing wrong. IECT may just not be present because it uses a CHT sensor instead, but I can't seem to be able to find the MAF transfer function either, at least not with anything defined in the xdf, It is weird because his def can not be wrong seeing as how he uses it regularly. Some addresses seem wrong as well. Maybe because I am using one of his bins and not a stock read? I am using his xdf file and the PDN0 maurader file with 4r70w bin file.
jsa
Posts: 274
Joined: 2021 Feb 16, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: EEC V file conversion

Unread post by jsa »

BOOSTEDEVERYTHING wrote: 2023 Oct 04, 12:10

Code: Select all

 Sub_8316e:
8316e: a1,8a,6d,34        ldw   R34,6d8a         R34 = 6d8a;
Values loaded by immediate address mode are often addresses...but how to tell...

Code: Select all

83173: 56,34,00,04        ad3b  R4,R0,[R34]      AD_Cmd = [R34];
Lookup opcode 56 in the software manual and note the address mode.
Read about the address mode in the manuals.
56 Is the opcode
R34 Contains the value 6d8a. The square brackets around R34 for an indirect address mode mean that ad3b will get the byte of data at address 6d8a.
R0 Contains the value 0x00.
R4 Is a special function register, specifically the AD_Cmd special function register.

The operation reads the byte from 6d8a, adds it to the byte 0x00 and writes it to the AD_Cmd special function register.

Read about memory expansion from Page 6-57 of the software manual. Memory Expansion is how multibank bins are implemented.
Read about the location of the data bank in particular.
The processor is automatically prefixing the data bank number to the address 6d8a to give 16d8a.

From your LST.

Code: Select all

0e906: b1,11,11           ldb   R11,11           BANK_Select = 11;
B1 is load byte, again immediate address mode.
R11 is special function register 11, the memory bank select register.
11 is the high and low nibble written to R11, so both stack and data use bank one.
This operation loads the memory bank select function register with the stack and data bank numbers.

So we know 6d8a is being used as an address because of the indirect address mode operation at line 83173.
We also know it is in Bank 1.

Add each of these lines individually to your DIR, rerun SAD, then look at those addresses to see what has happened.
Add both together in your DIR, rerun SAD, then post up the results from LST.

Code: Select all

STR 16D8A 16DB7 $Q1 :Y :WN                  #
STR 16DB8 16DD0 $Q1 :Y :WN                  #
Read the SAD help file to understand what those two lines instruct SAD to do.

More later.
ATPCR
Posts: 152
Joined: 2023 Feb 18, 22:25
Location: Hazel Green Alabama USA
Vehicle Information: 1997 Mountaineer 5.0 that originally had a wasted spark ignition system. I'm converting to coil-near-plug. I will use a 4.6 Luxury Sedan PCM & modified powertrain harness. It will be reprogrammed to operate the Windsor 5.0.

Re: EEC V file conversion

Unread post by ATPCR »

@jsa I got it to download properly and it accepted the bin file. I hope you guys don't mind me following along. It is helping me see how this is all laid out.
jsa
Posts: 274
Joined: 2021 Feb 16, 15:46
Location: Australia
Vehicle Information: 95 Escort RS Cosworth
2.0 YBP
CARD / QUIK / COSY / ANTI
GHAJ0
SMD-190 / SMD-490 EEC-IV

Binary Editor
ForDiag

Re: EEC V file conversion

Unread post by jsa »

Cool
Post Reply