EEC V file conversion

[jsa]

Having run SAD with the DIR converetd from DMR, I've opened both EQE3 and REAC4 in ultracompare.
I've manually aligned the ATOD_LIST in each.

The RZASA DMR had names for the ATOD_LIST and all the analog channels.
Straight up we can add to the EQE3 DIR;

Code: Select all

SYM 16D8A "ATOD_LIST"                         # Address of analog to digital channel list

One of the channels stands out because of repeated use. That's interesting lets check that one out.
Both RZASA and EQE3 read Channel 3 multiple times. The RZASA DMR has it as TP_CNTx. Good enough for Ford, good enough for me.
Let's see in EQE3 if TP code is the same.

I search EQE3 for _Ch3 and get a hit at 0x847D4.
I search RZASA for TP_CNT and get a hit at 0x940EC.
Line them up to compare

They are a match.
We are going to edit or add to EQE3 DIR.

Code: Select all

SYM   1D6 "TP_CNT1"                       #UW # Throttle position counts 1
SYM   1D8 "TP_CNT2"                       #UW # Throttle position counts 2
SYM   1DA "TP_CNT3"                       #UW # Throttle position counts 3
SYM   1DC "TP_CNT4"                       #UW # Throttle position counts 4
SYM   1DE "TP_ENG"                        #UW # Average throttle position

SYM 11548 "TP_ENG_LAST"                   #UW # Previous average throttle position




Sub 847D4 "Sub847D4_TP_CNT>TP_ENG"                         # Updates TP_ENG from TP_CNT 1 to 4

We are going to add to EQE3 CMT

Code: Select all

847D5 # [1DE]
847D8 # [11548]
847DE # [1D6]
847E1 # [1D8]
847E8 # [1DA]
847EE # [1DC]
847F7 # [1DE]

These changes should be in numerical order in the relevant sections.

Run SAD; the result should look like this

Code: Select all

   ATOD_LIST:
16d8a: 03,d6,01           struct    3, TP_CNT1 
16d8d: 00,c0,01           struct    0, iADC_Ch0
16d90: 01,c2,01           struct    1, iADC_Ch1
16d93: 05,d4,01           struct    5, iADC_Ch5
16d96: 02,a6,01           struct    2, iADC_Ch2
16d99: 03,d8,01           struct    3, TP_CNT2 
16d9c: 06,ce,01           struct    6, iADC_Ch6
16d9f: 07,a4,01           struct    7, iADC_Ch7
16da2: 08,9e,01           struct    8, iADC_Ch8
16da5: 09,a0,01           struct    9, iADC_Ch9
16da8: 03,da,01           struct    3, TP_CNT3 
16dab: 0c,d2,01           struct    c, iADC_ChC
16dae: 0a,1c,0e           struct    a,      e1c
16db1: 0f,a2,01           struct    f, iADC_ChF
16db4: 03,dc,01           struct    3, TP_CNT4 
16db7: ff                       ## terminator

   Sub847D4_TP_CNT>TP_ENG:
847d4: f2                 pushp                  push(PSW);
847d5: a0,df,2c           ldw   R2c,R1de         R2c = TP_ENG;                     # [1DE]
847d8: c3,ec,c8,2c        stw   R2c,[Rec+c8]     TP_ENG_LAST = R2c;                # [11548]
847dc: 01,2a              clrw  R2a              R2a = 0;
847de: a0,d7,2c           ldw   R2c,R1d6         R2c = TP_CNT1;                    # [1D6]
847e1: 44,d9,2c,28        ad3w  R28,R2c,R1d8     R28 = R2c + TP_CNT2;              # [1D8]
847e5: a4,00,2a           adcw  R2a,R0           R2a += CY;
847e8: 64,db,28           ad2w  R28,R1da         R28 += TP_CNT3;                   # [1DA]
847eb: a4,00,2a           adcw  R2a,R0           R2a += CY;
847ee: 64,dd,28           ad2w  R28,R1dc         R28 += TP_CNT4;                   # [1DC]
847f1: a4,00,2a           adcw  R2a,R0           R2a += CY;
847f4: 0c,02,28           shrdw R28,2            lR28 >>= 2;
847f7: c0,df,28           stw   R28,R1de         TP_ENG = R28;                     # [1DE]
847fa: f3                 popp                   PSW = pop();
847fb: f0                 ret                    return;

A number of payloads have been identified.
You could add a similar sub name to RZASA DIR.

You can search the CDAN2 and CRAI8 strategy docs for TP_ENG, that will be about 100 hits. Maybe some of the strategy doc code is identifiable in EQE3.

Now it is possible to search both LST's for TP_CNT, TP_ENG and TP_ENG_LAST. You're looking for more common code, to identify more parameters. Have a go, see what you find and report back.

After getting what we can from this, we'll have a crack at ECT.

[BOOSTEDEVERYTHING]

Ok. Will I be running the rzasa on my EQE3 bin file or a compatible rzasa bin? If using a compatible rzasa bin file would you mind sharing one with me so we are using the same one please? I think I may be getting weird results from using the bins posted here because they are modified already. Thanks.
Sorry. Just noticed I jumped the gun a bit. lol. We are using the converted dmr files on my EQE3 bin. Also, how do I convert the dmr files to dir files? Thanks.

search EQE3 for _Ch3 and get a hit at 0x847D4.
I search RZASA for TP_CNT and get a hit at 0x940EC.
Line them up to compare
TP_CNT.PNG
They are a match.

Also..I am sorry, but I feel stupid. I don’t see where they match up exactly. Should I only be looking at a portion of the code instead of the whole line of code to match?

[tvrfan]

General note - "what tables and functions are for ?"
They are your calibration/tune. They are the jets in your carb, and springs in your dizzy. But it's a hell of a lot more complex than that with all the sensors.
(Yes, you knew that. Just repeating.)

SAD disassembles the code. It can only try to pick out what it can. Data is still missed here and there. Some of the Ford coding is difficult to sort out. And that's before we get to what the data and code actually does for the engine. It's an ongoing project. Sorting out subroutine arguments/parameters is/was a real bastard to do. It doesn't work perfectly. Sorting out tables (2D lookups) correctly is tough as well.

Unfortunately the true answer is there is no way to know without a human brain looking through it. After studying for a while, you get to spot patterns more quickly, but even then some stuff may still be 'wtf?" without tracing what calls it and what it does. It's a slow process. IMHO, A9L is still really useful as a backup for the comments and labels it has. Many of its functions and tables are labelled to state what they do. Some good work done there. And it's still relevant.

JSA is studying CARD for example (Cosworth 2.0 Escort, manual trans) but CARD still has a lot of code which looks just like A9L, even though engine/trans is totally different to a V8 auto....

As JSA states above, start with A/D inputs, then can use interrupt handlers and that gives you a base of inputs, and try to work from there. See if the tables/funcs look similar to a one in a bin that's been identified already. In some ways it's also like a treasure hunt.

I hope that doesn't put you off, I'm just trying to be honest.

I can help with how the code works, and how functions/tables actually 'work' in terms of input/output, but I haven't done much for a particular engine/tune, others are much more experienced. I am doing SAD as a 'keep my brain active' project. I don't even own a Ford vehicle any more.

[BOOSTEDEVERYTHING]

Thank you for responding so quickly. I do know how the tables affect the engine and stuff like that, the tuning side of it I feel pretty capable with, It is identifying what a particular subroutine, ad input, tables, and functions actually are for. Like in the example above, iADC_CH3 turns out to be tp_cnt. I am guessing that is not always the case and comparing to other already disassembled bins and definition files is the only way to narrow down what the specific function, or channel or table actually is, or does, in tuning terminology. and what the actual lookup tables are pointing to, like the actual value of the table, ex: volts, counts, etc.
I am not put off by anything you both have to say to me at all. I am trying to learn and any help or pointers you both have, or anyone may have I welcome. Thank you both so much for taking your time to help me. I honestly can't express enough how thankful I am for the help. I am happy to do the work to learn how to do this. I even printed the hardware and software manuals out and put them in binders so I could flip though and reference them. A reem of paper and toner cartridge later. lol I printed the Sad documents I found as well, a commands list and the sad user manual. I hope the correct manual. It was the one labeled SAD_User_manual_4.0.7.16b_onwards. is that correct for sad SAD_4.012.exe? that is the version I have been using to walk through with JSA.

[BOOSTEDEVERYTHING]

when I try and run my bin through the sad.exe windows version I get an error message. So I stopped using that version. Maybe I am doing something wrong? I just run the sad.exe and go to open and click on the bin I have been using

[jsa]

Ok. Will I be running the rzasa on my EQE3 bin file or a compatible rzasa bin?

RZASA DIR with RZASA BIN
EQE3 DIR with EQE3 BIN

If using a compatible rzasa bin file would you mind sharing one with me so we are using the same one please?

RZASAMY.BIN

(216 KiB) Downloaded 45 times

We are using the converted dmr files on my EQE3 bin. Also, how do I convert the dmr files to dir files? Thanks.

There is no DMR file publicly available for EQE3 unless you have one to share.
We are using the DIR for EQE3 that I attached in an earlier post.

I've converted the rzasa dmr to dir already.
This DIR for RZASA is attached here;
http://www.efidynotuning.com/forum/view ... c4d#p12525
Edit the dir name to suit the bin.


A quick overview;
Download the dmr.
Open it in excel.
Sort by ascending address.
Write a concatenation formula that outputs a SAD command from the dmr data then copy to every row.
Copy commands from excel to dir.

I think it will be best if you become familiar with writing SAD commands manually before trying to jump to automated methods. Do the work from my previous post and then we can come back to this if you wish.

search EQE3 for _Ch3 and get a hit at 0x847D4.
I search RZASA for TP_CNT and get a hit at 0x940EC.
Line them up to compare
TP_CNT.PNG
They are a match.

Also..I am sorry, but I feel stupid. I don’t see where they match up exactly. Should I only be looking at a portion of the code instead of the whole line of code to match?

"Exactly" is setting the bar too high.

You should be looking at what each line of code does and in combination as a subroutine. More or less the opcodes and inputs.

Ignore the addresses, they rarely if ever match across different strategies.

Rzasa has names but eqe3 does not until we add them. Overlook that to see the underlying code sequence.

Try comparing the same code from both as raw lst, maybe it will be clearer.

Both subroutines add the 4 reads from analog channel 3 together, then divide by 4 using shift right >>2. They are averaging 4 reads of throttle position. They also save the previous average before updating the current average. So they match because they do the same thing.

[tvrfan]

when I try and run my bin through the sad.exe windows version I get an error message. So I stopped using that version. Maybe I am doing something wrong? I just run the sad.exe and go to open and click on the bin I have been using

That's program crash, you are not doing anything wrong, that is some kind of bug... !DAMN! (or stronger). That should never happen. It should be robust to everything, even user errors. If there is a serious error it should just refuse to disassemble.

"write to address zero" hmmm....that's DEFINITELY a bug on my part.

Yes there are some versions with bugs in which cause crashes. SAD should say what version in the xx_msg.txt file (where xx is the bare name of the bin (ie. without the .bin)).. can you tell me which version ??

Generally the latest version on github is the best (but not always, new bugs can creep in...) Official stable is 4.06, but if you go into 'development' subdirectory it goes to 4.012 . If you are using that one, I am interested in how you managed it (so I can fix it).


Please confirm - 1) which bin. 2) send your dir file and cmt file if you have one.... and I'll see if I can find the bug.

[BOOSTEDEVERYTHING]

the version is 0.2 in the about drop down, not sure if that helps?I will post a screen shot and the bin I am using.

[jsa]

.

[decipha]

concatenate is when you take more than 1 string or variable and combine them together