4 Bank Checksum

Disassembly, Programming, Coding, Assembly, Binary information and all hacking discussions belong here.

4 Bank Checksum

Unread postby decipha » Sat Sep 05, 2015 12:54 pm

so I'm finally getting around to putting the finishing touches on my fbfg2 def file for tunerpro and the checksum needs to be addressed

4 bank ford ecu's calculate checksum per bank, at the following addresses

Bank 8
22000 - 2FFFF

Bank 1
12000 - 1DFFF

Bank 0
2000 - FFFF

Bank 9
32000 - 3FEFF

the ecu adds all of the values in that memory range together using a LSB word if the value equals 0 the checksum is good, if it doesn't the checksum is bad

the actual checksum is saved in bank 1 at 12004-12005

tunerpro will only let you copy through a range, so i setup 4 checksum to read per bank, then using null filler, saved the value of each bank and added them 4 together to come up with a total / offset error, i then copy the current checksum to that null filler and hoped to subtract the offset from the current checksum to calculate the new checksum to save to 12004, then setup another checksum to clear the filler i used, but tunerpro doesn't allow subtraction, thus email request sent to mark

I also found another issue with the checksum, even if you select the LSB check box in the checksum after you open and close tunerpro a few times they will magically become un-selected on their own for no reason, i cannot find any rhyme or reason to it but its troublesome, makes me wonder if anything else is changing behind the scenes as well unbeknownst to me

if anyone wishes to know more, I have attached the code from FBFG2 where the checksum is verified

Code: Select all
<---- Verify Checksum Routine ----->

  subr_ChecksumVerify:
8 8e58: 01,40             clrw  R40            x40 = 0;                       // clear r40 to save checksum

<---- Bank 8 ---->
8 8e5a: a1,00,20,3e       ldw   R3e,2000       x3e = 2000;                    // 0x2000 start of ROM
8 8e5e: b1,ff,77          ldb   R77,ff         CONSOLE_PRIORITY = ff;         // r77 = 255, looped to secure CONSOLE
8 8e61: 10,08             rbnk  8                                             // bank 8 first pass
8 8e63: 66,3f,40          ad2w  R40,[R3e++]    x40 += [x3e++];                // saves value then increments 3e
8 8e66: 89,fe,ff,3e       cmpw  R3e,fffe                                      // 0xFFFE 2nd to last word of bank 1 ROM
8 8e6a: d3,f2             jnc   8e5e           if ((uns) x3e < fffe) goto 8e5e; // loop until 0xFFFE reached
8 8e6c: 10,08             rbnk  8             
8 8e6e: 66,3e,40          ad2w  R40,[R3e]      x40 += [x3e];                  // save 0xFFFE and 0xFFFF to r40

<---- Bank 1 ---->
8 8e71: a1,00,20,3e       ldw   R3e,2000       x3e = 2000;                    // reset for bank 1
8 8e75: b1,ff,77          ldb   R77,ff         CONSOLE_PRIORITY = ff;         // secure console
8 8e78: 66,3f,40          ad2w  R40,[R3e++]    x40 += [x3e++];                // 2000, 2002++...
8 8e7b: 89,fe,df,3e       cmpw  R3e,dffe                                      // DFFF end of ROM bank1
8 8e7f: d1,f4             jleu  8e75           if ((uns) x3e <= dffe) goto 8e75; // NOTE: d1 opcode, stop at DFFF

<---- Bank 0 ---->
8 8e81: a1,00,20,3e       ldw   R3e,2000       x3e = 2000;                    // reset for bank 0
8 8e85: b1,ff,77          ldb   R77,ff         CONSOLE_PRIORITY = ff;         //secure console
8 8e88: 10,00             rbnk  0             
8 8e8a: 66,3f,40          ad2w  R40,[R3e++]    x40 += [x3e++];
8 8e8d: 89,fe,ff,3e       cmpw  R3e,fffe                                      // FFFE breaks loop
8 8e91: d3,f2             jnc   8e85           if ((uns) x3e < fffe) goto 8e85;
8 8e93: 10,00             rbnk  0             
8 8e95: 66,3e,40          ad2w  R40,[R3e]      x40 += [x3e];                  // 0xFFFE and 0xFFFF added to sum

<---- Bank 9 ---->
8 8e98: a1,00,20,3e       ldw   R3e,2000       x3e = 2000;                    // reset for bank 9
8 8e9c: b1,ff,77          ldb   R77,ff         CONSOLE_PRIORITY = ff;         // secure console
8 8e9f: 10,09             rbnk  9             
8 8ea1: 66,3f,40          ad2w  R40,[R3e++]    x40 += [x3e++];
8 8ea4: 89,fe,fe,3e       cmpw  R3e,fefe                                      // FEFE 2nd to last word of ROM bank 9
8 8ea8: d3,f2             jnc   8e9c           if ((uns) x3e < fefe) goto 8e9c;
8 8eaa: 10,09             rbnk  9             
8 8eac: 66,3e,40          ad2w  R40,[R3e]      x40 += [x3e];                  // 0xFEFE and 0xFEFF added to sum

<-----Verify Checksum---->
8 8eaf: 88,00,40          cmpw  R40,0         
8 8eb2: df,02             je    8eb6           if (x40 != 0)  {               // correct checksum will == 0
8 8eb4: 17,44             incb  R44            x44++; }                       // x44 checksum has failed flag
8 8eb6: f0                ret                  return;
User avatar
decipha
Tooner
 
Posts: 15787
Joined: Mon Jul 15, 2013 5:29 pm
Location: New Orleans, LA
Name: Michael Ponthieux
Vehicle Information: Supercoupin' x10
90 (4x 5spds) - Dante, Ruby, Daja, Ava
91 4r70w - Skarlett
92 (2x) 5spd & auto - Bianqa, Andrea
93 auto - Danika
94 5spd Rionda
95 auto Aisha
Vehicle 2 Information: Others:
00 Lincoln LS - Luanda
98 Camaro SS - Bounquisha
02 Harley F-150 - Sasasha
03 Marauder - DyShyKy
00 Explorer 5L - Bernyce

Re: 4 Bank Checksum

Unread postby decipha » Sat Sep 05, 2015 2:11 pm

I just skimmed through the cbaza xdf as well and tunerpro incorrectly calculates that checksum as well

in cbaza the range is 2000 to FFFD with the checksum being stored at 200a, it too is a 2byte LSB value

and in GUFB, the range is 2000 to 9FFF with the checksum being stored at 200a, 2byte LSB as well

tunerpro seems to correctly mistakenly calculate out the checksum on cbaza every now and again when set for 1's compliment LSB
User avatar
decipha
Tooner
 
Posts: 15787
Joined: Mon Jul 15, 2013 5:29 pm
Location: New Orleans, LA
Name: Michael Ponthieux
Vehicle Information: Supercoupin' x10
90 (4x 5spds) - Dante, Ruby, Daja, Ava
91 4r70w - Skarlett
92 (2x) 5spd & auto - Bianqa, Andrea
93 auto - Danika
94 5spd Rionda
95 auto Aisha
Vehicle 2 Information: Others:
00 Lincoln LS - Luanda
98 Camaro SS - Bounquisha
02 Harley F-150 - Sasasha
03 Marauder - DyShyKy
00 Explorer 5L - Bernyce

Re: 4 Bank Checksum

Unread postby decipha » Sat Sep 05, 2015 3:24 pm

well i've narrowed it down and the issue can simply be resolved by having the LSB box staying checked, i can check them closed out tunerpro and when i open it back up they are unchecked which causes the incorrect checksum, even with it checked it doesn't do an LSB first
User avatar
decipha
Tooner
 
Posts: 15787
Joined: Mon Jul 15, 2013 5:29 pm
Location: New Orleans, LA
Name: Michael Ponthieux
Vehicle Information: Supercoupin' x10
90 (4x 5spds) - Dante, Ruby, Daja, Ava
91 4r70w - Skarlett
92 (2x) 5spd & auto - Bianqa, Andrea
93 auto - Danika
94 5spd Rionda
95 auto Aisha
Vehicle 2 Information: Others:
00 Lincoln LS - Luanda
98 Camaro SS - Bounquisha
02 Harley F-150 - Sasasha
03 Marauder - DyShyKy
00 Explorer 5L - Bernyce

Re: 4 Bank Checksum

Unread postby decipha » Mon Sep 07, 2015 10:17 am

Mark fixed it!!!!

all works excellent now!!! TunerPro correctly calculates out the checksum for all single, 2-bank, and 4-bank binaries!!!!!

now on to clearing filler and shooting him some s/w requests.
User avatar
decipha
Tooner
 
Posts: 15787
Joined: Mon Jul 15, 2013 5:29 pm
Location: New Orleans, LA
Name: Michael Ponthieux
Vehicle Information: Supercoupin' x10
90 (4x 5spds) - Dante, Ruby, Daja, Ava
91 4r70w - Skarlett
92 (2x) 5spd & auto - Bianqa, Andrea
93 auto - Danika
94 5spd Rionda
95 auto Aisha
Vehicle 2 Information: Others:
00 Lincoln LS - Luanda
98 Camaro SS - Bounquisha
02 Harley F-150 - Sasasha
03 Marauder - DyShyKy
00 Explorer 5L - Bernyce


Return to Programming & Coding

Who is online

Users browsing this forum: No registered users and 1 guest