Piton
Junior Member
Posts: 94
|
Post by Piton on Sept 26, 2023 19:17:08 GMT
Hello Dino. I understand that you are a great programmer, but where is the help with the program? I’m like that myself (you’ll figure it out for yourself). Secondly, the tables have different data dimensions. For example two-dimensional input byte, output byte, ROM:334F RPM_INDEX: dc.b 17 INJ_PW=FCN(RPM) ROM:334F ; CRANK_INJ_PW ROM:3350 dc.b 16, 0 ; 512 ROM:3352 dc.b 20, 16 ; 640 ROM:3354 dc.b 25, 32 ; 800 ROM:3356 dc.b 28, 48 ; 896 ROM:3358 dc.b 31, 64 ; 999 ROM:335A dc.b 35, 80 ; 1120 ROM:335C dc.b 39, 96 ; 1248 ROM:335E dc.b 47,112 ; 1504 ROM:3360 dc.b 55,128 ; 1760 ROM:3362 dc.b 62,144 ; 1984 ROM:3364 dc.b 70,160 ; 2240 ROM:3366 dc.b 78,176 ; 2496 ROM:3368 dc.b 94,192 ; 3008 ROM:336A dc.b 109,208 ; 3488 ROM:336C dc.b 125,224 ; 4000 ROM:336E dc.b 140,240 ; 4480 ROM:3370 dc.b 156,255 ; 4992 or input byte, output word (16 bits) ROM:4B96 CNV_2D_B_W_4B96: dc.b 9 ; INJ_PW=FCN(T) ROM:4B96 ; INJ_PW:loc_12992↓o ROM:4B97 dc.b 44 ; -20 ROM:4B98 dc.w 2816 ROM:4B9A dc.b 64 ; 0 ROM:4B9B dc.w 2816 ROM:4B9D dc.b 84 ; 20 ROM:4B9E dc.w 2944 ROM:4BA0 dc.b 104 ; 40 ROM:4BA1 dc.w 3008 ROM:4BA3 dc.b 139 ; 75 ROM:4BA4 dc.w 4032 ROM:4BA6 dc.b 149 ; 85 ROM:4BA7 dc.w 4416 ROM:4BA9 dc.b 164 ; 100 ROM:4BAA dc.w 4416 ROM:4BAC dc.b 170 ; 106 ROM:4BAD dc.w 3840 ROM:4BAF dc.b 180 ; 116 ROM:4BB0 dc.w 2880 The same applies to 3D tables. Best regards, Konstantin.
|
|
|
Post by dino2gnt on Sept 26, 2023 20:05:35 GMT
Hey Konstantin! Hope you've been well. Sarcasm! I believe the two structures you describe are specific to the JTEC firmware and aren't used in the SBEC3 firmware. The SBEC3 code has three identified table types: a 2D scale, a 3D table with encoded X axis, and a 3D table with no encoded X axis. Each table type has a header that defines the table size, which is what the viz tool reads to determine table dimensions. That's also why the starting offset in the values table for 3D tables is always 3 bytes higher than the supplied offset - to account for the header bytes. In the example below, the table also contains the X-axis values (a 1-byte RPM value in this case)
ROM:0BF6 dc.b 17 ROM:0BF7 dc.b 17 ROM:0BF8 dc.b 0FFh ; 0xFF == Signed ROM:0BF9 byte_BF9: dc.b 16, 19, 22, 25, 28, 37, 47, 55, 63, 82,101,119,138,152,180,194,225 ROM:0BF9 dc.b 210,210,223,234,238, 11, 14, 38, 31,127, 67, 69,127,127,127,127,127 ROM:0BF9 dc.b 210,210,222,232,239,246,251, 25, 24, 37, 23, 37, 50, 76, 62, 58, 26 ROM:0BF9 dc.b 210,210,222,233,238,246,239, 17,245, 66, 30, 43, 52, 78, 64, 60, 28 ROM:0BF9 dc.b 208,208,220,231,236,244,251, 11, 7, 54, 38, 43, 53, 79, 65, 61, 29 ROM:0BF9 dc.b 207,207,219,229,232,234,251, 25,255, 49, 32, 43, 53, 79, 65, 61, 29 ROM:0BF9 dc.b 205,205,218,228,232,224,251, 5,243, 25, 25, 25, 52, 79, 64, 60, 28 ROM:0BF9 dc.b 194,194,206,218,227,251,251, 16, 10, 26, 26, 10, 51, 77, 64, 62, 28 ROM:0BF9 dc.b 194,194,206,218,218,251,251, 16, 10, 26, 26, 10, 51, 77, 69, 68, 30 ROM:0BF9 dc.b 194,194,206,220,226,246,251, 16, 10, 21, 26, 10, 50, 77, 71, 70, 32 ROM:0BF9 dc.b 13, 4, 10,224,224,246,251, 16, 10, 21, 26, 10, 50, 75, 76, 73, 34 ROM:0BF9 dc.b 34, 24, 20,217,223,246,251, 16, 10, 16, 26, 10, 50, 73, 76, 73, 34 ROM:0BF9 dc.b 51, 40, 32,223,223,246,251, 16, 10, 16, 26, 10, 51, 73, 77, 74, 34 ROM:0BF9 dc.b 67, 55, 44,229,229,246,251, 16, 10, 10, 16, 10, 51, 73, 77, 74, 34 ROM:0BF9 dc.b 74, 62, 51,235,235,246,251, 10, 5, 5, 16, 10, 51, 73, 77, 74, 34 ROM:0BF9 dc.b 75, 63, 52,236,236,246,251, 8, 2, 5, 16, 10, 51, 73, 77, 74, 33 ROM:0BF9 dc.b 80, 68, 56,240,240,246,249, 5, 1, 5, 16, 12, 52, 74, 78, 76, 35 ROM:0BF9 dc.b 87, 75, 63,246,246,252,249, 5, 5, 5, 16, 12, 54, 79, 81, 80, 39
For the 2D byte-to-byte scale, it's "type c" in the viz tool, but it looks for a two byte header value for the number of byte pairs, and whether the values are signed or unsigned
ROM:0928 dc.b 3 ; BARO+MAP Scale ROM:0929 dc.b 80h ; unsigned ROM:092A dc.b 128, 0 ROM:092A dc.b 240,224 ROM:092A dc.b 255,255
I think, in the entire SBEC3 firmware, there are maybe two examples of 3D tables with no encoded X, ("type B" tables). I mostly use this mode to edit hex values directly, using the settings of "type B, view as Hex".
My workflow goes something like this:
In the Options pane, click Browse and upload a firmware image. Then, provide the offset of the table or location in the "Table Address (hex)" textbox. Input format is in hex, e.g. '0x0BF6'. Select your table type options in the pane to the right of the textbox. Click "Draw or Reload". If you edit the table in the values table, click "Save Data" in the left left of the table. Once any edits are complete and saved, select the checksum options (128 or 256K), and click "Write New Checksum". The checksum is written in-place. You can then click "Download Modified ROM" to download your modified binary firmware.
|
|
Piton
Junior Member
Posts: 94
|
Post by Piton on Sept 26, 2023 20:37:03 GMT
My favorite table for converting the value of a temperature sensor from an ADC. Note that the values are in degrees Celsius, not Fahrenheit. It feels like the programmers were not from America.
Input word, output byte.
ROM:0408 CONV_TEMP: dc.b 20 ROM:0408 ; Size Table ROM:0409 WtoB <55, 214> ; 150C ROM:040C WtoB <71, 204> ; 140C ROM:040F WtoB <85, 194> ; 130C ROM:0412 WtoB <108, 184> ; 120C ROM:0415 WtoB <137, 174> ; 110 ROM:0418 WtoB <175, 164> ; 100 ROM:041B WtoB <222, 154> ; 90 ROM:041E WtoB <282, 144> ; 80 ROM:0421 WtoB <354, 134> ; 70 ROM:0424 WtoB <440, 124> ; 60 ROM:0427 WtoB <534, 114> ; 50 ROM:042A WtoB <631, 104> ; 40C ROM:042D WtoB <725, 94> ; 30 ROM:0430 WtoB <809, 84> ; 20 ROM:0433 WtoB <877, 74> ; 10C ROM:0436 WtoB <929, 64> ; 0C ROM:0439 WtoB <966, 54> ; -10C ROM:043C WtoB <990, 44> ; -20C ROM:043F WtoB <1005, 34> ; -30C ROM:0442 WtoB <1014, 24> ; -40C
|
|
Piton
Junior Member
Posts: 94
|
Post by Piton on Oct 2, 2023 15:57:35 GMT
Hello Daniel. A couple of questions remain. The first is where the offset for the checksum came from (for JTEC EqualizerOffset = 0x02FF;) ? In my experience there is a different bias. According to the standard, there is a requirement for vehicle software as Calibration verification numbers (CVN). It does not depend on the checksum. But the OBD protocol will give you an error if you change any bit in the program. mechanics.stackexchange.com/questions/46041/is-the-calibration-verification-number-cvn-uniqueJTEC calculate CVN ROM:29DE6 MAIN_LOOP: ; CODE XREF: HW_INIT+1D1C↑j ROM:29DE6 ; MAIN_LOOP↓j ... ROM:29DE6 brset 50Eh, Z, #80h, MAIN_LOOP ; Calibration Verification Numbers (CVN) ROM:29DEC ldd #6Dh ROM:29DF0 std 52Dh, Z ROM:29DF4 ldd #47h ROM:29DF8 std 52Fh, Z ROM:29DFC clrb ROM:29DFE tbxk ROM:29E00 ; assume XK = 0 ROM:29E00 ldx #0 ROM:29E04 ROM:29E04 loop: ; CODE XREF: MAIN_LOOP+D4↓j ROM:29E04 ; MAIN_LOOP+DC↓j ROM:29E04 ldd 52Bh, Z ROM:29E08 bitb #20h ROM:29E0A lbne loc_29ECE ROM:29E0E lde 52Fh, Z ROM:29E12 ande #0E000h ROM:29E16 eore 1Eh, X ROM:29E1A eore 18h, X ROM:29E1E eore 16h, X ROM:29E22 eore 14h, X ROM:29E26 come ROM:29E28 ste 534h, Z ROM:29E2C lde 52Fh, Z ROM:29E30 ande #3Ch ROM:29E34 adde 10h, X ROM:29E38 adde 0Eh, X ROM:29E3C adde 0Ah, X ROM:29E40 adde 4, X ROM:29E44 eore 534h, Z ROM:29E48 ste 534h, Z ROM:29E4C lde 52Fh, Z ROM:29E50 ande #0FCh ROM:29E54 eore 534h, Z ROM:29E58 ste 534h, Z ROM:29E5C lde 52Fh, Z ROM:29E60 ande #380h ROM:29E64 adde 8, X ROM:29E68 adde 6, X ROM:29E6C adde 2, X ROM:29E70 adde 0, X ROM:29E74 ste 532h, Z ROM:29E78 lde 52Fh, Z ROM:29E7C ande #1C00h ROM:29E80 eore 0Ch, X ROM:29E84 eore 12h, X ROM:29E88 eore 1Ah, X ROM:29E8C eore 1Ch, X ROM:29E90 eore 532h, Z ROM:29E94 ste 532h, Z ROM:29E98 lde 52Fh, Z ROM:29E9C ande #0FE00h ROM:29EA0 eore 532h, Z ROM:29EA4 eore 534h, Z ROM:29EA8 eore 52Dh, Z ROM:29EAC ste 52Dh, Z ROM:29EB0
ROM:29EB0 Next_block: ; CODE XREF: MAIN_LOOP+162↓j ROM:29EB0 aix #20h ROM:29EB2 stx 52Bh, Z ROM:29EB6 txkb ROM:29EB8 cmpb #3 ; Check Page ROM:29EBA lbcs loop ROM:29EBE cpx #END_ROM ; 3BB90 ROM:29EC2 lbcs loop ROM:29EC6 bset 50Eh, Z, #80h ; Set End ROM:29ECA lbra MAIN_LOOP ROM:29ECE ; --------------------------------------------------------------------------- ROM:29ECE ROM:29ECE loc_29ECE: ; CODE XREF: MAIN_LOOP+24↑j ROM:29ECE lde 2, X ROM:29ED2 eore 6, X ROM:29ED6 eore 8, X ROM:29EDA eore 0Ah, X ROM:29EDE ste 534h, Z ROM:29EE2 lde 52Dh, Z ROM:29EE6 ande #7F00h ROM:29EEA eore 4, X ROM:29EEE eore 0Eh, X ROM:29EF2 eore 12h, X ROM:29EF6 eore 534h, Z ROM:29EFA ste 534h, Z ROM:29EFE lde 0Ch, X ROM:29F02 eore 10h, X ROM:29F06 eore 16h, X ROM:29F0A eore 18h, X ROM:29F0E come ROM:29F10 eore 534h, Z ROM:29F14 ste 534h, Z ROM:29F18 lde 1Ah, X ROM:29F1C eore 1Ch, X ROM:29F20 ste 532h, Z ROM:29F24 lde 52Dh, Z ROM:29F28 ande #0F000h ROM:29F2C eore 0, X ROM:29F30 eore 14h, X ROM:29F34 eore 1Eh, X ROM:29F38 eore 532h, Z ROM:29F3C eore 534h, Z ROM:29F40 eore 52Fh, Z ROM:29F44 ste 52Fh, Z ROM:29F48 lbra Next_block ROM:29F48 ; End of function MAIN_LOOP
|
|