ok we have some rom dump, how to "hack" it?

[Nemis]

now in this forum we can see come ecu rom dump

but how about ignition table, or fuel table?
how to change the map in this file?

someone have found where the map are, and what map are?
bye

[calvinc]

guys we are doing this the hard way. i realize people want to get 'fiddling' with their ecu data but if we analyze each and every ecu dump looking for individual maps it will take us ages to build up the database.

i'm 100% that the map locations, including axis size definitions, are in the rom itself. if we can find out the header structure for the rom we will save months of research time.

calvin.

[cboles]

i'm 100% that the map locations, including axis size definitions, are in the rom itself. if we can find out the header structure for the rom we will save months of research time.
calvin.

I disagree. All of the ECU code that I have looked at just directly accesses data in the flash without another layer of indirection. I certainly don't keep track of where my tables are located in ROM when I write C or ASM, so I'm not sure why the Denso engineers would bother either, performance issues aside. That's the job of the compiler (or the linker, really). If you have evidence otherwise, I'd be interested to see it though...

Of course it is useful to add indirection if you want to do live tuning where, for example, the code would lookup a pointer in RAM which tells it where to actually find the table. If the pointer is validated, it can find that table in RAM where you are modifying the values on the fly. If not, it can get the table from the usual place in ROM. This way you can overcome the limitation that there is not enough RAM in the WRX ECU to put all of the ROM tables in RAM for live modification by selectively mapping what you need into RAM on the fly.

[cboles]

[I moderated Spiider's MAP offset posts to the respective model years in the reverse enginering forums...]

[calvinc]

if you re-use the same processing code then it makes sense to have adjustable table definitions in the flash memory. it is after all the maps that make the car run...

[cboles]

I'm looking at some stuff related to OBD Diagnostic Trouble Codes (DTCs) in the Subaru ROM right now, and appears that there is a lookup table for how many parameters (including the DTCs) map into the RAM space... Stay tuned.

[calvinc]

great work colby! keep it up...

am i correct in assuming that the.tpu file contains the processing code?

[cboles]

what do you mean by processing code? the TPU memory area is only executed when you are in the kernel loading mode - it isn't used in normal operation of the car.

[calvinc]

the code that administers the RAM area and gets the values from the ROM tables.

[richip]

I'm looking at some stuff related to OBD Diagnostic Trouble Codes (DTCs) in the Subaru ROM right now, and appears that there is a lookup table for how many parameters (including the DTCs) map into the RAM space... Stay tuned.

Any updates?

[cboles]

Haven't had a chance to get at it again. I will try to write up what I have figured out so far though.

[richip]

Haven't had a chance to get at it again. I will try to write up what I have figured out so far though.

Thanks. Anything to keep the momentum going (at least for me )

[evo]

Hi guys

im obviously new here, but my experiences extend back 5+yrs to the inception of the honda PGMFI forums.

Does anyone have the opcodes/mnemonics for the MCU chips.

unless im on the wrong tangent here, this is the only proper way to read the DASM correctly.

sorry if i've missed anything, ive spent a few hrs reading the forum, and couldnt find these codes.

Any help, much appreciated.

[ahains]

Colby posted a HC16 module for IDA, including source.
I'm an assembly newb, but I would assume that even if you don't have IDA you should be able to easily find the opcodes in his source code. Post is here:
http://forums.openecu.org/viewtopic.php ... ght=module

-Adrian

Hi guys

im obviously new here, but my experiences extend back 5+yrs to the inception of the honda PGMFI forums.

Does anyone have the opcodes/mnemonics for the MCU chips.

unless im on the wrong tangent here, this is the only proper way to read the DASM correctly.

sorry if i've missed anything, ive spent a few hrs reading the forum, and couldnt find these codes.

Any help, much appreciated.