RomRaider

The unofficial Guide to creating Merpmod based patches

Introduction
There has been a lot of requests for MerpMod (MM) 32bit speed density mod to be ported over to an individuals’ vehicle where a patch has not yet been made, or alternatively there are others who are seeking information to carry out the porting themselves. I’ve taken some time while recovering from an accident (don’t worry, not in a car, I'm fine) to collect the information that could potentially guide you through this journey. The information consists of existing information available throughout the forums along with pointers from my own experiences.

Target Audience
This documentation is simply intended for those who are looking to port their own versions of MM.
It assumes the reader has had previous experience or at least an understanding of the tuning process, particularly using ECUFlash, and understands the purpose of the modifications. It also assumes the reader has an understanding in the disassembly of ROMs, as this guide will not explain the disassembly process or the intricate uses of the software packages mentioned. Links to useful information will be provided for those wanting further reading.
This documentation does not, however, guarantee that the reader will in fact successfully build and apply a patch and all steps will be carried out at the reader's own risk.
The information provided, as mentioned above, does contain personal advice and clarification or correction is more than welcome from others where appropriate.

Software/Hardware required
HEW - viewtopic.php?f=25&t=7680
IDA - https://www.hex-rays.com/products/ida/
Sharptune - https://github.com/Merp/SharpTune
ECUFlash - https://www.tactrix.com/index.php?optio ... blog&id=36

Initial setup
Follow the installation process for IDA and HEW
Folder structure
Create a new folder that will house all your working files. This can be anywhere and called anything. Eg. “32bit Speed Density”
Create a new folder inside this and call it “MerpMod”. Download or clone the project files from your preferred flavour of MM (AijMod for this example) Here. Place the project files in the folder you have just created.
Download SharpTune and place SharpTune.exe inside the same folder as above.
Go back to your top level and create a new folder called “SubaruDefs”*. Download and place the ECUFlash and RomRaider definition folders inside the SubaruDefs folder. We will talk about which definitions later.
Go back to your top level and create a new folder called “SubaruRoms”* inside this, create another folder called “OEM”*. You will place the original image for the vehicle you are patching inside this folder. You can find most OEM ROMs here. This should also be in the .bin format.
*These folders must be named as described.

At this point your folder structure should look something like this.


Locating required addresses
Open the MerpMod.hws file within your MerpMod folder.



In the HEW file explorer, open the header file that has all the known addresses needed for the patch. eg. A8DH202X.h
Open the header file that relates to your ROM.
Click Window > Tile Vertically to have the windows sit side by side.

Work your way through the reference file copying the variables over to your own one by one, each time removing the address to make sure you don’t accidentally use it.

Open two instances of IDA, one with your OEM ROM and one matching the file you are using as reference above.
Using IDA

Go through each address listed in the reference image and find the occurance in your own. Note down the new address in your .h file.

Building your first patch

In your MerpMod folder, run SharpTune.exe and point the definition location to the SubaruDefs folder holding both the RomRaider and ECUFlash definitions. You will need to make sure the definitions you are using match the version of MM you are trying to build.

In HEW, click Setup > Customize > Placeholders.
Double click the TARGETROM placeholder and replace the CAL ID with yours. Click OK.
Depending on the version of MM you are building, you will need to set the build configuration to either Gratis, Flash or Switch. You can set this either using the dropdown menu near the top of your working windows, or by clicking Build > Build Configurations and selecting your build under “Current Configuration”.
To determine what build you will be using, refer to the documentation.

You may need to update your .h file to reflect the build config you are using. This is normally the first #include and following #define’s.

Back in HEW, press F7 or Build > Build to build your patch.
If the build process is successful, sharptune should open the donation page and then proceed to ask you which ecu defs and logger defs you wish to use. This will then create the new definitions.

A successful build should have applied the patch and removed the patch without error along with successfully creating the definitions.

If the definition process has errors but the patching process was successful, you can manually make the definitions later, however if you have any other errors or warnings present, you should go back through the logs and determine what these are. This guide will not provide advice as to how to correct any warnings or errors as it could be one of many things and should be checked thoroughly by yourself.
Applying your first patch
In your MerpMod folder, open MerpMod > TestRom. Here you will find your built patch file for the last successful build you have completed. Copy the .patch file to your mod location that SharpTune is currently referencing.

Open SharpTune.exe, open your OEM ROM file and you should then see your patch under the “Mods” tab. Click your mod in particular and click the “Apply Mod” button. Again you should see no errors in the log window.

Opening your first patch
In ECUFlash set your metadata directory to the "ECUFlash" folder that is in your SubaruDefs folder. The build process should have created a new folder within standard called "MerpMod". Within that the folder named after the build config you used (gratis, flash, switch) inside the appropriate folder will be the definition for your new ROM that includes all the new tables. If this doesn’t exist, double check the build logs in HEW to see if the definitions were successfully created. Otherwise you may need to create the definition by hand, copying an existing definition and finding the locations once again for the new tables that were injected into the ROM.

Open your patched ROM in ECUFlash and if your definitions are set up correctly/the ROM is patched correctly you should receive a checksum error. Click “Yes” and then save.

At this point you will need to go through each table one by one and make sure all the values are displayed correctly and are present. If any look incorrect, your definitions are likely incorrect, or potentially you have the wrong addresses entered in your .h file prior to building. Double check everything!

If you are confident that everything looks right, you can begin adjusting the tables where necessary. THESE NEW TABLES ARE NOT BASE TABLES AND MUST BE TUNED/CHECKED BEFORE USE!

Testing your first patch
**ATTENTION** At this point it’s all you! The above steps are all very important, however they are carried out in a safe environment where the undo button is readily available. The following steps could either result in a car with some extra features or a very expensive lawn ornament. If you do not feel comfortable with the changes you are making, if you are unsure as to what you are actually doing, or if you have received any errors or warnings along the way that you have ignored, STOP NOW. Otherwise, this is the fun part...

When you are completely confident in the changes you have made. Use the test write feature to apply your patched ROM to your vehicle. If all looks correct, continue with the actual writing process. If you receive any errors, stop. If anything else goes wrong, you will need to deal with any issues accordingly.

If the write is successful you can set up your logger with the logger definitions that were created and monitor your changes.

From here on, it’s the same process as any other time, monitor, drive, log, make changes.

Changelog
30/1/21 - Corrections and clarifications to the use of SharpTunes definition directory selection
7/1/21 - Updated links to prerequisites. Corrections and clarifications to folder structure
9/2/20 - Initial Post

To Do: Attach pdf/doc version with screenshots
Add thank yous
Coffee

Hi Puddles
thanks for the time to make this post

Im working on make a patch for wrx 2011 usdm (AE5IA10L)
and I read and read and reeeeead tons of post and guides but I have a litte problems to understand same parts

but my idea is:

I compared de stock rom for adm wrx 11 and stock rom wrx 11 usdm and aparently the tables are the same, rom to rom

so my hamster in mi mind tell : edit the existing patch of the ADM11 and acomodate for my call ID AE5IA10L, I read the guides for use ida and I observed the guides its for define a new rom so in this case my rom are defined and existing defitions so the proces its diferent or more short?

I run sharp tune and xml to idc and cheked the option "rom tables", this generate a script for me and open in Ida pro, in this part its my hell

I understand its necesary make a folder on merpmod work and I created the folder but dont understand how to make and insert the .h files .map file .c file same to all roms folder that show when I open de merpwork

so... my idea its stupid? or its a good way?

its possible your help in this new topic please? merp for usdm wrx 11 dont exist

No, this is not the case. The tables between ROMs may look identical however the addresses and structure of the ROM may be slightly or completely different behind the scenes.

This is where IDA comes in to play to confirm you are creating a patch specifically for your car.

As for creating the .c, .h and map files. You should be able to make a copy of the existing files there and rename them to what you are targeting. I have not tested this process however I would assume this is possible. At this point you use IDA to find the addresses for each item.

hi Puddles
thanks for your response!

well in this case the option for copy de .h files its not possible, the option its not available so I asuming its need to create this archives and this is my advance and my new wall

I used Xmltoidc and obtained 3 idc scripts (tables. stdparams, extendedparams)

so I imagine this archives are my base for create a
.map
config.h
xxID.txt file



but my problem is how to?
what tool or process?

its possible to guide me please? i read and read and read the README_PORTING.md but its very confuse


NOTES: in the merpmod work folder has created the current work folder (AE5IA10L usdm wrx 2011 MT)

has created a header file and this file contain a copied variables but deleted addresses (are unknowed for me on that point)

*atached images*


puddles it is the corret way to my process to build my patch??

You should be able to copy the files you need in the working folder itself, not in the program.



Not too sure what you mean here, but you should have
xxID.h (Looks like you already have this set up in your image)
xxIDConfig.h
xxID.txt
Don't worry about the .map that get's looked after later

I'm very confused going around in circles

Maybe it is something simple in which I am stuck but hew does not allow me the options to copy and paste the files from one folder to another are in gray (not available)
so I want to know: the .map file at what time will I need it? my xmltoidc degenerate files is enough to trace addresses and arm my patch? without the map file ??

I mean use Windows Explorer to navigate and copy the files that way in the "targets" folder, not in HEW


You will need to use IDA or similar program to find your addresses. xmltoidc creates a script that IDA will consume and show some of these addresses.
I'm not 100% positive where .map is used, but I have not needed to copy this file at any stage of the process.

I hope to make a video of the entire process, so if you are stuck, maybe wait for a little while until this is available.

try to copy them as you show me but when opening hew they do not appear in my folder, I will try again it may be successful

but in the best case I will gladly wait for your video !!. hoping it will not be in the very distant future ...

I have IDApro and I am with a lot of free time and wanting to be able to help and continue with this work and to be able to provide new updates if possible. right now i want to get patch for wrx 11

in advance I thank you very much for your work and your time!

video would be helpful. Thanks

video would be awesome!!!

Currently in the process of recording the video, hopefully will have something out in the next week.

puddles thank you very much man !!!
happy to see your work very helpful !!!

if possible if you can show some example related to finding or understanding the references of the addresses where to hang the hacks

thank you very much for the effort to give of your time man

thanks thanks thanks a lot!!


Enviado desde mi iPhone utilizando Tapatalk

Thank you Puddles!!!

Cant wait for it

*Edit - to prevent confusion, see my post a couple posts down.
Hey Puddles, thanks for taking the time to run through this. I've built Merps switch patch for A8DH202X, I haven't validated it by checking line by line but the .patch was created and the debugger window in HEW looked good except for the definition creation part. I did check out Aijmod but need to spend more time thumbing through the tables as I received a bunch of errors during the patch process with his project.

I'm having some definition problems and it'd be great if I could get everything working as it should so I don't have to manually build the defs.

I was hoping you could shed some light on a couple things:
1. You say point sharptune to the Romraider defs, do you mean specifically Subarudefs>Romraider or do you mean just Subaru defs?
1a. I seem to have a sharptune issue where no matter what I do, it's pulling the embedded defs from the .sharptune setting directory and not from my imtryingtobrickmyecu directory, thoughts here?
2. My folder structure to get everything working looks a bit different than yours, my first build attempt in HEW created a bunch of errors from files missing so I placed things where it looked like debugger said they were missing from. Did you have to do the same?


thanks in advance