RomRaider

Hey, not too sure if this is the right way/place to post this, but I was doing some research on removing throttle rev hang in an 08 STi. I came across this post (viewtopic.php?f=15&t=13107&start=15) and saw someone had mentioned something about a "Target Throttle Angle Idle Airflow Target Base Minimum" table they found/used for fixing Rev Hang. I didn't see anything in the latest defs, or the Alpha defs for either Romraider or ECU Flash, so I decided to see what I could find.

I ran ScoobyRom on the OEM ROM for the car AZ1G202I, and while I didn't look through the decompiled ROM to figure out what is look at this table, I did find one that looked pretty similar to the table in the post above (see screenshot).

Question: Can anyone, or how can I confirm that this is the Target Throttle Angle Idle Airflow Target Base Minimum table? Z start is 0xD4D2C and the values look to make sense based on the ROM.

Hi there. I was one of the people discussing rev hang in the thread you linked to. For me, the Target Throttle Angle Idle Airflow Target Base Minimum table made a difference, but the "idle airflow min target decel adder" table made an even bigger difference. I shared a view of this table, both stock and tuned, as well as some additional information relevant to reducing rev hang in the second to last post in the thread you linked to, see page 3. Also, I wrote a lengthier post on this topic here: https://forums.nasioc.com/forums/showth ... ?t=2933889

I've been straight out at work lately, but if I can find some time I'll try and confirm the addresses of these tables for your ROM in IDA. If you don't hear back in a few weeks, PM me a reminder

The help would be appreciated!

Hi, took a look in IDA just now and was able to confirm that the table you found is in fact the "Target Throttle Angle Idle Airflow Target Base Minimum" table. I also dug out the "Idle Airflow Min Target Decel Adder (RPM)" table. Both tables were verified by tracing the table addresses back to the sub-routines and comparing them to known sub-routines that correspond to those tables.

My notes for this ROM are copied below and a screenshot showing the Idle Airflow Min Target Decel Adder (RPM) table is attached so you can confirm it is correctly setup in whatever program you use. Good luck!

USDM Market Vehicle
ECU ID 6912783007
Flash Method SUBARUCAN
Memory Model SH7058
Checksum subarudbw
32 Bit Rom

Entry Point is C0C

For 7058, Start is 0xFFFF0000, physical RAM length is 0xBFFF, but enter 0xFFFF.
Be sure to check the box to make the RAM segment.

Leave ROM length and start at defaults

There's a way to create one later as well. After the ROM is opened, click "Edit, Segments, Create Segment" in the menu. For a 7058 CPU, fill in the box as follows:

Segment name: RAM
Start address: FFFF0000
Length: BFFF (End: FFFFBFFF)
Base: 0
Class: (empty)
32-bit segment

<table name="Idle Airflow Min Target Decel Adder (RPM)" address="d3628">
<table name="Engine Speed" address="D35E8"/>
</table>

Target Throttle Angle Idle Airflow Target Base Minimum
D4C9C - RPM
D4CDC – Requested Torque
D4D2C – Throttle Position %

Much appreciated!

Have a subroutine address or IDA layout/script (can't recall the right names, I dabble poorly in IDA) that defines them a bit better? I have some other stuff I want to search around for, and having a base for an example would help.

I'll throw these into my RR defs and go ahead and play

Happy to help! I relied on the kindness of others on these forums for some time before finally figuring some basic things out, so just trying to repay those favors.

Regarding the IDA script, see attached. This was generated using the version of XMLtoIDC that is built into Sharptune and the latest defs. Of course, the script only shows the tables listed in the defs, but this can help to locate yourself within a ROM since the layout is similar in most.

Regarding subroutine addresses, I don't have them handy (on a virtual machine that is not readily accessible right now), but they are pretty easy to find using the table addresses already provided. My basic strategy (IDA specific) is to do a text search (alt-T) for the table addresses in the IDA view tab and, if only one address shows up, jump to the address then right-click on that location and choose "list cross-references to". This usually only provides one or two locations, one of which is a mov or similar operation and the other being an offset, multiplier, or similar (not positive on this second location, never really use it). Choose the mov or similar operation to jump to then view the location as a graph (i.e. right-click anywhere in IDA view and choose "view graph"). This should put you in the subroutine that uses that table with the value highlighted.

If more than one address is listed in your search for the table address, try choosing a different axis of the table to search (e.g. sometimes RPM or requested torque axis are shared between separate tables, but the data and/or other axis of those same tables is usually not). So long as at least one of those searches yields only one result, you can be reasonably sure that the location is correct, I think (I'm also more of a dabbler than a guru ).

Let me know if you need anything else and/or how the changes work out for you!

Wonderful, that's the exact insight I am after. Tables are so easy to find, but confidently defining them are things I struggle with... more so with ROMs I have dumped, but no one is working on.

I'll get to tuning here in a few weeks, working on removing the AP from the car, and some of the parts that go with it... also may just throw in a 207, but these tables will still apply to that ROM.

A year later, and I finally added in these defs to my defs.. easy cheesy for someone looking for these tables for their 08 STi.

Tuned out all of the flow adders and seemed to help.. needs a bit of tuning on the throttle angle base, but I need to drive the car more now without a Cobb AP on it to figure out what to do.

Some logs show that there is definitely room for response improvement: https://datazap.me/u/equinox92/grb-8-27 ... =1788-2434

You can see the throttle opening angle opening faster and closing slower than the pedal request or torque request. Don't want to ruin on throttle response by damping the request to 100% angle so I have left the table until I drive it more and decide what to do.

Man it's also nice to have the same tables in each SI drive mode too