RomRaider

Has anyone looked at how CAN data gets copied to the ECU's RAM?

With Ghidra's auto analysis, it can only find reads on parameters like vATTEMP and wvATTEMP but no writes. It can't get there by magic!

One theory/guess I have there might be some sort of array of CAN IDs to RAM addresses in the ROM and copying CAN IDs to RAM could be handled by a single function.

What triggered me to try and learn more about the CAN functionality is that I can only find wvATTEMP on VD70A and not vATTEMP. I can't find either on VC269 but I suspect they're there somewhere, even if not used by the ECU. I know TCMs are compatible between the two so if I could work backwards from the wvATTEMP on VD70A to find a CAN ID then work forwards from the same CAN ID on VC269.

I have a bench TCM but the flash chip is currently removed and I really don't want to solder it back on at the moment. If I had more motivation, I could put the bench TCM back together, power it up together with my bench ECU, hook potentiometers up to the two separate fluid temp inputs with different scalings and do ECU RAM dumps looking for expected values but that's pretty intense!

There are a crazy amount of vCANDAT RAM parameters. Haven’t looked at functionality, but I would assume “vCANDAT” = CAN Data.