RomRaider

I'm in the process of converting my A8DH200X rom to SD using freon's code, but I'm running into some trouble with the analysis. I have the rom almost completely disassembled, and I've been able to find a bunch subroutines based on references to various things I found in the definitions. However, I'm still missing alot of stuff, including the maf calculations.

So, what I'm looking for is addresses of data stored in RAM used by the ecu, such as rpm, map, load, g/s, mafv, etc...

I've searched for a list, but can't find anything. If anyone knows the addresses or a method to find the address from the *direct* logger defs, it would really help me out.

Thanks

The XML defs use an "ECU ID" rather than the CALID. Not sure why, but it adds a step.

Look up your CALID in the ecu_Defs.xml, the "ECU ID" is in there, then find that value in the logger defs to find all the "direct logger parameters." I.e., yours is 4312584006. You then have to finger through the values.

I recommend this. Use Textpad. Mark all instances of "ecuparam id=" and "4312584006". (F5 for find window, then "mark all" button). Then use the F2 button. You'll find the parameter, press F2 again and it will show you the address.

This should show you the address is 0xFF6698. (or rather it would be 0xFFFF6698)

I do use a more direct MAP value than I think Merchgod has in the logger defs. There is a smoothing function (used MAP = (current MAP + previous MAP)/ 2). I figured this was a bad idea and would add lag in fueling so I used the MAP value immediately after digital to analog conversion. It's not very hard to find once you know the direct MAP memory location. Just look for where it is written to memory, the smoothing function is right there along with the direct MAP. If you then look for references to the direct MAP memory location you can find the D/A routine. All the D/A routines happen as calls from a master D/A routine, which is useful to have marked, while you're at it.

Thanks! Already found a bunch of stuff.

Just found the direct MAP value. I tried looking through all the references to the smoothed MAP, but had no luck. Instead, I found the MAP sensor scaling values being used and saw where the value was stored.

Also, this value is measured in mmHG

For the A8DH200X: 0xFF5CB4

Time to find Delta MAP

Ah yeah, the map defs that point to the gradient/offset for the MAP scaling is a smarter way. =P

Just keep looking for references to the direct MAP and you'll find the delta being calculated. It is used in the smoothing function. It only smooths if delta map is above or below 15mmhg/sample window or something like that.