RomRaider

SSM_WRITE_LUT

0x60 - ECU reset
0x6F - Ignition Timing Adjustment
0x70 - Idle RPM adjustment
0x71 - Idle RPM with Air Conditioner
0x89 - ???
0x8A - ???
0xE8 - ???

Has anybody traced those function calls? It looks like this is the last SSM position where something can be writen and read.

Associated memory bytes are bit tested in subroutines. SSM[E8] is a good candidate for "soft\partial" ecu reset (writen into checksum protected RAM area).


ROM:00037ECC .data.l LUT_READ_FF
ROM:00037ED0 .data.l LUT_READ_FF
ROM:00037ED4 .data.l SSM_READ_@089_FFFFB014
ROM:00037ED8 .data.l SSM_READ_@08A_FFFFB015
ROM:00037EDC .data.l LUT_READ_FF
ROM:00037EE0 .data.l LUT_READ_FF

ROM:0003844C .data.l SSM_WRITE_SKIP
ROM:00038450 .data.l SSM_WRITE_SKIP
ROM:00038454 .data.l SSM_WRITE_@089_FFFFB014
ROM:00038458 .data.l SSM_WRITE_@08A_FFFFB015
ROM:0003845C .data.l SSM_WRITE_SKIP
ROM:00038460 .data.l SSM_WRITE_SKIP

ROM:0003804C .data.l LUT_READ_FF
ROM:00038050 .data.l SSM_READ_@0E8_FFFF80D8
ROM:00038054 .data.l LUT_READ_FF

ROM:000385CC .data.l SSM_WRITE_SKIP
ROM:000385D0 .data.l SSM_WRITE__@0E8_FFFF80D8_SOFT_RESET ???
ROM:000385D4 .data.l SSM_WRITE_SKIP



7055 based JDM ROM.

I just started looking at the SSM write routines in my ROM last weekend. I think I have found the base of the SSM write LUT, and I'm trying to verify that 6F, 70 and 71 are the timing and idle adjustments. I hope to have that confirmed in the next couple days, and then I'll look into the others.

I've confirmed the timing adjustment in my ROM.

I've found some code that initializes 0x89 and 0x8A, called from code that also initializes many other variables, perhaps called the ECU boots, or when the engine starts. Also found code that checks different bits in the underlying variables. The code that calls those bit-check routines is a mystery to me though, I have not assigned names to any of the other variables that code works with.