4EAT TZ TCM ROM image

Sasha_A80 · **Posted:** Sat Oct 06, 2012 8:32 am

Getting started..

SH7055F chip inside.

Sasha_A80 · **Posted:** Sat Oct 06, 2012 12:48 pm

To be continued:

ROM:000609F8 SSM_READ_lookup_table_609F8:.data.l byte_FFFF9A6A ; DATA XREF: sub_91F0:off_9464
ROM:000609FC .data.l ecuID_0_byte_60682
ROM:00060A00 .data.l ecuID_1_byte_60683
ROM:00060A04 .data.l ecuID_2_byte_60684
ROM:00060A08 .data.l ecuID_3_byte_60685
ROM:00060A0C .data.l ecuID_4_byte_60686
ROM:00060A10 .datab.l 8, _00_byte_6067D
ROM:00060A30 .data.l SSM_00E_RPM_word_FFFF9A6B
ROM:00060A34 .data.l SSM_00E_RPM_word_FFFF9A6B+1
ROM:00060A38 .datab.l h'C, _00_byte_6067D
ROM:00060A68 .data.l SSM_01C_BatteryVoltage_byte_FFFF9A6D
ROM:00060A6C .data.l _00_byte_6067D
ROM:00060A70 .data.l SSM_01E_ThrottleSensorVoltage_byte_FFFF9A6E
ROM:00060A74 .datab.l h'A, _00_byte_6067D
ROM:00060A9C .data.l SSM_029_AcceleratorOpenning_byte_FFFF8AE7
ROM:00060AA0 .datab.l h'1E, _00_byte_6067D
ROM:00060B18 .data.l SSM_048_FrontWheelSpeed_byte_FFFF9A6F
ROM:00060B1C .data.l _00_byte_6067D
ROM:00060B20 .data.l SSM_04A_Gear_byte_FFFF9A70
ROM:00060B24 .data.l SSM_04B_LinePressureDuty_byte_FFFF9A71
ROM:00060B28 .data.l SSM_04C_LockupDuty_byte_FFFF9A72
ROM:00060B2C .data.l SSM_04D_TransferDuty_byte_FFFF9A73
ROM:00060B30 .data.l SSM_04E_ThrottleSensorVoltage_byte_FFFF9A74
ROM:00060B34 .data.l SSM_04F_TurbineRPM_byte_FFFF9A75
ROM:00060B38 .data.l SSM_050_BrakeClutchDuty_byte_FFFF9A76
ROM:00060B3C .data.l SSM_051_RearWheelSpeed_byte_FFFF9A77
ROM:00060B40 .datab.l 3, _00_byte_6067D
ROM:00060B4C .data.l SSM_055_LateralGsensorVoltage_byte_FFFF9A78
ROM:00060B50 .data.l SSM_056_ATFtemperature_byte_FFFF9A79
ROM:00060B54 .data.l SSM_057_LowClutchDuty_byte_FFFF9A7A
ROM:00060B58 .data.l SSM_058_HighClutchDuty_byte_FFFF9A7B
ROM:00060B5C .data.l SSM_059_LoadReverseBrakeDuty_byte_FFFF9A7C
ROM:00060B60 .datab.l 6, _00_byte_6067D
ROM:00060B78 .data.l SSM_060_Reset_byte_FFFF8300

Sasha_A80 · **Posted:** Sun Oct 07, 2012 4:05 am

Table indexes are loaded into RAM:

ROM:000326F2 loc_326F2: ; CODE XREF: loadTableDescriptors_sub_326AA+1Aj
ROM:000326F2 ; loadTableDescriptors_sub_326AA+24j
ROM:000326F2 ; loadTableDescriptors_sub_326AA+2Cj
ROM:000326F2 ; loadTableDescriptors_sub_326AA+36j
ROM:000326F2 ; loadTableDescriptors_sub_326AA+3Ej
ROM:000326F2 extu.w r5, r4
ROM:000326F4 mov.w @(h'EA,pc), r8 ; [000327E2] = h'FFFF8FAC
ROM:000326F6 mov #1, r3
ROM:000326F8 mov.w @(h'E8,pc), r9 ; [000327E4] = h'FFFF8FA8
ROM:000326FA tst r4, r3
ROM:000326FC mov.w @(h'E6,pc), r10 ; [000327E6] = h'FFFF8FA4
ROM:000326FE mov.w @(h'E6,pc), r11 ; [000327E8] = h'FFFF8FE8
ROM:00032700 mov.w @(h'E6,pc), r12 ; [000327EA] = h'FFFF8FA0
ROM:00032702 mov.w @(h'E6,pc), r13 ; [000327EC] = h'FFFF8F9C
ROM:00032704 mov.w @(h'E6,pc), r14 ; [000327EE] = h'FFFF9040
ROM:00032706 mov.w @(h'E6,pc), r7 ; [000327F0] = h'FFFF8F98
ROM:00032708 mov.w @(h'E6,pc), r6 ; [000327F2] = h'FFFF8FDC
ROM:0003270A bt loc_3277E
ROM:0003270C mov.l @(h'110,pc), r1 ; [00032820] = _2D_word_6EE8C
ROM:0003270E mov.l r1, @r7
ROM:00032710 mov.l @(h'110,pc), r3 ; [00032824] = _3D_byte_6EF9C
ROM:00032712 mov.l r3, @r13
ROM:00032714 mov.l @(h'110,pc), r2 ; [00032828] = _3D_word_6EFC4
ROM:00032716 mov.l r2, @r12
ROM:00032718 mov.l @(h'110,pc), r3 ; [0003282C] = _3D_word_6EFB0
ROM:0003271A mov.l r3, @r10
ROM:0003271C mov.l @(h'110,pc), r2 ; [00032830] = _3D_word_6EFD8
ROM:0003271E mov.l r2, @r9
ROM:00032720 mov.l @(h'110,pc), r3 ; [00032834] = _2D_word_6EE9C
ROM:00032722 mov.l r3, @r8
ROM:00032724 mov.l @(h'110,pc), r2 ; [00032838] = _3D_byte_6EFEC

Table axes\content may be RAM loaded:

ROM:0006EE9C _2D_word_6EE9C: .data.b h'E ; DATA XREF:loadTableDescriptors_sub_326AA:off_32834
ROM:0006EE9D .data.b 9
ROM:0006EE9E .data.b 0
ROM:0006EE9F .data.b 0
ROM:0006EEA0 .data.l word_FFFF90E4
ROM:0006EEA4 .data.l word_66518
ROM:0006EEA8 .data.b 0
ROM:0006EEA9 .data.b 0
ROM:0006EEAA .data.b 0
ROM:0006EEAB .data.b 0

subarutech77 · **Joined:** Fri Jul 17, 2009 2:47 am **Posts:** 77

Nice work Sasha!

nsfw · **Joined:** Thu Nov 23, 2006 2:23 am **Posts:** 2565

Very cool! How did you read the ROM?

Sasha_A80 · **Posted:** Wed Oct 10, 2012 7:07 am

This particular one by means of the stack hacked to enable AUD.
Not applicable for MY02+ due to proper stack protection for SH based Denso ecu's.

Will try to upload ROMs of the rest TCUs floating around or being donated. Could not promise to return those TCUs back.

Sasha_A80 · **Posted:** Wed Feb 20, 2013 9:02 pm

SH7054F chip inside.

4EAT TV TCM added.

dschultz · **Posted:** Mon Mar 04, 2013 3:10 am

Sasha_A80 wrote:

Getting started..
92D170F000_86D17WF0_31711AG331_TZ_TCM.BIN
SH7055F chip inside.

Here's a dump of all the tables in the ROM with raw axis and data units.
Once the units are discovered then the def can be refined accordingly.

Sasha_A80 · **Posted:** Mon Mar 04, 2013 3:46 am

Probably we need an insider to understand algorithms..
There are a lot of tables with axes\body located in RAM.
I suspect those table are for TCU learning features.

subarutech77 · **Joined:** Fri Jul 17, 2009 2:47 am **Posts:** 77

These both have 7055 inside

dschultz · **Posted:** Mon Mar 04, 2013 4:24 am

Sasha_A80 wrote:

Probably we need an insider to understand algorithms..
There are a lot of tables with axes\body located in RAM.
I suspect those table are for TCU learning features.

The references to RAM addresses are for tables that share a common axis. There are many 2D and some 3D tables that do this. The RAM address contains two Words, the index along the axis that the lookup value matches and the quotient for interpolation between the two cells bounding the lookup value.
In the def I provided I resolved the RAM addresses to the shared axis they reference. You will see them listed with "Shared " table labels and Shared axis labels.

Here's an example. The Axis_ is referenced just below the RAM address that's loaded to r6.
Then the Data_ is read using the same RAM address which contains the index and quotient from the axis lookup.

Code:

ROM:0003834C 90 1F                       mov.w   #h'FFFF919F, r0
ROM:0003834E 20 20                       mov.b   r2, @r0
ROM:00038350 96 1E                       mov.w   #h'FFFF91BC, r6
ROM:00038352 65 00                       mov.b   @r0, r5
ROM:00038354 D4 10                       mov.l   #Axis_4CF40, r4
ROM:00038356 92 1C                       mov.w   #h'32B8, r2
ROM:00038358 42 0B                       jsr     @r2 ; sub_32B8
ROM:0003835A 65 5C                       extu.b  r5, r5
ROM:0003835C 95 18                       mov.w   #h'FFFF91BC, r5
ROM:0003835E D4 0F                       mov.l   #Data_4CF5C, r4
ROM:00038360 93 18                       mov.w   #h'3384, r3
ROM:00038362 43 0B                       jsr     @r3 ; sub_3384
ROM:00038364 00 09                       nop
ROM:00038366 92 16                       mov.w   #h'FFFF91AA, r2
ROM:00038368 4F 26                       lds.l   @r15+, pr
ROM:0003836A 00 0B                       rts
ROM:0003836C 22 01                       mov.w   r0, @r2   ; store result

I believe many of these shared tables are related to other structured lookup tables, that when indexed point to a table to be read in each case. Indexes are possibly related to gear, TPS, RPM, etc.

TCM Table Structure Reference

Code:

Shared Table Axis - Data Type Byte
0x04 (00000100)
     - data uint8
0x08 (00001000)
     - data uint16

Shared Data Axis - Data Type Byte (bit 0-7 check)
    Axis references a RAM address of lookup values from shared axis
0x0D (00001101)
     - data values bit0 = 1 uint8 data
0x0E (00001110)
     - data values bit0 = 0 uint16 data
0x3D (00111101)
     - data values bit0 = 1 uint8 data
0x3E (00111110)
     - data values bit0 = 0 uint16 data
 
    
2D Table - Data Type Byte (bit 0-7 check)
byte - DataType
byte - Size
word - 0x0000 ?
dword - axis address
dword - data address
dword - 0x00000000 ?
0x05 (00000101)
    - axis values bit2 = 1 uint8 data
     - data values bit0 = 1 uint8 data
0x06 (00000110)
    - axis values bit2 = 1 uint8  data
     - data values bit0 = 0 uint16 data
0x09 (00001001)
    - axis values bit2 = 0 uint16 data
     - data values bit0 = 1 uint8  data
0x0A (00001010)
    - axis values bit2 = 0 uint16 data
     - data values bit0 = 0 uint16 data


3D Table - Data Type Byte (bit 0-7 check)
byte - DataType
byte - X axis size
byte - Y axis size
byte - 0x00 ?
dword - X axis address
dword - Y axis address
dword - data address
dword - 0x00000000 ?
0x19 (00011001)
    - first  axis bit2 = 0 uint16 data
     - second axis bit4 = 1 uint8  data
     - data values bit0 = 1 uint8  data
0x1D (00011101)
    - first  axis bit2 = 1 uint8  data
     - second axis bit4 = 1 uint8  data
     - data values bit0 = 1 uint8  data
0x29 (00101001)
    - first  axis bit2 = 0 uint16 data
     - second axis bit4 = 0 uint16 data
     - data values bit0 = 1 uint8  data
0x2A (00101010)
    - first  axis bit2 = 0 uint16 data
     - second axis bit4 = 0 uint16 data
     - data values bit0 = 0 uint16 data

Sasha_A80 · **Posted:** Sat Mar 16, 2013 6:00 am

TCU Legacy BF5.
SH7055 processor.

Sasha_A80 · **Posted:** Fri Apr 12, 2013 7:29 pm

SH7054F based 4EAT TV TCM added.
Probably 31711AG332 case.

Sasha_A80 · **Posted:** Fri Apr 12, 2013 7:31 pm

SH7054F based 4EAT JDM Forester TV TCM added.

Sasha_A80 · **Posted:** Tue May 06, 2014 5:48 pm

SH7055F chip inside.
4-EAT TCM

RomRaider

4EAT TZ TCM ROM image

Who is online