RomRaider

Those letters are included by compilers for Renesas M32R chip protection against ROM reading.
Mitsubishi bootloaders do not pay attention to those letters.

OK thank you.

OK holidays are her for two weeks so I have lots of time to dedicate to my rom and tuning

I have already got a lot of stuff logging with 'Evoscan'

I am yet to get the MAF and TPS logging though.

The requests from Evoscan to log are in a CAN format, eg the rpm request is CAN2-2, speed is CAN3-1 and so on.

I have searched through the rom and it seems to me the requests point to the RAM addresses.

I can't find any xrefs that point to a particular address because they all seem to come from 31B0 which is the sub_31E4

Is there a way that Ida can point to the sub routine that writes to a particular point in the RAM ?

Yes you can make a data reference.
Under the File menu open the Script command window (or press Shift-F2). Enter the command:

where the first address is the code location and the second the RAM location.

Cool thank you,

Now I just need to work out which sub routine handles the MAF and TPS

Well I have spent a lot of time on this and have found the MAF tables as per the pic...

I am still no closer to working out the addresses so that I can log these things though.
I think I am logging the knock base instead of the the actual knocksum as the ECU is pulling one - two degrees of timing and knock is showing eleven counts. Not convinced yet, need to locate the proper addresses.

Any hints on how to find them ??



Uploaded with ImageShack.us

130 cells MAF table is probably usual for naturally asrirated engine Mitsubishi ecu.
I have got the same for EJ204 engine ecu.

Knock strategy may be not similar to FHI approach.

Is there anything that i can look for to find the knock info ?

I assume there would be some sort of table like the MAF to tell the ECU the conditions to start retarding timing....

I have followed the spark advance through various subroutines but I easily get lost as they branch to more subroutines.....

Another thing I struggle with is linking the rom to the ram addresses, can Ida do this for me ?

IDA can.
Just create RAM section.
But. You will need to make the majority of links manually since the compiler generates relative addresses.

Still having trouble finding what points to the ram address.
Everything in the ram references to 0x0. I guess the ECU needs power to start writing to the ram lol, I am tired will continue tomorow....

I hope one of you can explain this to me, from the screen capture below.

The reference in the ram section points to a subroutine which is in the yellow box at the right.
After the subroutine it has +20 and the little arrow pointing upward.
Almost all references in the ram have this extra part and some point down, some up.
The numbers vary from zero to over 100.
Most of the subroutines are loading a 24bit immediate value.

I am stuck with tuning as have a persistent knock. It seems to be in cycles and we think it is EGR related.
So I am trying to find the EGR info and any knock strategy info I can.

I think I have found the EGR timing advance table but not certain yet.

Those simply give details about the reference.

In this case, (one of) the reference to that ram address occurs in sub_20B8 at offset 20, which is 'upwards' from 0x807A96. Not sure exactly what the letters mean, but you'll see a pattern that corresponds to: loading immediate data, loading data @ address, jump to sub, branch, etc. Pressing x while highlighting the ram address will show the full list of references.

There are opportunities:

- you may zero EGR tables
- you may disable EGR algo

After that you are to make alternative ignition tables equal to each other in order to prevent ignition advance when ecu consider EGR is open.

Below is EGR table fo reference

Thanks for the info guys

I am trying to follow the ignition timing to see where I am logging it from and where the ecu writes it to the ram.

Sasha, awesome, but you are light years ahead of me
I am yet to find the EGR duty tables

So with some more runs and investigation the knock is being triggered by a reducing injector pulse width.

The load also reduces similarly.

From around 4500rpm though to 6000 rpm
Load from 93 % to 82 %
IPW from 15.1 ms to 12 ms

Obviously as the ipw reduces the knock gains.

I can't find any reason for this... unless my MAF is crook or maxing out at 4500 rpm.

Attached is an Evoscan log