Landrover 4.4L V8 petrol Denso ECU Help

martymonaro · **Joined:** Thu Feb 15, 2007 12:59 am **Posts:** 23

I am hoping someone here can help me, I have a Landrover 4.4L V8 petrol with denso ECU and I want to turn off EGR codes and cannot find anyone who can or is willing to help and I thought I would try here. I have tried putting file into IDA and using what I have read here but it is not helping me. If anyone has any idea and can help me with locations or point me in the direction I would be very great full.

Thanks Marty

dschultz · **Posted:** Tue Dec 04, 2012 10:40 am

Off hand I'm going to say that it's not setup the same way the Subaru CEL routines work.
Do you have any additional info about the ROM layout and how it communicates, what protocol is used for diagnostics?

td-d · **Posted:** Tue Dec 04, 2012 11:12 am

I can verify that. That being said, I've figured out how most of the tables work, and I suspect the CEL routine is here:0x44C00 and the CEL switches here: 0x449F0 - but it's not a 1 / 0 switch table - uses values 0,1,2, 3,5, 6, 9 and 10.

Check out how subroutine 0xDC87A evaluates the switches.

radsdau · **Joined:** Thu Apr 06, 2006 9:53 pm **Posts:** 15

I'm not sure it's that straightforward. The only ref I can find to misfire codes for instance (all 9 of them) is at 451CC. There's an 0403 just before that but it's not word aligned.
Which specific codes do you need to turn off?

dschultz · **Posted:** Fri Dec 07, 2012 12:38 am

I did a little digging in the ROM. I believe I have the table definition structure identified.
Here's a 3D table (2D is similar):

Code:

ROM:000F2840 01          Data_F2840:     .data.b 1               ; DATA XREF: ROM:000F2878
ROM:000F2841 00                          .data.b 0               ; data type (01 == byte)
ROM:000F2842 00                          .data.b 0
ROM:000F2843 40                          .data.b h'40            ; size
ROM:000F2844 00 04 E5 F6                 .data.l byte_4E5F6
ROM:000F2848 41 80 00 00                 .float 16.0             ; multilpier
ROM:000F284C 00 00 00 00                 .float 0.0              ; offset
ROM:000F2850 02          Xaxis_F2850:    .data.b 2               ; DATA XREF: ROM:Table_F2870
ROM:000F2851 00                          .data.b 0               ; data type (02 == word)
ROM:000F2852 00                          .data.b 0
ROM:000F2853 08                          .data.b 8               ; size
ROM:000F2854 00 04 E6 36                 .data.l word_4E636
ROM:000F2858 3B FA 00 00                 .float 0.0076293945     ; multiplier
ROM:000F285C 00 00 00 00                 .float 0.0              ; offset
ROM:000F2860 02          Yaxis_F2860:    .data.b 2               ; DATA XREF: ROM:000F2874
ROM:000F2861 00                          .data.b 0               ; data type (02 == word)
ROM:000F2862 00                          .data.b 0
ROM:000F2863 08                          .data.b 8               ; size
ROM:000F2864 00 04 E6 46                 .data.l word_4E646
ROM:000F2868 3E 48 00 00                 .float 0.1953125        ; multiplier
ROM:000F286C 00 00 00 00                 .float 0.0              ; offset
ROM:000F2870 00 0F 28 50 Table_F2870:    .data.l Xaxis_F2850     ; DATA XREF: sub_8C2E0+26A
ROM:000F2870                                                     ; sub_8C2E0:off_8C798
ROM:000F2874 00 0F 28 60                 .data.l Yaxis_F2860
ROM:000F2878 00 0F 28 40                 .data.l Data_F2840

The last 3 DWORDS identify the location of each data set needed for the axis and table content.

You end up with something like this when you use the info in an Editor def.

Attachment:

someTables.png

I haven't looked for DTC stuff yet.

martymonaro · **Joined:** Thu Feb 15, 2007 12:59 am **Posts:** 23

Hi, Thanks for looking at the file

, I was waiting to get the scanner back on the car so I could see what code it is throwing and it is P0401 EGR Flow.
Im excited as this is the best progress I have had and it would be great to see the end of the light on the dash.

Marty.

td-d · **Posted:** Fri Dec 07, 2012 3:56 am

There's other table types as well, and an interesting use of offset, where tables offsets are in the LUT section as well, e.g. :

Code:

ROM:000FBC5C byte_FBC5C:     .data.b 2               ; DATA XREF: ROM:000FBC94o
ROM:000FBC5D                 .data.b    0
ROM:000FBC5E                 .data.b    0
ROM:000FBC5F                 .data.b h'E1 ; ß
ROM:000FBC60                 .data.l h'69C88
ROM:000FBC64                 .data.l h'3AC80000
ROM:000FBC68                 .data.l 0
ROM:000FBC6C byte_FBC6C:     .data.b 2               ; DATA XREF: ROM:off_FBC8Co
ROM:000FBC6D                 .data.b    0
ROM:000FBC6E                 .data.b    0
ROM:000FBC6F                 .data.b  h'F
ROM:000FBC70                 .data.l h'69E4A
ROM:000FBC74                 .float 0.1953125
ROM:000FBC78                 .data.l 0
ROM:000FBC7C byte_FBC7C:     .data.b 2               ; DATA XREF: ROM:000FBC90o
ROM:000FBC7D                 .data.b    0
ROM:000FBC7E                 .data.b    0
ROM:000FBC7F                 .data.b  h'F
ROM:000FBC80                 .data.l h'69E68
ROM:000FBC84                 .data.l h'39200000
ROM:000FBC88                 .data.l 0
ROM:000FBC8C off_FBC8C:      .data.l byte_FBC6C      ; DATA XREF: sub_D7FC6+E8o
ROM:000FBC8C                                         ; sub_D7FC6:off_D81E8o
ROM:000FBC90                 .data.l byte_FBC7C
ROM:000FBC94                 .data.l byte_FBC5C

dschultz · **Posted:** Fri Dec 07, 2012 10:23 am

td-d wrote:

There's other table types as well, and an interesting use of offset, where tables offsets are in the LUT section as well, e.g. :

That's the same structure as I posted. Did you mean to post something different?

martymonaro wrote:

it is throwing and it is P0401 EGR Flow.

Wouldn't it be better to fix the problem rather than just extinguish the light?

td-d · **Posted:** Fri Dec 07, 2012 12:25 pm

dschultz wrote:

td-d wrote:

There's other table types as well, and an interesting use of offset, where tables offsets are in the LUT section as well, e.g. :

That's the same structure as I posted. Did you mean to post something different?

Posted that more for the last table - the offset for the 3 tables above.

martymonaro · **Joined:** Thu Feb 15, 2007 12:59 am **Posts:** 23

dschultz wrote:

td-d wrote:

There's other table types as well, and an interesting use of offset, where tables offsets are in the LUT section as well, e.g. :

That's the same structure as I posted. Did you mean to post something different?

martymonaro wrote:

it is throwing and it is P0401 EGR Flow.

Wouldn't it be better to fix the problem rather than just extinguish the light?

The EGR valve has been removed along with fitting better exhaust hence EGR flow code.
Thanks again
Marty.

martymonaro · **Joined:** Thu Feb 15, 2007 12:59 am **Posts:** 23

Hi,
I am trying to understand what you have done so far and when I open file in IDA pro and follow the instructions found here I cannot get what you have got?
I open file and select sh4B
I tick ram and select 0XFFFF0000 for a length of 0xFFFF
I go to options and select make final analisys pass
then hit reanalise program
This is what I get at the same location

ROM:000F2840 dword_F2840: .data.l h'1000040, h'4E5F6, h'41800000, 0
ROM:000F2840 ; DATA XREF: ROM:000F2878o
ROM:000F2850 dword_F2850: .data.l h'2000008, h'4E636, h'3BFA0000, 0
ROM:000F2850 ; DATA XREF: ROM:off_F2870o
ROM:000F2860 dword_F2860: .data.l h'2000008, h'4E646, h'3E480000, 0
ROM:000F2860 ; DATA XREF: ROM:000F2874o
ROM:000F2870 off_F2870: .data.l dword_F2850 ; DATA XREF: sub_8C2E0+26Ao
ROM:000F2870 ; sub_8C2E0:off_8C798o
ROM:000F2874 .data.l dword_F2860
ROM:000F2878 .data.l dword_F2840

What am I doing wrong or what have I not done?
Thanks for your time and help.
Marty

dschultz · **Posted:** Fri Dec 14, 2012 10:36 am

You're not doing anything wrong, some areas of code are not directly referenced by any other code so they are not automatically analyzed. Other areas such as where you are looking is the contents of a data structure. IDA has not idea of the structure format so it can't do anything with it. So you will need to manually redefine it similar to the format I posted above.

The D key toggles through the data sizes, byte , word, dword (and float if you selected float in the Data Type listing of IDA.

name goes here · **Joined:** Sat Jan 19, 2019 11:48 pm **Posts:** 21

Does anyone have this definition, I have a land Rover disco with the 4.0 V8 that needs a CEL turned off also.

RomRaider

Landrover 4.4L V8 petrol Denso ECU Help

Who is online