[tvrfan]

I'm looking at how to improve detection of the 'Copyright' and 'Ident' texts from bins like 4DBG which have this text outside the bank data, and discovered 22CA from trying out test subjects. Also discovered SAD was missing some ID strings within banks, so trying to fix this as well.

I found that 22CA appears to be a 'short ROM bank' binary, even though the bin file itself has a full bank 1. Bin file has non 0xff values beyond 0x1dfff, and it also has an extra [strange] text string between 'Copyright' and ID text in an empty bank 9, which has all interrupt vectors set up, but nothing else. I used 22CA originally for this extra text as a test.

I found that 22CA writes to 0x1e002, supporting that it's a 'short bank', and this may be why the bin file has the weird values in it.
So I might need to handle bins bank 1 a bit differently to the way SAD does it now.

Anybody using this bin ?? Any Comments ??

22CA write to 1e002, implying RAM exists here

Code: Select all

8d320: a1,02,e0,4a        ldw   R4a,e002         R4a = e002;
8d324: a2,4a,38           ldw   R38,[R4a]        R38 = [R4a];
8d327: fa                 di                     interrupts OFF;
8d328: 02,38              cplw  R38              R38 = ~R38;
8d32a: c2,4a,38           stw   R38,[R4a]        [R4a] = R38;
8d32d: 8a,4a,38           cmpw  R38,[R4a]        

[sailorbob]

I have not done anything much with the NVGB5 strategy but if you look at the ROM checksum routine at 0x0434A it appears that they treat ROM bank 1 as if it is 32k in size. The CRAJ0 strategy is the same.

[tvrfan]

I have not done anything much with the NVGB5 strategy but if you look at the ROM checksum routine at 0x0434A it appears that they treat ROM bank 1 as if it is 32k in size. The CRAJ0 strategy is the same.

Thanks Bob, didn't check that.

OK. Seems from looking at listing that true actual data ends at 0x16d50, timer structure is the last item, beginning at 16ca0. My bin copy has values 0xff from there to 0x1dfff, which tallies with a 'short ROM bank' too, and then has sets of 256k blocks of values 0xe0, 0xe1, 0xe2, etc. (some kind of weird address reflection ? Um...looks suspicious anyway... ). So that all makes sense.

Text string at 9ff06 confirms strategy = "NGVB5EZ.HEX*", and bank 9 is otherwise empty except for interrupt vectors and safety loopback jump at 0x92000.

Thinking that if I get SAD code to track writes then can it can report RAM (and special chip) areas, and perhaps sort out a 'short ROM bank' from spotting writes to 0x1e000 and above. Just makes it all a bit neater.

[sailorbob]

Yes, NGVB5, I fat fingered the G and the V in my first post.

[tvrfan]

I honestly didn't spot that....

[crakrz]

In the first post you asked if anyone is using this bin. It is a very commonly used bin here in Australia for our 2001-2002 XR8 5.0 Falcons. I use the 22NA bin which is from the NGVC0 strategy, but its pretty much identical with some different address locations but that's about all. Pretty much the only difference between the two bins is the transmission default switch settings, and a few other minor things. After slowly tinkering about over the years, my NGVC0.xls def has approx 400 scalars, 180 functions, 90 tables or thereabouts, and fully functioning datalogging so I am very interested in seeing how much can be discovered with the disassembly.
Keep up the great work. Let me know if you want a copy of my amateur hack of a def file, even if its for a laugh. I have thick skin, I don't mind.

[tvrfan]

In the first post you asked if anyone is using this bin. It is a very commonly used bin here in Australia for our 2001-2002 XR8 5.0 Falcons. I use the 22NA bin which is from the NGVC0 strategy, but its pretty much identical with some different address locations but that's about all. Pretty much the only difference between the two bins is the transmission default switch settings, and a few other minor things. After slowly tinkering about over the years, my NGVC0.xls def has approx 400 scalars, 180 functions, 90 tables or thereabouts, and fully functioning datalogging so I am very interested in seeing how much can be discovered with the disassembly.
Keep up the great work. Let me know if you want a copy of my amateur hack of a def file, even if its for a laugh. I have thick skin, I don't mind.

Yep, knew it was a V8 Oz Falcon, but not a lot more than that....

Always happy to get a new def file, it gives me something to 'aim' for with auto disassembly. I'm still struggling trying to get the trickier data structures detected and decoded, and there's still quite a lot of odd data (funcs and tables) which don't get decoded, for various reasons.... so yes please.

I won't ever laugh - it's all working towards answers, and even stuff that's not right can still become a useful clue...

[crakrz]

Let me know if you want a NGVB5 excel file for the 22CA bin. I originally had one but lost it in a PC crash. But using Hexplorer, I can create a new spreadsheet if it helps. Might take a few days though. But like I said earlier, the files are pretty much identical, just has some different addresses. If I remember correctly, a lot of them lined up perfectly.
From memory, the 22CA bin was for the manual transmission XR8, and I know the 22NA was for Auto trans XR8, but I'm using it on my 5.6 litre TE50. My TE50 originally used the NVXF5 strat and 22KB bin, but I couldn't be bothered creating a new def when the 22NA bin works flawlessly with some changes copied over from 22KB.

[OzFalcon]

I know the 22NA was for Auto trans XR8, but I'm using it on my 5.6 litre TE50. My TE50 originally used the NVXF5 strat and 22KB bin, but I couldn't be bothered creating a new def when the 22NA bin works flawlessly with some changes copied over from 22KB.

hi was looking at your def file and bin ... im using it as a sort of "guide" for working out my own DEF and datalogging on an AU 6cyl ... (no one seems to have got it going on a 6 yet).. thanks for uploading that, it is very helpful to see..

i was comparing the 22NA and the 22CA ... (i have a 256K 22CA bin) and i can see yours is a 216K bin... all the bins i use are 256K to go with TunerPro.. makes a direct comparison harder, but hey thats how it is.. bit more work learning to reaarrange..
i was wondering what u use the 216K bins with, because i thought most non 256k bins were BE bins, but then i thought they would have been 224K.. or is a 216K file just like the 224K but without the first 8K buffered in..

are u using TunerPro or BE or something else?

first i was just comparing AU 6 and v8 defs as im sure a lot like the trans control would be the same..
then i was trying to see in your def and bins if i could find the patch code.. do u have the binary with the patch code in it to compare?

[jsa]

This might help you to understand the layout of different size files.

https://eectuning.org/forums/viewtopic. ... 30#p134855

[OzFalcon]

This might help you to understand the layout of different size files.

https://eectuning.org/forums/viewtopic. ... 30#p134855

yes i think i understand the various layouts... it was more i was asking what the 216K file originated from..
was reading http://www.efidynotuning.com/dis.htm that is where i first found an explaination of the bank addresses and file size conversion..
the most confusing thing at first was : "whilst most software uses a non-padded bin of 56k per bank (224k 4 bank file). To fuel the fire, some software will swap banks 8 and 9 while saving the bin
"... this took me a while to figure out... i thought hang on 4 banks is the most, and now its talking about banks 8 and 9... i had to spend a fair bit of time reading until it was mentioned (somehwhere - cant remember now) that ford only uses 0,1,8,9 to refer to the banks and not the obvious 1,2,3,4 or even 0,1,2,3..

anyway..

I ran the 22NA through SAD.. just for curiosities sake and to see if it could id the layout... i did it myself earlier by looking at it in a HEX viewer...

so anyway SAD came up with this

"# ----------------------------
# SAD Version 4.0.6 (22 Jun 2020)
# ----------------------------
# Input file is 'C:\R&D\ECU\SAD\SAD_406\22NA_stock_read.bin'
# File is 216K (0x36000) bytes
Cannot find a Start bank [bank 8]
Probably binary file is corrupt
Abandoned !!"

I found start bank 8 @ 28000
it is a 0-1-9-8 layout
0 @ 0000
1 @ E000
9 @ 1A000
8 @ 28000

[jsa]

16 banks are possible, but not seen one in the wild.