This is where the BIN Hackers and definition junkies discuss the inner workings of the EEC code and hardware. General tuning questions do not go here. Only technical/hardware-specific/code questions and discussions belong here.

Moderators: cgrey8, EDS50, Jon 94GT, 2Shaker

Post Reply
User avatar
tvrfan
Tuning Addict
Posts: 581
Joined: Sat May 14, 2011 11:41 pm
Location: New Zealand

22CA bin - anyone analyzing this one ??

Post by tvrfan » Mon May 10, 2021 3:44 pm

I'm looking at how to improve detection of the 'Copyright' and 'Ident' texts from bins like 4DBG which have this text outside the bank data, and discovered 22CA from trying out test subjects. Also discovered SAD was missing some ID strings within banks, so trying to fix this as well.

I found that 22CA appears to be a 'short ROM bank' binary, even though the bin file itself has a full bank 1. Bin file has non 0xff values beyond 0x1dfff, and it also has an extra [strange] text string between 'Copyright' and ID text in an empty bank 9, which has all interrupt vectors set up, but nothing else. I used 22CA originally for this extra text as a test.

I found that 22CA writes to 0x1e002, supporting that it's a 'short bank', and this may be why the bin file has the weird values in it.
So I might need to handle bins bank 1 a bit differently to the way SAD does it now.

Anybody using this bin ?? Any Comments ??

22CA write to 1e002, implying RAM exists here

Code: Select all

8d320: a1,02,e0,4a        ldw   R4a,e002         R4a = e002;
8d324: a2,4a,38           ldw   R38,[R4a]        R38 = [R4a];
8d327: fa                 di                     interrupts OFF;
8d328: 02,38              cplw  R38              R38 = ~R38;
8d32a: c2,4a,38           stw   R38,[R4a]        [R4a] = R38;
8d32d: 8a,4a,38           cmpw  R38,[R4a]        
Attachments
22CA.bin
4 bank, but empty bank 9
(256 KiB) Downloaded 398 times
TVR, kit cars, classic cars. Ex IT geek, development and databases.
https://github.com/tvrfan/EEC-IV-disassembler

sailorbob
BIN Hacker
Posts: 1759
Joined: Tue Jul 12, 2005 6:10 am

Re: 22CA bin - anyone analyzing this one ??

Post by sailorbob » Tue May 11, 2021 7:42 am

I have not done anything much with the NVGB5 strategy but if you look at the ROM checksum routine at 0x0434A it appears that they treat ROM bank 1 as if it is 32k in size. The CRAJ0 strategy is the same.

User avatar
tvrfan
Tuning Addict
Posts: 581
Joined: Sat May 14, 2011 11:41 pm
Location: New Zealand

Re: 22CA bin - anyone analyzing this one ??

Post by tvrfan » Tue May 11, 2021 7:22 pm

sailorbob wrote: Tue May 11, 2021 7:42 am I have not done anything much with the NVGB5 strategy but if you look at the ROM checksum routine at 0x0434A it appears that they treat ROM bank 1 as if it is 32k in size. The CRAJ0 strategy is the same.
Thanks Bob, didn't check that.

OK. Seems from looking at listing that true actual data ends at 0x16d50, timer structure is the last item, beginning at 16ca0. My bin copy has values 0xff from there to 0x1dfff, which tallies with a 'short ROM bank' too, and then has sets of 256k blocks of values 0xe0, 0xe1, 0xe2, etc. (some kind of weird address reflection ? Um...looks suspicious anyway... ). So that all makes sense.

Text string at 9ff06 confirms strategy = "NGVB5EZ.HEX*", and bank 9 is otherwise empty except for interrupt vectors and safety loopback jump at 0x92000.

Thinking that if I get SAD code to track writes then can it can report RAM (and special chip) areas, and perhaps sort out a 'short ROM bank' from spotting writes to 0x1e000 and above. Just makes it all a bit neater.
TVR, kit cars, classic cars. Ex IT geek, development and databases.
https://github.com/tvrfan/EEC-IV-disassembler

sailorbob
BIN Hacker
Posts: 1759
Joined: Tue Jul 12, 2005 6:10 am

Re: 22CA bin - anyone analyzing this one ??

Post by sailorbob » Wed May 12, 2021 2:00 am

Yes, NGVB5, I fat fingered the G and the V in my first post.

User avatar
tvrfan
Tuning Addict
Posts: 581
Joined: Sat May 14, 2011 11:41 pm
Location: New Zealand

Re: 22CA bin - anyone analyzing this one ??

Post by tvrfan » Wed May 12, 2021 1:36 pm

I honestly didn't spot that....
TVR, kit cars, classic cars. Ex IT geek, development and databases.
https://github.com/tvrfan/EEC-IV-disassembler

crakrz
Regular
Posts: 172
Joined: Wed Feb 16, 2011 12:06 am

Re: 22CA bin - anyone analyzing this one ??

Post by crakrz » Sun May 30, 2021 6:42 pm

In the first post you asked if anyone is using this bin. It is a very commonly used bin here in Australia for our 2001-2002 XR8 5.0 Falcons. I use the 22NA bin which is from the NGVC0 strategy, but its pretty much identical with some different address locations but that's about all. Pretty much the only difference between the two bins is the transmission default switch settings, and a few other minor things. After slowly tinkering about over the years, my NGVC0.xls def has approx 400 scalars, 180 functions, 90 tables or thereabouts, and fully functioning datalogging so I am very interested in seeing how much can be discovered with the disassembly.
Keep up the great work. Let me know if you want a copy of my amateur hack of a def file, even if its for a laugh. I have thick skin, I don't mind.
Aussie Tickford Falcon 2002 AU3 T3 TE50. Factory 5.6 Stroker Windsor, NVXF5 22KB.

User avatar
tvrfan
Tuning Addict
Posts: 581
Joined: Sat May 14, 2011 11:41 pm
Location: New Zealand

Re: 22CA bin - anyone analyzing this one ??

Post by tvrfan » Sun May 30, 2021 11:56 pm

crakrz wrote: Sun May 30, 2021 6:42 pm In the first post you asked if anyone is using this bin. It is a very commonly used bin here in Australia for our 2001-2002 XR8 5.0 Falcons. I use the 22NA bin which is from the NGVC0 strategy, but its pretty much identical with some different address locations but that's about all. Pretty much the only difference between the two bins is the transmission default switch settings, and a few other minor things. After slowly tinkering about over the years, my NGVC0.xls def has approx 400 scalars, 180 functions, 90 tables or thereabouts, and fully functioning datalogging so I am very interested in seeing how much can be discovered with the disassembly.
Keep up the great work. Let me know if you want a copy of my amateur hack of a def file, even if its for a laugh. I have thick skin, I don't mind.
Yep, knew it was a V8 Oz Falcon, but not a lot more than that....

Always happy to get a new def file, it gives me something to 'aim' for with auto disassembly. I'm still struggling trying to get the trickier data structures detected and decoded, and there's still quite a lot of odd data (funcs and tables) which don't get decoded, for various reasons.... so yes please.

I won't ever laugh - it's all working towards answers, and even stuff that's not right can still become a useful clue...
TVR, kit cars, classic cars. Ex IT geek, development and databases.
https://github.com/tvrfan/EEC-IV-disassembler

crakrz
Regular
Posts: 172
Joined: Wed Feb 16, 2011 12:06 am

Re: 22CA bin - anyone analyzing this one ??

Post by crakrz » Mon May 31, 2021 1:36 am

Let me know if you want a NGVB5 excel file for the 22CA bin. I originally had one but lost it in a PC crash. But using Hexplorer, I can create a new spreadsheet if it helps. Might take a few days though. But like I said earlier, the files are pretty much identical, just has some different addresses. If I remember correctly, a lot of them lined up perfectly.
From memory, the 22CA bin was for the manual transmission XR8, and I know the 22NA was for Auto trans XR8, but I'm using it on my 5.6 litre TE50. My TE50 originally used the NVXF5 strat and 22KB bin, but I couldn't be bothered creating a new def when the 22NA bin works flawlessly with some changes copied over from 22KB.
Attachments
22NA_stock_read.bin
(216 KiB) Downloaded 402 times
NGVC0.xls
(319.5 KiB) Downloaded 387 times
Aussie Tickford Falcon 2002 AU3 T3 TE50. Factory 5.6 Stroker Windsor, NVXF5 22KB.

OzFalcon
Regular
Posts: 67
Joined: Sat Aug 23, 2014 8:50 am

Re: 22CA bin - anyone analyzing this one ??

Post by OzFalcon » Mon Feb 21, 2022 10:10 pm

crakrz wrote: Mon May 31, 2021 1:36 am I know the 22NA was for Auto trans XR8, but I'm using it on my 5.6 litre TE50. My TE50 originally used the NVXF5 strat and 22KB bin, but I couldn't be bothered creating a new def when the 22NA bin works flawlessly with some changes copied over from 22KB.
hi was looking at your def file and bin ... im using it as a sort of "guide" for working out my own DEF and datalogging on an AU 6cyl ... (no one seems to have got it going on a 6 yet).. thanks for uploading that, it is very helpful to see..

i was comparing the 22NA and the 22CA ... (i have a 256K 22CA bin) and i can see yours is a 216K bin... all the bins i use are 256K to go with TunerPro.. makes a direct comparison harder, but hey thats how it is.. bit more work learning to reaarrange..
i was wondering what u use the 216K bins with, because i thought most non 256k bins were BE bins, but then i thought they would have been 224K.. or is a 216K file just like the 224K but without the first 8K buffered in..

are u using TunerPro or BE or something else?

first i was just comparing AU 6 and v8 defs as im sure a lot like the trans control would be the same..
then i was trying to see in your def and bins if i could find the patch code.. do u have the binary with the patch code in it to compare?
Primary car : 1999 Falcon AU 1.5 australian 6cyl
ECU : EEC-V
WANA / 9XL1N6
EDIS with Speed Density
Using TunerPro / Quarterhorse

from Vic, Australia

jsa
Tuning Addict
Posts: 1155
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: 22CA bin - anyone analyzing this one ??

Post by jsa » Tue Feb 22, 2022 2:55 am

This might help you to understand the layout of different size files.

https://eectuning.org/forums/viewtopic. ... 30#p134855
Cheers

John

95 Escort RS Cosworth - CARD QUIK COSY ANTI / GHAJ0
Moates QH & BE
ForDiag

OzFalcon
Regular
Posts: 67
Joined: Sat Aug 23, 2014 8:50 am

Re: 22CA bin - anyone analyzing this one ??

Post by OzFalcon » Tue Feb 22, 2022 5:05 am

jsa wrote: Tue Feb 22, 2022 2:55 am This might help you to understand the layout of different size files.

https://eectuning.org/forums/viewtopic. ... 30#p134855
yes i think i understand the various layouts... it was more i was asking what the 216K file originated from..
was reading http://www.efidynotuning.com/dis.htm that is where i first found an explaination of the bank addresses and file size conversion..
the most confusing thing at first was : "whilst most software uses a non-padded bin of 56k per bank (224k 4 bank file). To fuel the fire, some software will swap banks 8 and 9 while saving the bin
"... this took me a while to figure out... i thought hang on 4 banks is the most, and now its talking about banks 8 and 9... i had to spend a fair bit of time reading until it was mentioned (somehwhere - cant remember now) that ford only uses 0,1,8,9 to refer to the banks and not the obvious 1,2,3,4 or even 0,1,2,3..

anyway..

I ran the 22NA through SAD.. just for curiosities sake and to see if it could id the layout... i did it myself earlier by looking at it in a HEX viewer...

so anyway SAD came up with this

"# ----------------------------
# SAD Version 4.0.6 (22 Jun 2020)
# ----------------------------
# Input file is 'C:\R&D\ECU\SAD\SAD_406\22NA_stock_read.bin'
# File is 216K (0x36000) bytes
Cannot find a Start bank [bank 8]
Probably binary file is corrupt
Abandoned !!"

I found start bank 8 @ 28000
it is a 0-1-9-8 layout
0 @ 0000
1 @ E000
9 @ 1A000
8 @ 28000
Primary car : 1999 Falcon AU 1.5 australian 6cyl
ECU : EEC-V
WANA / 9XL1N6
EDIS with Speed Density
Using TunerPro / Quarterhorse

from Vic, Australia

jsa
Tuning Addict
Posts: 1155
Joined: Sat Nov 23, 2013 7:28 pm
Location: 'straya

Re: 22CA bin - anyone analyzing this one ??

Post by jsa » Tue Feb 22, 2022 6:16 am

16 banks are possible, but not seen one in the wild.
Cheers

John

95 Escort RS Cosworth - CARD QUIK COSY ANTI / GHAJ0
Moates QH & BE
ForDiag

Post Reply

Who is online

Users browsing this forum: No registered users and 4 guests