[mnhaught]

Hi,

I was wondering if someone could tell me how to read a dissassembly? I have the CAT's running right now, but I just don't understand what I'm looking at.

Would someone please help?

Marshall

[svojohn]

Can you post a screen capture of the code you're trying to read?

[mnhaught]

Sure, The binary is from the HUG2 PCM. For example, I know that at the address B8FE is the start of the MAF transfer function, but how does one know that for sure?

B8FE: FF NOP ;.
B8FF: FF NOP ;.
B900: DC 09 JVT LB90B ;..
B902: 00 SKP ;.
B903: 50 DC 09 00 AN3B ZROLO,INTPND,L00DC ;P...
B907: 4C **** ;Address Alignment Error
B908: 7B 08 00 48 SB2B L0048,ZROLO[INTMSK] ;{..H
LB90B
B90C: 3D 07 00 JB TMRHI,5,LB90F ;=..
B90F: 44 26 06 00 LB90F AD3W ZROLO,TMRLO,L0026 ;D&..
B913: 40 **** ;Address Alignment Error
B914: 30 05 00 JNB AD_HI,0,LB917 ;0..
LB916
B917: 3C 59 04 LB917 JB L0059,4,LB91E ;<Y.
B91A: 00 SKP ;.
B91B: 38 9D 03 JB L009D,0,LB921 ;8..
B91E: 00 LB91E SKP ;.
B91F: 34 FA 02 JNB L00FA,4,LB924 ;4..
LB921
B922: 00 SKP ;.
B923: 30 6E 02 JNB L006E,0,LB928 ;0n.
LB924
B926: CD **** ;.
B927: 2C 0C SCALL LB535 ;,.
LB928
B929: 02 9A CPLW L009A ;..
B92B: 29 B6 SCALL LBAE3 ;).
B92D: 01 66 CLRW L0066 ;.f
B92F: 26 6C SJMP LB79D ;&l
;
B931: 01 **** ;Address Alignment Error
B932: 33 23 2B JNB L0023,3,LB960 ;3#+
B935: 01 9A CLRW L009A ;..
B937: 21 0E SJMP LBA47 ;!.

[svojohn]

Try looking up the Calibration_Pointers at 0x2022 through 0x2030 as a word. This will tell you the address of REG_F0 through REG_FE.

Example code:

Code: Select all

2022  00C0                word  $C000                       ; REG_F0
2024  ECC2                word  $C2EC                       ; REG_F2
2026  C6C4                word  $C4C6                       ; REG_F4
2028  EACB                word  $CBEA                       ; REG_F6
202A  4ECE                word  $CE4E                       ; REG_F8
202C  12D4                word  $D412                       ; REG_FA
202E  C2D6                word  $D6C2                       ; REG_FC
2030  D6D6                word  $D6D6                       ; REG_FE

Notice throughout your code you'll see code which looks similar to this:

Code: Select all

21B5  452A00F042            add   REG_42,REG_F0,#$002A 

The code will add 002A and REG_F0 together to find the lookup address. REG_F0 equals C000 in the above example code. C000 + 002A = C02A which just happens to be the MAF transfer function in my example code.

[mnhaught]

I think I am following you so far. I think I found the pointers, but the Cat's dissassembler doesn't show the registers like the the code you posted. Unless I am doing something wrong, which is possible.

The pointers I found are as follows:

E4D8
FADA
CCDC
74E6
F8E9
58EF
30F2
88FD

I have to reverse the bytes to get the addresses for the registers. Is that right?

[svojohn]

I'm not familiar with the Cat's disassembler. I use the 8061 disassembler by William Lawrance. This disassembler requires you to make a DIR file for the code you're working with.

Yes your F0 equals D8E4 and so on...

[mnhaught]

Try looking up the Calibration_Pointers at 0x2022 through 0x2030 as a word. This will tell you the address of REG_F0 through REG_FE.

Example code:

Code: Select all

2022  00C0                word  $C000                       ; REG_F0
2024  ECC2                word  $C2EC                       ; REG_F2
2026  C6C4                word  $C4C6                       ; REG_F4
2028  EACB                word  $CBEA                       ; REG_F6
202A  4ECE                word  $CE4E                       ; REG_F8
202C  12D4                word  $D412                       ; REG_FA
202E  C2D6                word  $D6C2                       ; REG_FC
2030  D6D6                word  $D6D6                       ; REG_FE

Notice throughout your code you'll see code which looks similar to this:

Code: Select all

21B5  452A00F042            add   REG_42,REG_F0,#$002A 

The code will add 002A and REG_F0 together to find the lookup address. REG_F0 equals C000 in the above example code. C000 + 002A = C02A which just happens to be the MAF transfer function in my example code.

I think I understand what your saying, but how did you know 21B5 would be the MAF transfer function?

How does a DIR file work ?

Thank you for taking time to help me understand all of this stuff.

[svojohn]

I use Microsoft Word to make my DIR file. The disassembler will use the DIR file to add comments, labels and display code as hex, byte, word, code, etc... Here's an example of my DIR file for the code above:

Code: Select all

commentl    2021  Num_Calibs
hex         2021

commentl    2022  Calibration_ptrs
word        2022
comment     2022  REG_F0
comment     2024  REG_F2
comment     2026  REG_F4
comment     2028  REG_F6
comment     202A  REG_F8
comment     202C  REG_FA
comment     202E  REG_FC
comment     2030  REG_FE


commentl    2032  ************************************
commentl    2032  * Reset Subroutine
commentl    2032  ************************************
code        2032

21B5 is not the MAF transfer function, C02A is the MAF transfer function. Knowing that requires you to go through the code and figure it out. All the mass air eec-iv's will have code that looks similar to this somewhere in the code:

Code: Select all

; *************************************************
         ; * Read MAF/Calibrate/Lookup in Transfer Function
         ; *************************************************
5C8D  A372A050      L5C8D ld    REG_50,$A0[REG_72]          ; $0120 = raw MAF counts (voltage)
5C91  6D002850            mulu  REG_50,#$2800               ; max calibrated count
5C95  8F728E              divu  REG_50,$8E[REG_72]          ; $010E = div by zero (VCAL) regulated

Looking through here you'll find code which looks similar to this:

Code: Select all

5CA2  A376D252            ld    REG_52,$D2[REG_76]          ; $0352 = MAF transfer function pointer

Now look back at 21B5 and we see this same pointer at 21BA getting loaded into C02A:

Code: Select all

21B5  452A00F0            add   REG_42,REG_F0,#$002A        ; $C02A MAF transfer function
      42
21BA  A376D232            ld    REG_32,$D2[REG_76]          ; $0352 = MAF transfer function pointer