[jamie from oz]

hi i am loading NVMG8 4bank.xlsx and 6DFD 4bank.bin in BE and appears to have errors loading it .
when i look at the data in .XLSX it is 0X3000 range and when i look at the .BIN it is 0002A000 (0X2A000 ?) .

do i need to move all the data manualy or am i doing some thing wrong ??

i had down loaded these from BE and updated stratergy and BE but still dont load in BE.
i have loaded Quaterhorse with tune in tuner pro and car runs ok (6DGC.bin) and was going to up load it to compare.

[][/img]

[jamie from oz]

BE start error.png (673.95 KiB) Viewed 21355 times

BE no perameters.png (100.08 KiB) Viewed 21355 times

BE start error 1.png (461.33 KiB) Viewed 21355 times

[jsa]

Bins for tuner pro are often padded up to 64kb per bank, so 256kb total for a 4 bank.

Bins for BE should have the padding stripped out at the beginning of each bank.

You need bank numbers for the addresses in the bin.

[jamie from oz]

thanks for the reply.

the bin and strategy are both from the BE data base in the program that have 0x3000 / 0x2000 and i was using tuner pro hex editor for looking at the bin to compare as i couldn't get it to load in BE .

i will see if i can find the bin bank addresses .

added bank0:002000-00ffff . bank1:012000-01ffff . bank8:022000-02ffff . bank9:032000-03ffff . (into config tab)
added file size:0x38000 . (into config tab)
now i have scalars / functions / tables tree but nothing in it.

[jsa]

The 6dfd I have here only has one bank.
Post the bin you have.

[jamie from oz]

6DFD 4 Bank.bin

(224 KiB) Downloaded 652 times

NVMG8 4 Banl v1.xls

(684 KiB) Downloaded 705 times

[sailorbob]

The 6DFD is a 2 bank 88k ECU.

[jamie from oz]

if its a 2 bank is it still 216k in BE and 256k in tuner pro ?
what would the eec-v bank addresses be as i have only found eec-v 4 bank addresses?

[jamie from oz]

arctic blue 5.0 v8.bin

(256 KiB) Downloaded 672 times

this is the NVMG84 / 6DGC file that i have loaded on my QH with Tuner pro that currently runs ok.
not sure if its padded to fill the 256k if they are originally 88k .

i was wanting to data log and live tune so that is why i was using the BE strategy and bin from there site .

[jsa]

I got rid of the file size warning.

That definition is a bit of a mess, I can't get the Scalar error 133 to go away in the available time.
Might need to start with a clean excel workbook.

Here are 88kb versions of the files.
It looks like the definition had a mixture of addresses for 2 bank and 4 bank size bins.

[jamie from oz]

thank you John .
i will see how i go and thanks for the help every one .

[jsa]

No worries Jamie.

I generated a disassembly directive file from your definition, then ran SAD4.07.16 against the bin.

The definition is of questionable quality. SAD flagged a number of issues with address crossovers.

Proceed with caution!

Code: Select all

# ----------------------------
# SAD Version 4.0.7.16 (16 Jun 2021)
# ----------------------------

# Input file is '.\6DFD 88kb.bin'

# File is 88K (0x16000) bytes


# Read commands from directive file at '.\6DFD 88kb_dir.txt'

## FUN 8A274 8A2EB "F.FN036"  :UW  :UW               # MAF Transfer
 Warning - Function Start value Invalid 

## FUN 8A8EA 8A8F5 "F.FN884"  :SY  :UY               # ISC Dutycycle During Crank
 Warning - Function Start value Invalid 
 Error - Commands Overlap

## FUN 8AE7A 8AE8B "F.FN387"  :SY  :UY               # Underspeed Fuel Multiplier
 Warning - Symname replaces previous "S.LRESUM"

## FUN 8AE8C 8AE95 "F.FN004"  :UY  :UY               # Exhaust Back Pressure Correction
 Warning - Symname replaces previous "S.MINVSP"

## FUN 8AE96 8AEBD "F.FN074"  :UW  :UW               # EGR Valve Upstream Pressure
 Warning - Symname replaces previous "S.ACLDED"

## FUN 8B114 8B133 "F.FN039"  :UW  :UW               # Emission Scaler for RPM
 Warning - Function Start value Invalid 

## FUN 8B134 8B14B "F.FN367"  :UY  :UY               # Injector Offset vs Voltage
 Warning - Function Start value Invalid 

## FUN 8B14C 8B157 "F.FN300"  :SY  :UY               # Fuel Multiplier vs ACT
 Warning - Function Start value Invalid 

## FUN 8B158 8B16F "F.FN301"  :UW  :UW               # CT Drive Fuel Multiplier vs RPM
 Warning - Function Start value Invalid 

## FUN 8B170 8B183 "F.FN301N"  :UW  :UW              # CT Neutral Fuel Multiplier vs RPM
 Warning - Function Start value Invalid 

## FUN 8B184 8B1A3 "F.FN303"  :UW  :UW               # WOT Fuel Multiplier vs RPM
 Warning - Function Start value Invalid 

## FUN 8B294 8B2AF "F.FN035"  :UW  :UW               # Peak Load at Sea Level vs RPM
 Warning - Function Start value Invalid 

## FUN 8B2B0 8B2CB "F.FN320A"  :SW  :UW              # Load% Min for O/L vs ECT
 Warning - Function Start value Invalid 

## FUN 8B2CC 8B2EB "F.FN371"  :SW  :UW               # Drive Engagement Fuel Multiplier vs ECT
 Warning - Function Start value Invalid 

## FUN 8B3EC 8B403 "F.FN374"  :UW  :UW               # Decel Fuel Shut Off Multiplier
 Warning - Function Start value Invalid 

[jamie from oz]

That would explain a lot of the errors and why BE doesn't load it.

do you have a base 88k strategy that i could start with ? ( v8 maf )
or are they purchase ones ?
looked on a couple sites for a strategy template but found nothing ( BE doesn't have one in the DEF file any more)

[jsa]

do you have a base 88k strategy that i could start with ? ( v8 maf )
or are they purchase ones ?

I don't have one.

Rumour has it, that sailorbob has one to purchase.

PM him.
https://eectuning.org/forums/ucp.php?i= ... ose&u=1683

[jamie from oz]

do you have a base 88k strategy that i could start with ? ( v8 maf )
or are they purchase ones ?

I don't have one.

Rumour has it, that sailorbob has one to purchase.

PM him.
https://eectuning.org/forums/ucp.php?i= ... ose&u=1683

I have sent him a msg.

Thanks for your help

[jamie from oz]

When i put this dir.txt and bin through SAD there is nothing in the list.txt and msg.txt ??

6dbx_dir.txt

(8.9 KiB) Downloaded 453 times

obviously i have missed something when i did the dir.txt

i have renamed the EL 6 cyl 6dbd.bin so i dont get confused with the one i am messing with for the V8 6dbx.bin

6dbx.bin

modified for v8

(64 KiB) Downloaded 453 times

[jsa]

Which version of SAD?

[jamie from oz]

Sad 4.0.7.16b

When I drop the bin on to it with no dir.txt it decodes most if it but I thought putting the fun and tab in the dir might have help decode the blocks of code that where in the the list and msg.txt

Jamie.

[jamie from oz]

On a side note when the list.txt starts from 0x2000 and I look at the bin I pulled with BE / QH in hexplorer the same point of address is 0xe000.

So when I have been putting addresses into BE xls I have been substituting the first letter (0xc000 changed to 0x18000)
(0xd000 changed to 0x19000)
I understand that It is 256k padded vs a 112k file.

If the TP 256k has the check sum at 0x200a and that makes it 0xe00a for BE and TP has the other check sum at 0x1200a so I assume BE it will be 0x000a (in ram area on both)

[jsa]

When i put this dir.txt and bin through SAD there is nothing in the list.txt and msg.txt ??
6dbx_dir.txt
obviously i have missed something when i did the dir.txt

i have renamed the EL 6 cyl 6dbd.bin so i dont get confused with the one i am messing with for the V8 6dbx.bin
6dbx.bin

The BIN is corrupt.

6dbx corrupt.PNG (613.21 KiB) Viewed 15821 times

Note the warning and the bank address.

Code: Select all

# ----------------------------
# SAD Version 4.0.7.16b (11 Apr 2022)
# ----------------------------

# Input file is 'E:\AllFiles\EEC-IV\Strategies\Aussie\6DBD\Jamieoz\6dbx.bin'

# File is 64K (0x10000) bytes


 WARNING - file/bank appears to have extra byte(s) at front
# ----- No directive file. Use default options

# ----- Start Disassembly phase 1 -----

# ----- End   Disassembly phase 1 -----

# ----- Start Disassembly phase 2 -----

# ----- End   Disassembly phase 2  -----

# ----- Output Listing to file E:\AllFiles\EEC-IV\Strategies\Aussie\6DBD\Jamieoz\6dbx_lst.txt



# ---------------------------------------------------------------------------------------------
# The disassembler has scanned the binary and produced the following command list.
# This list is not guaranteed to be perfect, but should be a good base.
# Commented lines for information bu may be uncommented for use (e.g. banks)
# This following list can be copied and pasted into a directives file.
# ---------------------------------------------------------------------------------------------


setopts  : default : 8065 

# Banks Found.  For information, can uncomment to manually override

# bank  8  2001 2000 fffe 

[jsa]

Sad 4.0.7.16b

When I drop the bin on to it with no dir.txt it decodes most if it but I thought putting the fun and tab in the dir might have help decode the blocks of code that where in the the list and msg.txt

Jamie.

For a corrupt bin all bets are off!
I'll not waste my time on why the DIR does not work with a corrupt bin.

More generally, the scan command is the most reliable dir command for blocks of code. A bit painful as it stops at every return, I've been moaning at tvrfan about being able to specify a range for scan. Might have to step it up to giving grief ;)

SAD has missed some of the lookups. Specifying the missing ones will allow the data to be uncovered by SAD.

Code: Select all

3564: 91,20,e0,91,10,e0,20,2c,91,20,e0,20,06,91,20,e0  ???  
3574: 91,10,e0            ???   
...
35f1: 91,20,e0            ???   

TVRfan has a major update to SAD in the melting pot, I think I've given him excess grief on lookup's, so the next SAD should find them all. :)

[jsa]

On a side note when the list.txt starts from 0x2000 and I look at the bin I pulled with BE / QH in hexplorer the same point of address is 0xe000.

So when I have been putting addresses into BE xls I have been substituting the first letter (0xc000 changed to 0x18000)
(0xd000 changed to 0x19000)
I understand that It is 256k padded vs a 112k file.

If the TP 256k has the check sum at 0x200a and that makes it 0xe00a for BE and TP has the other check sum at 0x1200a so I assume BE it will be 0x000a (in ram area on both)

Us users are very good at manually corrupting bins, so as you see above, SAD indentifies the 806x address range without blindly following the file address. BE and TP do not analyse the bin file to find a valid bank address range, they are staunch supporters of the GIGO principle!

Yes, address translation from LST and DIR to BE and TP is necessary. SAD uses 806x memory space addresses. BE and TP use file position. Of course it all gets messy when fill gets added for non existent banks or RAM fill included or excluded.

After fixing the BIN, post back with remaining concerns and I'll take a further look.

[jamie from oz]

have corrected the 6dbx.bin and have added the BE read

be read 6dbd.BIN

(112 KiB) Downloaded 417 times

[jamie from oz]

the 256k read that dosent appear to be corrupted

6dbd 256.bin

(256 KiB) Downloaded 452 times

6dbx.bin

(64 KiB) Downloaded 421 times

[jsa]

Function commands without options, appear to be your downfall.

Code: Select all

fun    c208 c223: 

Comment them out or add valid options like UW, SY, etc.

Check your MSG file, similar issues with the tables.

[jamie from oz]

ok

thanks

[tvrfan]

Code: Select all

fun    c208 c223:                                     "fuel startup table scaler for time"                
fun    c224 c237:          
fun    c238 c257: SW X 10 : SW X 10 V 256 
fun    c258 c272:                                      "table scaler for map word"
fun    c288 c29f:                                      "fuel table scaler for ect/act" 
fun    c2a0 c2bb: UW X 10 : UW X 10 V 256              "table scaler for rpm"
fun    c2bc c2d7:                                      "fuel table scaler for map/bp"            
fun    c2d8 c2f3:                                      "fuel ol stabilised table scaler for"
fun    c2f4 c307: UW X 10 : UW X 10 V 256 

Jamie,

what *should* happen is that SAD should reject those func commands as invalid.... Does it actually crash or does it loop around forever?? Anyway, I'll add this to my bug list. func command should always have at least a cell size (W or Y), it will default to unsigned (U) .

As in my other posts I always suggest you run SAD with no dir file at all, and see what it picks up. Yes, it will probably miss some data, both functions and tables - I'm still working on how to fix that. SAD is still a work in progress. It's sometimes like a 'chase', in that a new bin turns up and won't work, and I then need to find out what's new to prevent SAD working. There's a lot of threads still around in here as to exactly how some stuff works (hardware too, especially some of the weirder bits of 8065. jsa has done lots of work on this), which also feeds in changes to be done. There's still some bits of code which are WTF? and not resolved (yet).

The msg.txt file should show a list of commands which SAD has worked out, and you should be able to copy and paste that into a dir file and then expand it with your extra commands.

Note. The latest STABLE version in github still has a 'gap scanner' which should pick up missed code and at least some of the data. I dropped this out of development version as it produces quite a lot of false matches, but may be worth a try.

[jamie from oz]

I understand how hard it is to reverse engineer this stuff and fully appreciate all your work as it's great to be able to have these type of tools to help.

Thanks very much.

I will investigate further.

[jamie from oz]

i have in the QH tab the list of addresses for a patch code that have a offset of 0xC000 .
so to get them to a blank area of filler 0xEE00 area do i change the offset to 0x4300 to get them in that ball park ???
(0xAB85 + 4300 = 0xEE85 ??)

QH tab screenshot.jpg (38.31 KiB) Viewed 15024 times

[jsa]

i have in the QH tab the list of addresses for a patch code that have a offset of 0xC000 .
so to get them to a blank area of filler 0xEE00 area do i change the offset to 0x4300 to get them in that ball park ???
(0xAB85 + 4300 = 0xEE85 ??)

QH tab screenshot.jpg

First some patchcode background...
Patch code is required for the logging of registers.
Registers are memory addresses internal to the 8061 or 8065 uP.
Register reads and writes do not get written to the external MBus as they are internal to the uP.
The QH (and tweecer) connect to the MBus with no way to see uP internal activity.
For 8061 that is register address 0x00 to 0xFF.
For 8065 that is register address 0x00 to 0x3FF.
Everything above those addresses is on the MBus, so QH can see the activity and can read / write directly.

The QHorse Tab tells BE what the patchcode instructions are, where to place the patchcode and where to offset 0x00 to 0xFF / 0x3FF too.
The Payload Tab will have the addresses to log. Where those addresses are in the range 0x00 to 0xFF / 3FF the DatalogOffset will be added the payload address so that the patchcode gets the uP to copy the payload address data to the offset address.

In your pic, 0xA1 is written to address 0xAB85, 0x00 to 0xAB86 and so on.
Typically patchcode is written over part of the console subroutine which is usually the first subroutine in the background vector list. This allows the patchcode to copy payload data to the offset address.
Be certain what you have at AB85 can be overwritten.

Looking at the instruction part of GUFB QHorse tab patchcode;
The address column is where BE will write the data column values too in the QH.

gufb patch 1.PNG (178.04 KiB) Viewed 15014 times

The following is a disassembly of GUFB console routine after being overwritten with patchcode by BE to the QH.
0D00 is the datalogoffset, so an address of 0x28 on the payload tab would have its data copied to 0xD28 to make it accessible to the QH.
Note 0D00 is part of the patchcode instructions, that means the Data column on the QHorse Tab needs changing as well, if you want the DatalogOffset to work.

Code: Select all

   Check_ConsoleD:
84b1: fa                  di                     disable ints;
   Check_console:
84b2: a1,ee,84,42         ldw   R42,84ee         R42 = 84ee;
84b6: a2,43,14            ldw   R14,[R42++]      R14 = [R42++];
84b9: a2,14,1c            ldw   R1c,[R14]        R1c = [R14];
84bc: c3,15,00,0d,1c      stw   R1c,[R14+d00]    [R14+d00] = R1c;
84c1: 8a,42,00            cmpw  R0,[R42]         
84c4: d7,f0               jne   84b6             if (0 != [R42]) goto 84b6 ;
84c6: a1,22,20,14         ldw   R14,2022         R14 = 2022;
84ca: 3c,24,01            jb    B4,R24,84ce      if (Console_flag = 0)  {
84cd: fb                  ei                     enable ints; }
84ce: a1,f0,00,18         ldw   R18,f0           R18 = f0;
84d2: b3,01,20,20,1a      ldb   R1a,[R0+2020]    R1a = [2020];
84d7: a2,15,1c            ldw   R1c,[R14++]      R1c = [R14++];
84da: c2,19,1c            stw   R1c,[R18++]      [R18++] = R1c;
84dd: e0,1a,f7            djnz  R1a,84d7         R1a--;
                                                 if (R1a != 0) goto 84d7 ;
84e0: 71,ef,24            an2b  R24,ef           Console_flag = 0;
84e3: a3,01,fc,ff,42      ldw   R42,[R0+fffc]    R42 = [fffc];
84e8: c3,01,fe,ff,42      stw   R42,[R0+fffe]    [fffe] = R42;
84ed: f0                  ret                    return;

84ee: ae,00               word     ae

84f0: 00,00,00,00,fb,a1,f0,00 ??? 
84f8: 18,b3,01,20,20,1a,a2,15 ??? 
8500: 1c,c2,19,1c,e0,1a,f7,3c ??? 
8508: 24,22,a3,01,f2,1f,42,89 ??? 
8510: 1c,1f,42,d7,17,a1,a5,a5 ??? 
8518: 42,c3,01,f6,1f,42,8b,01 ??? 
8520: f6,1f,42,d7,07,c9,2c,85 ??? 
8528: cb,01,f2,1f,71,ef,24,f0 ??? 

Looking at the payload part of GUFB QHorse tab patchcode;
Each address is where BE writes each register payload address selected to be logged.

gufb patch 2.PNG (112.9 KiB) Viewed 15014 times

So...are you asking about DatalogOffset or the payload list location??
Based on GUFB patchcode;
If you want to use 0xEE00 as your DatalogOffset then put that at cells E2 and in B14|B15
If you want to use 0xE000 as your payload list location put that in cells B3|B4, A62 and increment A63 etc by 0x01.