Understanding the definitions

poohbear · **Joined:** Mon Jan 18, 2010 10:31 pm **Posts:** 191

Throttlehappy: Where did you come up with the F3FAC9? Or is that just knowing where the ecuID would be from previous definitions?

When you say define the table 3d and 3d and even even the singles... Are you actually defining what each table is? Or are you just going through fidning which table is which? IE this is a 3d table since I see its 12x12 or 144 long so I will define it as such... Then when you can view the table in romraider is when you label what each table is...

Thanks for the hint on the hex editor... Searched F3FAC9 and found 11 81125950 ... However it was in the d9d10... attached is a screen shot...

dschultz: I did not post the rom since I wasnt making a request to have a definition written... However if you want to take a look I have attached it here (it is a stock 2012 sti sedan USDM rom)... If you would like I can make another post with the stock rom and request for the definition... However there is not huge rush. I have not seen anyone else make a request for this rom...

EDIT: Wow my screen shots are horrible... Is there a ss option in hxd that im missing? After I print screen and scale the image to upload it becomes to distorted for any use..

poohbear · **Joined:** Mon Jan 18, 2010 10:31 pm **Posts:** 191

quick update... I was able to open the 2012 rom in romraider using the information you guys helped me to find... I defined the 2011 sti as the 2012 and opened it with all the 2011 definitions in hopes that at least most of the tables would be similar... No...

Looks like each table needs to be defined... Some tables look as though only the x and y are incorrect.. But the data for the ram is correct... IE in fueling im seeing propper fueling numbers just not in the correct spots with 0 in both x and y on the table...

The next step is then to define each table in the rom...

This comes into play by using the SH2 or IDA.. Correct? I see some guys are using the hxd... But I dont really see how... That must seem like an ignorant statement lol...

NSFW · **Joined:** Wed Nov 22, 2006 10:23 pm **Posts:** 2275

You'll probably get a kick out of this:
http://subdiesel.wordpress.com/ecu-anal ... -software/

It finds 2d and 3d tables in the ROM, but figuring out which tables do what is not easy. Timing, fueling, and boost are usually easy to recognize, though.

The ROM itself determines what the tables are for. Dschultz is talking about creating XML so that RomRaider (and whoever is using RomRaider) knows what's what. That XML is usually referred to as a 'definition' for the ROM in question.

For screenshots, try opening Windows' Start menu and typing 'snip' and see if the Snipping Tool comes up. I think it's been included with Windows since Vista but I'm not really sure. (And/or, it might be available as a download from Microsoft's site.)

Renesas (the manufacturer of the CPUs in the ECUs) makes a software package called High Performance Embedded Workstation (HEW) for developing software for those CPUs. It also has a debugger, and by loading a ROM into the debugger it will show you the disassembly. So that's another tool to be aware of. It's free, and my 'hacking with HEW' thread (in this subforum) has info about where to download it.

What really sets IDA apart is the way it helps you annotate and navigate a disassembled ROM - giving names to memory locations as you figure them out, adding comments etc, following references to and from locations in memory, and so on.

poohbear · **Joined:** Mon Jan 18, 2010 10:31 pm **Posts:** 191

Ill have to go through the readme... It looks as though it will define the tables and you can export them into an xml... Then I guess its up to us to determine whats what...
From the looks of it that would save us (throttlehappy) about 3-5 hours of table consolidation into 2d and 3d sections right?

I wonder it there is a trial version of IDA somewhere...

throttlehappy · **Posted:** Mon Dec 26, 2011 10:12 pm

poohbear wrote:

Throttlehappy: Where did you come up with the F3FAC9? Or is that just knowing where the ecuID would be from previous definitions?

When you say define the table 3d and 3d and even even the singles... Are you actually defining what each table is? Or are you just going through fidning which table is which? IE this is a 3d table since I see its 12x12 or 144 long so I will define it as such... Then when you can view the table in romraider is when you label what each table is...

Thanks for the hint on the hex editor... Searched F3FAC9 and found 11 81125950 ... However it was in the d9d10... attached is a screen shot...

dschultz: I did not post the rom since I wasnt making a request to have a definition written... However if you want to take a look I have attached it here (it is a stock 2012 sti sedan USDM rom)... If you would like I can make another post with the stock rom and request for the definition... However there is not huge rush. I have not seen anyone else make a request for this rom...

EDIT: Wow my screen shots are horrible... Is there a ss option in hxd that im missing? After I print screen and scale the image to upload it becomes to distorted for any use..

ECU ID is: 8112595007, the 07 is always the last 2 digits

The address is D9D18 but that is irrelevant as the F3FAC9 is what EcuFlash uses to in Test Write to see if the existing Ecu ID matches the loaded Rom Ecu ID. A Test Write will fail if the 2 Roms have different Ecu ID's

I use Photoshop or MSPaint to crop the screenshot before posting

poohbear · **Joined:** Mon Jan 18, 2010 10:31 pm **Posts:** 191

Yeah I used paint... But after I scale it down you cannot even read it lol...

When you say you define the 3d and 2d tables etc are you saying you are putting them together as in what they are (just defining the x and y and then viewing what they are in romraider)... You define the tables then look in romraider to see what they are? Or can you actually see what the table is using your hex editor?
I guess what im asking is how are you defining the tables using the hex editor?
I dont see how you can see whats what with HxD... Guess and check but that seems like it would take a lifetime...

throttlehappy · **Posted:** Mon Dec 26, 2011 10:32 pm

Watch out when you define this... there is a new set of AVCS tables which are complete reversed versions of the Cruise AVCS table(ie 20 degrees of AVCS = -20 on the other table) which may be to stop the RomRaider community from changing things around too much?

poohbear · **Joined:** Mon Jan 18, 2010 10:31 pm **Posts:** 191

are you comparing two roms in HxD then looking at what each table corresponds to in the known xml definition? IS that how you saw the invert of the avcs?

throttlehappy · **Posted:** Mon Dec 26, 2011 11:23 pm

poohbear wrote:

Yeah I used paint... But after I scale it down you cannot even read it lol...

When you say you define the 3d and 2d tables etc are you saying you are putting them together as in what they are (just defining the x and y and then viewing what they are in romraider)... You define the tables then look in romraider to see what they are? Or can you actually see what the table is using your hex editor?
I guess what im asking is how are you defining the tables using the hex editor?
I dont see how you can see whats what with HxD... Guess and check but that seems like it would take a lifetime...

800rpm is always the same value in Hex, so this is an easy starting point. However, in a lot of cases, the X axis or even the Z data is common between 2 tables. I copy and paste

poohbear wrote:

are you comparing two roms in HxD then looking at what each table corresponds to in the known xml definition? IS that how you saw the invert of the avcs?

Essentially yes, then modifying the cell values

poohbear · **Joined:** Mon Jan 18, 2010 10:31 pm **Posts:** 191

so you are looking for a constant... IE 800 rpm... then you know what axis 800 falls under and can define the the z value and either the x or y by process of elimination... Then open in romraider to view what everything is?...

whats 800 in hex? and thats what your searching for.. One by one looking for the loaction and adding in to what it should be?

Now since you're comparing to another rom. You have two hex files open looking to the closest address to the known rom; and assuming that the closest address is what is defined in the previous rom correct? Then copy that memory location into the new xml to be used as the definition?

what about areas of memory that do not have any revs? Like maf scaling for example? Is this just looking for the memory section thats closest to whats defined in the known rom?

throttlehappy · **Posted:** Tue Dec 27, 2011 12:39 am

poohbear wrote:

so you are looking for a constant... IE 800 rpm... then you know what axis 800 falls under and can define the the z value and either the x or y by process of elimination... Then open in romraider to view what everything is?...

whats 800 in hex? and thats what your searching for.. One by one looking for the loaction and adding in to what it should be?

Now since you're comparing to another rom. You have two hex files open looking to the closest address to the known rom; and assuming that the closest address is what is defined in the previous rom correct? Then copy that memory location into the new xml to be used as the definition?

what about areas of memory that do not have any revs? Like maf scaling for example? Is this just looking for the memory section thats closest to whats defined in the known rom?

I usually use the first four X axis values, then use the Y axis and Z data from the known table to confirm the new table is the same.

If you use the known ROM's definition, scroll through and find the MAF cell address starting point, then search the new rom for the same values, you will easily find the new ROM MAF table. That particular table is unique

dschultz · **Posted:** Tue Dec 27, 2011 9:26 am

throttlehappy wrote:

To find the Ecu ID, use HxD and search for: F3FAC9(as a Hex Value, not Text String) which should be in the D3D00 region of the ROM and the Ecu ID will be the 10 values prior in Hex and will have 07 in front of the F3FAC9

This thread works in a hex editor too for finding the ECU ID: viewtopic.php?t=6295

Attachment:

find_ecu_id.png

dschultz · **Posted:** Tue Dec 27, 2011 9:46 am

throttlehappy wrote:

ECU ID is: 8112595007, the 07 is always the last 2 digits

I'm sorry to say that this is not always the case. Just have a look in the current logger.xml and you can see the variation in them.
xpath=/logger/protocols/protocol/ecuparams/ecuparam/ecu/@id

My post above is a better way to find the ECU ID. And as I mentioned before, the last word of the ROM is a pointer to where the CAL ID is stored.

Attachment:

find_cal_id.png

dschultz · **Posted:** Tue Dec 27, 2011 10:01 am

poohbear wrote:

whats 800 in hex?

It's actually a hex representation of an IEEE754 floating point value.
800 = 0x44480000
http://www.h-schmidt.net/FloatApplet/IEEE754.html

throttlehappy · **Posted:** Tue Dec 27, 2011 7:25 pm

Your right, I just noticed a trend of the 08+ H4T ECU's using 07 and assumed it was accurate.

throttlehappy wrote:

Watch out when you define this... there is a new set of AVCS tables which are complete reversed versions of the Cruise AVCS table(ie 20 degrees of AVCS = -20 on the other table) which may be to stop the RomRaider community from changing things around too much?

<table name="Intake Cam Advance Angle Cruise (AVCS)" storageaddress="DB2BC" sizex="19">
<table type="X Axis" storageaddress="DB228" />
<table type="Y Axis" storageaddress="DB274" />
</table>
<table name="Intake Cam Advance Angle Non-Cruise (AVCS)" storageaddress="DB5FC" sizex="19">
<table type="X Axis" storageaddress="DB568" />
<table type="Y Axis" storageaddress="DB5B4" />
</table>
<table name="Odd Intake Cam Advance (AVCS)" storageaddress="DB93C" sizex="19"> TEST
<table type="X Axis" storageaddress="DB8A8" />
<table type="Y Axis" storageaddress="DB8F4" />
</table>

There is a corresponding exhaust cam table as well.

RomRaider

Forum rules

Understanding the definitions

Who is online