Tightmopedman9

Tuners Rejoice! Free Tuning For M4.4!

Recommended Posts

On 2/22/2020 at 4:22 PM, ItalianT5 said:

Hello,

I am having troubles flashing my ECU. I am using the following OBD cable: https://www.ebay.de/itm/Diagnostischen-FTDI-OBD2-FT232RL-BMW-INPA-Ediabas-USB-fur-DCAN-Kabelwerkzeug-H/303324951331?_trkparms=aid%3D111001%26algo%3DREC.SEED%26ao%3D1%26asc%3D20160727114228%26meid%3Db279ccc8bc4743859bd97ddc01231b2e%26pid%3D100290%26rk%3D2%26rkt%3D4%26sd%3D231461230279%26itm%3D303324951331%26pmt%3D0%26noa%3D1%26pg%3D2060778&_trksid=p2060778.c100290.m3507

I use 16.2 volts on B8 to go into bootmode, but all I get while trying to flash in Motronic Suite is "Erase failed". I also editet the config file and added my COM port, but nothing works.

Do I use the wrong OBD cable or are there any more possible problems I have to check first for?

Thanks in advance

Can't tell if that's the right cable or not.  I always look for some reference to Triumph motorcycles, like this:  https://www.ebay.com/itm/USB-cable-for-Triumph-Motorcycles-TuneECU-FTDI-FT232RL-Chip-OBD-II-KTM-Tune-ECU-/122549303447

But assuming you do have the right cable, you need to make sure you have hooked up all the ecu power and ground wires, and no loose connections.  Just hooking up one or two of them isn't going to do it.  Use similar gauge wire that's in the car too.

Share this post


Link to post
Share on other sites

That cable you linked is the incorrect cable. You need a VAG-COM cable, which is a 'dumb' cable which does nothing to the signal between the OBDII port and computer. 

Make sure that you get a VAG-COM cable with FTDI chip. 

Share this post


Link to post
Share on other sites

Hi

Can someone share settings for 100% E85 cold start, i have trouble to get engine running when engine and weather is cold, it need multiple short starts to get it running.

Share this post


Link to post
Share on other sites

Been lurking here for a while, but would like to say a big thanks to everyone who has contributed/helped with this as I wouldn't got so interested in it otherwise :)

Just thought i'd share my IDA database that I've been working on for the past couple of weeks (pretty new to all of this) in case it can be of use to anyone (based on custom/wiki 607 rev 5b).

It isn't the best but has the upper/lower bank disassembled/segmented and sorted (mostly) so that the disassembly makes sense (as well as sorting alot of the duplicated upper/lower bank funcs) (upper bank stuff mostly has _UB suffix).

Also using the DAMOS and some other sources traced and labelled most of the ROM (v_ prefix) vars (mostly lower bank for now, will duplicate to upper bank later), RAM (r_ prefix), XRAM (xr_ prefix) and SCL (scl_ prefix) addresses.

For the disassembly constants I linked them to the applicable CODE/ROM, XRAM or SCL segment for ease of disassembly/cross referencing (using virtual segments for XRAM and SCL offsets).

The function naming is mostly vague and poor but can give a rough idea to some of the disassembly (although some may be incorrect based on earlier guesses before I started looking at the functions properly).

As it's based on the custom/wiki rev 5b I've also labelled the custom functions/vars that are part of that too (mostly labelled with CUSTOM_ prefix).

As I say alot of it has been compiled from multiple sources/references scoured from pretty much everywhere so lost track of who and what, but not claiming as mine - just couldn't keep track of everything.

 

Download: https://drive.google.com/file/d/1cUPIOqOU0KckyA52apXzQq5ZVJ_LkT4s/view?usp=drivesdk

 

Edited by jenksta
  • Like 1

Share this post


Link to post
Share on other sites

Thanks very much for that!

I've spent a lot of time in IDA and I  tried for a little while to import RAM variable names, but couldn't figure out an automated way to do it so I gave up on it. Did you write a script, or is there some easy way I'm totally missing?

 

Share this post


Link to post
Share on other sites
On 4/3/2020 at 4:33 PM, Tightmopedman9 said:

Thanks very much for that!

I've spent a lot of time in IDA and I  tried for a little while to import RAM variable names, but couldn't figure out an automated way to do it so I gave up on it. Did you write a script, or is there some easy way I'm totally missing?

 

No worries, hopefully someone can make use of it someday haha.

The XRAM vars I did do with a script, however everything else was done manually (sounds really tedious but I'm used to it so wasn't too bad). For the ROM variables I mostly just referenced vars I'd found in a function or something and go around that address double checking the byte patterns to ensure it was the same and nothing was added/removed in the different versions, then naming them (could have been scripted but just easier for me to carry on manually).

When i started with the ROM vars I was putting descs in from the damos, but got tedious so in the end I decided to just name them, and have since managed to mostly figure out the DAMOS text file format, so will write a script to insert all the translated descriptions, data types and sizes from there then duplicate any to the upper bank if needed.

The offsets in the code were admittedly all done manually by searching for hex offsets in the mov DPTR instruction , figuring out what its referencing (ROM, SCL, XRAM, e.t.c.) then using ALT+R (set base for offset) to set it as a ROM/RAM/XRAM/SCL offset (again probably could have been done with a script but meh haha), makes it so much easier to understand the code with them set though.

One of the other things too was creating a seperate code segment for the upper bank so that any references in instructions point correctly to the upper bank and not the lower bank (also helps when IDA does the automatic disassembly as it can understand them properly so does alot more for you). Would have been relatively easy to do it on the blank file but chose to do it after I'd already done alot of work so the only way was to use IDC/Python to manipulate the segments slightly as otherwise it would destroy everything I'd already done.

Bit late to the party as I know you guys have worked on this for years, but as only recently got an 850/4.4 and never touched 8051 stuff before I've learnt alot and also picked up some IDA tricks on the way, but worth it in the end :)

Share this post


Link to post
Share on other sites

I really appreciate the work, I've been working on a routine to log the cam angle, but haven't made much progress - this will really speed things up since cross referencing the DAMOS gets pretty tedious after only a few lookups. I'd like to monitor cam angle for VVT purposes.

 

NVM on the following stuff, P1.6 is the external clock output. 

I'm assuming that the cam signal is tied to P1.6. In Reset_0 the status of P1.6 is moved into r_FLAG1.7 (camshaft level with status 'found_located' (PH_OLD)).  In the crankshaft triggered interrupt, IEX3,there is a JB based on r_FLAGBM.4 (phase change not yet recognized. (ZDGVERB)), if this bit is set then the status of P1.6 is checked.

Since P1.6 is tied to IEX6 and IEX6 isn't used, I assume you could write a bit of code that moves the crank angle to a spare XRAM when IEX6 is triggered. Based on the sab80c517a  datasheet it looks like the interrupt would fire at the rising and falling edge, so you could poll the status of P1.6 and have a separate XRAM depending on which edge triggered the interrupt.  This would allow you to see the relative motion of the cam angle when triggering the VVT solenoids. 

I'm having trouble finding the variable that contains the crank angle in .75º degree increments, if it even exists. 

Edited by Tightmopedman9

Share this post


Link to post
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.