v2.0 413 Tuning thread

[el bob]

Check the addresses of the WOT ignition. You are off. You can either look at the bin in dec format for the blocks of numbers ranging from 60-99 OR find the table of addresses to check the various possible locations. You know they will be 16 x 12 with inputs of d0 and d5 (rpm and load). The WOT and PT ignition tables are close to one another in the bin and share similar values.

Oops, sorry about that, I screwed up. I took screen shots of them with the wrong bin/xdf selected. I updated the screen shots with the correct data. Does it look okay now?

the only way to be off like that is to not be finding the maps in a hex editor... and/or not undrstanding the formatting of the tables. which is why we don't share the XDF files. building the XDF is trivial once you understand the format. understanding the format is crucial to being able to effectively use an editor like tunerpro.

Again, sorry Mike, it was my own clerical error. I somewhat agree with you. I was definitely surprised by how easy it was to build an .xdf once I was able to understand how to identify map/data sections in a hex file using the info you and the other pioneers (NockenPaul, artwar, borealiss, dredder, robstah, 325icitn, and others) laid out in the original 413 thread. You guys are awesome!

This is true. The information in this thread provides the method for understanding the format. By the time you correct the timing maps above, you will understand the format.
No one xdf covers all versions of the software., so sharing xdf's only takes you so far. I just looked at two different bins today that don't match my primary xdf. If I didn't understand the format, then I could not make an xdf to fit the different software versions.
In addition, to continue to expand control you have to be able to locate and identify the different types of tables and information.

Yeah I saw that when checking out the ~94'ish 325is bin Mike posted versus the 95 525i map I pulled off a junkyard DME. They're both 413 bin's, but a quick hex comparison shows they are very different. On the other hand, like you said, it doesn't take that much effort to remap it all if you understand the structure.

I'm kind of hoping that there are less than 10 variations of the 413 bin and that eventually there will be an FTP site where matching .xdf's are available for download. Even if we don't know exactly which production years and models correspond to which 413 bin versions, it seems like it won't be terribly difficult for a tuner to open up the bin in question and then switch through the two or three possible matching xdf's until you get meaningful data in all of your maps. Now this won't work if some of the bin versions are very similar and a tuner could be fooled, but from what I have seen so far, it's an all or nothing thing where it's pretty obvious if you have the right .xdf/.bin combo. I could be wrong though, but ya gotta start somewhere.

[techno550]

The idea was to potentially have a database of files (bin and def) when there was a community behind it. there isn't, so there isn't. Doing so now is counterproductive.

[wulfgang]

Is density@STP a constant that can be adjusted for altitude etc?

That is not necessary since the HFM gives a direct reading of mass flow.

[wulfgang]

the only way to be off like that is to not be finding the maps in a hex editor... and/or not undrstanding the formatting of the tables. which is why we don't share the XDF files. building the XDF is trivial once you understand the format. understanding the format is crucial to being able to effectively use an editor like tunerpro.

We need to get around this problem. The directory is easy, easy, easy for a human to find, but the DME calculates its base address in a somewhat convoluted way (for example, do a hex search for an absolute pointer into the directory and you won't find one). There must be some deterministic way to find the exact offset into the main directory. That is what I was trying to do last time I ran an emulator, but I ran out of time...

If somebody puts me on their payroll, I'd be happy to continue

[325icintn]

We need to get around this problem. The directory is easy, easy, easy for a human to find, but the DME calculates its base address in a somewhat convoluted way (for example, do a hex search for an absolute pointer into the directory and you won't find one). There must be some deterministic way to find the exact offset into the main directory. That is what I was trying to do last time I ran an emulator, but I ran out of time...

If somebody puts me on their payroll, I'd be happy to continue

Something like the function call that the Porsche guys figured out:

[325icintn]

AND:
Here are a couple screenshots of the flowcharts that can be made in ida pro. If anyone can help make sense of them feel free to chime in. This is the beginning of the flow chart for the first of many functions

[wulfgang]

Looks nice. Is there an IDA Pro eval version?

[rennteknik]

Looks nice. Is there an IDA Pro eval version?

http://www.hex-rays.com/idapro/idadown.htm

[wulfgang]

http://www.hex-rays.com/idapro/idadown.htm

I thought that version did not do 8096. Also says it only supports PE files, and a bin is definitely not a PE.

I see older versions are free. Is anybody running one of the free versions with 8096?

[m3j0n]

there is a plethora of useful info in this thread.....thank you to all involved (specifically, 325icintn and techno555). Once again, it really says A LOT about a tuner that is willing to "share" this type of information at no cost. I know that some other tuners wont even shake your hand without getting paid, let alone give out this type of information.... Props to you guys!

[techno550]

We need to get around this problem. The directory is easy, easy, easy for a human to find, but the DME calculates its base address in a somewhat convoluted way (for example, do a hex search for an absolute pointer into the directory and you won't find one). There must be some deterministic way to find the exact offset into the main directory. That is what I was trying to do last time I ran an emulator, but I ran out of time...

If somebody puts me on their payroll, I'd be happy to continue

there is a pointer into the directiory of tables. also has pointers to the bits not addressed by that directory (such as the MAF table).

[wulfgang]

Yes, but given a RESET, how does the MCU find that first pointer? It is not hard-coded; it is calculated at run time.

[Keaton]

I thought that version did not do 8096. Also says it only supports PE files, and a bin is definitely not a PE.

I see older versions are free. Is anybody running one of the free versions with 8096?

IDA supports 80196 which is the same family of processors as the 8096

[325icintn]

How about a bump to see what happens?

[MrT0m]

wondering whats going on also..

[eficker]

Yeah, seems like people are mad about JimC's sw not coming out, but will not put in the time to make this work. I'm selling my AEM to go this route, so i will be spending some time...

[328iJunkie]

I wish i could tune

[wulfgang]

Yeah, seems like people are mad about JimC's sw not coming out, but will not or can not put in the time to make this work.

Corrected your post.

[eficker]

I doubt that's the case, cannot is a false term. Anyone can do anything. Whether they choose to or not is the real question. Not whether they can. Anyway.

I'm willing to put in some time. I'm not super code master, but i can figure some crap out. Is there any reason why we can't have a sw gui that will do the work for us for map locations that we have already found? Implement Moates' ostrich to work for our needs? Add in some FI maps where there is room in the rom file? It has been done for almost every other obd1 car make and is almost always a result of community contributions with a few people taking the lead.

I don't think there are piles of money to be made with the sw, but we should be able to figure it out for those of us who care.

[325icintn]

You don't need to add FI maps, just modify the existing. The GUI is Tunerpro or WinOLS once you've built the definition file. Ostrich already works with our cars.

[Keaton]

can anyone post up screen shots of Ostrich2.0 running on our cars

[a32guy]

There is no screenshot. It works, I have one. Take my word for it. If you're thinking of the trace, that doesn't work.

[Keaton]

There is no screenshot. It works, I have one. Take my word for it. If you're thinking of the trace, that doesn't work.

sorry but i'm confused. trace?

i'm asking if someone can open up the tool while its running with a car, then press the "Prt Scrn" (print screen) button and post it up.

[a32guy]

Well the Ostrich doesn't have any influence of what the software looks like, TunerPro:



If its connected you can emulate and make changes live on the fly.

[Keaton]

oh, well i have tuner pro. i thought Ostrich2.0 had its own software and interface to tune out of