pgmfi.org

Hacking up Honda's ECU
It is currently Thu Oct 18, 2018 7:07 pm

All times are UTC - 5 hours [ DST ]





Post new topic Reply to topic  [ 8 posts ] 
Author Message
PostPosted: Mon Sep 11, 2006 1:13 am 
Offline

Joined: Tue Jul 27, 2004 2:34 am
Posts: 101
Just reading the OKI instruction manual and I come across this magical gem here on page 16:

Image

Now call me crazy but does this mean that there are EIGHT pointing registers that we can use to store words in RAM? And further, does this mean that unless we are DAMN SURE of the 3 lower bits of the PSW, we never know which of the 8 freakin' registers we are looking at??? If so this explains a lot... someone please enlighten me, I hate assembler!


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Mon Sep 11, 2006 7:45 am 
Offline

Joined: Tue Jul 27, 2004 3:01 am
Posts: 2945
Location: Tampa bay, Florida
It is so..

but you should be able to follow the code to some extent and determine what register is selected when it is working with certain code. It will always be set to something and the programmer knows to change it when needed.

If you need to change it but don't want to disturb other code.. find an open RAM location, copy the SCB to that location, change the SCB to what you want, do your code, then copy that RAM location back to SCB.

You could always try without doing that... if it doesn't work it won't take long to notice... you should know as soon as you try to start the car.


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Mon Sep 11, 2006 4:55 pm 
Offline

Joined: Tue Jul 27, 2004 2:34 am
Posts: 101
Thanks dude, much appreciated :)

Does the stock Honda code confine itself to several of the sets of registers? Are there any known-open ones where we can store data? I know the main loop is quite long so to be 'sure' I'd have to trace through it all... and I'm just not that good at coding assembler, especially when I don't know the input values most of the time and they do bit rotations through the PSW :D


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Mon Sep 11, 2006 8:21 pm 
Offline

Joined: Tue Jul 27, 2004 3:01 am
Posts: 2945
Location: Tampa bay, Florida
I'm quite sure Honda didn't use all 8 sets.. you just need to look and find out. Nobody really went through and cataloged them that I know of..

If you analyze the code closely, you will notice that mainly they stick to only a few register sets, each one defined to a specific set of data.

Besides... X1, X2, etc... are mostly used to translate tables together in Honda's code and not to really store data. What is used more is the main registers, as set by the LRB


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Mon Sep 11, 2006 10:07 pm 
Offline

Joined: Tue Jul 27, 2004 2:34 am
Posts: 101
I'll do my best, thanks man :)

Has anyone tried any tools to map out the 203 code? I find I get lost after just a few jumps. Surely there's some sort of freeware mapping tool we could use, workflow diagram visualizer, maybe MindManager (but probably not), something...


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Tue Sep 12, 2006 1:18 pm 
Offline

Joined: Tue Jul 27, 2004 3:01 am
Posts: 2945
Location: Tampa bay, Florida
how about a REALLY HUGE piece of paper...

There are tons of jumps in just one 'procedure'.. due to how Honda reused code.. Figuring out what each small segment does helps a lot. There are currently two ODB1 mappings going on. One is on the P72_273 code and the other is the P30-203 code. Both are in SourceForge. Check out the stickies in the OBD1 forum for more info on joining in.


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Tue Sep 12, 2006 2:01 pm 
Offline

Joined: Tue Jul 27, 2004 2:34 am
Posts: 101
Yeah I've been reading the P72 one at least for quite a while now, hehe... this if my first foray into the 203. I'm on sourceforge already, just not smart enough to really add anything to the comments. I'm more trying to figure out what can be done with what we already know as opposed to deciphering new code blocks.

I'm thinking more about unravelling, shifting the code around via copy/pasting to get rid of the duplicate calls, that sort of thing. Keeping it all inline and simplifying. But I guess even mapping is kind of out of the question due to the indirect jumps and table jumps. But on the other hand, even if you couldn't do it all, you could do a lot!


Top
 Profile  
Reply with quote  
 Post subject:
PostPosted: Tue Sep 12, 2006 3:11 pm 
Offline
Senior Developer

Joined: Tue Jul 27, 2004 2:09 am
Posts: 4380
Location: Cincinnati, Ohio
p30-rearrange (on my old laptop, RIP) was a start on that. All that was done was the numerous J XXXX statements were moved back into the code, and all jumps fixed. It's a start in the right direction - all the patches make the code very hard to read.


Top
 Profile  
Reply with quote  
Display posts from previous:  Sort by  
Post new topic Reply to topic  [ 8 posts ] 

All times are UTC - 5 hours [ DST ]


Who is online

Users browsing this forum: No registered users and 4 guests


You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot post attachments in this forum

Search for:
Jump to:  
cron


Powered by phpBB® Forum Software © phpBB Group