disassemble a binary file ecu

[munro]

in practice corregimi if I'm wrong tranky the only thing that is missing in the hack of the micro-now is the source code??

[tranky]

To put it as it is these units I don't know if the process code is encrypted (with the source encrypted) or only compiled and it must be defined with what..
In the first case back in the force the history of the XYZ mentioned above, while in the second it is only an interpreter to be defined, use it to convert and understand..
Tomorrow at work I'm with your ass parked without chores there I've been toying around some more and will update it.

[munro]

I read in the document that you posted you that the programming code used is the C
now, however, we do not know if bosch or fiat have adopted this, I would say yes, but who better than you can find out..
if you have bisogon a hand contact...)

[tranky]

To find out I need a Linux crosscompiler and a PC!
As soon as I finish the notebook I install it with dual-boot and I have to if decompile in C, or tomorrow will be VMware.. See you tomorrow

[tranky]

Hello,
here are the news of the day (we're ****lli of the Messenger, every day chronicle of the day):
Here img01.jpg see the code broken down with all the factors of the allocation of memory based on the Assembly code (I am now certain that it is assembly and not C++) that now I can not post totally, as I'm using it on a virtual machine and as soon as I scroll through the code, I kill the processes due to low memory. In the code, as you can see, there are for each ID his "formula" of interaction on the ECU (of course, encoded in the language of the processor), which interprets the signal in order to operate in his features, and then send any signals to the devices or to correlate with sensors which will create roule of the type: if the ECU signal is X and the sensor x says X, it sends X to the Y component.. stuff like that short.. this should tell you to me
Here you place a brief description of the processing of the code Assembly ****llo processor.
regarding the intent of integrating new features, I would say that we are not very far from it, we should at this point have an ecu+auto test and make any rip-offs of codes relating to functions that are defined in the ecu test and see if you integrate. What I don't know if it compromises the size of the file to be rewritten, we'll know only by trial.
Here is the document on the assembly (partial of course since this will be nmila pages in toto)
assembly base.rar
If anyone has had the opportunity to read the code as described and has any advice, are welcome.
Remember that the change of the SistemaOperativo of the ECU is an implementation of the native system comparable to an android smartphone custom of the house to which we install for example cyanogenmod above, then the same functionality with something more of the house (always if it works and does not lock the ecu, but nothing that a BDM you will work around with the file ORI)
The next update (work in progress)

[tranky]

ah I forgot to say one thing..
notice the img code that the processing is divided by 2 types of processor:
- 386 that would be the x86 processor standard 32bit
- 8086 that would be a very old range of processors (the late 80, early 90)
I would say that the components of the Ecu are diversified also by 2 types of processors..
I presume but have not verified on the online documentations of the componenstistiche of the ecu.
byebye

[munro]

then tranky...we're almost there I think...in the jpg that you posted(that you can see really bad) I seem to see the functions in the ecu code now, according to me, is missing a last step to extrapolate from that pile of letters is numbers without meaning something readable...
in practice, we see this
sub_FFA60:
FFA60 mov r4, word_8E40
FFA64 mov r9, word_BE80
FFA68 cmp r9, r4
FFA6A jmpr cc_ULE, loc_FFA7C
FFA6C mov r4, word_F87A
FFA70 mov r9, word_BE82
FFA74 cmp r4, r9
FFA76 jmpr cc_ULE, loc_FFA7C
FFA78 movb byte_8DAC, ZEROS
FFA7C
FFA7C loc_FFA7C:
FFA7C
FFA7C extp #0E1h, #1
FFA80 mov r4, 0CFF2h
FFA84 jnb r4.2, loc_FFA9A
FFA88 jnb word_FD48.9, loc_FFA94
FFA8C extp #0E1h, #1
FFA90 mov 0CFF2h, ZEROS
FFA94
FFA94 loc_FFA94:
FFA94 movb rl4, byte_8AF3
FFA98 rets
FFA9A ; ---------------------------------------------------------------------------
FFA9A
FFA9A loc_FFA9A:
FFA9A extp #0E1h, #1
FFA9E mov r4, 0CFF0h
FFAA2 mov r9, word_BE7E
FFAA6 cmp r9, r4
FFAA8 jmpr cc_ULE, loc_FFABE
FFAAA movb byte_8DAC, CC2IC
FFAAE addb rl4, #1
FFAB0 extp #0E1h, #1
FFAB4 movb 0CFF0h, rl4
FFAB8 movb rl4, byte_8AF3
FFABC rets
FFABE ; ---------------------------------------------------------------------------
FFABE
FFABE loc_FFABE:
FFABE jb word_FD48.9, loc_FFACE
FFAC2 extp #0E1h, #2
FFAC6 mov 0CFF0h, ZEROS
FFACA mov 0CFF2h, ONES
FFACE
FFACE loc_FFACE:
FFACE movb rl4, byte_8AF3
FFAD2 rets
FFAD2 ; End of function sub_FFA60



but to understand the whole thing and implement the new features we should see this

function_8FFA60()
{
// Anti-Lag
if (vehicleSpeed < ThresholdSpeed && engineRpm > ThresholdRpm)
{
closingTime = 0; // Interrupt ignition
}

// No-Lift-Shift
if (! noLiftShift_active)
{
// NoLiftShift is inactive
if (cond_clutchPressed)
{
noLiftShift_active = TRUE;
}
}
else
{
// NoLiftShift is active
if (counter_NoLiftShift < ThresholdCounter)
{
closingTime = 0; // Interrupt ignition
counter_NoLiftShift++;
}
else
{
if (! cond_clutchPressed)
{
counter_NoLiftShift = 0;
noLiftShift_active = FALSE;
}
}
}
}




function_antilag_noliftshift()
{
// Anti-Lag
if (B_kuppl && vfil_w < SpeedThreshold && nmot_w > LaunchRPM)
{
tsrldyn = 0; // Interrupt ignition
return;
}

// No-Lift-Shift
if (B_kuppl)
{
if (! B_brems && nmot_w > RPMThreshold && wped > AccPedalThreshold)
{
// NoLiftShift is active
if (counter_NoLiftShift < IgnitionCutDuration)
{
tsrldyn = 0; // Interrupt ignition
counter_NoLiftShift++;
}
}
else
{
// Other conditions not true, don't allow ignition interruption
// until the clutch is released and pressed again
counter_NoLiftShift = 0xFFFF;
}
}
else
{
// Clutch released -> re-arm NLS
counter_NoLiftShift = 0;
}
}


here my friend re-enters in the game you on how to do this...
P. S: erre has reason to fucks less if you understand these things the bp and cazzatine various are a smoked cigarette.

[tranky]

ok then tunerpro.. now we begin to understand the direction to take even if I have not understood how it works with the file xdf..
I learn I learn I learn...
work in progresex !

[tranky]

Where did you produce that output?
About the fuck talk with my wife, I don't have a voice.. the woman has the "stick" of the command!

[munro]

from nefmoto...