88lt3

Hey everybody, you may have heard this story before, but, I'm struggling to fully understand the code needed for adding an input on my 7749 running $59 bin. Heres what i know. the ram locations, routines and such are all addressed in different locations than say, $58 or 8d. I have disassembled the bin, and can find what I think is the code for the ESC, which would indicate the routine I would need to address. I'm trying to add a a/d read for #$04 on the u6 chip for pin b3. I think I know what I'm looking at, but need a nudge... I have been staring at this for a week or two now. ive read I/0 addressing thread about a 100 times, but it just isn't clicking yet. I really don't "need" to have this, but would like to log egts with the rest of my data during a pull. I know most of you all run 8d, but many of you seem quite savvy w/code. Any help would be appreciated.

88lt3

Vanilla Ice

What nudge do you need?
Here's a simple code breakdown.
https://www.thirdgen.org/forums/diy-...ml#post6076065
It probably doesn't directly translate, but I assume there's a read pin routine you can copy, then a filter for the ad value, then wrote the result to a ram spot.
Next thing to do is change the data output for data logging.

88lt3

I'm pretty sure I got the code right.

3AF9: L3AF9 LDAA #$0004 ;.. u6 read CH4
3AFA: JSR LC061 ;.. A/D ROUTINE
3AFB: STAA L017F ;.. STORE RESULT

just need to bridge the gap to xdf to adx now. that portion I'm still unsure of. ive tried reverse engineering the code to find a aldl word location that I don't use, there are plenty, but don't have a scalar or bit setup to reference the stored location. this is where I need help I guess. this is also assuming that my bin will assemble properly too.

88lt3

I MEANT,

3AF9: LDAA #$0004 ;.. u6 read CH4
3AFB: JSR LC061 ;.. A/D ROUTINE
3AFD: STAA L017F ;.. STORE RESULT

Vanilla Ice

Xdf shouldn't be used for this.
The wideband you're using should have a scalar from the manufacturer. If you setup the ADX to read directly you can manually apply the scalar to the spreadsheet datalog. Or you can tell tuner pro to do it.
If you copy another logging variable in tunerpro you can change it to suit your needs.
Here's mine:
https://www.thirdgen.org/forums/powe...-test-bin.html

88lt3

ok, so if my variable is stored at L017F, what in the adx to do I change to read this in the data stream? How does the adx reference the 017f? sound I simply be able to put 017f as the hex address for a value I don't need? If so, that isn't working...

Vanilla Ice

In $8D there's a table for the ALDL data stream that tells which ram addresses to output.
You'll need to figure out one unused/unneeded by you and replace it with your address. Then alter the ADX for that variable you no longer care to log or make sure the ADX will read that output. The ADX for $8d is incomplete with many things in the aldl data stream that isn't actually logged because they unimportant.

88lt3

well, I got it and thank you for that, but now my data jumps back and forth about every .5 second, from some where close to the value I'm trying to log back to a static value, what should I check, id assume the actual voltage at my input, then what else?

Vanilla Ice

Check voltage output, ground

88lt3

TURNS OUT THE ALDL LOCATION WAS ADDRESSED TWICE, CAUSING IT TO TOGGLE CONSTANTLY BETWEEN THE TWO OPERATIONS. THANKS AGAIN FOR ALL YOUR HELP. NOW I JUST NEED TO GET IT SCALED CORRECTLY. ONE QUESTION I DO STILL HAVE, IS CAN I ADD A READ LIKE THAT ANYWHERE IN THE BIN, AND A STAA ANYWHERE IN THE BIN? WHEN I ORIGINALLY ADDED IT, I FOUND A LOCATION WHERE THERE WAS "NOP", ADDED THE CHANNEL READ CODE THERE AND THEN ADDED THE STORAGE LOCATION TO AN OPEN LOCATION NEAR THE ESC STORAGE LOCATION AND IT DIDNT SEEM TO WORK. HOW CAN YOU TELL WHERE THE RAM/ROM/CODE AREAS IN THE BIN ARE? Sorry, didn't mean to yell, just realized this is in all caps.

Vanilla Ice

I used IDA so I just look at the fancy picture to see where things are.

You can hijack and place code in wherever you find that makes sense but it needs to be in a place where it will go through often enough to get the desired result.
You wouldn't want to place wideband code in the startup routine.

I can't comment on finding extra RAM in your bin. I found some in the stack and also in a few spots like oil temp that's an arbitrary value that the ecu doesn't care about.

Just have to get creative really and think everything through.

JP86SS

iTrader: (1)

To add code anywhere you must replace existing code with the same "size" items so nothing shifts.
There are indexed addresses that will corrupt sequence of operation if code isn't the same size. You'l need to count the OP Code addresses and figure out where it can go and use NOP to "pad" any differences.

One of the easier things to do is look for an oil temp reading that is not used.
It exists in $8D but is not used, Not sure if its the same in $59.
Change the lookup channel address like you did above and use that as it already has an ALDL output location as well.
That way code did not need to be changed.

Be careful with what appear to be open RAM address locations. Some are double words and not called out specifically so you don't see them when searching.
Moving the stack a bit can yeild a couple but don't get crazy unless you are bench testing first
HTH

Vanilla Ice

As opposed to replacing code it's FAR easier to place a hook either with a jump or jsr to your own code wherever you want then jump back to any address you want or return from subroutine.

JP86SS

iTrader: (1)

To clarify for 88lt3 and others,
True, if you find a operation point that has clean registers or unneeded values in them.
Otherwise you'll have to save and restore the values in registers that may be in transition.
Not difficult, just needs to be done in the new subroutine.
Exactly