Grumpy

You can develope your own source code. Once you get that far, you are in control of the ecm.....
Even with the aftermarkets your limited to doing what they'll let you. And none of them I know of will let you see the code for their ecms.
It took 5 years to get the pieces, and then 3 months to get it all together, but it can be done.
Took the help of a real guru, but I'm to where my limitation is my imagination.

You guys working with the various masks, should team up and work out the source code for your ecms. There is enough talent here, just need to get organized. Least that would make sense to me.

There is alot of mindless typing, and that gets old fast. But, once your done you got it all.

Wish I knew all the details for getting it done, and could help, but I don't. Just hope this fires a few folks up enough to do it.

Ken73

I have yet to come far enough to understand the assembly language yet, and I'd love to dig into it - I can truely appreciate what you've done with this as I've looked at it and been totally confused. Is it a steep learning curve?

As for a "what-if" .... is it possible to reverse-engineer the BLM code to actually allow a car to tune itself, and re-program an EEPROM as it goes? (Or possibly have a "tune mode" where the ALDL jumper has a resistance across it, and the engine tunes itself?)

Ken

Grumpy

real steep curve,
the newer PCMs have a a bit of auto learn in them.
IMO, it's learn to walk before running.

One thing that strikes me as being odd, is folks are leery of tuning things themselves, but not a care about the ecm/pcm doing it. I'd rather min the ecm control of what's going on. Let it work out the toggling over Stoich., but that's it in my book.

Scott_92RS

I am in no means ready to try this, or even discuss it, but the idea just dawned on me. Would it be possible to get a EPROM that was too large for the current source code in the stock EPROM, put the stock code into it along with other functions. The function I thought of was a constant learn function. It would take BLM values after if got a certain number of readings in a cell (lets say 75 or 100), and use that value to adjust the actual fuel mixture values for that point using the same conversion that are in the Excel spreadsheet. It would probably be really hard to pull off, if not impossible, but I'm new to this stuff, and thought I might have a cool idea!

Grumpy

Yes, it can be done.
I have a C3 ecm running on a 27128 rather then a 2732.
It's lots of work. Rewritting and completely commenting the code takes just short of forever. I've mentioned a group effort to develope the 730 to the level of being source code as a group project but no one seems interested.

DAVECS1

iTrader: (2)

Grumpy I would be interested in your idea of developng a 730 source code. I am an electrical engineer for the company that makes big yellow feline earth moving machines. If you would be willing to work with me on the finer points of the 730, I think you will find I pickup on stuff pretty quick. I do software here and I have meddled with the my 730 extensively, admitedly with many failures. I am up for some hacking if you are.

HighHopes85

If this was a callout, then count me in. But I evidently have a long way to understand what the difference between source code and the code I have been using TC to change is
-Matt-

Grumpy

Yes, some folks need to get together and do this. The reason for the plural is that it is such a huge project. I've done the ecm I use. I have some other irons in the fire, that I simply must get done. In all honesty there is no need for me to get into doing one for others. But if you can muster some guys that are really really interested in doing something like this, I'd be will to share some snippets of what the final result should look like. I don't know all the answers on how even to do it, but I'm really sure some of the guys here can fill in some of the blanks.
6 guys with software expereince, and perferably knowing the Motorola couls knock this out in 2 months. For one guy it's a years work. I'm just one guy, so you can imagine how much time I have in mine.

Grumpy

Shame to see this one die.

Ken73

I agree, but I think there are other things that more people need to get a better grip on first. The idea is being thrown out though, which means people are evolving. Eventually it will become mainstream to have an ECM bench, where you can check your code before you slap it in the car.

I'm somewhat trying to follow your footsteps for the '7747 - eventually I'd like to drop a 27128 and do the ~ROMENABLE trick; I can't imagine it being that difficult, especially with the code being so well hacked. I just don't have the assembler knowledge yet to do anything with it. I'd like to gain control over some of the other outputs (such as cannister purge, or the "A2 out" output, for flapper door or other such WOT-enabled devices.) But, I don't want to get ahead of myself yet - I still have to learn how to tune pretty (damn) good, and make it easy for others to understand and do, without blowing their engines up. Not to mention my EPROM emulator that I'm working on, hopefully to be reasonably priced.

Things have evolved since your first CrossFire project. I would think SOMEONE would have tried something. You've paved the way and others have helped refine the means to the end. I just don't think the mainstream group is ready for it yet.

Ken

Grumpy

For years, I was harped at by some knowing fellows to get to the stage of reading code. Luckily I fell into some good info., and was able to do the romless mod in my ecm and then develope the Source Code for it. I begged for a while to get a hand, but there were no takers (of those running the same ecm), so I have months working at it full time to now have actual source code for my ecm. Now after seeing what is there, things are making alot more sense, also I have more room now to add code to this.

There are enough sharp guys here to do it, they just don't realise how important it is to get it done.
With the source code, you basically have the best of the best ecm. You can take advantage of all the millions of dollars GM spent in refining the GM to where it is today.

Just think, with some basics out of the way, folks could take a 8051 and refine it for use with a distributor. With the ability to flash it rather then using chips, it's a step closer to RELIABLE on the fly tuning.

Short story for a long tale

Grim Reaper

For those that want to learn Assembly Language Programming, here is a link explaining the Motorola 68HC11 processor. This is a nicely written explanation of how the processor works. There are more "indepth" links I will be willing to provide if people are interested, but this link will get people started.

Go here ---> http://www.owlnet.rice.edu/~elec201/Book/6811_asm.html

As I said, I have more links to help people get into Assembly Language Programming if I see people interested in it.

Astro4X4

Yes I am very interested in learning all I can and realize it is a long road to the goal. I have been playing with the tuning for my engine and reading all I can get my hands on, I have very little experience with programming but have the desire to learn. So assembly language is the first step to understanding my ECM fully? Any info you can pass my way would be greatly apprciated.

Dave

velocity150

Great link. I enjoyed reading it. Any others that your are willing to post will be appreciated.

JG

Go here ---> http://www.owlnet.rice.edu/~elec201/Book/6811_asm.html As I said, I have more links to help people get into Assembly Language Programming if I see people interested in it.

Bossute

This needs togoback to the top

Anyone got some good links so we can all learn to disassemble the code.

i have progressed tothe stage Ihave added a shift light routine to my code butthiswasonly achievable thanks to a mate who showed me were the std rev cut routine was in my prom

V8Astro Captain

iTrader: (1)

I've been tuning my PROM for a couple months now, and I see the huge advantage of editing source code.

One thing I still wonder is, where do you get the source code out of? What chip inside the ECM do you get it from? I know this sounds like a really, really stupid question but I gotta start somewhere.

I would love to take a look at all this.

Bossute

The source code is in the binary image you have been editing to do your tune.
Normally the tables are in the first half of the image and then the source code that acesses these values follows. Try looking at some disasemblies that are floating around and you will start to get a little understanding on what is going on.

Grim Reaper

Okay, here is some more links.

Go here ---> http://e-www.motorola.com/brdata/PDF.../M68HC11RM.pdf

This is some light reading for you; the actual Motorola HC11 Reference Manual. Though you should read through the whole thing as some point, the two key parts to look at are:

Chapter 6 - Central Processor Unit (CPU)
Appendix A - Instruction Set Details

Also getting a grasp on Chapters 3 - 5 is advisable, but Chapter 6 and Appendix A are a must. I use Appendix A as I read the $8D hac and then document a disassembly I created of the AUJP1615 BIN (for SD L98 cars). I will get into how to create disassemblies in the next week or so and tell you how to create one for $8D and $6E. As there is a ready hac for the 7747, you $42 guys can use the "hac" to setup the disassembly and $32 MAF guys can use the $32 hac as their guide.

To get those hacs:
Go here ---> http://www.geocities.com/ecmguy.geo/tuning/do_tune.html

But you may want to rush. ECMGUY passed away awhile back and this website is living on "borrowed time" as long as someone is willing to pay to keep it up. For those that read Traxion's Prom Introduction Article, you would have already found these if you had clicked on all the "recommended links".

KAOSRacing

If someone can get me the files for the site, I will gladly donate some space on teamkaos.org to host the files.

No reason for his work to disappear.

Grim Reaper

Just grab the hacks from here --> http://www.geocities.com/ecmguy.geo/tuning/do_tune.html

KAOSRacing

I'll try to get that done this weekend. Is just the hacks all that needs to be "saved" or should I grab the whole site?

Grim Reaper

It's not my site, but "mirroring" the entire site may tick some people off.

Just grab the hacks while you can. If you want to offer the downloads from your website, that's your call. It seems a few people are "building" their own website with various links and downloads these days - some better than others.

Grumpy

Grab it all.
I think in the spiirit of the ecm guys own way for it to be residplayed would be fine with him.
Mirroring while he was with us would have been a different matter.

Lowaholic

Hey all. I haven't been here in awhile and I noticed a lot of talk about 'eprom emulators'- are we talking about pretty much an 'adapter' to bypass your prom and run it into an external processor (ie-laptop)? I am a third year CIS student and have been becoming more and more curious as to how this could be accomplished. All the recent talk about 'stand-alone engine management systems' just got me to thinking. Anyways if anybody could tell me what this project is about I may be interested in helping out where I can

afgun

The emulator that's being discussed is an emulator for the PROM itself - ie you plug a programmable device into the ECM and can update it on-the-fly, though most people have not had luck doing it while the engine is actually running.

JPrevost

Restarting this old post. I'm going to start working on the 8746 source code and if any other TBI guys would like to help I'd appreciate it. Grumpy, when do you think the efi pow wow will be this year? Hopefully not over my spring break like last year. I'm in Ohio for the majority of winter and spring but for my spring break I go home to NJ. So if you could schedule the meeting around March 22nd and April 1st I would really appreciate it.

Grim Reaper

This is something I have been looking at trying with my SD ECM since I already am using a Flash Prom. Whether the ECM can actually write to a specific "byte" in the Flash Prom is unknown, and not expected to work because most Flash Proms write in "blocks" as opposed to "bytes".

But the bigger problem is a Flash Prom is not "indefefinitely reuseable" as RAM. Flash Proms, while being able to be re-written too a LOT more than an Eprom, still can only be re-written so many times. The ECM could end up re-writting a particular byte THOUSANDS of times in a second. A Flash Prom can only handle somewhere between 1,000-100,000 rewrites, so somewhere after 1 - 100 seconds of running, you may permanently ruin a particular byte in the Flash Prom.

What you need to do is "hack" the Source Code and try and find some free RAM bytes (low order memory).

I just sent Jon an e-mail on "how to create a disassembly". I will try and repost it.

Grim Reaper

This is a copy of an e-mail I sent to Jon Prevost regarding "Creating Source Code".

To make Source Code is quite simple, you need a disassembler (TunerCat's is free for 30 days, and that is longer than you will need it). Then (since you already have a hack for the 7747) you tell the Disassembler what areas are "single byte data", "double byte data" and "instructions". Though it is nice to have the "double byte" defined, you will probably run out of "definitions" in the Disassembler - so you can "clean up" the "double byte data" later. Defining the "data" and the "instructions" is the most important.

My "disassembly work" has all been done for the SD, so the defined areas are different. However, GM structured the Motorola Code in pretty much the same fashion: the first part is all data for "Tables and Constants", then find the first part of the instructions in the hack and make sure that is setup as "instruction mode" and lastly look at the end of the code and you'll find a "vector table", this needs to be defined as "data". The Vector table has "standard" error entry routines from the Motorola's processor, and contains the addresses the instructions need to jump to for various conditions like "Boot", "restart", and "error handling".

The Disassembler will create "undocumented" source code without the lower part of the addresses defined. You then take that Disassembler and try "Assembling" it. Initially you are going to get a TON of errors because you don't have the starting addresses in the ECMs lower memory defined. These lower addresses have the RAM where the various sensor readings are stored, some special error instructions, various "control words and switches".

You just take EVERY one of those "errors" for "missing variable" and do an EQUATE instruction so the Source Code now has the "pointer" defined. Also, depending on the Assembler you use (there are free ones and ones you can purchase) they may list only a limited number of errors. The "free one" I use limits you to 20 errors and then it just "craps". You just EQUATE those 20, try it again, get 20 more, assemble it again... until you get them all.

The EQUATES are quite simple. You will get an error saying "L0000 is missing", then you add an EQUATE statement like this:

L0000 EQU $0000

Later, when you start to document the code (using the hack as a guide), you will eventually discover what L000 really is and you can give it a more meaningful name, such as:

L0000_MAP_Volt EQU $0000

I am not saying L000 is the ACTUALLY the MAP Voltage reading, just that I find it nice AFTER I got Source Code that assembles "error free" that instead of variable names like L8000, that L8000_Useful_Name makes the Source Code ALMOST self-documenting.

The last thing to do is to start with the instructions and go line by line with the hack and your "new source code" following each instruction from the start until the end and documenting it as you go. To say this takes a little time is an understatement, BUT you REALLY learn what the Code is doing this way. There is no easy short cut. You can "split it" among a group of others that are seriously interested in developing Source Code, but you will only learn the parts that you worked on. To truly learn it, you need to do it all yourself. That is what I have been doing over the last year myself.

I now know the location of virtually EVERY RAM variable the ECM has and I even found a "byte or two" that I think is free in the SD code. Free RAM areas should be treated like GOLD, because this will allow you store "counters and pointers" for any NEW CODE you wish to add.

There is a LOT MORE that I can mention, but I think the above information will get you started and then you can ask specific questions as they arise. Too much information can "overwhelm" a guy, so it is best to work in small chunks. But the first place to start is to get TunerCat's Disassembler (it's free for 30 days) and create a disassembly using your "hack" as a guide. I will look around for one of the better "free" Assemblers, unless you are interested in purchasing one. The advantages of "purchased" Assemblers is they have better "error reporting", will display ALL your errors (useful in creating your first Source Code from the Disassembly) and handle longer Variable names and more variable names.

Grim Reaper

I realize that Jon now has a 746 (not a 747) but the principal is the same. You can still use the 747 as a "base" for "guidance" but the areas will be a little different.

junkcltr

iTrader: (1)

That is a good summary of how to disassemble and assemble the code. It sounds like using the assembler you are currently using is a good way to go because it only lists 20 errors. I would think that the average person would give up if they saw all of the 5,000 or so errors at once.
It would be good to all agree on an assembler due to pseudo-ops differences.
J

junkcltr

iTrader: (1)

Grumpy,
You write about source code(for Motorola Uprocessors--ECM)...........what kind of code? High level(various languages), or low level(assembly)? Are you thinking of writing a sub-set of functions in a high level language that mimic the assembly functions in the existing code? Or just more assembly routines to add to the existing code? I guess I am confused.........what is "the goal" of all of this?

Glenn,
Yes, you are right. There is a decent amount of RAM that is unused in some of the ECMs. It is usable by 'new' routines.
J

AlexJH

Are there any free disassemblers out there? I don't need Tunercat so it would be a bit of a waste for me to buy it just for that.

I would be interested in working on this. I have a bit of experience with assembly language, although it's with Intel chips, so I'd have to learn how to think backwards if I'm going to work with a Motorola cpu.

junkcltr

iTrader: (1)

Do a search for "68HC11 disassembler" in your favorite search engine. There are multiple free ones. Some are much better than others......just my opinion.
It is good to hear that you have written some assembly for Intel things. Don't worry about learning to think backwards for the Motorola things. You know some assembly in general.........that means you already have learned to think backwards.
J

Grim Reaper

As Junkcltr said, there are some free disassemblers out there. At the time I did all this, I was pretty much on my own. I tried a few of the freebies, but I didn't have much luck disassembling my AUJP BIN and they all "blew up".

So I tried TunerCat's disassembler (since it was free for 30 days) and while it still was "less than perfect", it did create a reasonably "useable" disassembly that I was able to run with to start creating my Source Code.

Also, since I only need TunerCat's Disassembler to create the initial disassembly, I only needed it for a day or two; which was within the 30 day "free trial". For most people, they will probably find the same thing - need it for a day or two and then have no further need.

AlexJH

It looks like www.techedge.com.au has one, and it's even been used for disassembling Holden ECMs.

No Linux version though.

junkcltr

iTrader: (1)

What's Linux............just kidding. I did come across some source code for a simulator that included a disassembler. It can be compiled under Linux, and I think it used the later libraries/kernel.
If people are serious about this. I think one of the biggest things is agreeing on using one assembler. There are some Linux and Win assemblers out there. The one at techedge isn't linux friendly. Also, it spits out some Z80 (non native) type Op Codes. Using an assembler that was more generic would be a better choice. The gcc package (compiler/assembler/linker) would be the best choice........I think. This offers the most freedom in terms of taking things to the next level.........writing the code in C......focusing on the algorithms instead of 'should that be a bra or a jmp instruction'.
Cheers, J

Grumpy

It doesn't use the standard Motorola Pnemonics.

If you want a good dissemblier the only answer I know of is Dunfield, and that is by recommendation.

The AU assemblier does work however.

Also, when surfing the net be sure you have you spyware up to date.

junkcltr

iTrader: (1)

I haven't seen that one I don't think. What and where is a 'Dunfield'? What is a 'spyware'?
By the sounds of it Grumpy, it appears that you were thinking all in assembly? Correct?
Thanks,
J

AlexJH

Haha. I dual boot into Windows because PP and WinBin need it, so I don't have a problem there.

If we are going to do stuff in C, I agree, gcc is the logical choice.

Hmm... I don't quite understand this one...

Dunfield can be found here:

http://www.programmersheaven.com/zone5/cat460/2390.htm

junkcltr

iTrader: (1)

Thanks for the link. I'll check out the disassembler more later. Is it freeware? The site said it was a demo version.
The C thing...........I am starting to get lost. What is the intent on this thread......'source code'.......edit it? Hey, is my ECM gonna get a virus from this??? Anyone got Norton for a '165
Thanks,
J

AlexJH

http://www.diy-efi.org/gmecm/html_ar.../msg00145.html

Just found this in the archives re spyware. thanks Bruce.

Any important stuff that I have is encrypted and/or not 'net connected, but it's still good to be vigilant.

junkcltr

iTrader: (1)

A bunch of EEs and SEs are much smarter than I am. Therefore, I rely on there algorithms running the engine for me. Min control is a carb. The Non Volatile memory in ECMs/PCMs keeps growing which means the algorithms are getting more sophisticated. Yes, harder to understand, but I think they do a better job controlling the engine. Anyway, back to the topic. What is the goal here? Generate high level source code or low level? Or just try to strip or add functionality to the existing code any way you can? Kind of like the efi332 project........but hardware is more accessible and cheaper. Just no floating point math.
Cheers,
J

Grumpy

The rub is EE and SE aren't engine tuners and GM codes do contain errors.
Once you get into things, you'll see some strange stuff, ie on the early stuff they did lots of patchs to get things to pass various driving conditons, and emission checks.
Some contain code that doesn't even run, and tables that are unused.

Grumpy

Dunfield Labs make an excellent disassembler.

Spyware is a program to eliminate programs that you down load that phone home to allow someone to remote access your computer.

Ad-ware is one such program

Grim Reaper

Bruce is so right. Some of the code can be "streamlined" to reduce the number of operating cycles and thus have the ECM perform quicker. However, sometimes GM used a seemingly useless instruction that is there SPECIFICALLY for "timing events" to ensure the ECM has properly read a sensor and returned a "filtered" variable.

And, as Bruce said, GM has code in there that isn't even working. Highway Mode is a great example of code that GM wrote, implemented yet chose to not "activate". Or, (on SD cars), physically disabled the code requiring a small code change to make it work (Highway Mode Spark Advance is good example of this).

But, as Bruce is suggesting, diving into the code and learning what it's doing sets you up to modify the existing code to do things that GM never intended. Re-writing the 7730 code to properly handle a 2 Bar MAP is entirely feasible once you have developed Source Code and learnt how the code works.

Wouldn't it be great to be able to run a power-adder like a SC or Turbo on a 7730 and the only things you need to do is install a 2 Bar MAP, run a 2 Bar Version of the 7730 AUJP BIN and then just tweak the 2 Bar VE Tables to handle boost conditions?

Or, how about creating a routine to pull a little timing during an up-shift (the first place where detonation often occurs)? How about extending the BLM Table so it handles a 5x5 or 6x6 (or whatever) table instead of the stock 4x4.

Or, maybe you would like to have different data displayed on your ALDL. Modify the source code of Craig's scan tool and you could have a couple of different versions - a full diagnostic ALDL stream to show you EVERYTHING in the RAM, normal and a shortened version for "racing" where the amount of data in minimal so you can actually use the data captured as a means of timing yourself.

The beauty of the 7730 AUJP Bin, is that it only utilizes 58% of the space on the eprom. 42% is BLANK! That is a lot of free room on the AUJP's BIN.

As Bruce said, if you get into the Source Code, you have COMPLETE control of the ECM and you are limited by your own imagination. The problem is, once people start to get into the Source Code, and they start to develop some interesting changes, they start to see Dollar Bills in front of their eyes.

Bruce is the last of a "breed" that is trying to get "hobbiest" to work together for the betterment of all - without trying to make a buck at it. Or worst, do virtually nothing except "pick people's brains", get beta-versions from the people that developed the new Source Code, slam a patent on it and steal it.

junkcltr

iTrader: (1)

Both of you are right. Yes, there are some errors. Yes, the are some unused functions. And yes, there is room for more code in most of the ECMs address space(including existing PROM). I have a lot of ideas for this stuff and have implemented some of them.....have been working it for over a year now......and yes, some are interesting. Glenn, you make a good point.......I am not going to let anyone rip them off. I have a lot of sleepless nights working on them. I guess I should jump out of this thread. I am not trying to be a jerk, but you gave me some stuff to think about. Too bad politics crushes creativity sometimes.
Thanks,
J

Grumpy

Wonderful, go ahead and jump ship.
Great to see it's been just a waste of time. You come in and learn what you can then want to leave so that others don't rip you off. Great scott, tell me the difference in what your doing.

Maybe I shouldn't have done Programming 101 and left the world hanging.

Ya that's the spirit just everyone lurk.
Be like DIY where there are so many lurkers nothing gets done anymore. The idea is to give.

Rant Off

HighHopes85

Trying to stay on topic, I have a question for those who have already gained enough knowledge to modify the source code.

If you wanted to (for examples sake) put a line in the middle of the code that lit up an LED on your dash, is it as easy as just adding that code assuming there is space or do you have to readjust every other entry in the code?

Is the source code similar to any Visual Basic code where you can have routines and subroutines, then link them together (this is what it sounds like after reading the info so far). I know it isn't like VB, but there again, just for comparisons sake...

For me to do this, I realized that I first had to have a handle on HEX and the different ways it can be written out, what a mask value is, etc. Now that I can finally go through and make sense of the anht_hac without doubts, I feel like taking the next step. Thanks, -Matt-

Grumpy

If you car say had a shift light, or you wanted to turn on the SES, yes. You could use the Charcoal Canister Purge output to run some other light.

Once you have source code, as long as you have an input and output to use you can add anything.

If there is an unused input you cold use that to data log something like a WB.

Launch assist, OK
two stag rpm limiters
Anti theft
valet mode
just a few key stockes away

Expanded tables
Add tables
Deleted tables,

junkcltr

iTrader: (1)

Grumpy, I have no idea what programming 101 is. Are you saying that I have taken programming 101 just by reading what you have written in this thread? I hope not....cause all I learned is that there are only a few that would like to mess with the assembly code.
I joined this board about a month ago because I read a thread that was about someone having a problem running some DOS software that a member had written. I wanted to help so I joined the board and responded. Overall, I have learned some stuff and have helped some others out.......I thought that is what this board is about. Not about getting upset when people change their minds. This is not my job, I do it for fun and enjoy sharing ideas with people that are interested. Correct me if I am wrong, but you seem very serious about this stuff. I am not....just for fun. Sorry if I wasted some of your time. I wasn't trying to offend anyone.
J