$42 Questions
Thread Starter
Member
Joined: Dec 2007
Posts: 152
Likes: 0
$42 Questions
Well, I got crazy and decided to try to get a $42 hack to assemble. After spending the afternoon looking at the pink book, I am down to a couple of questions. The last 3 bytes of the $42 bin are 27 09 96. the Hack says BEQ LE008. That is 9 bytes from the end of the prom if it is offset at $D000 like it appears. so 27 09 is a BEQ with a relative address of 9. Whats the 96? BEQs use relative addressing with a range of +- 128 which 9 is between, but I keep getting an addressing out of range error. Is there more code on another chip starting at $E000? and I guess I can just use an equ to set the 96. Splain 
it to me please. I can get $0D code, but $42 has me stumped right now.
it to me please. I can get $0D code, but $42 has me stumped right now. 
Moderator
iTrader: (1)
Joined: Mar 2002
Posts: 18,432
Likes: 233
From: Chasing Electrons
Car: check
Engine: check
Transmission: check
Re: $42 Questions
The PROM only holds the first 1/3 of the calibration & code. The remaining 2/3's is in on-board masked ROM. There is already a commented dis-assembly of $42 out there in pdf format.
The last byte of the PROM is the first byte of another instruction. This instruction continues over into the on-board ROM at $E000. Here is what it looks like:
RBob.
The last byte of the PROM is the first byte of another instruction. This instruction continues over into the on-board ROM at $E000. Here is what it looks like:
Code:
LDFF7: LDAA L00BC ; PROPORTIONIAL FACTORED AIR FLOW ; LDAB L000E ; A/F MODE Word Flag BITB #$40 ; b6, RICH BEQ LE008 ; BR IF NOT b6, RICH ; ... else ;--------------------------------------------- ; ROM PORTION OF ALGO ; $E000 - $FFFF ;--------------------------------------------- ; ;-------------------------------- ; ORG $E000 ; Can't do this, an instruction ; ; is split between the sections ; ; ; ; ANDA $90,X ; ; ; CPX L2409 ; ; ;-------------------------------- LDAA L00A4 ; Current Integrator SUBA L00BC ; PROPORTIONIAL FACTORED AIR FLOW BCC LE00E ; bra if no underflow ; CLRA ; clear reg A BRA LE00E ; ; LE008: ADDA L00A4 ; INTEGRATOR
Thread Starter
Member
Joined: Dec 2007
Posts: 152
Likes: 0
Re: $42 Questions
That's the hac I was working with, not a really well done one, it has lots of errors in it. I understand that the C3 platform used a different processor, is this true. I want to be able to burn a prom from the assembly source like $0D, I just need to get everything to work. I used EQU to get around the last 3 bytes, but it won't open the S19 file to make a bin.
Moderator
iTrader: (1)
Joined: Mar 2002
Posts: 18,432
Likes: 233
From: Chasing Electrons
Car: check
Engine: check
Transmission: check
Re: $42 Questions
The C3 series of ECMs used a GMCM uProc (General Motors Custom Microprocessor). It is similar to the 6803 uProc.
RBob.
RBob.
Thread Starter
Member
Joined: Dec 2007
Posts: 152
Likes: 0
Re: $42 Questions
RBob, Thanks. Is the GMCM assembly different than the 6811 asembly? Does ASM11 work OK for it? I noticed that the code you posted took into account the LDAA instruction was split across the boundary of the 2 chips, but the ORG really should be ORG $DFFF not ORG $E000 because the LDAA instruction starts at $DFFF.
Moderator
iTrader: (1)
Joined: Mar 2002
Posts: 18,432
Likes: 233
From: Chasing Electrons
Car: check
Engine: check
Transmission: check
Re: $42 Questions
The GMCM code is a subset of 'HC11 code, so ASM11 works. I use Dunfield's XTOOLS ASM11 for the work I do. For a disassembler I wrote one many years ago when I first started working with the GM ECMs.
I corrected the ORG at $E000 as that file is able to be assembled. As for the correct location of the ORG, the reason it is that way is that the EPROM was disassembled as one part, with the ROM code being disassembled separately.
If they were first combined and disassembled the ORG at $E000 would not have been required. As far as the errors in the many hac's out there, it sure is better then trying to figure it all out on our own.
RBob.
I corrected the ORG at $E000 as that file is able to be assembled. As for the correct location of the ORG, the reason it is that way is that the EPROM was disassembled as one part, with the ROM code being disassembled separately.
If they were first combined and disassembled the ORG at $E000 would not have been required. As far as the errors in the many hac's out there, it sure is better then trying to figure it all out on our own.
RBob.
Supreme Member
Joined: Oct 2002
Posts: 1,096
Likes: 0
From: Idaho
Re: $42 Questions
I've done a lot of work with available hacks and although I never had an issue with location there are a lot of values wrong to specified bin and comments are, well?
Here's one I'm trying to figure out? In Bold Italic. 2 the same, both values listed are wrong, one is higher and one lower and they both are commented as the same?
Here's one I'm trying to figure out? In Bold Italic. 2 the same, both values listed are wrong, one is higher and one lower and they both are commented as the same?
Code:
; ; CLOSED LOOP TIMER QUALS ; ;----------------------------------- LD296 FCB 102 ; 60 Deg c, (140f) CLS LP Timer WARM Thresh, (1K PU) ; LD297 FCB 20 ; 10.0 Sec WARM CLS LP Timer LD298 FCB 95 ; 47.5 Sec COLD CLS LP Timer ;---------------------------------- LD299 FCB 64 ; 35c, COOL Min for CLS LP Enable LD29A FCB 100 ;; 35c, COOL Min for CLS LP Enable
Trending Topics
Moderator
iTrader: (1)
Joined: Mar 2002
Posts: 18,432
Likes: 233
From: Chasing Electrons
Car: check
Engine: check
Transmission: check
Re: $42 Questions
I believe that these are the correct usage:
RBob.
Code:
;-------------------------------------- ; Closed loop timer quals ;-------------------------------------- LD296: FCB 102 ; 60 deg c, (140f) cls lp timer warm thresh, (1k pu) ; LD297: FCB 20 ; 40.0 sec warm closed loop timer (sec = val * 2) LD298: FCB 110 ; 220.0 sec (3m 40s) cold closed loop timer (val * 2) ; LD299: FCB 104 ; 62c, min cool for closed loop, øc = ((n * 0.625) - 5) ; LD29A: FCB 100 ; 20 sec, O2 window closed loop timeout (val / 5)
Thread Starter
Member
Joined: Dec 2007
Posts: 152
Likes: 0
Re: $42 Questions
Well, I am down to forcing addressing modes in the assembly to get the correct bin values. Slow and tedious, but the help i received here and on gearhead-efi answered the important questions. Thanks RBob
Thread Starter
Member
Joined: Dec 2007
Posts: 152
Likes: 0
Re: $42 Questions
I have completed ASDX assembly source for stock ASDX, added hiway lean cruise patch, and the ESC forced knock patch. I just completed doing the ASDU auto version, and now would like to find ADTT to do a 305 version. Anyone know where to find a stock factory ADTT bin I could use to create a commented ASM file?
Thread
Thread Starter
Forum
Replies
Last Post
