The Subaru SVX World Network   SVX Network Forums
Live Chat!
SVX or Subaru Links
Old Lockers
Photo Post
How-To Documents
Message Archive
SVX Shop Search
IRC users:

Go Back   The Subaru SVX World Network > SVX Main Forums > Technical Q & A

Reply
 
Thread Tools Display Modes
  #1  
Old 04-27-2007, 02:06 AM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Memory dump of ECU

I have dumped the memory of my ECU to a file and I'm starting to analyse it. Any other hardcore computer guys want to take a look?

Car: 94 JDM version S40-ii
RomID: 742512

CPU is M37791 (Mitsubishi MELPS7700)

This file is a dump of the whole 16-bit address space.

0000-00FF is IO
1000-14FF is RAM data (14FF downwards is the program stack)
8000-8FFF is ROM data (possible 16x16 tables at 0x8120 and 0x8e20 ?)
9000-FFCF is ROM code
FFD0-FFFF is Interrupt vectors
The rest of the address space appears to be unused.

Attached Files
File Type: zip ECU.zip (49.4 KB, 2083 views)
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II
Reply With Quote
  #2  
Old 04-27-2007, 03:12 AM
Dessertrunner's Avatar
Dessertrunner Dessertrunner is offline
Registered User
 
Join Date: Jul 2005
Location: Griffith NSW
Posts: 2,156
YEs I am interested how did you dump the data? I tried to open the file and didn't have any luck.
Tony
__________________
1995 - SVX 700,000 K Mine, DMS Struts to lift car 2in. Tyres Wrangler Silent Armor 235/70R16, PBR Radiator. 6 speed with DCCD and R180 rer diff, Heavy duty top strut mounts front and rear. Speedo correction box fitted. New stero (gave up on the old one). Back seat removed and 2 spare tyres fitted for desert driving. ECUTune SC sitting in the box for the next SVX.
1992 - SVX 255 K Wife (Want to stay Married so not allowed to fit SC)
1992 - SVX Pearl with black roof race car roll cauge etc ready to race. Ex Tasman Targa car.
1995 - SVX Green low k mint condiation.
1995 - SVX Rally car, ex Matts car. Now to be used on track.
1992 - SVX red & Black being converted to Mid Engine.
1995 - SVX Red 143,000 bit rough.
Owned 5 others Subaru back to a 1974 1400 GSR.
Reply With Quote
  #3  
Old 04-27-2007, 05:52 AM
JaySVX's Avatar
JaySVX JaySVX is offline
Bad decisions effect everybody
 
Join Date: Mar 2007
Location: Collegeville, PA
Posts: 1,902
Send a message via AIM to JaySVX Send a message via Yahoo to JaySVX
Any way you can export it to raw text? Having issues with the .bin.
__________________
*No SVX at the moment...*
1987 Winnebago Elandan 35'
2001 Yamaha Roadstar 1600
2004 Ford Excursion Eddie Bauer, 6.0litre Power Stroke Diesel - Daily Driver.


Life should NOT be a journey to the grave with the intention of arriving safely in an attractive and well-preserved body, but rather to skid in sideways, scotch in one hand, body thoroughly used up, totally worn out and screaming HOOOOYA !!!!!
Reply With Quote
  #4  
Old 04-27-2007, 07:41 AM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
OK. Here's some raw text files (inside the zip):

Archive: ECU3.zip
Length Date Time Name
-------- ---- ---- ----
331776 04-27-07 14:43 AddressSpace.txt - This is the whole address space from 0000 to FFFF (engine off).
320896 04-27-07 15:32 disassembled-code.txt - This is a disassembly of the program code from 9000 to FEB5.
6240 04-27-07 14:43 RAM-data.txt - This is the RAM data from 1000 to 14FF (engine idling).
19968 04-27-07 14:43 ROM-data.txt - This is the ROM data from 8000 to 8FFF.
-------- -------
678880 4 files


I'm putting together some info on how to do this and will post it later today.

Phil.
Attached Files
File Type: zip ECU3.zip (184.8 KB, 1790 views)
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II

Last edited by b3lha; 04-27-2007 at 08:35 AM.
Reply With Quote
  #5  
Old 04-27-2007, 07:52 AM
Hocrest's Avatar
Hocrest Hocrest is offline
Freezepop's are Awesome!!!!
Subaru Silver Contributor
 
Join Date: Oct 2003
Location: Pittston, PA
Posts: 5,334
Send a message via AIM to Hocrest
OK, now the real question???

Does subavanagon + Your Memory Dump Info + This and a few things =

__________________
Dave
- 03 Baja - 92 SVX - 86 Brat - 08 OB 3.0
Reply With Quote
  #6  
Old 04-27-2007, 12:22 PM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Quote:
Originally Posted by Hocrest
OK, now the real question???

Does subavanagon + Your Memory Dump Info + This and a few things =
YES
(once the correct parameter addresses are found)

Please check my website for further details. I have created a HOWTO for building the interface and posted the results of my investigations so far.
http://www.alcyone.org.uk/ssm
I have also written some open-source software to download data from the ECU.

I am making three of these interfaces with the intention of selling two of them. Currently two are complete, tested and working. The third one is almost complete, just waiting on a part that was out of stock at the supplier.
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II

Last edited by b3lha; 04-27-2007 at 12:28 PM.
Reply With Quote
  #7  
Old 04-28-2007, 06:29 AM
cdvs cdvs is offline
Registered User
 
Join Date: Mar 2007
Location: Oakham, MA
Posts: 197
Quote:
Originally Posted by Hocrest
By 'a few things' you mean a dropping resistor, voltage divider or other voltage converter to reduce the vehicle's 12V+ to 5V+ for the RS232/TTL converter linked to above or similar premade device?

This seems a quicker and less complicated method to get to the same place as building the interface from scratch.

We could then connect with the audio plug described as follows:

pin 2 (orange/white) transmit (rs232/ttl)
pin 3 (blue/white) receive (rs232/ttl)
pin 5 (red/black) to +12V in (choice of above) to +5v out (rs232/ttl)
pin 9 (green/black) ground (rs232/ttl)

Good show!
Reply With Quote
  #8  
Old 08-21-2007, 12:23 PM
TomsSVX's Avatar
TomsSVX TomsSVX is offline
Maniac modifier
 
Join Date: Dec 2003
Location: Branchburg, New Jersey
Posts: 15,489
Registered SVX Classic SVX
The only thing wrong with the maps you are showing is the fuel map. It seems at low load, the engine management would want to keep consistant fuel related to higher rpms... To reword that, the map should be flat in low load as rpms increase... Thats what I have seen thus far... make reference to this post ECU Tune's measurements

Tom
Reply With Quote
  #9  
Old 08-21-2007, 01:56 PM
Calum Calum is offline
Registered User
 
Join Date: Aug 2007
Location: Lubbock, TX, USA
Posts: 43
Hello from Nissan land

Hi,

Just by random luck and insomnia I wandered across this thread. I don't own an SVX or even a Subaru, but do happen to do quite a bit of work with early 90s Nissan ECUs (I make a product called the 'Realtime' daughterboard, it does memory emulation that allows seamless changes to the rom while the car is running, and also bundles the Nissan CONSULT -somewhat like the Subaru diagnostic stuff- over a single USB connection, fun stuff). Anywho, it looks like the ecus have quite a few similarities on the hardware level (they're based on 77xx mcus too), and I thought this might help you guys out. If this is just duplicate stuff you already know, nevermind me.

First off, the 7791 looks pretty much identical to the 7790. I'm judging that by the matching interrupt vector tables. I bet they're pretty much the same processor, maybe a different package? If you look in this directory:

http://www.calumsult.com/calumsu/disassembler/

Under docs I've posted the short datasheet for the 7790. Also posted is a longer datasheet for a 7700 that is useful for reference. The newer 77xx chips had different peripherals (the ADC changed, etc) than the older ones, and the 7700 is in the same era as the 7790 so its peripheral documentation is useful. It has a different combination of peripherals than the 7790 though (no biggie). Combine its datasheet with the short 7790 datasheet and you've got a pretty decent 7790 datasheet.

Also listed is the software manual, but without the stupid 'EOL' splashed in the middle of every page.

Anywho, how we've got a different disassemble put together than what your using. Rather than just starting blindly at 8000, ours walks Kaele's dasm77 through the bin, using the interrupt vector table as the starting points. As it disassembles it keeps track of the M and X flag, and sets them correctly. This is a bit more complicated than it sounds, because its doing this for every single branch, and they tend to get quite nested. It takes the disassembler a while to fully run, but the end result is I think a bit more readable. I went ahead and put together a version for the SVX bin that b3lha had posted, check out the SVX directory. The disassembler will also autocomment known memory variables, and you can add to the list in a file called memory.txt. I put the locations b3lha had listed in when I ran the disassembler. The big txt file in the SVX folder is the result.

I went ahead and posted the SVX version of the disassembler exe and source code (its in C++, and compiles under the free MS Visual C++ 2005 Express compiler). Its a console app, and you need to have it in the same directory as DASM77. Also, I didn't compile it for use on machines that don't have C++ Express installed (I'll do that later), sorry!

If you want to add to your current disassembler the code above has the memory locations for the peripherals, and correct order and contents of the interrupt vector table.

Btw, on your interface problem, I'd guess that the ecu RX signal isn't exactly CMOS compatible (i.e. truly 0-5V logic). The Nissan CONSULT had a similar issue. A quick look with a 'scope would verify this (want to ship me an ecu and wiring harness, lol?). Just stick a comparator in front of the max232. I'd be happy to whip out a schematic if you need help. Also, if your wanting to use that for real datalogging I'd look into speeding up the transmission speed, the Subaru speed is just slow. Nissan has CONSULT set to 9600 baud and thats just barely fast enough for datalogging. Changing the UART speed on the 77xx is a bit of a pain in the butt, its a bit more than just changing the code, stupid old processor.

Last edited by Calum; 08-21-2007 at 01:59 PM.
Reply With Quote
  #10  
Old 08-22-2007, 02:46 AM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Quote:
Originally Posted by Calum
Hi,

Just by random luck and insomnia I wandered across this thread. I don't own an SVX or even a Subaru, but do happen to do quite a bit of work with early 90s Nissan ECUs (I make a product called the 'Realtime' daughterboard, it does memory emulation that allows seamless changes to the rom while the car is running, and also bundles the Nissan CONSULT -somewhat like the Subaru diagnostic stuff- over a single USB connection, fun stuff). Anywho, it looks like the ecus have quite a few similarities on the hardware level (they're based on 77xx mcus too), and I thought this might help you guys out. If this is just duplicate stuff you already know, nevermind me.
Welcome. Thanks for helping out.
Quote:
Originally Posted by Calum
First off, the 7791 looks pretty much identical to the 7790. I'm judging that by the matching interrupt vector tables. I bet they're pretty much the same processor, maybe a different package? If you look in this directory:

http://www.calumsult.com/calumsu/disassembler/

Under docs I've posted the short datasheet for the 7790. Also posted is a longer datasheet for a 7700 that is useful for reference. The newer 77xx chips had different peripherals (the ADC changed, etc) than the older ones, and the 7700 is in the same era as the 7790 so its peripheral documentation is useful. It has a different combination of peripherals than the 7790 though (no biggie). Combine its datasheet with the short 7790 datasheet and you've got a pretty decent 7790 datasheet.

Also listed is the software manual, but without the stupid 'EOL' splashed in the middle of every page.

Anywho, how we've got a different disassemble put together than what your using. Rather than just starting blindly at 8000, ours walks Kaele's dasm77 through the bin, using the interrupt vector table as the starting points. As it disassembles it keeps track of the M and X flag, and sets them correctly. This is a bit more complicated than it sounds, because its doing this for every single branch, and they tend to get quite nested. It takes the disassembler a while to fully run, but the end result is I think a bit more readable. I went ahead and put together a version for the SVX bin that b3lha had posted, check out the SVX directory. The disassembler will also autocomment known memory variables, and you can add to the list in a file called memory.txt. I put the locations b3lha had listed in when I ran the disassembler. The big txt file in the SVX folder is the result.

I went ahead and posted the SVX version of the disassembler exe and source code (its in C++, and compiles under the free MS Visual C++ 2005 Express compiler). Its a console app, and you need to have it in the same directory as DASM77. Also, I didn't compile it for use on machines that don't have C++ Express installed (I'll do that later), sorry!

If you want to add to your current disassembler the code above has the memory locations for the peripherals, and correct order and contents of the interrupt vector table.
Thanks! I just downloaded it all from your site. The disassembly I posted at the start of this thread is rubbish. After that I wrote a program to call the MAME disassembler and keep track of the M flag at each branch instruction. I've had a look at your disassembly and the end result seems to be the same as the one on my website, except for differences in notation. The auto-commenting is a great idea and also, your disassembler is automatically skipping dead code and inline data where I have to do that manually.
I am undecided whether to use your disassembler or update mine with your ideas. At present I'm using a linux box which rules out MS C++.
Quote:
Originally Posted by Calum
Btw, on your interface problem, I'd guess that the ecu RX signal isn't exactly CMOS compatible (i.e. truly 0-5V logic). The Nissan CONSULT had a similar issue. A quick look with a 'scope would verify this (want to ship me an ecu and wiring harness, lol?). Just stick a comparator in front of the max232. I'd be happy to whip out a schematic if you need help.
If this is a proven working solution on the Nissan then it's certainly worth a try. You sure came along at the right time.
I've had a look at some comparator datasheets (LM339 & LM311) but I can't figure out how to add them to our circuit. If you have a schematic it would help immensely.
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II
Reply With Quote
  #11  
Old 08-21-2007, 05:07 PM
b3lha's Avatar
b3lha b3lha is offline
Phil & Belha
 
Join Date: Aug 2001
Location: Alcyone Limited, Buckinghamshire UK
Posts: 2,671
Quote:
Originally Posted by TomsSVX
The only thing wrong with the maps you are showing is the fuel map. It seems at low load, the engine management would want to keep consistant fuel related to higher rpms... To reword that, the map should be flat in low load as rpms increase... Thats what I have seen thus far... make reference to this post ECU Tune's measurements

Tom
Thanks Tom. That's reassuring.

The shape of the graph comes from the data in the table. It's the scales and units that I'm not 100% sure of. Thanks for posting the ECUtune graphs, I'd been looking for them, but couldn't find them. I'm happy that they look fairly similar to mine.

I understand what you are saying about the map should be flat in low load as rpms increase. I'll check the code again and make sure I haven't got the scale backwards.

There are some other tables in the memory that probably have an effect on things. I don't understand what they do yet.
__________________
Subaru ECU and TCU Website
1992 Alcyone SVX Version L
1992 Alcyone SVX Version L
1994 Alcyone SVX S40-II
2004 Subaru Legacy 2.5 SE Sports Tourer
1996 Subaru Legacy 2.2 GX Wagon
1988 Subaru Justy J12 SL-II
Reply With Quote
  #12  
Old 10-22-2007, 11:14 AM
Tobi Tobi is offline
Registered User
 
Join Date: Oct 2007
Location: Germany
Posts: 15
Send a message via ICQ to Tobi
So I am back with some news.

I sent the hexcode and my ecu answer with this.
TX>78123400<TX
0042000000

I am sure that the code came from the ecu because when i unplugged
the Select-Monitor-Connector then i got nothing back.

Is my ECU a special one?

I can change this settings for the Converter.
http://img141.imageshack.us/img141/7...ngscom3uk3.jpg

Are the parameters correct?
This parameters are the defaults.
I test some values but without a success.

Last edited by Tobi; 10-22-2007 at 11:21 AM.
Reply With Quote
  #13  
Old 10-22-2007, 12:24 PM
Tobi Tobi is offline
Registered User
 
Join Date: Oct 2007
Location: Germany
Posts: 15
Send a message via ICQ to Tobi
YES it works

This is the correct wiring:

GND(black)(USB-cable) to GND (green/black)(SSM-connector)
TXD(orange)(USB-cable) to RXD (blue/white)(SSM-connector)
RXD(yellow)(USB-cable) to TXD (orange/white)(SSM-connector)

Green Light for this Adapter
http://apple.clickandbuild.com/cnb/s...dCategoryID=47

Thx 4 help @all
Reply With Quote
  #14  
Old 10-22-2007, 11:17 PM
Nomake Wan's Avatar
Nomake Wan Nomake Wan is offline
Retired
 
Join Date: Jan 2007
Location: Orange, CA
Posts: 1,031
Send a message via AIM to Nomake Wan Send a message via MSN to Nomake Wan Send a message via Yahoo to Nomake Wan Send a message via Skype™ to Nomake Wan
Hahaha, the transmit/receive wiring was just backwards? I love simple fixes.

I'll have to check out that adapter, it looks really promising.
Reply With Quote
  #15  
Old 10-23-2007, 02:49 AM
Tobi Tobi is offline
Registered User
 
Join Date: Oct 2007
Location: Germany
Posts: 15
Send a message via ICQ to Tobi
Yes that was the problem

The Adapter is absolutely advisable.
If you know the wiring you can build it in few minutes.
In the next days i will check the adapter thoroughly.

Tobi
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off

Forum Jump


All times are GMT -6. The time now is 01:32 PM.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2024, vBulletin Solutions, Inc.
© 2001-2015 SVX World Network
(208)-906-1122