10/11/2021 13:42 Edc15 multimap - ECU Connections

 Quick links  FAQ  Rules  Notifications  Private messages KyProg 

 Board index ‹ General Tuning Assistance - Cars, Motorcycles, Trucks ‹ Reverse Engineering 

Do not write thank you posts, use the button.

NO CRACKED SOFTWARE OR CLONE TALK IS ALLOWED!

Edc15 multimap

 Search this topic…   227 posts

1
2
3
4
5
…
10



nihalot
Newbie

Edc15 multimap

Wed May 31, 2017 6:41 pm

my post, copy pasted from nefmoto

Hope this helps anyone, although there doesnt seem to be much interest in this ECU...

Follow my other post and disable the checksums first.

1st step is to find how the CANBUS is handled. There is a buffer in RAM in which the messages are stored before they
are transmitted.

On edc15, finding the buffer is easy. Example: Search for sequence of bytes: 0x280 or 0x288 or any other CAN id used
by the ecu...

This will point you to the code which handles canbus:

CODE: SELECT ALL

ROM:00094156                 mov     r5, #280h

ROM:0009415A                 mov     CAN_280, r5               ;CAN_280- RAM buffer handling id -0

ROM:0009415E                 movb    rl4, #8

ROM:00094160                 movb    byte_C743, rl4

ROM:00094164                 mov     r4, #288h

ROM:00094168                 mov     CAN_288, r4

ROM:0009416C                 movb    rl4, #8

ROM:0009416E                 movb    byte_C74F, rl4

ROM:00094172                 mov     r4, #380h

ROM:00094176                 mov     CAN_380, r4

ROM:0009417A                 movb    rl4, #8

ROM:0009417C                 movb    byte_C75B, rl4

ROM:00094180                 mov     r4, #480h

Now that you've found the CAN buffer, refer to the FR CAN section.

Below, Ive shown the CANBUS buffer handling id 0x280 in my file.

CODE: SELECT ALL

MEM_EXT:0000C744 CAN_280:        ds 2                    ; DATA XREF: ROM:0009415Aw

MEM_EXT:0000C746 byte_C746:      ds 1                    ; DATA XREF: ROM:000945DCw

MEM_EXT:0000C746                                         ; ROM:0009463Ew ...

MEM_EXT:0000C747 byte_C747:      ds 1                    ; DATA XREF: ROM:0009468Aw

MEM_EXT:0000C747                                         ; ROM:0009475Ew

MEM_EXT:0000C748 can_nmot_low:   ds 1                    ; DATA XREF: ROM:0009468Ew

MEM_EXT:0000C748                                         ; ROM:00094788w

MEM_EXT:0000C749 can_nmot_high:  ds 1                    ; DATA XREF: ROM:00094692w

MEM_EXT:0000C749                                         ; ROM:00094790w

https://www.ecuconnections.com/forum/viewtopic.php?f=211&t=51373 1/11
10/11/2021 13:42 Edc15 multimap - ECU Connections
MEM_EXT:0000C74A byte_C74A:      ds 1                    ; DATA XREF: ROM:00094696w

MEM_EXT:0000C74A                                         ; ROM:00094814w ...

MEM_EXT:0000C74B byte_C74B:      ds 1                    ; DATA XREF: ROM:loc_948A0w

MEM_EXT:0000C74B                                         ; ROM:000948CAw

To use the rpm gauge for showing the present map(or any other parameter like boost, SOI,etc), you'll have to modify
the subroutine writing to bytes 3 and 4 of the CAN id 0x280.

CODE: SELECT ALL

ROM:00094780                 calls   9, sub_94002

ROM:00094784                 add     r0, #4

ROM:00094786                 mov     r9, r4

ROM:00094788                 movb    can_nmot_low, rl4

ROM:0009478C                 mov     r4, r9

ROM:0009478E                 ashr    r4, #8

ROM:00094790                 movb    can_nmot_high, rl4

ROM:00094794                 mov     r1, word_C420

ROM:00094798                 add     r1, word_C426

ROM:0009479C                 cmp     r1, word_F962

ROM:000947A0                 jmpr    cc_SGE, loc_947A6

ROM:000947A2                 mov     r9, r1

ROM:000947A4                 jmpr    cc_UC, loc_947AA

r4 contains the actual RPM. We will modify this vaue to whatever we want; to show the map selected in our case.

I inserted my call at 94784, to my routine. Its upto you to decide where to insert this call, but make sure you dont
change the original logic.

Next step is to take inputs like clutch, brake or cruise control.

This can also be inferenced from the CAN buffer.

example: id 0x280, byte 0, bit 4 is B_kuppl(clutch pedal).

Find the code which writes to this bit, and you will find B_kuppl

CODE: SELECT ALL

ROM:00094EBC                 movb    rl4, word_C49A+1

ROM:00094EC0                 jmpr    cc_NZ, loc_94ED0

ROM:00094EC2                 mov     r4, word_14D6

ROM:00094EC6                 movb    rl5, [r4]

ROM:00094EC8                 jmpr    cc_NZ, loc_94ED0

ROM:00094ECA                 movb    rl4, #8

ROM:00094ECC                 orb     byte_C746, rl4

As seen in above code, 0xC94B contains the status of the clutch pedal. But this is not the global variable. I suppose,
this is a temporary RAM address to which the clutch switch status is copied when this subroutine starts(so that as long
as the subroutine is still being executed, any change in the clutch status will not be updated. Otherwise, it's possible
that at the start of the subroutine the status of the clutch is different from that when the subroutine ends, resulting in
unpredictable behaviour)

Find the global variable by searching for xrefs to 0xc94b

CODE: SELECT ALL

ROM:0009433E                 movb    rl2, byte_C370

ROM:00094342                 movb    word_C49A+1, rl2

0xc370 is the global variable for B_kuppl.

Repeat this for other variables you want to use(cruise control status is on id 0x388/0x38A and brake pedals on 0x288)

Now, for mapswitching, you need to change the DPP's

Each datablock is referred using DPP0, DPP1 and DPP2. DPP3 is used for CAN.

datablock 1:

DPP0- 0x34

https://www.ecuconnections.com/forum/viewtopic.php?f=211&t=51373 2/11
10/11/2021 13:42 Edc15 multimap - ECU Connections

DPP1- 0x35

DPP2- 0x36

datablock 2:

DPP0- 0x38

DPP1- 0x39

DPP2- 0x3A

datablock 3:

DPP0- 0x3C

DPP1- 0x3D

DPP2- 0x3E

This is the code I use for switching between maps and displaying boost on RPM gauge.

CODE: SELECT ALL

$MOD167                                 ; Define C167 mode

$SEGMENTED ; Segemented memory mode

$CASE ; Symbols case sensitive

$include (reg167.inc)

NAME MINIMON

ASSUME DPP3:system

StackData0 SECTION DATA SYSSTACK ; Data Section to reserve

; Stack-Memory  

DSB 20H ; 32 Byte

StackData0 ENDS ; End of Dummy-Section

DriverCode0 SECTION CODE PUBLIC 'CDRIVER'

DriverProc PROC FAR

I suggest writing your own code, as mine can be a bit difficult to follow

Basically, my code does this:

- check if clutch is pressed, if yes then continue.

- check if cruice control cancel button is pressed. If yes, store 1 in a free ram byte ( lots of free ram in this ECU,
0xC820-0xC82F is free on all the edc15's I've worked on, enough for our small subroutine) and exit the subroutine

This is done to "debounce" the button press (as long as the button is pressed, no change will take place)

- check if the "debounce" ram byte is 1, if yes, set it to 0 and switch maps( by changing the DPP's)

- To display the map selected understand how the rpm is displayed on the instrument cluster.

Lets say you want the rpm needle to show 2000rpm. There is a factor of 4.

So the transmitted CAN message for rpm is 2000*4= 8000 which corresponds to 0x1F40 in hex

All we need to do is replace the value in r4 with the value you want to display.

- Setup a counter for displaying the selected map. This is necessary because replacing r4 with the desired value once is
not enough. The main loop takes around 40ms to execute. So after 40ms r4 will get overwritten by RPM and the needle
will not show the value you wanted it to show. Look at my code for a better understanding...

Compile using Uvision or a compiler of your choice. Load the output hex file into Winols, search where your code
begins, and copy it to a free space in your flash.

Then insert a call to your new function. I chose to insert my call at 0x94784(0x14784 in WinOLS)

Free space in my file - 0x1A000 which translates to 0x9A000

Hence, opcode for call: DA 09 00 A0

I will be posting a part 2 showing how you can save the selected datablock over ignition cycles.

www.tangentmotorsport.com

multimap/LC/rolling antilag for MED17/EDC17/MED9/EDC15

contact for reverse engineering services of any ECU/TCU

https://www.ecuconnections.com/forum/viewtopic.php?f=211&t=51373 3/11