Hacking the DataStream

[EagleMark]

Yes that's the bin hac. what I showed above is the ALDL the way it is recived and I have never done this. We need Rober Saar!!! Here is what TunerPro says about 2 bytes MSB LSB for ADX file.

Packet Offset (H | D) - This is the zero-based byte number within the packet that this value is
associated with. The data at this offset is used for the conversion. If the item
is 8 bits (1 byte) in size, it will contain only this byte. If it is 16 bits (2
bytes) in size, it will this byte number plus the byte after (MSB, LSB). To
input data in hexadecimal, use the left side text field. For decimal, use the
right side text field.

Data Source Size - This specifies the number of bits (and bytes) that will be used to
calculate the displayed value. 8 bits equals 1 byte, and 16 (bytes=wrong in directions and should be bits) equals 2 bytes
(MSB, LSB), and 32 bits is 4 bytes (MMSB, MSB, LSB LLSB).

[RobertISaar]

it's too bad all of the $42 hacks start at D000, meaning all of the RAM address are cutoff...

however:

http://www.thirdgen.org/techboard/di...o-winaldl.html

confirm:
0052 is the BPW MSB
0053 is the BPW LSB

so what i would do:

change D4E7(will show as 04E7 in the TP hex editor) to 00 52
change D4E9(04E9) to 00 53

^assuming those aren't reversed anyways

then change a working $42 ADX and outright modify the PROM ID value instead of making a new one. just call it BPW, we'll deal with scaling later if it's correct. don't do any of that LSB first stuff since it's not necessary since we are able to modify the stream. save the BIN so the checksum updates and test.



that's what i would do.

[EagleMark]

Problem is there is no Prom ID in the ADX and I don't know how to set up MSB LSB?

TunerPro directions say:

If the item is 8 bits (1 byte) in size, it will contain only this byte. If it is
16 bits (2 bytes) in size, it will this byte number plus the byte after (MSB,
LSB).

I know how to do 8 bit 1 byte "0x01" but how do you get 2 in that box with below set to 16 bit? If I enter "0x01 0x02" it comes out to 4097 in text box?

[gregs78cam]

it's too bad all of the $42 hacks start at D000, meaning all of the RAM address are cutoff...

however:

http://www.thirdgen.org/techboard/di...o-winaldl.html

confirm:
0052 is the BPW MSB
0053 is the BPW LSB

so what i would do:

change D4E7(will show as 04E7 in the TP hex editor) to 00 52
change D4E9(04E9) to 00 53

^assuming those aren't reversed anyways

then change a working $42 ADX and outright modify the PROM ID value instead of making a new one. just call it BPW, we'll deal with scaling later if it's correct. don't do any of that LSB first stuff since it's not necessary since we are able to modify the stream. save the BIN so the checksum updates and test.



that's what i would do.

From the hac I was looking at...
LSB @ 0052
MSB @ 0053

We are logging the data from one address into an 8bit value, and data from the other to the following 8bit value. Even if these are reversed, isn't it easy to fix in the ADX, just checkmark LSB first? OR does it have to be logged that way?

I have another ADX that shows PromID as Packet 0x01, don't know if it works right though.

[gregs78cam]

Problem is there is no Prom ID in the ADX and I don't know how to set up MSB LSB?


I know how to do 8 bit 1 byte "0x01" but how do you get 2 in that box with below set to 16 bit? If I enter "0x01 0x02" it comes out to 4097 in text box?

From my experience it simply takes the following packet and puts it into a 16bit with the first packet.

[RobertISaar]

this is why i tend to stay away from C3 stuff....

a testbench would be a wonderful tool here, assuming someone had one setup for a 7747.

but i would attempt to put them in the correct order in the BIN and not mess with the ADX unless necessary.

mark, a link to the ADX you're using?

[EagleMark]

My test bench is in the middle or a wire harness build, but I do have a 7747 in my Suburban with AutoProm hooked up in driveway. We got the change in XDF correct as you noted and it checks out in bin in hex, we get data but it is not correct, don't now how to do MSB LSB 16 bit data. The ADX never had a Prom ID.

ADX attached...

[EagleMark]

From my experience it simply takes the following packet and puts it into a 16bit with the first packet.

I am going to try that right now...

[RobertISaar]

from the looks of it, you have the correct settings in the ADX, Mark, so it's all in the BIN now.

[EagleMark]

That did not work with ADX change..

It looks like it's changing 8 9 10 11 in hex and it should be changing 7 8 9 10 . I'm going to try and change the hex and see if it logs as Robert said it looks OK. If it works we will see why we are 1 off with XDF thingy...

[gregs78cam]

That did not work with ADX change..

It looks like it's changing 8 9 10 11 in hex and it should be changing 7 8 9 10 . I'm going to try and change the hex and see if it logs as Robert said it looks OK. If it works we will see why we are 1 off with XDF thingy...

The .bin address is correct. It should be and is changing:
L04E7 00
L04E8 52
L04E9 00
L04EA 53

You could try swapping the 52 and 53, but that should just do the same thing as setting the 'LSB First' checkmark in the ADX.


I found this at the end of the hac I have been using. There are some more references to BPW, so maybe I just picked the wrong address to pull data from. We can try them one at a time, and see what we get.
You can try:
L04E7 L04E8 L04E9 L04EA
$BC $0E $BC $0F
or
$BC $3C $BC $3D

        ; ASDZ ALGO,    12/03/93, WAS
        ;        REV        06/06/95, WAS
        ;        
        ; 127747 ECM
        ;
        ;     OBJECT FILE: AKSM
        ;     DISASSEMBLED FOR THE MC6803
        ;     BY THE CAMS DISASSEMBLER
        ;     12-09-1992
         ;---------------------------------------------
       L0000     EQU     $0000        ; STATUS WD
       L0001     EQU     $0001        ; STATUS WD
       L0002     EQU     $0002        ; STATUS WD
       L0003     EQU     $0003        ; STATUS WD 
                                       ;    b4 = FUEL DECEL C/O
                                    ;
       L0004     EQU     $0004        ; STATUS WD
       L0005     EQU     $0005        ; STATUS WD
       L0006     EQU     $0006        ; STATUS WD
       L0007     EQU     $0007        ; STATUS WD
       L0008     EQU     $0008        ; STATUS WD
       L0009     EQU     $0009        ; STATUS WD
       L000B     EQU     $000B        ; STATUS WD
       L000D     EQU     $000D        ; STATUS WD

       L000E     EQU     $000E      ; MAWF1 (DISPLAY)

       L000F     EQU     $000F        ; STATUS WD

       L0010     EQU     $0010        ; TMR
       L0012     EQU     $0012        ; AFR STATUS WD
       L001C     EQU     $001C      ; RPM/25
       L001F     EQU     $001F        ; RPM/12.5

       L0020     EQU     $0020        ; RPM/12.5
       L0021     EQU     $0021        ; COOLANT
       L0025     EQU     $0025      ; COOLANT, VDC
       
       L0026     EQU     $0026        ; S/D MAP 
       L002B     EQU     $002B        ; TRANSIENT MAP TMR 
       L002E     EQU     $002E        ; MAP
       L002F     EQU     $002F        ; FILT MAP

       L0031     EQU     $0031        ; VACUUM
       L0032     EQU     $0032        ; DIFF MAP    
       L0034     EQU     $0034      ; MPH/1
       L0036     EQU     $0036        ; MPH VAL
       
       L003E     EQU     $003E      ; o2 VDC, (A/D)
       L003F     EQU     $003F        ; FILT o2 VAL
       
       L0043     EQU     $0043        ; ASYNC INJ VAL    

       L0048     EQU     $0048      ; TPS, VDC
       L0049     EQU     $0049        ; TPS
       L004A     EQU     $004A
       L004B     EQU     $004B        ; ACCEL ENRICH  FILTERED TPS
       L004C     EQU     $004C
       L004D     EQU     $004D        ; FILTERED TPS
       L004F     EQU     $004F        ; MIN TPS VAL
       L0050     EQU     $0050        ; TPS ERR TMR
       L0051     EQU     $0051
       
       L0052     EQU     $0052        ; BPW, MSB
       L0053     EQU     $0053        ; BPW, LSB
       
       L0054     EQU     $0054        ; COLD OP'S o2
       L0055     EQU     $0055        ; o2 SENSOR VOLTAGE BIAS
       L0056     EQU     $0056        ; Slow o2 ERROR
       L0057     EQU     $0057        ; ASYNC INJ MULT
       L0058     EQU     $0058        ; PORP DURATION, SEC'S
       L0070     EQU     $0070        ; STATUS WD
       L007F     EQU     $007F        ; AIR FLOW FOR EGR

       L0096     EQU     $0096        ; BPW,  ASYN
       L0098     EQU     $0098
       L0099     EQU     $0099        ; PUMP SHOT LK UP
       L009A     EQU     $009A
       L009B     EQU     $009B        ; TRANS FUEL CALC INTERVEL TMR
       L009C     EQU     $009C        ;
       L009D     EQU     $009D
       L009E     EQU     $009E        ; DECEL FUEL MULT
       L009F     EQU     $009F        ; BETWEEN DECEL FUEL C/0 TIMER
       L00A0     EQU     $00A0        ; POST DECEL C/O TMR
       L00A1     EQU     $00A1        ; DECEL FUEL C/O TMR
       L00A2     EQU     $00A2        ; BLM
       L00A3     EQU     $00A3      ; BLM, BIN
       L00A4     EQU     $00A4      ; INTIGRATOR, BIN
       L00A5     EQU     $00A5        ; OPN LP AFR
       L00A6     EQU     $00A6
       L00A7     EQU     $00A7        ; EGR CORRECTION
       L00A9     EQU     $00A9        ; VE LK UP RESULT
       
       L00AA     EQU     $00AA
       
       L00AB     EQU     $00AB        ; TEMP BPW, (SYNC)
       L00AD     EQU     $00AD        ; TEMP BPW,  (ASYNC)
       
       L00AF     EQU     $00AF        ; INTEGRATOR DELAY TMR
       L00B0     EQU     $00B0        ; INTEGRATOR DELAY
       L00B1     EQU     $00B1
       L00B2     EQU     $00B2
       L00B4     EQU     $00B4        ; IDLE AFR TMR
       L00B5     EQU     $00B5        ; AFR
       L00B6     EQU     $00B6        ; AFR
       L00B8     EQU     $00B8        ; BLK LEARN TMR
       L00B9     EQU     $00B9        ; INTEGRATOR DELAY TMR 
       L00BA     EQU     $00BA      ; ALDL CTR
       L00BB     EQU     $00BB        ; PE ON DELAY TMR
       L00BC     EQU     $00BC        ; PORP  FACTORED AIR FLOW
       L00BD     EQU     $00BD        ; OLD  FILT o2 VAL
       L00BE     EQU     $00BE        ; AIR FLOW, (gms/sec)
       L00BF     EQU     $00BF        ; PORP DURATION TMR    
       L00DE     EQU     $00DE        ; STATUS WD
       L00DF     EQU     $00DF
       L00E3     EQU     $00E3        ; START UP COOL
       L00E5     EQU     $00E5        ; AFR


       L0457     EQU     $0457        ; FOR HEADS UP USE
       L0458     EQU     $0458        ; FOR HEADS UP USE
       

       L5800     EQU     $5800        ; HEADS UP


       LBC00     EQU     $BC00        ; DRP COUNT

       LBC0E     EQU     $BC0E        ; SYNC  BPW    PWM
       LBC14     EQU     $BC14        ; ASYNC BPW PWM

       LBC3C     EQU     $BC3C        ; PWM



       LE008     EQU     $E008        ; CPU HOOK
       LE531     EQU     $E531
 
       LFA59     EQU     $FA59        ; FIRMWARE
       LFB12     EQU     $FB12        ; LAG FILTER ROUTINE
       LFB36     EQU     $FB36        ; 2d LK UP
       LFB40     EQU     $FB40        ; 2D LK UP W/LINE CNT IN HDR
       LFB45     EQU     $FB45        ; 2d LK UP
       LFB49     EQU     $FB49        ; 2d look up routine
       LFB67     EQU     $FB67        ; 3D LU ?
       LFB92     EQU     $FB92
       LFBB9     EQU     $FBB9
       LFBCE     EQU     $FBCE
       LFBDB     EQU     $FBDB        ; READ A/D
       LFCD8     EQU     $FCD8
       LFD18     EQU     $FD18

       LFD39     EQU     $FD39

       LFDBD     EQU     $FDBD
       LFDCB     EQU     $FDCB
       LFDDA     EQU     $FDDA
       LFF66     EQU     $FF66
       LFF80     EQU     $FF80
       LFFFF     EQU     $FFFF

[EagleMark]

I think we got the right ones and it's working. But I think the conversion is wrong. Numbers go up with load and down on decel. But there no where near %

[RobertISaar]

I think we got the right ones and it's working. But I think the conversion is wrong. Numbers go up with load and down on decel. But there no where near %

for now, it's just BPW, but it sounds like it's working.

if the BPW is correct, then a injector DC value can be created.

[EagleMark]

if the BPW is correct, then a injector DC value can be created.

Is that the conversion? It does go up with load, down with decel and is steady with other data. But I thought in the end it was a value of up to 100%?

Anyway sweet job Greg! Thanks for the help Robert! I learned a lot tonight and because of you guys think I could do this again for Spark and Hiway AFR I wanted to add. At least Greg can get his first post write up correct!
We all learned from you guys!

[gregs78cam]

No problem, It should be reading in milliseconds. Idle should be around .5-.75 millisconds, and WOT should be somewhere around 3-4ms or maybe as high as 5-6ms depending on RPM.

So it is actually working properly? Or does the data still jump around?