Club3G Forums - View Single Post

2kgteclass · 08/29/2007, 02:56 PM

The rom being studied is the one posted by kobalt82 on logicgates ecuflash thread in this forum.

Finally we can read our H8 roms. Unfortunately now we are faced with the enormous task of dissassembling and enterpreting the machine code. This is unfortunately the only way to know for sure that we are editing the right data, or even to know that we are actually editing data and not machine code instructions.

I have the disassembler for the H8, the file name is dasmh85.exe and it can be downloaded from many web sites online, just search for the filename on google if you are interested in seeing what machine code looks like. The problem with this is that the disassembler is a console app that outputs the machine code ten lines at a time and there may be millions of lines of code. I have attempted to use a few console logging apps to make it easier to condense into one stream of instructions which would be much easier to read, but at the moment I am trying to do it by copy and pasting it out of the console window about 300 lines at a time. This could take a week or two to complete, if anyone knows of an easier way, let me know.

Some things I have noticed so far from looking at the hex file in a hex editor-

The fuel maps(offsets 000017a3-00001856,0000185f-00001915)seem to be coded as words just like in the sh7 series roms{deleted erronious information here, that was the sh7 4cyl that i was looking at which only had 140 elements on the map,v6 has 180 on sh7 also}. Further disection of the actual code will lead to the axis labels which will tell us if the h8s maps support boost

The timing maps(offsets 00001c25-00001d09,00001d11,1df4) also seem to be coded as words just like the sh7

The open loop load maps are at offsets 0000193c and 0000194c

The accelleration enrichment map is at 00001ac6

injector latency map
00001a2e

MAF scaling
00001704

MAF Smoothing
0000171e

MAF Size
0000080c

MAF Filtering
00000808

Min Temp For Closed Loop
00000888

RPM Limit
0000156a

As I said, I will be working on this for a while as im sure will other people, nothing will happen overnight, but eventually the h8 will be flashable just like the others.

I am actually noticing that the same data is used for most of these and they are stored using the same data types.

08/29/2007, 02:56 PM	#1 (permalink)
2kgteclass mumbles the madman Join Date: Mar 2007 Location: RHODE ISLAND Vehicle: 2000 Eclipse GT Posts: 229	H8 ECU Definition Information Thread The rom being studied is the one posted by kobalt82 on logicgates ecuflash thread in this forum. Finally we can read our H8 roms. Unfortunately now we are faced with the enormous task of dissassembling and enterpreting the machine code. This is unfortunately the only way to know for sure that we are editing the right data, or even to know that we are actually editing data and not machine code instructions. I have the disassembler for the H8, the file name is dasmh85.exe and it can be downloaded from many web sites online, just search for the filename on google if you are interested in seeing what machine code looks like. The problem with this is that the disassembler is a console app that outputs the machine code ten lines at a time and there may be millions of lines of code. I have attempted to use a few console logging apps to make it easier to condense into one stream of instructions which would be much easier to read, but at the moment I am trying to do it by copy and pasting it out of the console window about 300 lines at a time. This could take a week or two to complete, if anyone knows of an easier way, let me know. Some things I have noticed so far from looking at the hex file in a hex editor- The fuel maps(offsets 000017a3-00001856,0000185f-00001915)seem to be coded as words just like in the sh7 series roms{deleted erronious information here, that was the sh7 4cyl that i was looking at which only had 140 elements on the map,v6 has 180 on sh7 also}. Further disection of the actual code will lead to the axis labels which will tell us if the h8s maps support boost The timing maps(offsets 00001c25-00001d09,00001d11,1df4) also seem to be coded as words just like the sh7 The open loop load maps are at offsets 0000193c and 0000194c The accelleration enrichment map is at 00001ac6 injector latency map 00001a2e MAF scaling 00001704 MAF Smoothing 0000171e MAF Size 0000080c MAF Filtering 00000808 Min Temp For Closed Loop 00000888 RPM Limit 0000156a As I said, I will be working on this for a while as im sure will other people, nothing will happen overnight, but eventually the h8 will be flashable just like the others. I am actually noticing that the same data is used for most of these and they are stored using the same data types. Last edited by 2kgteclass; 08/29/2007 at 05:49 PM.