And away we go....
Thanks festy

Ok with some help from europe... Heres where its at The bin code from 0000h to 2000h is really 8000h to 10000h. The missing 2k is in a seperate location probibly on the daugter board over the MCU and RAM chips. Using the ROM image from a M1.3 the EPROM code dissassembles in one run with IDA. There a...

Got a question...
Playing about with function commands on the ecu's and data bus wondering if you could send me any command strings you found???

That's pretty much where I'm at now. IDA likes a program start from X2000h if I run a procedure decode from x20e0h it decodes most of the program leaving the calibration area as uncoded. The first lcall after x2000h is to x8000h changed it to x0000h and it decodes :-). There's still some wired stuff...

Okey good progress finally...
Any suggestions on why the main subroutines start at the x2000h address?????
It appears that the generic bosch code lives in the first 8k and then the manufacturers code?

Well said

To all a merry Christmas and a safe and happy new year.
Hopefully Santa will bring what's wanted.

DieselBob

Thanks for the help just went through the 7000h and looked for the MAPS got a good result now to reverse it out..
alot happier...

just had a hunt for the iram shift to the acc. Its not finding a reference but there is another function.
7a61 has the First Map Table Index Entry Address.
7ae5 for the injector constant (Guessing here).

So the advice to take 8000h from any address above 8000h looks to be good. :) I saw the routines in the 7000 region so many with different layouts got a bit much, tried a couple must have been other functions dont remember trying the specific ones in the area you pointed out, still working with the ...

Ok heres a couple of annoying examples :D Code for Address X001e mov 0c3h,a ; 0014 f5 c3 uC nop ; 0016 00 . clr 0c0h.3 ; 0017 c2 c3 BC clr 2ch.3 ; 0019 c2 63 Bc mov a,rb3r1 ; 001b e5 11 e. mov 7ah,a ; 001d f5 7a uz cjne a,#1,X0032 ; 001f b4 01 10 4.. push dph ; 0022 c0 83 @. push dpl ; 0024 c0 82 @....