RPM change.

[Denny]

Thanks for the help hjtrbo. MPC001 has helped me a few times, on 2 sites. His posts are well written. Thanks again MPC001.

I have installed Gihdra and Gihdra assist. I have created a new project uploaded my bin and a XDF of that bin created with Universal Patcher. Now I have no clue where to start.

How do I set up the r2 & r13 registers??? Thanks for helping.

[Denny]

I got this from AI.

In Ghidra, to set or modify the values of registers like R2 and R13 during analysis, you typically work within the "Registers" window or use scripting to manipulate register states. Here's how you can do it:

### Manual Method (Using the Registers Window)
1. **Open the Registers Window:**
- During a debugging session, go to **Debug** → **Registers**.
- If you're not debugging, this window may not be available. You need to be in a debugging context.

2. **Locate R2 and R13:**
- In the Registers window, find the registers named `R2` and `R13` (or their equivalents depending on the architecture, e.g., ARM).

3. **Set Values:**
- Double-click on the value field next to each register.
- Enter the desired value (in hex or decimal).
- Press Enter to set the register.

### Programmatic Method (Using Ghidra Scripts)
If you want to set registers programmatically, you can write a Ghidra script in Python (Jython) or Java. Here's an example in Python:

```python
#@author
#@category Debugging
#@command Set R2 and R13 registers

from ghidra.util import Msg

# Access the current program and state
currentProgram = state.getCurrentProgram()
listing = currentProgram.getListing()
registers = currentProgram.getRegisterSpace()

# Access the current thread's register context
context = currentProgram.getProgramContext()

# Set R2 and R13 to desired values
# Replace with your desired values
value_for_r2 = 0x1234
value_for_r13 = 0xABCD

# Obtain register objects
r2_reg = currentProgram.getRegister("R2")
r13_reg = currentProgram.getRegister("R13")

# Write values to registers
context.setRegister(r2_reg, value_for_r2)
context.setRegister(r13_reg, value_for_r13)

Msg.info("Registers set", f"R2 = {hex(value_for_r2)}, R13 = {hex(value_for_r13)}")
```

**Note:** This script needs to be run during a debugging session with a valid context.

---

### Important:
- The exact register names (`R2`, `R13`) depend on the architecture (e.g., ARM, x86). Make sure to use the correct register names.
- If you're working with a specific architecture, consult the architecture's register naming conventions in Ghidra.

---

**If you need further help with a specific architecture or context, let me know!**

[hjtrbo]

Setting the processor as PowerPC MPC8270 seems to work well enough for poking around looking for tables.

I'm always looking for analytical ways to be educated to determine correct r2 / r13 settings in e38/67 (e.g. someone that knows what they're doing viewtopic.php?t=8976), but I usually search program text for 'r2,' and look for the results with oris r2, xyz & oris r13, xyz. Note the comma in the search box, it significantly reduces the search hits.

5.png

Add a chunk of ram using the memory manager. I usually add a big block from somewhere in the 0x2xxxxx range up to 0x400000. I do a program text search for =>DAT_002 and copy the results to excel. Then sort by address and see which is the lowest accessed. That's the address where I start my memory block from.

6.png

Using commercial tuning software with your OS makes life much easier, you can search for the values and start diving down the rabbit hole depending on number of search hits.

Here is your cut off rpm and resume rpm 6100rpm, 6020rpm. Easy to find if you know the values before hand. They are scaled 0-8192rpm = 0-65535

1.png

In gear cut-off 6000rpm, 4000rpm in N & P

2.png

Oil temp cut-off 8000rpm

3.png

Engine run time vs coolant temp cut-off 4000-6000rpm

4.png

Once you've got the addresses and table dimensions, create a xdf in TunerPro

[MPC001]

Thanks for your help MPC001. I'm going to stick with what I have. I thought more info would be available. Thanks again.

Don't lose heart Denny. If you have the time to put into it during those frozen Canadian winters, all good.

As hjtrbo notes, you can go the Ghidra route, & looks like you have a good working knowledge of Universal Patcher. If you haven't already got it, EFILive will open & view your E38 & T42 bins. There are 18 rpm based shift parameters in the T42 if rpm & speed are the shift options. 6 each in 1-2,2-3,3-4.

If you have the E38 bin at hand, post it or pm it.

[MPC001]

That's seriously impressive hjtrbo. Kudos. I must read your post a few more times & see if I can pick it up.

Slightly off topic, but if I may ask, did you need engineering approval in your state for the RB in the HJ, or does it drop in pretty well on factory mounts & just need an inspection?

VF2 LSA, gotta be one of the best production cars ever produced on the planet . A mate has one. Awesome to drive.

[hjtrbo]

That's seriously impressive hjtrbo. Kudos. I must read your post a few more times & see if I can pick it up.

Hacking around looking for tables is about my limit. Blows me away the skill level of some of the members on here. Like writing custom patches & bootloaders, just nuts.

Slightly off topic, but if I may ask, did you need engineering approval in your state for the RB in the HJ, or does it drop in pretty well on factory mounts & just need an inspection?

Needed custom engine mounts. The Rod Shop sell RB30 ones which would have worked just fine too. It does need engineering, I've left that as a problem for another day.

[MPC001]

Hacking around looking for tables is about my limit. Blows me away the skill level of some of the members on here. Like writing custom patches & bootloaders, just nuts.

You are right there! OS patches are another planet & bootloaders are into rocket science stuff in terms of talent. Tazzi's bootloader extravaganza being a great example. Some seriously awesome skill levels & experience & effort around to come up with PCM Hammer & Universal Patcher.

[Denny]

Hi guys.
1. I created a project
2. imported my bin
3. chose the language, analyse and added ram2 (r2 & r13 show no match until analysed)
4. searched r2, and r13,
5. followed linked instructions calculating r2 and r13
6. set registry values
**************************************************************
* FUNCTION *
**************************************************************
undefined FUN_0003353c()
assume linkreg = 0x0
assume r13 = 0x3db68
assume r2 = 0x1d0d0
undefined <UNASSIGNED> <RETURN>
FUN_0003353c XREF[1]: FUN_000150e0:000151ec(c)
0003353c 3c 00 00 00 lis r0,0x0
00033540 64 02 00 01 oris r2,r0,0x1
00033544 60 42 d0 d0 ori r2,r2,0xd0d0
00033548 64 0d 00 40 oris r13,r0,0x40
0003354c 61 ad 24 98 ori r13,r13,0x2498

When I search for =>DAT_002, I get no matches. Thanks.

[pman92]

Hi guys.
1. I created a project
2. imported my bin
3. chose the language, analyse and added ram2 (r2 & r13 show no match until analysed)
4. searched r2, and r13,
5. followed linked instructions calculating r2 and r13
6. set registry values
**************************************************************
* FUNCTION *
**************************************************************
undefined FUN_0003353c()
assume linkreg = 0x0
assume r13 = 0x3db68
assume r2 = 0x1d0d0
undefined <UNASSIGNED> <RETURN>
FUN_0003353c XREF[1]: FUN_000150e0:000151ec(c)
0003353c 3c 00 00 00 lis r0,0x0
00033540 64 02 00 01 oris r2,r0,0x1
00033544 60 42 d0 d0 ori r2,r2,0xd0d0
00033548 64 0d 00 40 oris r13,r0,0x40
0003354c 61 ad 24 98 ori r13,r13,0x2498

When I search for =>DAT_002, I get no matches. Thanks.

R13 = 0x404298 ?

[Denny]

Hi pman92. Thanks for your reply. So, to get the correct r2 r13 registers I need to add them both? I added for r2 and subtracted for r13. Does the ad on this line mean to add them? If yes. I should have looked at my bin a little better.

0003354c 61 ad 24 98 ori r13,r13,0x2498

I think the link shows addi and subi (meaning add & sutract)? That's where I think I messed up. I just followed the example without considering they may be differently set up. Am I correct? I will test and update the post when I get a chance.

Thanks again for helping.