Alfa bin files

[DieselBob]

Ok didn't really phrase the question properly...
DPTR loads at 0000
The question should have been when the lcall references outside the code area what does it reference?

The info has worked well found at least 1 multiply function and another 3b lookup....
Spare time is at a premium so it's slow going.

Still trying to figure the DPTR loads the PC doesn't seem to match???

[DieselBob]

Things are going well when I get the time
Starting to build routines...
Looking for the conversions...
Data rx tx.....
Still having trouble trying to make the 2d 3d lookups reference a table, thinking its something to do with an offset from a lcall outside the rom area

Found another couple of multiples and a div routine.....

[DieselBob]

Ok have the conversion db tables found the table lookup calls
Still working on the conversion functions......

[DieselBob]

Found something that looks alot like constant lookups
Its better now not as frustrating

[antus]

Sounds like your making really good progress

[DieselBob]

yeah Festys stuff isn't exactlly the same but close enough for a guide to get it started.
Now it's a slow methodical run through the code, finding the obvious then going back and working with
whats left......

[festy]

My Motronic plug-in for TP is still a bit rough around the edges, but it works so if you want to do some data logging PM me.
And if you can get me a pic of the ECU's digital board, I'll see if my RT module will work with your ECU.

Have you worked out how the 2d/3d table lookup routine works?
I've documented it in plain english if you're still fighting with it...

[DieselBob]

Found a lot of references to the area just before the MAP data area.
Looks like the A/D and other conversion tables and constants.
Have ljmp and lcall addresses.

There are no disassembled references that relate to the MAP area itself.
? Is there an adjustment to the addressing reference that I'm missing...

Another problem is there are mov calls to the area outside the ROM code.
These are addressed to h8000 and greater????

Bit lost on the last one........

[DieselBob]

OK heres a question i have

the disassembly looks ok until i see this

ljmp 8029h
this runs through to
mov dptr #9f29h
movc a,@a+dptr

my bin finishes at 7fffh

I believe i have found the MAP lookup routines however they all have lcalls into the 8000 - 9fff region???????

Any Ideas??????????????

[festy]

MOTRONIC M7.1
This is for a Motronic M1.7.

Some extracts…
0x0000 - 0x1fff (Main internal code ... I need a friend at BOSCH!)

I recently got the opportunity to have a look at a rather rare motronic ECU from an alfa 164 24v Q4 (super-hi-tech 4wd model), and on reading the eprom found the same empty space from 0-1FFF... there appears to be an eprom on-board that occupies this space and is used for things like the immobiliser etc.
So I connected to the ECU with my TP plugin and was able to download the bin for it

This ECU has been modded for immo delete apparently (and the eprom has been replaced with one from the non-immo version of this ECU) and I'm not sure how close it will be to the M1.7's code but imagine it would be similar...