Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Disassembly, Reassembly, Tools and devleopment. Going deep with Hardware and Software.
Ionut
Posts: 25
Joined: Thu Jul 24, 2014 9:43 pm
cars: Opel Astra 1.7DTI Y17DT

Re: Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Post by Ionut »

It doesn`t look like your example with 68K selected. At 0x00000 is ECU identifier, nothing like user vector.
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Post by antus »

Yes, I dont know where the vectors are. Perhaps after the identifier.

But if you dissassemble from say 1F68 you'll see its a correct looking function in 68k. They say ls1 delphi pcms are 68330, but the general 68k setting supports all opcodes in the family so is a good choice without better information.

This is from "Vauxhall -Opel Astra G 1.7dti 97240621 EADLNF.orig". It looks logical as 68k, and similar in architecture to the '0411 PCMs I have worked on.

Code: Select all

ROM:00001F68                                                   ; =============== S U B R O U T I N E =======================================
ROM:00001F68
ROM:00001F68
ROM:00001F68                                                   sub_1F68:                               ; CODE XREF: sub_1FC4+10p
ROM:00001F68                                                                                           ; ROM:00002078p ...
ROM:00001F68
ROM:00001F68                                                   arg_3           =  7
ROM:00001F68
ROM:00001F68 2F07                                                              move.l  d7,-(sp)
ROM:00001F6A 1E2F 000B                                                         move.b  4+arg_3(sp),d7
ROM:00001F6E 207C 00FF 802A                                                    movea.l #$FF802A,a0
ROM:00001F74 72C0                                                              moveq   #$FFFFFFC0,d1
ROM:00001F76 C210                                                              and.b   (a0),d1
ROM:00001F78 1081                                                              move.b  d1,(a0)
ROM:00001F7A 703F                                                              moveq   #$3F,d0 ; '?'
ROM:00001F7C C007                                                              and.b   d7,d0
ROM:00001F7E BE00                                                              cmp.b   d0,d7
ROM:00001F80 6606                                                              bne.s   loc_1F88
ROM:00001F82 1007                                                              move.b  d7,d0
ROM:00001F84 8001                                                              or.b    d1,d0
ROM:00001F86 1080                                                              move.b  d0,(a0)
ROM:00001F88
ROM:00001F88                                                   loc_1F88:                               ; CODE XREF: sub_1F68+18j
ROM:00001F88 13C7 00FF 802D                                                    move.b  d7,($FF802D).l
ROM:00001F8E 4A10                                                              tst.b   (a0)
ROM:00001F90 6A0A                                                              bpl.s   loc_1F9C
ROM:00001F92 13F9 00FF 815A 00FF 8159                                          move.b  ($FF815A).l,($FF8159).l
ROM:00001F9C
ROM:00001F9C                                                   loc_1F9C:                               ; CODE XREF: sub_1F68+28j
ROM:00001F9C 13FC 0011 00FF 815A                                               move.b  #$11,($FF815A).l
ROM:00001FA4 1039 00FF 8139                                                    move.b  ($FF8139).l,d0
ROM:00001FAA B039 00FF 813A                                                    cmp.b   ($FF813A).l,d0
ROM:00001FB0 630A                                                              bls.s   loc_1FBC
ROM:00001FB2 13FC 0008 00FF 8029                                               move.b  #8,($FF8029).l
ROM:00001FBA 6004                                                              bra.s   loc_1FC0
ROM:00001FBC                                                   ; ---------------------------------------------------------------------------
ROM:00001FBC
ROM:00001FBC                                                   loc_1FBC:                               ; CODE XREF: sub_1F68+48j
ROM:00001FBC 6100 FF42                                                         bsr.w   sub_1F00
ROM:00001FC0
ROM:00001FC0                                                   loc_1FC0:                               ; CODE XREF: sub_1F68+52j
ROM:00001FC0 2E1F                                                              move.l  (sp)+,d7
ROM:00001FC2 4E75                                                              rts
ROM:00001FC2                                                   ; End of function sub_1F68

Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Ionut
Posts: 25
Joined: Thu Jul 24, 2014 9:43 pm
cars: Opel Astra 1.7DTI Y17DT

Re: Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Post by Ionut »

you lost me here :) What function has this subroutine? I`m courious how maps are addressed and how sensors are read and compared to maps (Ex: MAP sensor reading and Turbo Target Map)
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Post by antus »

Its just a random function. I dont know what it does. The point is that it looks sain. The branches make sense (have compare calls before them). The function is self contained, manages the stack at function entry and exit. Its definitely motorola 68k code.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Ionut
Posts: 25
Joined: Thu Jul 24, 2014 9:43 pm
cars: Opel Astra 1.7DTI Y17DT

Re: Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Post by Ionut »

Ok, thank you. Could you please point me in the right direction to understand this code? Any link that describe how 68K works internally helps me a lot.
Thank you,
Ionut.
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Post by antus »

Try this http://mrjester.hapisan.com/04_MC68/

The 68k series of processors have been used in a lot of old school computers and consoles.

You'll also need to identify what other hardware is in the pcm and then use the disassembly to figure out where/how that hardware is mapped. Look at what fragments and dissassembly of other 68k based gm pcms you can find. There will be common things about them so you will get clues.
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Ionut
Posts: 25
Joined: Thu Jul 24, 2014 9:43 pm
cars: Opel Astra 1.7DTI Y17DT

Re: Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Post by Ionut »

Thank you. Read first 6 pages and found a lot of useful things that didn`t know about assembly (I`m high level programmer, I`m working with more readable languages (PHP, C#, C++, JavaScript, PERL, so is harder for me to learn now all those things) :)
Ionut
Posts: 25
Joined: Thu Jul 24, 2014 9:43 pm
cars: Opel Astra 1.7DTI Y17DT

Re: Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Post by Ionut »

all chips from my ECU have their series erased and almost all are hybrids... so is hard to see how this ecu is built
User avatar
antus
Site Admin
Posts: 8237
Joined: Sat Feb 28, 2009 8:34 pm
cars: TX Gemini 2L Twincam
TX Gemini SR20 18psi
Datsun 1200 Ute
Subaru Blitzen '06 EZ30 4th gen, 3.0R Spec B
Contact:

Re: Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Post by antus »

Yes, thats normal for delco/delphi. You need to infer it from the code. It'll mostly be the same hardware as other delco/delphi 68k pcms. A lot of the subroutines will be common across different OS. Try getting an elm interface and plugging it in to the obd port and let it autodetect protocol. Then assuming its vpw, you can look in to the vpw hardware in other pcms in the family. And once you have an idea about that get the data sheet and see if you can find other references on the net for other pcms as to where the registers are mapped and look for those addresses in your bin. Theres a decent chance they'll line up and you'll be able to start IDing the comms routines. Then follow it from there... find the code that answers to messages for data for particular pids. Then you can look at the SAE pid list, and find the code that handles eg RPM. And see where its getting the rpm from in ram. Then you can find code that references rpm in ram. etc etc. If it is vpw, its probably based around this chip (pdf attached).
Attachments
mc68hc58.pdf
(700.8 KiB) Downloaded 400 times
Have you read the FAQ? For lots of information and links to significant threads see here: http://pcmhacking.net/forums/viewtopic.php?f=7&t=1396
Ionut
Posts: 25
Joined: Thu Jul 24, 2014 9:43 pm
cars: Opel Astra 1.7DTI Y17DT

Re: Delco HDRC (Y17DT DYRX, DMRW & DNLF)

Post by Ionut »

I have an ELM bluetooth interface, but i can`t get it working on my astra. it works on other cars (Audi A3 1.8T, skoda superb 1.9TDI, VW Golf V 1.9TDI). Also i have Galletto 1260, MPPS and OP-COM

Do you have a complete list of assebly operation and 68K specific operations? Something with 3 columns will be great. First the operation name (like move.w a,b), second an example of operation and result and third a short description of operation. I`m a PHP and C# programmer, and assembly makes me go mad :)

Thank you in advance.
Post Reply