Anyone have Stock EEC-V Bins?

[DWS]

I'm slowly working on some concepts I have in mind for matching up reused code across different computers and models, but could use as many stock bins as possible to make sure detections are solid and ideally no false positives. Anything would be useful, but currently my main focus is 1998+ 4 bank EEC-V dumps (any vehicle/engine).

My first target is try to catch all the different versions of the PATS code and the flag for disabling that, but down the road I want to extract the stock calibrations for MAF, injectors, etc in a database to understand the actual engine changes better. Like 98-04 Crown vic 4.6L ran 2 different injector sizes, some had different MAF sizes too, that shows up in the calibration in the computer.

I'd like to also get some AU based vehicle bins as I've read they are formatted a little different.

Anyway, figured I'd ask before I go too crazy buying ford computers (have 25 or so right now lol, several duplicates though).

[VX L67 Getrag]

There's a heap I got from TI Performance website, they have a whole heap of files & info there & quite a few I've read off the j3 board adapter & a few I've read with Kess but need to put them all together.

[VX L67 Getrag]

here's 3 I've read with kess

[Gareth]

Does anyone know where there's a XDF resource for Ford Falcon PCMs?

I have had issues with TI performance ones not being correct, I currently have a customers speedway car we can't raise the rev limit on.

[DWS]

Thanks for the reference, I grabbed the bin files off the site and compared some and found a 4 bank.

12BE_01.bin

Bank0: 2000-ffff
Bank9: 32000-3ffff
Bank1: 12000-1ffff
Bank8: 22000-2ffff

That lines up with what SAD says too. Either case more bins should be useful for the testing I want to do. The XDF's should be handy too if any of the functions are used across other bins, should be some solid guidance at least.

[VX L67 Getrag]

These are some of my reads directly off the port of the PCB....

[DWS]

These are some of my reads directly off the port of the PCB....

Thanks for all the help =). I haven't looked into the 2 bank computers much, but the file labeled as

12ND = 9-2001 LPG Dedicated AU2 1Tonner Auto updated to 12ZE (NGIC9N6).bin

appears to be a 2 bank. My code detected it as:

Bank9: 32000-3ffff
Bank1: 12000-1ffff

Looks like the rest of the bank area is FF'ed out, so I suspect that should be correct, unless the 2 bank naming is different than that.

I did run across one of the other files that had a very minor change on bank 0 that was breaking my detection, but I've updated it and seems to be working well. I'm planning to standardize the file names and run some detection code across them in bulk. I might have to remove the single bank files since I haven't worked with 8061 yet, so not sure if the op codes and such match up, I suspect there's differences though.

[DWS]

Does anyone know where there's a XDF resource for Ford Falcon PCMs?

I have had issues with TI performance ones not being correct, I currently have a customers speedway car we can't raise the rev limit on.

I'm not much help as of right now, but down the road I might be better suited. If you happen to know the current rev limiter you could convert that to hex and attempt to find the value and edit with a hex editor, but that would be a lot of trial and error depending how many matches there are.

Random example from a crown vic FBDE3A2_CAX0 computer is neutral rev limit 4000, it's a 16 bit value, so it's a simple 1:1 relation, just convert 4000 to hex which is 0x0FA0 then reverse the bytes so 0xA00F and search for that in the bin with a hex editor. Sadly in this example, there's a lot of results in this bin so not really feasible to go this route.

SAD is also handy, not perfect, but it does a lot automatically. I'm using version 406 for this one. If you repeat the search above with the file disassembled, you'd search a0,0f with a few spaces afterwards so only detected words show up. In my case there's 4:

157e6: a0,0f word fa0
1682a: a0,0f word fa0
16842: a0,0f word fa0
176fa: a0,0f word fa0

Could guess and check, or search the addresses and see what the code is doing. This one makes sense

8b43b: d1,0c jleu 8b449 if (R3a > [1682a]) {

aka if RPM is greater than RPM_Limit (run code that limits rpm like fuel cut)

This one could work, but likely not it (not the way someone would be likely to code the logic)

8d4f9: db,08 jc 8d503 if (R36 < [16842]) {

aka if RPM is less than RPM_Limit (run code to run the engine normally)

In this example on this file, I'd be inclined to think 1682a is the target though. Raw location in the file depends on the file format, can search for bank 1 and see what SAD says the range is in the file, take the discovered address (bank 1 - 682a) and subtract the base address from that value, in my case bank 1 is the first one in the file, no padding so it starts at 0, so no change.


A completely different way to go about it, is find a similar computer that that value is known on and try to search the code between the files to find one that matches up closely. This is a slower process and very manual though and actually understanding the code is more of a requirement.

Anyway, completely honest, I'm pretty new to reverse engineering assembly, but this is my off the top of my head way I'd think of doing it since rev limiters are easy to test more or less blindly. Always back up the orig file and edit a copy so you always have the stock one to fall back to.

[In-Tech]

DNL0_256k.bin

(256 KiB) Downloaded 77 times

Drosos_Stock.bin

(256 KiB) Downloaded 76 times

JCOL_170919c2_NW.bin

(256 KiB) Downloaded 77 times

Roger_Stock.bin

(256 KiB) Downloaded 83 times

Stock_Read_Cesar.bin

(256 KiB) Downloaded 77 times

[DWS]

Thanks for the bins, looks like some ranger/mazda trucks.

One did fail my bank detection, but the section that normally says copyright ford says www.EFIDynoTuning.com so clearly edited so that's kinda expected. The concept I have in mind for the updated detection is more exact per strategy so modded files I hope won't be an issue down the road unless they are patched or the actual code is modified.