So I've been poking at some more bins recently to try to get 90%+ coverage and this one has been one of the strangest ones so far. Exact file is QCAE1S3.bin which is a 2002 Ford Escort 2.0L SPI catch code RTX1 and HWID MLT-511. Any code patterns I look for that directly relates to PATS in any version including the unique AU Falcon versions has no correlation, not even small sections of the code. I figured it might be just another unique variation, but then I discovered this spot where it's hard coded to be a true if statement where a pats flag normally goes. Note the B0_R0 which is always 0.
Code: Select all
05731: d3,06 jnc 05739 if (R52 < R184) goto 05739; } }
05733: 3b,cd,03 jb B3,Rcd,05739 if (B3_Rcd = 0) {
05736: 30,00,03 jnb B0,R0,0573c if (B0_R0 = 0) goto 0573c; } } } }
To contrast, here's the code from another strategy with a similar structure but unrelated model. B1_R5f is set to 0 when PATS is disabled, otherwise it's 1 (bit flag).
Code: Select all
054a2: db,06 jc 054aa if (R52 >= R1e2) goto 054aa; } }
054a4: 39,b5,03 jb B1,Rb5,054aa if (B1_Rb5 = 0) {
054a7: 31,5f,03 jnb B1,R5f,054ad if (B1_R5f = 0) goto 054ad; } } } }
From my understanding, every EEC-V computer is known to have pats code in them even if it's not used for a given model/hwid. I think this might be a rare example of one that actually doesn't have the PATS code at all. Everything I read about this car suggests it didn't have PATS for an option at all and it appears they came standard with an anti theft system that just beeped the horn and flashed the lights (nothing to prevent the engine from running besides the physical lock cylinder).
Using this location of the code for identification, it appears this is a common theme on some of the strategies I have left. Another example
GWAG5
Code: Select all
0570c: 30,00,03 jnb B0,R0,05712 if (B0_0 = 0) goto 05712; } } } }
Here's a list of strategies that matches this setup. None of the bins with pats conflict with this pattern matching as well so I'm pretty sure this is correct. I included the addresses for these if anyone wanted to investigate further. If what I'm saying here is wrong in any way, please let me know. I haven't looked into the wire diagrams on every vehicle these match to, but I have a feeling none of them have PATS because of this flag situation.
Code: Select all
CSAH1 no_pats bool_enable 3396
GWAG5 no_pats bool_enable 570c
GWAG6 no_pats bool_enable 5734
QBAA0 no_pats bool_enable 54a7
QBAB0 no_pats bool_enable 552f
QBAC1 no_pats bool_enable 552f
QCAA0 no_pats bool_enable 5734
QCAA1 no_pats bool_enable 5733
QCAC1 no_pats bool_enable 5734
QCAE1 no_pats bool_enable 5736
Anyway, these 10 + the other strategies in the queue puts me at 89%, so close to that 90% figure!
FYI, I don't have a bin file for every strategy, so there's likely a hand full more. Most of the time finding 300003 in the file (in hex) is this code location, but not always.
