Need Help Locating Table

[03EBZ06]

I have an 03 LS1 bin file from a Corvette. Its not an LS1 edit file. Can someone please tell me how to locate the spark tables??

2 byte, 1 byte, 4 byte data?? Where at in the 512k file??

THANKS. If anyone needs info on the FORD stuff, I can probably help out.

[jfunk]

If anyone needs info on the FORD stuff, I can probably help out.

What kind of ford info do you have? I'm having a hard time finding usefull stuff, because there's not much out there.

[Chris@HPTuners]

what is the OS ID? 12221588? (long at 0x504)

try looking for words around 0xF1C0, the main spark tables are 25 x 29 (cols x rows)

I have an 03 LS1 bin file from a Corvette. Its not an LS1 edit file. Can someone please tell me how to locate the spark tables??

2 byte, 1 byte, 4 byte data?? Where at in the 512k file??

THANKS. If anyone needs info on the FORD stuff, I can probably help out.

[The_Highlander]

When I get home I will give you info on where the main spark table and the secondary spark table is... I might as well post ALL the spark table info...

I can post the table scalar if you need.

If you need any other table i probably have it and can post it.. so post what you need...

If you need flashing protocols.. i got too.

[03EBZ06]

long data @ 0x504 is 2491202048. Your help is sincerely appreciated. The table scalar would be helpful. Is the actual spark data 1 byte and 1 byte encoding or something odd??
I would also be interested in looking at the flashing protocols. I looked over 0xF1C0, didn't see the table, but I'll try again today.


Thanks.

[The_Highlander]

I will post the few locations.. it may vary depending OS ID.

Let me know what you have on ford.. I'll gladly trade you

[03EBZ06]

For example:

2003 Cobra Mustang spark_base_table
-------------------------------------------------------------------
addr: 010EAE size: 9x11 type: 1 Unsigned Byte

10EAE 40 43 45 46 48 49 50 50 50 50 50
10EB9 27 30 34 38 40 43 43 44 44 45 45
10EC4 17 19 29 34 37 38 39 40 41 41 42
10ECF 15 16 17 24 27 29 30 32 33 33 32
10EDA 10 11 16 22 25 26 28 30 31 31 29
10EE5 8 9 14 20 23 25 27 27 28 28 27
10EF0 6 7 12 18 22 23 25 26 26 27 25
10EFB 4 5 10 16 19 20 22 23 24 25 24
10F06 2 3 8 14 17 18 20 21 22 23 22


Rows by Load Factor
-------------------------------------------------------------------
addr: 010DAE size: 6x2 type: 2 Unsigned Bytes

10DAE 1.99996948242188 8
10DB2 1.5 8
10DB6 0.5 3
10DBA 0.350006103515625 2
10DBE 0.1500244140625 0
10DC2 0 0

Col by RPM
-------------------------------------------------------------------
addr: 010DEE size: 7x2 type: 2 Unsigned Bytes

10DEE 16383.75 10
10DF2 6500 10
10DF6 5000 9
10DFA 4000 8
10DFE 1000 2
10E02 500 0
10E06 0 0

I am very interested in learning how to setup definition files for my own car in particular, but also am very interested in how to communicate w/the pc w/regard to
seek/key, and downloading/retrieving the data. Am fairly
familiar with HS3000, have datalogged some obdii, but not real adapt at read/write yet.

Please email me your phone# and I can call you if thats ok.

[Chris@HPTuners]

long data @ 0x504 is 2491202048. Your help is sincerely appreciated. The table scalar would be helpful. Is the actual spark data 1 byte and 1 byte encoding or something odd??
I would also be interested in looking at the flashing protocols. I looked over 0xF1C0, didn't see the table, but I'll try again today.

what are the 4 bytes at 0x504?

the spark table values are words (16 bit) values and are deg BTDC x 45.5

[03EBZ06]

Yep, its 12221588 @ 0x504. Seems I was trying to read this file in an Intel format. Once I reversed the words, things made a little more sense.

With respect to the FORD info, please send any request you have via email. Should I posts my requests to this forum or to you guys specifically??

Thanks.

[Chris@HPTuners]

Yep, its 12221588 @ 0x504. Seems I was trying to read this file in an Intel format. Once I reversed the words, things made a little more sense.

With respect to the FORD info, please send any request you have via email. Should I posts my requests to this forum or to you guys specifically??

Thanks.

LOL you wouldn't be the first to be caught by this... okay so your HO spark is at 0xF1C0, 25x29(cols x rows), across axis is RPM, down is g/cyl

enjoy

[03EBZ06]

Now I'm having a blast... Where are the fuel functions and rev limiters stored? PE enrichment? Do you know the conversion factors.

Thanks again..

[Chris@HPTuners]

Now I'm having a blast... Where are the fuel functions and rev limiters stored? PE enrichment? Do you know the conversion factors.

Thanks again..

you need to start thinking about understanding the code... that means disassembly. It's one thing to thing to have someone tell you where to fish, it's another thing to find the fish yourself (and much more fun)...

[03EBZ06]

Ok, ok. What chip are we playing with and where can I find the opcode?

Also, are the calibration addresses loaded from offsets or pointers and if so, are these centrally located? I know FORD does funny things like loading injectors inline vs using pointers for access. Any clues gladly accepted on these processors. I am new to playing w/them.

Also, someone sent me a list of params for the ls1, but the email address was non-returnable and they did not list the processor or car. In this email, they list
550E as the spark table. What processor was that?

[03EBZ06]

Whats happening at D150?

[Chris@HPTuners]

there is a wealth of info in these 3 forum sections...

in short:
- you need to get a copy of IDA
- the processor type is 6833x
- create a RAM segment from FFFF0000 to FFFFFFFE (it's not really there but IDA cannot handle 24bit relative addys.)
- the RESET vector is at 0x04 (generally it is 0x0440)
- go to 0x0440 and start disassembly
- you'll see a number of CPU setup and PCM interity checking routines
- then you'll se an indexed jumpt to the main routines.

there is a post here someplace from me that describes the mainloops and how to find them and generally what can be found in them.

also there is a post somewhere that describes the 3D lookup routines.

you'll find that basically evrything from 0x20000 to ~0x78000 is pure code so i just write a little IDA script that turns it all into code.
The cal is 0x08000-0x1FFFFF.

the you need to execute the following script:

1:
do
pull hair out
much coca cola
no sleep
guessing
trial and error
...
while (!dead) || (stillmarried == 1) && (therapy == 0)

enjoy

0xD150 is in the middle of the Injector Offset table...