Is there a $F0 source/assembly file anywhere?

[scorp508]

Many years ago I went through the attached file to create a larger $32B XDF for myself to use in TunerPro with my 1987 Coupe. It took a while but was a fun learning experience while getting it correct.

Has anyone come across a similar file for $F0? I'd like to learn more on how some of the variables interact and see if there's anything worth adding not already in the definition.

[tiegsd]

Can't vouch for whether these are any good, but found a pile of them here, looks like it may be what you're after?:

https://www.tunerpro.net/downloadBinDefs.htm

At very least, maybe a good start.

[scorp508]

Can't vouch for whether these are any good, but found a pile of them here, looks like it may be what you're after?:

https://www.tunerpro.net/downloadBinDefs.htm

At very least, maybe a good start.


Thank you but not quite. :cheers: The XDF files are what tell a program like TunerPro how to interpret a BIN's values, so you can edit them. The ADS files are for interpreting the ALDL stream of data while logging.

The stuff I'm looking for would be the original assembly program GM used for the ECM itself, sort of like the file I attached for 32B in the first post. Those can be read to determine the address locations of other switches, scalers, and tables that may not already in in the XDF or just to better understand how they interact with each other.


It's a little nerdy to want to read them, but it's the kind of thing I enjoy combing through and building a few more wrinkles in my brain. :coffee2:

[-=Jeff=-]

Contact XfireZ51

He may know if there is one or not

[tiegsd]

Thank you but not quite. :cheers: The XDF files are what tell a program like TunerPro how to interpret a BIN's values, so you can edit them. The ADS files are for interpreting the ALDL stream of data while logging.

The stuff I'm looking for would be the original assembly program GM used for the ECM itself, sort of like the file I attached for 32B in the first post. Those can be read to determine the address locations of other switches, scalers, and tables that may not already in in the XDF or just to better understand how they interact with each other.


It's a little nerdy to want to read them, but it's the kind of thing I enjoy combing through and building a few more wrinkles in my brain. :coffee2:


Rgr, thanks. Not familiar with TunerPro, so wasn't really sure what I was looking at. I dig that kind of stuff myself though, wanted to dig into it a bit. Not familiar with how GM did its software engineering back in the day, but I imagine they did not provide assembly source for their ECMs to just anyone who asked for it. Interesting reverse engineering problem.

[XfireZ51]

Rgr, thanks. Not familiar with TunerPro, so wasn't really sure what I was looking at. I dig that kind of stuff myself though, wanted to dig into it a bit. Not familiar with how GM did its software engineering back in the day, but I imagine they did not provide assembly source for their ECMs to just anyone who asked for it. Interesting reverse engineering problem.

There are some who got the code ?over the transim? and some who can disassemble the Motorola assembler code.

[scorp508]

There are some who got the code ?over the transim? and some who can disassemble the Motorola assembler code.

I would love to speak to those who can of you have a suggestion. :cheers:

[XfireZ51]

I would love to speak to those who can of you have a suggestion. :cheers:

I would go to thirdgen.org. There are members there who have been responsible for many of the tools we have today for tuning, particularly OBD1.

[scorp508]

I would go to thirdgen.org. There are members there who have been responsible for many of the tools we have today for tuning, particularly OBD1.

Good idea. I cast the line and will see if anything bites.

https://www.thirdgen.org/forums/diy-prom/788708-disassembly-f0-available-read.html

[tiegsd]

There are some who got the code ?over the transim? and some who can disassemble the Motorola assembler code.


Rgr. I was poking around last week for a motorola chip diassembler, looks there are a few running around of unknown (to me anyway) quality, and IDA may be able to do it in the paid version, still looking into that.

[scorp508]

Rgr. I was poking around last week for a motorola chip diassembler, looks there are a few running around of unknown (to me anyway) quality, and IDA may be able to do it in the paid version, still looking into that.

Any idea what type of processor these were these based on back in the day? I could try to lean on some of my professional contacts if I can give them a hint of what they're disassembling.

[tpepmeie]

Motorola 68HC11
if that's what you are asking.

[tpepmeie]

Many many years ago I made a complete, fully commented disassembly of BFXB, and BMCB. Had the others partially complete but moved on to other things. Had full access to the source code to add, delete, routines and reassemble. It worked, I added closed loop lambda control at one point. I had a lot more free time in my 30s I guess... LOL

[scorp508]

Many many years ago I made a complete, fully commented disassembly of BFXB, and BMCB. Had the others partially complete but moved on to other things. Had full access to the source code to add, delete, routines and reassemble. It worked, I added closed loop lambda control at one point. I had a lot more free time in my 30s I guess... LOL

Annnnnd those files now reside where? :mrgreen: :dancing

Beer money to your Venmo/Paypal is waiting. :cheers:

[scorp508]

For what it's worth it has been recommended I give Ghidra (https://ghidra-sre.org/) a try for disassembly. The NSA created it.... so who knows what else it'll install on my machine. :mrgreen:

[tpepmeie]

I found an old presentation I did at the Gathering in 2004. Attached.

https://toddpepmeier.wixsite.com/pepmeierengines/post/zr-1-gathering-presentations

[tpepmeie]

If I remember, the "ANHT" hac was more closely related to the LT5 code at the time. It almost seemed like the various operating code sections were pulled from a menu and inserted into whatever calibration they needed to create at the time. All the LT5 calibrations are similar, but you can tell over time where they added some tweaks and minor functionality here and there. The BMCB version strikes me as the most advanced. Makes sense since it was among the final releases.

Here's a snippet of the BFXB code, which determines the target air-fuel ratio in open loop, and then applies the richest of the calculated ratios to determine the final ratio.

************************************************** ****
** OPEN LOOP/CLOSED LOOP FUEL/AIR RATIO CALCULATION
************************************************** ****
OLCLAIRF CLRA
LDAB FATI TIMEOUT A/F RATIO
ADDB KFABIAS OPEN LOOP F/A BIAS USED TO SET UP LEAN LIMIT
ADCA #0
ADDB FATC COOL TEMP F/A RATIO OFFSET
ADCA #0
PSHB
PSHA
BRSET MWFA1;BIT7,FAADDVAP 1=CLOSED LOOP MODE (BOTH SENSORS CL)

************************************************** ****
*** ADD MAP BASED TERM (VAPORIZATION FACTOR) IF IN OPEN LOOP
************************************************** ****
LDAA NMAPLD NORMALIZED MAP VALUE
LDX #F50H OPEN LOOP FUEL/AIR % CHANGE V. MAP
JSR P4LKUPQ 2D TABLE LOOKUP, NO OFFSET, SPACED 16
STAA FAVAPF FUEL/AIR VAPORIZATION FACTOR
FAADDVAP PULA
PULB
ADDB FAVAPF FUEL/AIR VAPORIZATION FACTOR
ADCA #0

************************************************** ****
*** APPLY ALL FUEL/AIR MODIFICATION TERMS TO STOCHIOMETRIC
************************************************** ****
MULFAST LDX KFASTCN STOCHIOMETRIC A/F RATIO
JSR P4M1616C 16X16 MULTIPLY RETURN W/ MIDDLE 2 BYTES
STD FAVALNPE NON-PWR ENRICH F/A VALUE

************************************************** ****
** PE FUEL-AIR RATIO CALCULATION
************************************************** ****
BRCLR MWFA;BIT5,PEAIRFLX 1=POWER ENRICHMENT ACTIVE

LDX #F68E POWER ENRICH FUEL/AIR % CHG V. RPM
LDAA NTRPMX RPM/25
CMPA #160
BHI PEAF001
SUBA #16
BCC PEAF002
CLRA
BRA PEAF002

PEAF001 LDAA NTRPMZ RPM/31.25
ADDA #16
BCC *+4
LDAA #255
PEAF002 JSR P4LKUPQ 2D TABLE LOOKUP, NO OFFSET, SPACED 16
TAB
LDX #128
ABX
LDAB LKUPF67 F67 LOOKUP IN 100 MSEC COOLVAR
ABX
LDD KFASTCN STOCHIOMETRIC A/F RATIO
JSR P4M1616C 16X16 MULTIPLY RETURN W/ MIDDLE 2 BYTES
STD FAVALPE PWR ENRICH F/A VALUE
PEAIRFLX EQU *

************************************************** ****
* RICHEST FUEL/AIR RATIO (P.E. OR NON-P.E.) DETERMINATION LOGIC
************************************************** ****
FAVALUPD LDX FAVALPE PWR ENRICH F/A VALUE
CPX FAVALNPE NON-PWR ENRICH F/A VALUE
BHI *+5
LDX FAVALNPE NON-PWR ENRICH F/A VALUE
LCB36 STX FAVAL FINAL TOTAL F/A VALUE

[tiegsd]

For what it's worth it has been recommended I give Ghidra (https://ghidra-sre.org/) a try for disassembly. The NSA created it.... so who knows what else it'll install on my machine. :mrgreen:


:cheers:

[tiegsd]

Interesting stuff going on in those old ECUs. More complicated than I realized.