some might have seen my posts in which analysis of the BINs was mentioned, most recently concerning the 59M. The lesson learned is that Marelli uses a library of functions in the code.
Some days ago I decided to take a look at the 5AM-HW103 BIN, used in a MTS1000. Mostly because the BIN was on my PC. And again it became appearent, that analysing a BIN has become more a question of time, not assembler language skills.
Here are some of the results, Fuel calculation, ignition and ignition trim calculation.
MadMonkeyBoy, t_bare, zeppo and 1 others like this.
In which software did you analyze the BIN? Running a SGS-Thomson ST10 CPU?
I'm using IDAPro. The CPU is a ST10-269.
Marelli's library approach makes it (loosely speaking) quite easy to analyze all BINs used in 5AMs. So far I've done Guzzi 4V and 8V and Aprilia Mana, GP850 and SRV 850 BINs using this approach.
I thought this might be of interest as base for a community effort in the Ducati community; I'd be happy to share.
Cool! I want to look at the 848EVO CORSE and 1198SP ECU software (32A0A0... and 3220... resp). They are a good base for race-bikes (848/1x98 and 9XX conversions), includes quickshifter, possibility for basic traction control etc.
Last edited by zeppo; Nov 21st, 2018 at 12:22 pm.
Zeppo kindly sent the BINs and a XDF, so the exploration could proceed. It seems that the code section(s) which accesses the immobilizer byte is identified, hence future searches in other BINs can start with the code section and from there on quickly find the immobilizer byte.
The attached picture shows the subs in which the byte is used, one of them, btw, is a OBD function which can be queried with software such as Guzzi/IAWDiag. In the different subs the byte is compared to 1 and 3, so the value range seems to be 1-3.
The byte is also referenced in the sub which contains the dash text, which is sent from the ECU to the dash as part of a CANBus packet.
While studying above inevitably the other relevant subs and tables, scalars and bytes/flags, both in RAM and ROM, were looked at. I'll go thru the interesting subs (fuel, ignition, OBD, CAN, ADC, injector correction, etc, one by one in the next posts.
let's begin with the fuel calculation. It begins with a look at the IdleFuelRPM legend and then branches, depending on the IdleFuel_en_dis_able_byte_48442 to the left, idle mode, or the right. The flag is used in quite a few subs, so I wouldn't change it before a more detailed analysis.
Then, depending on the value of tps_state_1_word_C6A6, the branch leads to the idle mode calculation using the IdleFuelTable_4D796, or the Mainfuel/Delta tables, depending on the value of cyl_num_byte_C9B0.
then the Lambda flags are evaluated. If set the different closed loop corrections - long and short term trims - are applied.
1 Attachment(s) took a "nap"