5AM BIN analysis - Ducati.ms - The Ultimate Ducati Forum
Reply
 
LinkBack Thread Tools Display Modes
post #1 of 30 (permalink) Old Nov 18th, 2018, 4:26 am Thread Starter
Member
 
Join Date: Aug 2015
Location: Uelversheim, , Germany
Posts: 75
5AM BIN analysis

Hi,

some might have seen my posts in which analysis of the BINs was mentioned, most recently concerning the 59M. The lesson learned is that Marelli uses a library of functions in the code.

Some days ago I decided to take a look at the 5AM-HW103 BIN, used in a MTS1000. Mostly because the BIN was on my PC. And again it became appearent, that analysing a BIN has become more a question of time, not assembler language skills.

Here are some of the results, Fuel calculation, ignition and ignition trim calculation.

Cheers
Meinolf
Attached Thumbnails
Click image for larger version

Name:	5AM_103_Fuelcalc1.JPG
Views:	114
Size:	89.1 KB
ID:	932451   Click image for larger version

Name:	5AM_103_Fuelcalc2.JPG
Views:	88
Size:	105.0 KB
ID:	932453   Click image for larger version

Name:	5AM_103_Fuelcalc3.JPG
Views:	64
Size:	86.8 KB
ID:	932455   Click image for larger version

Name:	5AM_103_Fuelcalc4.JPG
Views:	77
Size:	143.5 KB
ID:	932457   Click image for larger version

Name:	5AM_103_Ignition1.JPG
Views:	44
Size:	105.0 KB
ID:	932459  

Click image for larger version

Name:	5AM_103_Ignition_trim1.JPG
Views:	55
Size:	132.0 KB
ID:	932461  
Meinolf is offline  
Sponsored Links
Advertisement
 
post #2 of 30 (permalink) Old Nov 20th, 2018, 12:30 pm
Member
 
zeppo's Avatar
 
Join Date: Mar 2016
Posts: 36
In which software did you analyze the BIN? Running a SGS-Thomson ST10 CPU?

Present: Ducati SBK 848 -08 and Honda CRF250RX -13
zeppo is offline  
post #3 of 30 (permalink) Old Nov 21st, 2018, 12:24 am Thread Starter
Member
 
Join Date: Aug 2015
Location: Uelversheim, , Germany
Posts: 75
Hi Zeppo,

I'm using IDAPro. The CPU is a ST10-269.

Marelli's library approach makes it (loosely speaking) quite easy to analyze all BINs used in 5AMs. So far I've done Guzzi 4V and 8V and Aprilia Mana, GP850 and SRV 850 BINs using this approach.

I thought this might be of interest as base for a community effort in the Ducati community; I'd be happy to share.

Cheers
Meinolf
Punch likes this.
Meinolf is offline  
 
post #4 of 30 (permalink) Old Nov 21st, 2018, 10:43 am
Member
 
zeppo's Avatar
 
Join Date: Mar 2016
Posts: 36
Cool! I want to look at the 848EVO CORSE and 1198SP ECU software (32A0A0... and 3220... resp). They are a good base for race-bikes (848/1x98 and 9XX conversions), includes quickshifter, possibility for basic traction control etc.

Present: Ducati SBK 848 -08 and Honda CRF250RX -13

Last edited by zeppo; Nov 21st, 2018 at 12:22 pm.
zeppo is offline  
post #5 of 30 (permalink) Old Nov 25th, 2018, 12:59 pm Thread Starter
Member
 
Join Date: Aug 2015
Location: Uelversheim, , Germany
Posts: 75
Hi,

Zeppo kindly sent the BINs and a XDF, so the exploration could proceed. It seems that the code section(s) which accesses the immobilizer byte is identified, hence future searches in other BINs can start with the code section and from there on quickly find the immobilizer byte.

The attached picture shows the subs in which the byte is used, one of them, btw, is a OBD function which can be queried with software such as Guzzi/IAWDiag. In the different subs the byte is compared to 1 and 3, so the value range seems to be 1-3.

The byte is also referenced in the sub which contains the dash text, which is sent from the ECU to the dash as part of a CANBus packet.

While studying above inevitably the other relevant subs and tables, scalars and bytes/flags, both in RAM and ROM, were looked at. I'll go thru the interesting subs (fuel, ignition, OBD, CAN, ADC, injector correction, etc, one by one in the next posts.

Cheers
Meinolf
Attached Thumbnails
Click image for larger version

Name:	sbk1198_DP_full_immobilizer1.JPG
Views:	64
Size:	80.3 KB
ID:	932705  
Meinolf is offline  
post #6 of 30 (permalink) Old Nov 26th, 2018, 6:32 am Thread Starter
Member
 
Join Date: Aug 2015
Location: Uelversheim, , Germany
Posts: 75
Hi,

let's begin with the fuel calculation. It begins with a look at the IdleFuelRPM legend and then branches, depending on the IdleFuel_en_dis_able_byte_48442 to the left, idle mode, or the right. The flag is used in quite a few subs, so I wouldn't change it before a more detailed analysis.

Then, depending on the value of tps_state_1_word_C6A6, the branch leads to the idle mode calculation using the IdleFuelTable_4D796, or the Mainfuel/Delta tables, depending on the value of cyl_num_byte_C9B0.
Attached Thumbnails
Click image for larger version

Name:	sbk1198_DP_fuelcalc1.JPG
Views:	32
Size:	167.4 KB
ID:	932767  
Meinolf is offline  
post #7 of 30 (permalink) Old Nov 26th, 2018, 6:36 am Thread Starter
Member
 
Join Date: Aug 2015
Location: Uelversheim, , Germany
Posts: 75
then the Lambda flags are evaluated. If set the different closed loop corrections - long and short term trims - are applied.
Attached Thumbnails
Click image for larger version

Name:	sbk1198_DP_fuelcalc2.JPG
Views:	27
Size:	164.0 KB
ID:	932769  
Meinolf is offline  
post #8 of 30 (permalink) Old Nov 26th, 2018, 6:38 am Thread Starter
Member
 
Join Date: Aug 2015
Location: Uelversheim, , Germany
Posts: 75
then the air temp/pressure and engine temp corrections are applied
Attached Thumbnails
Click image for larger version

Name:	sbk1198_DP_fuelcalc3.JPG
Views:	24
Size:	139.4 KB
ID:	932771  
Meinolf is offline  
post #9 of 30 (permalink) Old Nov 26th, 2018, 6:40 am Thread Starter
Member
 
Join Date: Aug 2015
Location: Uelversheim, , Germany
Posts: 75
another set of trims, which I don't understand, for each cylinder
Attached Thumbnails
Click image for larger version

Name:	sbk1198_DP_fuelcalc4.JPG
Views:	36
Size:	107.9 KB
ID:	932773  
Meinolf is offline  
post #10 of 30 (permalink) Old Nov 26th, 2018, 6:43 am Thread Starter
Member
 
Join Date: Aug 2015
Location: Uelversheim, , Germany
Posts: 75
now a check if the engine is still in warmup mode (<2000 revs since start) and use of the warmup trim if yes
Attached Thumbnails
Click image for larger version

Name:	sbk1198_DP_fuelcalc5.JPG
Views:	27
Size:	65.6 KB
ID:	932775  
Meinolf is offline  
Sponsored Links
Advertisement
 
Reply

Quick Reply
Message:
Options

Register Now



In order to be able to post messages on the Ducati.ms - The Ultimate Ducati Forum forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.

User Name:
Password
Please enter a password for your user account. Note that passwords are case-sensitive.

Password:


Confirm Password:
Email Address
Please enter a valid email address for yourself.

Email Address:
OR

Log-in










Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page
Display Modes
Linear Mode Linear Mode



Similar Threads
Thread Thread Starter Forum Replies Last Post
Data logging and mapping - info and questions Punch Tech Forum 342 Apr 14th, 2019 5:36 pm
2003 ST4s-Planning to install a 5AM ECU Stick Tech Forum 31 Mar 4th, 2019 6:00 am
MTS1000 or 1100 5AM bin without stepper motor anyone? Andreaz Multistrada 0 Apr 18th, 2018 1:38 pm
Ducati programmer Maxmach Ducati Motorcycle Chat 13 Jun 16th, 2017 1:15 pm
Technoresearch VDST Diagnostics tool - standard eyduc Parts and Accessories 8 Mar 24th, 2017 10:57 am

Posting Rules  
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On

 
For the best viewing experience please update your browser to Google Chrome