![smash bros 3ds s smash bros 3ds s](https://www.ross-tech.com/vag-com/tour/704-screens/meas_blocks.png)
That's just the way my IDA is configured and won't make a difference. You may have spotted that the flash memory location is 0x0003 962C, but the snippet from IDA starts at 0x0043 962C.
Smash bros 3ds s code#
The last line jumps back to the main code where the measuring blocks are processed by the various functions that output the Measuring Blocks when requested by VCDS. This is the actual ram location that contains the Air Mass Flow. The code starts by loading ram location 0x7FEE48. The codes of interest for us are the first and last lines (lhz and b). In the above example, Air Flow Mass 0x000A (dec 10) is calculated at 0x0003 962C: The second table, Table 2, points out the flash memory location of the code that calculates the internal variable: This measuring block contains internal variables :Ĭhecking against the FR (Section 29.210.2 Testerkommunikation Meßwerte lesen), you can see the correlation.ġ0 mshfm_w (Luftmassenfluß / Air Mass Flow)ħ wdkba (Drosselklappenwinkel / Throttle Angle) Looking at Table 1 in the MED9.1 bin, Measuring Block 3 looks like this: From the VCDS label file 06F-907-115-AXX.lbl, you know that Measuring Block 3 contains:Ġ03,3,Throttle Drive,Angle Sensor 1,for EPC (G187) | Display Range: 0.100 % Also attached are a couple of pages from the FR showing what I'm talking about.įor example, let's say you read Measuring Block 3 with VCDS.
![smash bros 3ds s smash bros 3ds s](https://i.imgur.com/L91Px8e.jpg)
Smash bros 3ds s full#
The full tables are in the attached spreadsheet. I've shown just the first ten entries of each table below. This second table is laid out in the same order as the section describing the internal ECU variables in the FR - Section 29.210.2 Testerkommunikation Meßwerte lesen on page 4452. The second table has just one column which contains the flash memory address of the assembly code that actually calculates the measured value. The table doesn't contain actual values (it's flash after all), rather numerical pointers to a second table which has the flash memory addresses where the actual values are calculated. These are the four values you see in VCDS Measuring Blocks. In my flash, the first table is located at 0x001C 58C8 and consists of four columns. In the MED9.1 bin, there are two tables relating to measuring blocks. If your ecu turns into a pumpkin, I am not responsible! Also ensure that your flashing tool does a good job of checksums. Make sure you have a full backup (preferably BDM) before you start. I wouldn't suggest changing every bin you work on! But it could help if you are looking at something non-standard or want a value that isn't already in the standard measuring blocks. This alternative needs only VCDS and some changes to the MED9.1 bin.
![smash bros 3ds s smash bros 3ds s](http://lh3.ggpht.com/_C36J5jQvOdM/TOxcLALymMI/AAAAAAAAAHA/FFTrGP7vwLY/s576/Snap14.jpg)
Ram logging is my preferred option, but needs bespoke hardware and software.
Smash bros 3ds s how to#
I've posted some worked examples of exactly how to do this, but first a bit of background to explain. To be totally accurate, add ram locations to spare measuring blocks and then read these new measuring blocks with VCDS. Whilst working on a ram logger for MED9.1, it struck me that it could also be useful to use VCDS to read ram locations as well.