**FOR EDUCATIONAL PURPOSES ONLY** Use on a test bench... I do not advocate using code modifications in cars that will drive above 1 MPH or will run the engine over 4 RPM. This document was prepared in responce to a question about code mods for anti-theft. The principles are there, but the specific function this code performs is not anti-theft. Dave Zug 1997 (uploaded 10.2000) dzug@delanet.com, dzug@eecis.udel.edu ___________________ Here are my Notes from the programming way back when: ___________________ tps valet pgm: "89TGPtps.bin" 2-27-97 D.Z. call to f800 subrt inserted after tps sensor read at a129. a129:bd f8 00 replaces ce 86 4f. f800: checks tps against value (2v+-), sets bit1 at 01a9 hi if "normal" mode call to f840 substituted at a9fd (before spark tabl ref) a9fd: bd f8 40 replaces ce 81 09 f840: checks status of bit1 at 01a9 to decide between table at 8109(norman) and f909 (duplicated normal, but re-altered.) ____________________ Here is the FACTORY code located after checksum and TPS read operations: A129: LDX #$864F ;Pointer to main spark Here is what I replaced it with: A129: JSR $F800 ;GoSub F800 - NEW TPS hi / lo detection routine Note that a few lines PRIOR to this code, TPS is read, stored in its RAM location, and exists in the "A" register. Note at the end of the F800 subroutine (specifically line F815) the original code appears. Since I simply (ha!) over-wrote bytes to force the subroutine call, after the subroutine executes I must execute the REPLACED code still. _______________________________ F800 Subroutine: My Subrt Called immediately after TPS RAM location is set, which is after checksum. ACC-A contains throttle pos variable. F800:CMPA #$20 ;is Throttle significantly open? F802:BHI $F80D ;NO, execute FACTORY setup for spark table selection F804:PSHX ;YES, Store x for later retrieval, cause x is needed in this subrt. F805:LDX #$01A9 ;01A9 is a FREE RAM BYTE location, unused by factory program. ;I use it to store binary result of TPS compare for later use. F808:BSET $00,X,00000001B ;Set Bit 1 in free ram byte TRUE since TPS > setting F80B:BRA $f814 ;Branch to location to prepare to exit subrt F80D:PSHX ;Begin FACTORY SPK table selection section F80E:LDX #$01A9 ;Free ram loc. preparing for setting it by loading X. F811:BCLR $00,X,00000001B ;Set BIT 1 in free ram byte FALSE since TPS < setting F814:PULX ;restore environment var F815:LDX #$864f ;must have code that was removed earlier (for room to insert ; the JSR) located at end of this subrt. F818: RTS ;Resume execution after last JSR instruction. ________________________________ F840 Subroutine: My Subrt executed before each time a main spark table lookup occurs. Decides wether the FACTORY main spark table (at #8109) or MY ALTERNATE Spark table (at #F909) will be used. (Note: locations $7F10 thru about $FFD0 were FREE on the chip for this 1227727 application) F840:LDX #$01A9 F843:BRSET $00,X,00000001B,$F84C ;Was TPS HI at KEY-ON? F847:LDX #$8109 ;NO, set pointer to FACTORY spark table F84A:BRA $F84F ;go to exit subrt F84C:LDS #$F909 ;YES, set pointer to NEW spark table F84F:RTS ;Return to sub caller (exit sub) ________________________________