Magneti Marelli 8GMF - ASR Disable Part 1

ASR boost / torque reduction by intervention on Marelli 8GMF ECU - 1.4 MultiAir

• Software version: 3R05DC50
• Simplified ASR disable - applies to all of the driving modes, specific driving mode in Part 2
• Tools needed: WinOls / Hex Editor, Ghidra or IDA
• Difficulty: Hard if you don't have any expierence with disassembler.

1. Open flash binary in Ghidra, choose MPC8270 processor, in auto analyse option, mark aggressive instruction finder, press Analyse.

2. After complete initial analysis, You can set R13 register, it is the pointer for RAM, which is used in the code with offsets to read/write specific RAM address, but you can skip this part, as it's not necessary for modification, only for your information.

Finding RAM pointer in the code and setting it for static analyse:

1. Search Program Text for: "lis r13," - CTRL + SHIFT + E with checked "instruction mnemonics and instruction operands"

It should result in finding, begin of the code which sets r13 register at boot.

The function in this case "FUN_000220e0" contains also R2 register set, in some sw there can be second function like that, which is used in different mode. In normal mode of the ECU, You should be interested only in finding this function where R2 (resources pointer) is set @ 0x13xxxx.

So for this software version our R13 pointer will be 0x400095E8 (0x4000 0000 | 0x95E8) and R2 0x13206C (0x0013 0000 | 0x206C)

Press CTRL + A, then CTRL + R

Select R13 and value type 0x400095E8, press OK and same for R2, this will apply R13 to be this value for full flash binary. After that ReAnalyse the binary.

3. Patching torque recalculation of ASR/ESP intervention signal.

First address: 0x000b8b60 related to (Instantaneous ASR Torque Requested)

Second address: 0x000b8b78 related to (Predicted ASR Torque Requested)

At 0x000b8b60 press CTRL + SHIFT + G to open the assembler.

    000b8b60 7d 7a 58 50     subf       r11,r26,r11
    000b8b64 b1 6d a2 d8     sth        r11,-0x5d28(r13)=>DAT_400038c0 ; Instantaneous ASR Torque Requested

This is the original instruction, to R11 the recalculated value of torque request after ASR intervention is loaded then it's stored in specific RAM address, in this case it will be Instantaneous ASR Torque Requested. We will patch the subf instruction to load capped value of 0x2bc0, after factor correction it is 700Nm of torque request, in other words no limits from ASR request.

Patch it to:

    000b8b60 39 60 2b c0     li         r11,0x2bc0

Do same for Predicted ASR Torque Requested but keep in the mind for this the value from R12 is stored.

    000b8b78 7d 9a 60 50     subf       r12,r26,r12
    000b8b7c b1 8d a2 da     sth        r12,-0x5d26(r13)=>DAT_400038c2 ; Predicted ASR Torque Requested

Patch it to:

     000b8b78 39 80 2b c0     li         r12,0x2bc0

This how it looks after patch:

3. Disable general flag of ASR torque reduction request:

Address: 0x000cddd4

    000cddd4 38 e0 00 01     li         r7,0x1
    000cddd8 98 ed a9 4d     stb        r7,-0x56b3(r13)=>DAT_40003f35 ; ASR Active Flag
    000cdddc 98 ed a9 4f     stb        r7,-0x56b1(r13)=>DAT_40003f37 ; External Torque Reduction Request

Patch to:

    000cddd4 38 e0 00 00     li         r7,0x0

And this is all You need to disable Boost/Torque reduction while ASR intervention on 8GMF ECU, it is very similar in 8GMK but I will show it in next parts.

4. Save the project and You can export the full binary as file and import diffs with WinOLS or copy specific bytes to the WinOls or other hex editor.