MUT Commands Known?
Jul 12, 2009, 07:06 PM
#1
Evolving Member
Thread Starter
MUT Commands Known?
Does anyone have a complete list of the MUT Commands?
It would be helpful to figure things out in my disassembly.
Also what significance do the memory locations in the MUT table have for the MUT Commands?
So far I have:
DA-Disable Injector 1
DB-Disable Injector 2
DC-Disable Injector 3
DD-Disable Injector 4
DE-Disable Injector 5(Unused)
DF-Disable Injector 6(Unused)
F3-Clear Active Faults
FA-Clear Active and Stored Faults
FB-Force Tests to Run
Thanks very much for any help.
(Is the search function not working for everyone else right now??)
It would be helpful to figure things out in my disassembly.
Also what significance do the memory locations in the MUT table have for the MUT Commands?
So far I have:
DA-Disable Injector 1
DB-Disable Injector 2
DC-Disable Injector 3
DD-Disable Injector 4
DE-Disable Injector 5(Unused)
DF-Disable Injector 6(Unused)
F3-Clear Active Faults
FA-Clear Active and Stored Faults
FB-Force Tests to Run
Thanks very much for any help.
(Is the search function not working for everyone else right now??)
Jul 12, 2009, 09:25 PM
#3
http://evoecu.logic.net/wiki/MUT_Requests
We started talking about this over in this thread, if you want to join in.
We started talking about this over in this thread, if you want to join in.
Last edited by logic; Jul 12, 2009 at 09:31 PM.
Jul 12, 2009, 09:48 PM
#5
Evolving Member
Thread Starter
http://evoecu.logic.net/wiki/MUT_Requests
We started talking about this over in this thread, if you want to join in.
We started talking about this over in this thread, if you want to join in.
The Commands do the actuator tests, like turning on the fuel pump, set timing to 5 degrees, clear DTCs, etc.
Now that I looked things over more, the MUT Commands may be completely separate from the MUT Table.
Jul 13, 2009, 12:15 AM
#6
Evolved Member
Join Date: Mar 2008
Location: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Posts: 730
Likes: 0
Received 3 Likes
on
2 Posts
The only one that knows them for sure is Hamish (evo4mad). Maybe he can share his knowledge, but I doubt it. I personally would like to know them too - to save the disassembly effort. Anyway there is not that much CommandId's to sort out. The problem is that there is a couple of them handling immo - so I do not want to play with them.
Otherwise you always can sniff on EvoScan communication with the ecu - serial line sniffer.
Otherwise you always can sniff on EvoScan communication with the ecu - serial line sniffer.
Trending Topics
Jul 14, 2009, 01:14 AM
#8
Evolved Member
Join Date: Mar 2008
Location: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Posts: 730
Likes: 0
Received 3 Likes
on
2 Posts
Cannot tell more about it at the moment.
Jul 14, 2009, 07:45 AM
#10
Evolved Member
Join Date: Mar 2008
Location: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Posts: 730
Likes: 0
Received 3 Likes
on
2 Posts
I have gone thru Actuators they all seem to be within C0 - D8 MUT command range
It seems D5 is EGR actuator.
It seems D5 is EGR actuator.
Last edited by acamus; Jul 28, 2009 at 03:13 AM.
Jul 14, 2009, 10:17 AM
#11
Evolving Member
Thread Starter
Good info!
Do you know if the MUT Command's, memory lookup from the MUT Table have any any significance?
Or are the Table and Commands two separate things?
Do you know if the MUT Command's, memory lookup from the MUT Table have any any significance?
Or are the Table and Commands two separate things?
Jul 14, 2009, 12:16 PM
#12
Evolved Member
Join Date: Mar 2008
Location: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Posts: 730
Likes: 0
Received 3 Likes
on
2 Posts
MUT request range is from 01 to BF, so any MUT request higher than BF is not taken from MUT table. Some of them return values, but not from MUT table e.g.
EC-EF return CalibrationID bytes from (dword) F6A <- SH based code,
FE - returns Immo in case validation with ETACS is done and Periphery_0 & 0x8 is set,
FF - returns Init code in case validation with ETACS is done and Periphery_0 & 0x8 is set
Otherwise FE,FF returns SCC from (word) F8A <- SH based code, e.g. E4B7 as seen in EvoScan
Heh, looking at this post I am starting to believe I do not speak English anymore
EC-EF return CalibrationID bytes from (dword) F6A <- SH based code,
FE - returns Immo in case validation with ETACS is done and Periphery_0 & 0x8 is set,
FF - returns Init code in case validation with ETACS is done and Periphery_0 & 0x8 is set
Otherwise FE,FF returns SCC from (word) F8A <- SH based code, e.g. E4B7 as seen in EvoScan
Heh, looking at this post I am starting to believe I do not speak English anymore
Last edited by acamus; Jul 14, 2009 at 12:31 PM.
Jul 27, 2009, 07:15 AM
#13
Evolved Member
Join Date: Mar 2008
Location: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Posts: 730
Likes: 0
Received 3 Likes
on
2 Posts
Some insight to MUT actuators - 88590015 example
IDC command to create Actuator structure:
using Alt+Q one can get
Now the mask is applied at word values by index_of_actuator_word:
corresponding code is
I would like to spread the disassembly effort, so anyone who can read this can help out 
So knowing all this we should be able to sort them out.
Code:
auto id;
id = AddStrucEx(-1,"Actuator",0);
id = GetStrucIdByName("Actuator");
AddStrucMember(id,"index_of_actuator_word", 0X0, 0x000400, -1, 1);
AddStrucMember(id,"reserved", 0X1, 0x000400, -1, 1);
AddStrucMember(id,"bit_mask", 0X2, 0x10000400, -1, 2);
return id;
Code:
00009C3C 01 FF 04 00 Command_MUT_C0:Actuator <1, h'FF, h'400> 00009C40 01 FF 02 00 Command_MUT_C1:Actuator <1, h'FF, h'200> 00009C44 01 FF 00 00 Command_MUT_C2:Actuator <1, h'FF, 0> 00009C48 01 FF 00 00 Command_MUT_C3:Actuator <1, h'FF, 0> 00009C4C 01 FF 00 00 Command_MUT_C4:Actuator <1, h'FF, 0> 00009C50 01 FF 00 10 Command_MUT_C5:Actuator <1, h'FF, h'10> 00009C54 01 FF 00 00 Command_MUT_C6:Actuator <1, h'FF, 0> 00009C58 01 FF 00 04 Command_MUT_C7:Actuator <1, h'FF, 4> 00009C5C 01 FF 00 02 Command_MUT_C8:Actuator <1, h'FF, 2> 00009C60 01 FF 00 01 Command_MUT_C9:Actuator <1, h'FF, 1> 00009C64 00 FF 00 00 Command_MUT_CA:Actuator <0, h'FF, 0> 00009C68 01 FF 00 80 Command_MUT_CB:Actuator <1, h'FF, h'80> 00009C6C 00 FF 20 00 Command_MUT_CC:Actuator <0, h'FF, h'2000> 00009C70 00 FF 10 00 Command_MUT_CD:Actuator <0, h'FF, h'1000> 00009C74 00 FF 08 00 Command_MUT_CE:Actuator <0, h'FF, h'800> 00009C78 00 FF 04 00 Command_MUT_CF:Actuator <0, h'FF, h'400> 00009C7C 00 FF 02 00 Command_MUT_D0:Actuator <0, h'FF, h'200> 00009C80 00 FF 01 00 Command_MUT_D1:Actuator <0, h'FF, h'100> 00009C84 00 FF 00 82 Command_MUT_D2:Actuator <0, h'FF, h'82> 00009C88 00 FF 00 40 Command_MUT_D3:Actuator <0, h'FF, h'40> 00009C8C 00 FF 00 20 Command_MUT_D4:Actuator <0, h'FF, h'20> 00009C90 00 FF 00 10 Command_MUT_D5:Actuator <0, h'FF, h'10> 00009C94 00 FF 00 08 Command_MUT_D6:Actuator <0, h'FF, 8> 00009C98 00 FF 00 04 Command_MUT_D7:Actuator <0, h'FF, 4> 00009C9C 00 FF 00 02 Command_MUT_D8:Actuator <0, h'FF, 2>
Code:
FFFF6FE0 MUT_Command_Actuator_0:.res.b 2 FFFF6FE2 MUT_Command_Actuator_1:.res.b 2
Code:
000252DE 6A 13 mov r1, r10 000252E0 9B 70 mov.w @(h'E0,pc), r11 ; h'C0 000252E2 3A B8 sub r11, r10 000252E4 4A 08 shll2 r10 000252E6 DB 3C mov.l @(h'F0,pc), r11 ; Command_MUT_C0 000252E8 3B AC add r10, r11 000252EA 85 B1 mov.w @(2,r11), r0 000252EC 61 03 mov r0, r1 000252EE DB 3A mov.l @(h'E8,pc), r11 ; Command_MUT_C0 000252F0 6C 03 mov r0, r12 000252F2 60 A3 mov r10, r0 000252F4 02 BC mov.b @(r0,r11), r2 000252F6 62 2C extu.b r2, r2 000252F8 6C CD extu.w r12, r12 000252FA 2C C8 tst r12, r12 000252FC 8B 01 bf loc_25302 000252FE A1 3D bra loc_2557C 00025300 00 09 nop 00025302 62 2D extu.w r2, r2 00025304 42 00 shll r2 00025306 D0 38 mov.l @(h'E0,pc), r0 ; MUT_Command_Actuator_0 00025308 0A 2D mov.w @(r0,r2), r10 0002530A 2A 1B or r1, r10 0002530C 02 A5 mov.w r10, @(r0,r2)
So knowing all this we should be able to sort them out.
Last edited by acamus; Nov 4, 2009 at 09:57 PM.
Jul 27, 2009, 08:01 AM
#14
Evolved Member
Join Date: Mar 2008
Location: Lattitude 48.38°, Longitude 17.58°, Altitude 146m = Slovakia, for common dude
Posts: 730
Likes: 0
Received 3 Likes
on
2 Posts
Same command array can be found in X, for 5304010 at 84F0
Code:
000084F0 01 FF 04 00 Actuator <1, 0xFF, 0x400> 000084F4 01 FF 02 00 Actuator <1, 0xFF, 0x200> 000084F8 01 FF 00 00 Actuator <1, 0xFF, 0> 000084FC 01 FF 00 00 Actuator <1, 0xFF, 0> 00008500 01 FF 00 00 Actuator <1, 0xFF, 0> 00008504 01 FF 00 10 Actuator <1, 0xFF, 0x10> 00008508 01 FF 00 00 Actuator <1, 0xFF, 0> 0000850C 01 FF 00 04 Actuator <1, 0xFF, 4> 00008510 01 FF 00 02 Actuator <1, 0xFF, 2> 00008514 01 FF 00 01 Actuator <1, 0xFF, 1> 00008518 00 FF 00 00 Actuator <0, 0xFF, 0> 0000851C 01 FF 00 80 Actuator <1, 0xFF, 0x80> 00008520 00 FF 20 00 Actuator <0, 0xFF, 0x2000> 00008524 00 FF 10 00 Actuator <0, 0xFF, 0x1000> 00008528 00 FF 08 00 Actuator <0, 0xFF, 0x800> 0000852C 00 FF 04 00 Actuator <0, 0xFF, 0x400> 00008530 00 FF 02 00 Actuator <0, 0xFF, 0x200> 00008534 00 FF 01 00 Actuator <0, 0xFF, 0x100> 00008538 00 FF 00 82 Actuator <0, 0xFF, 0x82> 0000853C 00 FF 00 40 Actuator <0, 0xFF, 0x40> 00008540 00 FF 00 20 Actuator <0, 0xFF, 0x20> 00008544 00 FF 00 10 Actuator <0, 0xFF, 0x10> 00008548 00 FF 00 08 Actuator <0, 0xFF, 8> 0000854C 00 FF 00 04 Actuator <0, 0xFF, 4> 00008550 00 FF 00 02 Actuator <0, 0xFF, 2>
Last edited by acamus; Nov 4, 2009 at 09:58 PM.
Jul 27, 2009, 12:52 PM
#15
Evolving Member
iTrader: (4)
Join Date: Apr 2008
Location: Germany
Posts: 186
Likes: 0
Received 0 Likes
on
0 Posts
good stuff. I checked my disassembly.
CD, CE ac fan (hi/lo)
CF, D0 main fan (hi/lo)
D3 boost solenoid
D5 EGR solenoid
D7 Purge solenoid
CB maybe something with ALS
I don't have access to my car at the moment, it needs to be checked.
CD, CE ac fan (hi/lo)
CF, D0 main fan (hi/lo)
D3 boost solenoid
D5 EGR solenoid
D7 Purge solenoid
CB maybe something with ALS
I don't have access to my car at the moment, it needs to be checked.