| Here are some details on the corrupt 46P00 NA ROM that's floating around out there in case anyone else encounters it: The Z32 ROM is split into a 26kb code segment ($8000 to $E7FF) and 6kb data segment ($E800 to $FFFF). The corrupt part is in the code segment at addresses $8E09 to $8E0F, which is code involved with the O2 feedback system. It looks like this ROM was read over the CONSULT port and that a buffer read failed, repeating parts of the previous buffer. This resulted in a few op-codes being overwritten with corrupt data. The software used to read this ROM must not have had any error checking or checksum capabilities. Nissan actually included a great way to check for corruption via a checksum stored in the ROM. OEM ROMs *always* have correct checksums, so you can easily tell if any OEM chip has become corrupted. However, I've never seen an aftermarket chip with a proper checksum, so there is no way of knowing if those chips are corrupt without manually comparing files.
Here are the offending op-codes at ROM addresses $8E09 to $8E0F:
normal 46P00:
$27 $05 $FE $FE $EE $20 $08 corrupt 46P00:
$27 $7B $02 $53 $27 $36 $8E
Here is the disassembly including the adjacent instructions ($8E03 to $8E18)
normal 46P00: ROM:8E03 ldx byte_FF06
ROM:8E06 tim #2, byte_53
ROM:8E09 beq loc_8E10 ; $27 $05
ROM:8E0B ldx byte_FEEE ; $FE $FEEE
ROM:8E0E bra loc_8E18 ; $20 $08
ROM:8E10
ROM:8E10
ROM:8E10 loc_8E10:
ROM:8E10 tst byte_148A
ROM:8E13 beq loc_8E18
ROM:8E15 ldx byte_FF0C
ROM:8E18
ROM:8E18 loc_8E18:
corrupt 46P00:
ROM:8E03 ldx byte_FF06
ROM:8E06 tim #2, byte_53
ROM:8E09 beq loc_8E86 ; $27 $7B
ROM:8E09 ; ---------------------------------------------------------------------------
ROM:8E0B fcb 2
ROM:8E0C fcb $53
ROM:8E0D fcb $27
ROM:8E0E fcb $36
ROM:8E0F fcb $8E
ROM:8E10 ; ---------------------------------------------------------------------------
ROM:8E10 tst byte_148A
ROM:8E13 beq loc_8E18
ROM:8E15 ldx byte_FF0C
ROM:8E18
ROM:8E18 loc_8E18:
the corrupt code:
ROM:8E09 beq loc_8E10 ; $27 $05
ROM:8E09 beq loc_8E86 ; $27 $7B <-- $27 is the opcode for 'beq' (branch if equal to zero), and $7B is 'tim' (test immediate). It looks like there is a byte missing for the 'beq' instruction, and that the previous 'tim 2, byte_53' instruction was repeated. This is causing the 'beq' instruction at address $8E09 to incorrectly branch to $8E86 instead of $8E10, resulting in the O2 system malfunction.
|
