Looking for DME BIN files

[Tom]

I looked into it many years ago. Like you, I tried to adjust the idle speed and nothing changed, so I forgot about it until now. I haven't felt the need to change idle speed, so it hasn't been a priority.

I spend way too much on ChatGPT looking for idle RPM control in the BIN. ChatGTP-5, deep research mode, etc. Tried many logical BIN edits to no avail. After trying everything, I had ChatGPT examine the actual code and code a very thorough report on how it works, all of which seemed credible. Best guess is that Rogue's XDF idle RPM locations 'might' alter idle in RoW cars, but not in on US DME/BINS. Here's the last paragraph of ChatGPT's analysis...


Bottom line: The idle speed on the 944 Turbo’s DME is essentially built into the firmware logic. The known addresses from the Rogue XDF either point to code or minor constants that the code overrides. That’s why editing them had no effect on actual idle RPM. One would need to go deeper – altering the assembly routine or using a custom firmware – to truly change the idle target. Otherwise, the only reliable way to adjust idle is the old-school method: tweak the base idle screw (if minor change needed) or trick the ECU sensors (not recommended). For a software solution, a disassembler and understanding of the ML3.1’s idle control algorithm are required. In summary, the idle is controlled by multiple interdependent routines with hardcoded assumptions, making simple scalar tuning ineffective – the ECU keeps returning the engine to ~840 RPM by design.

edit: see subsequent discussion below -- looks like ChatGPT was wrong about this... see 4 cells starting at x05F5

[johnb]

I only skimmed the rest of the thread so I'm not sure what you're trying to do with the idle speed. Can someone fill me in on that? I might be able to help. I haven't dived into the DME code to anything like the same extent as I have for the KLR but it is a similar thing and I think I have a few notes somewhere.

[Tom]

I only skimmed the rest of the thread so I'm not sure what you're trying to do with the idle speed. Can someone fill me in on that? I might be able to help. I haven't dived into the DME code to anything like the same extent as I have for the KLR but it is a similar thing and I think I have a few notes somewhere.

Well, the rogue Tuning XDF contains a small table that purports to control idle RPM based on coolant temp. Changing these cells does not do anything, however, at least on US cars with a fixed 840 rpm. I've been hunting and pecking trying to find the 'right location' to adjust the idle, but I wasn't able to find it. I spent a lot of time having ChatGPT look at the BIN and suggest possible locations, and none of those worked either. ChatGPT even wrote a little routine it placed in unused memory to inject a new rpm value after the code generated it, to no avail. ChatGPT concluded that there were multiple control mechanisms going on that were hard coded (timing, ISV, AFR). If helpful I can send you the full ChatGPT assessment...

(P.S., I'd be very interested in getting my hands on an EU or RoW BIN, to see if the idle control logic could be borrowed and used in a US DME without losing closed loop AFR control etc. I suspect, but don't know, that Rogue's idle locations would control idle on those DME's).

[johnb]

I only skimmed the rest of the thread so I'm not sure what you're trying to do with the idle speed. Can someone fill me in on that? I might be able to help. I haven't dived into the DME code to anything like the same extent as I have for the KLR but it is a similar thing and I think I have a few notes somewhere.

Well, the rogue Tuning XDF contains a small table that purports to control idle RPM based on coolant temp. Changing these cells does not do anything, however, at least on US cars with a fixed 840 rpm. I've been hunting and pecking trying to find the 'right location' to adjust the idle, but I wasn't able to find it. I spent a lot of time having ChatGPT look at the BIN and suggest possible locations, and none of those worked either. ChatGPT even wrote a little routine it placed in unused memory to inject a new rpm value after the code generated it, to no avail. ChatGPT concluded that there were multiple control mechanisms going on that were hard coded (timing, ISV, AFR). If helpful I can send you the full ChatGPT assessment...

(P.S., I'd be very interested in getting my hands on an EU or RoW BIN, to see if the idle control logic could be borrowed and used in a US DME without losing closed loop AFR control etc. I suspect, but don't know, that Rogue's idle locations would control idle on those DME's).

Do you get higher idle speed at lower temps? Are you definitely getting 840rpm when the engine is up to temp? I ask because looking at the map, I don't see 840. I see 1600, 1080, 880 and 800. But I do see 840 at 0x1199 which is the location marked as "Idle RPM w/AC on" in that xdf file. So if you're really getting exactly 840, then I would guess it's coming form that location and not the map. Did you try changing that value?

[Tom]

I only skimmed the rest of the thread so I'm not sure what you're trying to do with the idle speed. Can someone fill me in on that? I might be able to help. I haven't dived into the DME code to anything like the same extent as I have for the KLR but it is a similar thing and I think I have a few notes somewhere.

Well, the rogue Tuning XDF contains a small table that purports to control idle RPM based on coolant temp. Changing these cells does not do anything, however, at least on US cars with a fixed 840 rpm. I've been hunting and pecking trying to find the 'right location' to adjust the idle, but I wasn't able to find it. I spent a lot of time having ChatGPT look at the BIN and suggest possible locations, and none of those worked either. ChatGPT even wrote a little routine it placed in unused memory to inject a new rpm value after the code generated it, to no avail. ChatGPT concluded that there were multiple control mechanisms going on that were hard coded (timing, ISV, AFR). If helpful I can send you the full ChatGPT assessment...

(P.S., I'd be very interested in getting my hands on an EU or RoW BIN, to see if the idle control logic could be borrowed and used in a US DME without losing closed loop AFR control etc. I suspect, but don't know, that Rogue's idle locations would control idle on those DME's).

Do you get higher idle speed at lower temps? Are you definitely getting 840rpm when the engine is up to temp? I ask because looking at the map, I don't see 840. I see 1600, 1080, 880 and 800. But I do see 840 at 0x1199 which is the location marked as "Idle RPM w/AC on" in that xdf file. So if you're really getting exactly 840, then I would guess it's coming form that location and not the map. Did you try changing that value?

No, that was actually my first clue those 4 values weren't being used. The care stays at 840 always. I'm sure I tried 0x1199 but will try it again to be sure. I actually tried brute force at one point and changed every hex 15 in the BIN (on the assumption the 840 is stored as a multiple of 40), to no avail.

[johnb]

Well, the rogue Tuning XDF contains a small table that purports to control idle RPM based on coolant temp. Changing these cells does not do anything, however, at least on US cars with a fixed 840 rpm. I've been hunting and pecking trying to find the 'right location' to adjust the idle, but I wasn't able to find it. I spent a lot of time having ChatGPT look at the BIN and suggest possible locations, and none of those worked either. ChatGPT even wrote a little routine it placed in unused memory to inject a new rpm value after the code generated it, to no avail. ChatGPT concluded that there were multiple control mechanisms going on that were hard coded (timing, ISV, AFR). If helpful I can send you the full ChatGPT assessment...

(P.S., I'd be very interested in getting my hands on an EU or RoW BIN, to see if the idle control logic could be borrowed and used in a US DME without losing closed loop AFR control etc. I suspect, but don't know, that Rogue's idle locations would control idle on those DME's).

Do you get higher idle speed at lower temps? Are you definitely getting 840rpm when the engine is up to temp? I ask because looking at the map, I don't see 840. I see 1600, 1080, 880 and 800. But I do see 840 at 0x1199 which is the location marked as "Idle RPM w/AC on" in that xdf file. So if you're really getting exactly 840, then I would guess it's coming form that location and not the map. Did you try changing that value?

No, that was actually my first clue those 4 values weren't being used. The care stays at 840 always. I'm sure I tried 0x1199 but will try it again to be sure. I actually tried brute force at one point and changed every hex 15 in the BIN (on the assumption the 840 is stored as a multiple of 40), to no avail.

Hmm I'm surprised that resulted in a working bin at all. I mean that would be bound to break something! I could have sworn my (totally stock) car idles higher when cold but it's been a while since I paid attention to it. Anyway if I can spot anything that might help I'll let you know.

[Tom]

Do you get higher idle speed at lower temps? Are you definitely getting 840rpm when the engine is up to temp? I ask because looking at the map, I don't see 840. I see 1600, 1080, 880 and 800. But I do see 840 at 0x1199 which is the location marked as "Idle RPM w/AC on" in that xdf file. So if you're really getting exactly 840, then I would guess it's coming form that location and not the map. Did you try changing that value?

No, that was actually my first clue those 4 values weren't being used. The care stays at 840 always. I'm sure I tried 0x1199 but will try it again to be sure. I actually tried brute force at one point and changed every hex 15 in the BIN (on the assumption the 840 is stored as a multiple of 40), to no avail.

Hmm I'm surprised that resulted in a working bin at all. I mean that would be bound to break something! I could have sworn my (totally stock) car idles higher when cold but it's been a while since I paid attention to it. Anyway if I can spot anything that might help I'll let you know.

Mine stays at 840 always. Curious if others see higher idle when cold? Mine is a CA spec car too, though the BIN started as the generic version found online. I'm using the Ostrich emulator so was able to change all the x15 entries one at a time. I did brick the DME a few times but the vast majority had no noticeable effect when just starting up the car and idling...

[johnb]

I found some interesting stuff about idle maps! The short version is:

* the maps are interpolated so the fact that they don't directly contain 840 doesn't mean much - it's half way between 2 of the values they do have

* there are 3 different maps that match this description in the DME. Rogue's XDF file only lists one. The 3 maps are all the same but they correspond to different regions/cat/o2 configurations.

The one used is controlled by something called a code plug... do you know about that and how yours is set?

If you just want to try editing the other maps, the locations of the other two in raw hex values are 18E8 and 1B00, while Rogue's XDF file has the only the other one (corresponding to the US setup) at 1665.

Note that that XDF file has an offset of 4096 (decimal) at the top which is 1000h so the address shown for the map is 0x655. So the corresponding values that I presume you need are 0x8E8 and 0xB00. You should be able to see that these contain the exact same rpm values as the one Rogue references.

So my guess is your car is selecting one of the other maps. Here's all the info I have on the code plug thing:

Screenshot_2025-09-02_22-58-32.png (88.31 KiB) Viewed 833 times

This is from an annotated version of the disassembled BIN that I got using stuff from a project called opendme. I don't know if it's still active but the code is on sourceforge and it has the .ctl files that if you disassemble the bin with D52, you get these useful comments and hints on what various functions do. It's far from a comprehensive reverse engineering but it's a good start. I used a hex editor to find other examples of the same map, studied the map read function and worked backwards....and then found this comment that explains almost everything lol!

I don't trust these comments 100% but they have definitely helped me so far.

[Dave W.]

Thanks for the info and the inspiration, John!
I just found the real idle maps for my car. I'm using a 24 pin APE stage 2 chip as the base, so this might not apply directly to stock chips.
If you'd like to do a string search the stock code is 13 03 6D 27 4D 19 17 15.
Breakdown: 13 is memory location for ECT.
03 is the number of columns in the map.
6D 27 4D are the coolant temp breakpoints.
My notes are from ten years ago so this part might not be accurate, but my notes show the coolant temp works out to -45*F, 95*F, 174*F
Idle speeds are 1000, 920, 840.

I verified it by adding 5 and then subtracting 5 to the hex value and watched idle speed change. I was happy to see the level of vibration at idle decreased by raising idle speed to 880. I have a urethane filled trans mount that transmits extra vibes at idle.

This is why I leave the Emulator plugged in with a USB cable at all times.

[johnb]

Thanks for the info and the inspiration, John!
I just found the real idle maps for my car. I'm using a 24 pin APE stage 2 chip as the base, so this might not apply directly to stock chips.
If you'd like to do a string search the stock code is 13 03 6D 27 4D 19 17 15.
Breakdown: 13 is memory location for ECT.
03 is the number of columns in the map.
6D 27 4D are the coolant temp breakpoints.
My notes are from ten years ago so this part might not be accurate, but my notes show the coolant temp works out to -45*F, 95*F, 174*F
Idle speeds are 1000, 920, 840.

I verified it by adding 5 and then subtracting 5 to the hex value and watched idle speed change. I was happy to see the level of vibration at idle decreased by raising idle speed to 880. I have a urethane filled trans mount that transmits extra vibes at idle.

This is why I leave the Emulator plugged in with a USB cable at all times.

That's great info! I see that map in the stock chip at 15F9. The idle values themselves begin at 15FE so for that XDF file it should be 0x5FE (3 values) @Tom

There are tons of NTC dependent maps, many of them containing rpm values and they're looked up all over the code. I wonder what the other 3 are really for? I can see they're used and that they depend on that code plug thing.

EDIT: I think I'm starting to understand it now...that map listed as idle rpm in the XDF file (and the other 2 I found like it) are not really rpm values. I'm pretty sure they are load values. These might be the baseline open loop ISV values by engine temp, so that the idle control code only has to make small adjustments.