Before we get underway, A few Disclaimers.
I offer this post as educational informational overview of how to find and define tables. I do not condone disabling any Emissions Equipment or bypassing any features in HPT.
Tune at your own risk, I do not take responsibility for any misuse of this information. I do not take responsibility for bad calibrations or adjusting things that should not be adjusted
Locating and defining tables from raw binary is difficult to say the least. This post is an overview of how the process works a surface level overview, not a bullet proof guidebook. If you are interested in trying to find tables that are not normally available, this is a starting point. This path is difficult and takes a lot more time than you would ever anticipate.
For Starters, you need to acquire a Binary file for the OS you are working with. I started with this Tuner pro Archive that i found while searching.
https://forum.hptuners.com/showthread.php?88874-Tuner-Pro-XDF-and-Bin-archive
I was surprised to find a E92 Truck Binary file. It was this file that i started with. I was able to then play around with the Ghirda Decompiler. Using some help from folk over at pcmhacking i was able to successfully de compile the E92 Binary.
From here it was game on sorting through different tables and seeing what i could locate. I grabbed a matching hpt file from the HP tuners repository to allow myself to cross reference more known tables.
To cross reference a table, you want to search the binary file for the values that you see in the table. A key piece though, these values could be in float notation or short notation or byte notation. They also normally have a range divisor involved. For example, if a value is of type short, that gives an integer range of 0-65535, or 0x0 to 0xFFFF. If the range divisor is 8, then the range becomes 0-8192 with .125 of increment precision. I have had the best luck by looking for the table RPM axis. As from my experience most RPM axis’s are in float formation. In Ghirda, searching for memory in tables is a click away. You select the notation, and put the data in order into the search box.
Skipping over intro to Hex. Once you locate a friendly table, you’ll want to find the corresponding Axis/data values. This can be very tricky, but for most tables having the de-compiled source helps out a ton here. if the source is de-compiled successfully, you will see a link to a function beside the start of the data set. This if clicked will show you the place where that data value is used in the source. I have found that the axis values are chosen right before the table values, which will lead you right to the placement in the binary for the other half of the table.
Okay!, so you have now located a Table in the raw binary. You’ll need to now locate this table in the OS you want to work with. The best way to accomplish this is to have the binary of the OS you want to work with. This may require purchasing Tools like Io Terminal in order to read the raw binary from the ECM.
You can cross reference between binary and HPT without having the binary of the OS, But it is tricky and a bit more complex to explain. The summary is that tables don’t move too far from home from source to source but can be very difficult to find still. Im going to save that piece for a different post going into cross referencing between binarys.
Now you have the location of a Table you have defined! You can take this table and insert it into a Tunerpro XDF file. This part should be mostly documented by Tunerpro. Then you simple load it up in HPT and check it out. This all takes a lot of trial and error and is way off the normal path.