Map Address Table - It is a table of 16 bit address where each map is located
	I have highlighted the first hex byte of the addressed in this map table. This pattern of sequential addresses is what you are looking for.

This is the 16-bit address table for maps or Map Table for a BMW 325i with a Motronic M1.3 ECU. Map Tables are usually surrounded by a few lines of FF. This is what I use to locate the table.

On the left, I did a search for FF and highlighted them in green. Between green areas is the Map Table. The address structure kind of jumps out at you. In the first few lines, note the pattern. Every other number is 4C. The 4C is the first half of a 16-bit address. The map table is address after another. I have the map address 4C06 highlighted in blue and the next map is at 4C20 then 4C2A and so on.

The entire Map Table extends from 4C00 to 6246.

I found 223 maps in this BMW 325i Motronic binary file. This is not to say that I have found 100% of them. The programmers often add maps for a specific car model that would not appear in this table.

Here are the first five maps as pointed to by the map address table. 4C00, 4C06, 4C20, 4C2A, and 4C32. Each map is highlighted in color. See, finding maps is not as hard as you first thought. Figuring out what the maps do is another story for another day.

Find One Map, Find'em All

Locating a single map will lead you to the location of the Map Jump Table. This works for almost all Motronic ECUs (not so much for OBDII based ECUs)

Map Table ( or Map Addressing Table. The maps hex address will be located somewhere in the code.

and can be bound doing a search for the he

	BMW 325i 0261200173 1267355705 Here, I have located a single map. I know nothing more at this point. I have determined the maps location as 5144h,.highlighted in red.
	Next, doing a search for 5144, I find this it highlighted here in green. This is the map table. It was just that simple. There is a pattern here. Starting at address 4860h, every other hex byte is 4C. This changes from 4C thru 62. The first map is located at 4C00h, the final map is at 6246h.
	I have highlighted the first hex byte of the addressed in this map table. This pattern of sequential addresses is what you are looking for. M2.10.1 only: I found that Porsche 968 and 993 has a code that marks the end of the map table. Doing a search for C40A finds the end of the map table. I only find this in M2.10.1 Motronic.

Sponsored by