permanent cel disable

[Navybluesubaru]

cboles, I am not having any luck with disabling my DTC's. I have been trying to remove the following on my "A4SGA00C" :

__DTC______#Offset
03-0037___2E535 - 2E537
04-1086___2E695 - 2E697
04-1088___2E69D - 2E69F
04-1094___2E645 - 2E647

I replaced each one with "05 00 00" in HEX of course. They all still appear just as if I didnt do anything at all. Also, they each only appear once in the entire rom so there are no duplicates hiding around. Any suggestions?

Jeff

[diablerouge]

where do they show up? does the cel flash, or are you scanning for the codes after you've driven around a bit?

i think we're going to have to figure out where the value of the threshold for triggering a malfunction is located in memory and modify it so that even a really bad signal from the device wouldn't cause the ecu to think of it as a malfunction. it would be nice if we could step through code on a simulator, that would make it perfectly easy.

[Navybluesubaru]

I still see the DTCs in ecuExplorer. I assume that I dont have to "reset" the ecu because that is automatically done when reflashing, which I have done several times since entering the 500000 stuff and still no results.

Jeff

[crispyduck]

I still see the DTCs in ecuExplorer. I assume that I dont have to "reset" the ecu because that is automatically done when reflashing, which I have done several times since entering the 500000 stuff and still no results.

Jeff

... I expect you mean "050000"

[cboles]

cboles, I am not having any luck with disabling my DTC's. I have been trying to remove the following on my "A4SGA00C" :

__DTC______#Offset
03-0037___2E535 - 2E537
04-1086___2E695 - 2E697
04-1088___2E69D - 2E69F
04-1094___2E645 - 2E647

I replaced each one with "05 00 00" in HEX of course. They all still appear just as if I didnt do anything at all. Also, they each only appear once in the entire rom so there are no duplicates hiding around. Any suggestions?

Jeff

Could you email me a copy of your modified ROM file so that I can verify your changes?

[Navybluesubaru]

Well I disabled the utecs ability to hide the DTC dash light and it is not turned on by these codes. However, they do show up in ecuExplorer. I was hoping to eliminate them completely though.

Jeff

[calvinc]

please bear in mind that there is an issue with some ECU's and the dtc reading in ecuExplorer. it is reporting some dtc's that are not present. this only applies if you are getting like 16 dtc's that really do not look valid. if you're getting 1 or 2 then they are most likely valid.

calvin.

[diablerouge]

an update on the cel disable:
i have not tried to disable any cel's using the 0x05 00 00 method, but i did check the notes for my cobb stage 2 map, which lists the dtc's that cobb disables for your with those base maps. after checking my dtc vs. memory address spreadsheet, i found that cobb does not use this method to disable cel's. i've created a diff between stock and cobb maps, and i've been comparing the changes to weed out the map changes from the changes which could be code or other unidentified parameters.
if anyone has an xml definition or just an accurate and complete list of offsets for the a4sgd10c, it would help very much. there is a nice list of offsets for an 02-03 usdm ecu, but the offsets are not accurate for the a4sgd10c. anyone?

[Kha0S]

In my A4SG900C ECU, there's a subroutine at 0x0A5BC that seems to index into the CEL table and throw the codes based on what it finds... I'm working on picking apart the routine right now to get a handle on what it's doing.

[Kha0S]

Hey -- here's an idea...

Is ecuExplorer looking directly in RAM via SSM for DTCs, or is it going through the OBD-II protocol?

I have a hunch (and it's only a hunch) that the table we're editing is only for translating the DTC into a form that a standard OBD-II reader can pull...

[crispyduck]

Guys, to me the existing method is great and works well. I have confirmed this for the two CEL fixes I described in an earlier post. Have you found problems and/or limitations with the 0x050000 method?
-Steve.

[Kha0S]

Guys, to me the existing method is great and works well. I have confirmed this for the two CEL fixes I described in an earlier post. Have you found problems and/or limitations with the 0x050000 method?

Yes. A number of my codes (including P1086) are visible through ecuExplorer even when set to 050000 in the ROM.

[cboles]

From what I have seen, the table I'm referring to is a map between flag bit fields in memory to OBDII DTCs. Using the 05 00 00 techinique really only affects DTC and some CEL reporting (OBDII functions), not the actual internal flagging of errors states by the ECU code logic.

[Kha0S]

From what I have seen, the table I'm referring to is a map between flag bit fields in memory to OBDII DTCs. Using the 05 00 00 techinique really only affects DTC and some CEL reporting (OBDII functions), not the actual internal flagging of errors states by the ECU code logic.

That's what I'm seeing. There's a few other subroutines in there that query the table, but my brain has started leaking out of my ear trying to debug them... the confusing addressing with broken index registers is killing me. Oh, how I miss my HC12...

I'm going to try using a regular OBD-II scanner and compare its output to the SSM code scanners.

[akcel]

what happens if you find multiple instances?

im trying to locate cyl misfire 1 2 3 4 caused by my flywheel in the ecu via the hex editor the codes are p0301, p0302, p0303, p0304.

theres quite a few 04 03 01's so im not sure which to change 05 00 00

is there a certain area in the hex editor i should be more focused on? or are the dtc's all throughout the ecu?

thanks.

i havent actually received a cable yet, just messing around with dumps i've found on here to try and see if u can take what everyone is posting and apply it.