Code out DTC for post cat - what bytes do I change?

[E46m3zcp]

Here is a bit of context - advice regarding the context also appreciated.

I have an HPDE weekend coming up, one of the last this season. It's next week, and my car decided to tell me just now about bad post-cat O2 sensors (I get 92 Nachkatsonde 1 Spannungsueberw using INPA). I don't want to fuss around trying to get the parts on time and swap them. A post-cat O2 sensor is just a monitor for the cats, who cares?

I could go with the check engine light on, but I'd like to avoid that as it could hide a more serious DTC (if some popped up during the event) and I would not bother scanning it (assuming there's just the post-cat code).

I have BMWFlash and a HEX editor, how easy is it to code-out the DTC? Can anyone point me to the sequence of bytes to look for ? I would flash the original parameters once I get a chance to fix the O2 sensors.

Another question I have is how do I set the checksum after manually editing the binary file?

[Slideways]

TunerPro with the correct XDF for your ECU is an easier DIY tool than using a standard Hex editor. ECUWorks is the paid option and it has an easy interface with check boxes.

Related links:

https://nam3forum.com/forums/forum/special-interests/coding-tuning/99950-modifying-catalyst-efficiency-thresholds

https://github.com/saildot4k/MSS54-XDFs/wiki/Post-Catalytic-Converter-O2-Sensor-Delete

[E46m3zcp]

Thanks for the info. I feel comfortable with modifying binary files, I was wondering if anyone knew the bytes that need to be changed.

That ECU Worx tool is a bit expensive for a user-friendly way to flip bytes (unless you want to change maps, which can get a bit tricky - but disabling a DTC can't be that complicated, or can it?)

From your link I found this DTC Deletion Strategies · saildot4k/MSS54-XDFs Wiki · GitHub
There's also a link to a spreadsheet mapping the DTCs to their hex string (I think!) so all I should be missing is how to fix the checksum

[samthejam]

https://nam3forum.com/forums/forum/s...-obd-readiness

There are 4 methods, I can't remember which one still sets readiness, I remember it being one of them, maybe someone else can confirm:

Example DTC String: AA 01 01 01 01 01 01 00 01 02 03 28 01 FF

METHOD 1: The first method to suppress a DTC, and coincidentally also the easiest, requires only a simple modification of the DTC string by replacing the 13th byte with '00':

String:AA 01 01 01 01 01 01 00 01 02 03 28 00 FF

METHOD 2: The second method is to actually zero out the entire 14-byte string:

String:00 00 00 00 00 00 00 00 00 00 00 00 00 00

METHOD 3 (untested): The third method is to perform a hybridization of the previous two by zeroing out the first and 13th bytes of the 14-byte string:

String:00 01 01 01 01 01 01 00 01 02 03 28 00 FF

METHOD 4 : The fourth method is to substitute the following string for the entirety of the original string, exactly as has been done within other OEM binaries for OEM suppressed codes:

String:00 28 28 03 02 03 02 00 01 02 03 28 00 FF

[E46m3zcp]

Thanks, I got what I was looking for, except how to correct the checksum, that's all I'm missing (I think!)

[Slideways]

Thanks, I got what I was looking for, except how to correct the checksum, that's all I'm missing (I think!)

BMWFlash - "The checksum is automatically corrected on MSS52, MSS54, and MSS54HP before a flash occurs."

[E46m3zcp]

ahhh, ok! Good to know. Thanks. Sorry I missed that