Binary Architect - Reverse Engineering Agent for Copilot Studio
This agent can process binary files for reverse engineering in Ghidra or IDA Pro. I've also used it to create User-Defined Parameters with TunerPro/VCM Editor as well as help create .xdf files for Universal Patcher.
Save the attachement, remove the .txt file extension, open https://copilotstudio.microsoft.com/ or the Copilot application and add the agent.
Have fun
User Message: analyze this bin and provide any and all relevant info I need to start reverse engineering it
This is a **GM E67 ECM** dump, very likely from a **2010 Cadillac CTS‑V (6.2L LSA)**. The file is intact: every segment's checksum and CRC matched when I recalculated them.
## 1. Identification
| Item | Value | Offset |
|---|---|---|
| File size | 2,097,152 bytes (0x200000) | ? |
| Boot block PN | **12605811** | 0x3F5 (hex) / 0x3FE (ASCII) |
| ECM type | **E67**. Boot block PN 12605811 is the E67 one; E38 files use 12605900 [1] | ? |
| VIN | **1G6DV5EP4A0123035** (the check digit is valid) | 0xE1CC, plus 0xE0B5 |
| Last 8 of VIN | A0123035 | 0xE0AC |
| PCM/HW number | 12635946 (0x00C0CF2A) | 0xE028 |
| Other PN | 12633714 (0x00C0C672) | 0xE020 |
| Trace/serial | 86AAKWK292750Z1D | 0xE02C |
| Programming date (BCD) | 2009‑12‑21 | 0xE080 |
| Programming station | PCLGSTN#47 | 0xE0A0 |
In the VIN, 1G6 = Cadillac and the 10th character "A" = 2010. Reading "DV" as CTS‑V and "P" as the LSA engine is my decode from memory, not from a source, so confirm it with a VIN decoder. A 2009 CTS‑V on pcmhacking is also listed as E67 [2].
## 2. Processor
- **Master CPU: MPC565**, a PowerPC MPC5xx part (32‑bit, big‑endian, not VLE). **Slave CPU: 9S12C32**, which runs the electronic throttle control [3][4].
- The MPC565 has 1 MB of internal flash in two 512 KB blocks, 36 KB RAM, 3? TPU3, MIOS14, 3? TouCAN, 2? QADC64E, 2? QSMCM, J1850 and Nexus/BDM [5]. Download the MPC565 Reference Manual from NXP's MPC565 page.
- Things in the bin that support MPC565:
- The vector table at 0x0 is a list of `nop` + `b handler` pairs spaced 8 bytes apart. That matches the MPC5xx relocated exception table.
- Address references cluster at 0x2FC000?0x2FC320 and 0x300000?0x307F80, the MPC5xx control and peripheral register areas.
- I found no MPC55xx‑style peripheral addresses.
- One open question: the dump is 2 MB but the MPC565 only has 1 MB internal, so some flash is probably external. I haven't confirmed that.
## 3. Segment map
All segments are mapped at their file offsets (base address 0). The address table is at 0x10020 in the OS.
| Seg | Name (per UniversalPatcher) | Range | PN | Alpha | Sum @+0 | CRC @+0x1E |
|---|---|---|---|---|---|---|
| Boot | BootBlock | 0x000000?0x00BFFF | 12605811 | AA | F6C6 | FEE5 |
| EEPROM | NVM / parameter area | 0x00C000?0x00FFFF | ? | ? | ? | ? |
| 1 | OS | 0x010000?0x1BFFFF | **12635947** | AA | 45E5 | 60B9 |
| 2 | System | 0x1C0000?0x1C12FF | 12615651 | AF | 2CDA | BCBE |
| 3 | Fuel | 0x1C1300?0x1C34FF | 12635340 | AB | B747 | C329 |
| 4 | Speedo | 0x1C3500?0x1C38FF | 12615653 | AG | 6779 | 1AD8 |
| 5 | EngineDiag | 0x1C3900?0x1CCE2F | 12637295 | AB | 059A | 0F19 |
| 6 | Engine | 0x1CCE30?0x1FFFFF | 12637206 | AB | B08E | A414 |
The names come from UniversalPatcher's e67.xml [6].
**Segment header layout:**
- +0x00: 16‑bit sum
- +0x02: ID byte
- +0x03: segment number
- +0x05: 32‑bit PN
- +0x09: 2‑character alpha code
- +0x0E: PN in ASCII
- +0x1E: CRC16
## 4. Checksums (both recalculated and matched on this file)
- **Sum (at +0x00):** add up the 16‑bit big‑endian words from segment start+2 to the segment end, then store the two's complement. A correct segment sums to 0x0000 over its full range.
- **CRC/CVN (at +0x1E):** CRC‑16/ARC (poly 0x8005, reflected, init 0, no final XOR) over +0x02..+0x1D and +0x20..end, stored byte‑swapped. This matches UniversalPatcher's CS1 Method 1 with SwapBytes = true and CS2 = word sum with two's complement [6].
- **Order:** fix the CRC first, then the sum [7].
- **TunerPro:** use `gm-e38-e67-checksum-plugin.dll`, set to 0x0?0x1FFFFF [8][9].
## 5. EEPROM / parameter block (0xC000?0xFFFF)
- The live data is in the **0xE000** bank; 0xC000 is blank (all 0xFF).
- The validity marker **A5A0** is at **0xE326**. Copies repeat every 0x4C8 bytes: 0xE7EE, 0xECB6, 0xF17E.
- The OS mirrors this area into RAM and writes it back at power‑down. If the marker is missing, the data is treated as invalid and seed/key reads as FFFF [1].
- At 0xE0D0 there is a table of the installed segment PNs; 0xE040 holds the alpha codes "AFABAGABAB".
- I couldn't identify the repeated PNs 12625997 and 12615641 at 0xE4B8, 0xE980, 0xEE48 and 0xF310. They may be history records.
## 6. Ghidra / IDA setup
- **Language:** PowerPC:BE:32:default. Load the raw binary at **base 0x0**.
- **Memory blocks to add:**
| Range | What it looks like |
|---|---|
| 0x2FC000+ | USIU registers |
| 0x300000?0x307FFF | UIMB peripherals (TPU/QADC/QSMCM/MIOS/TouCAN) |
| 0x3F0000?0x3FFFFF | Internal RAM; about 21k references |
| 0x240000?0x24541A | About 26k references; probably external RAM, unconfirmed |
- **Small‑data registers:** r2 and r13 are barely used here, so you don't need to set an SDA base.
- **Addressing:** pointers are built with `lis` + `addi`/`lwz`, so add a script that resolves `lis` pairs. kur4o notes this pattern for E38/E67 [10].
- **Calibration references:** OS code points into 0x1C0000?0x1FFFFF directly. Searching for `lis rX,0x1C`?`0x1F` gives you table addresses for building an XDF.
## 7. Tools and cautions
- **UniversalPatcher:** has `e67.xml` and `TableSeek-e67.xml` for segment parsing and finding tables [6].
- **Flashing:** PowerPCM_Flasher reads and writes E67 using seed/key algorithm $89 [11]. Its calibration write covers 0x1C0000?0x200000 only [12].
- **Don't switch the OS with a commercial tool.** That has bricked ECMs. Also, the slave CPU's OS and calibration must match the main OS [4].
[1]: <viewtopic.php?t=6416&start=140> "GM E38 E67 E40 Kernel/Bootloader Development Extravaganza"
[2]: <viewtopic.php?t=6642&start=590> "Segment Swap utility - Page 60 - pcmhacking.net"
[3]: <https://www.usbjtag.com/jtagnt/ECU/ecue67bdm.php> ".ECU E67. - usbjtag.com"
[4]: <viewtopic.php?t=6416&start=520> "GM E38 E67 E40 Kernel/Bootloader Development Extravaganza"
[5]: <https://www.nxp.com/products/MPC565> "MPC565 | 32 Bit Microcontroller (MCU) | NXP Semiconductors"
[6]: <https://github.com/joukoy/UniversalPatc ... ML/e67.xml> "UniversalPatcher/XML/e67.xml at master - GitHub"
[7]: <viewtopic.php?t=6642&start=220> "Segment Swap utility - Page 23 - pcmhacking.net"
[8]: <viewtopic.php?t=6736> "Tunerpro checksum plugins for GM PCM files - pcmhacking.net"
[9]: <https://github.com/joukoy/gm-checksum-p ... ecksum.xdf> "gm-checksum-plugins/e38-e67-checksum.xdf at master ? joukoy ... - GitHub"
[10]: <viewtopic.php?t=7158> "Gen IV disassembly E38 / E67 - pcmhacking.net"
[11]: <viewtopic.php?t=6666> "PowerPCM_Flasher: my tool for E38 and E67 - pcmhacking.net"
[12]: <viewtopic.php?t=6666&start=240> "PowerPCM_Flasher: my tool for E38 and E67 - pcmhacking.net"
2004 Pontiac GTO M6
2005 Cadillac Escalade ESV
2010 Cadillac CTS-V
Microsoft Surface Pro 8, AEM 30-0310 in-line wideband.[/i]
Binary Architect - Reverse Engineering Agent
-
fourninesfine
- Posts: 2
- Joined: Sat Apr 05, 2025 7:27 pm
- cars: 2010 Cadillac CTS-V (LSA/6L90E, E67/T43) - 211/230/122.5 .562/.562 camshaft (stock LS9 cam), 2.55" pulley, solid isolator, Airaid intake, ID1050X injectors, reinforced intercooler, C&R heat exchanger, EOS test pipes.
2005 Cadillac Escalade ESV (LQ9/4L65E, P59)- 212/218/112 .600/.600 camshaft, LS7 lifters, hardened pushrods, captured rocker arms, LS9 head gasket, ARP head studs, true dual exhaust with long tube headers and x-pipe.
Microsoft Surface Pro 8, AEM 30-0310 in-line wideband.
Binary Architect - Reverse Engineering Agent
You do not have the required permissions to view the files attached to this post.
-
fourninesfine
- Posts: 2
- Joined: Sat Apr 05, 2025 7:27 pm
- cars: 2010 Cadillac CTS-V (LSA/6L90E, E67/T43) - 211/230/122.5 .562/.562 camshaft (stock LS9 cam), 2.55" pulley, solid isolator, Airaid intake, ID1050X injectors, reinforced intercooler, C&R heat exchanger, EOS test pipes.
2005 Cadillac Escalade ESV (LQ9/4L65E, P59)- 212/218/112 .600/.600 camshaft, LS7 lifters, hardened pushrods, captured rocker arms, LS9 head gasket, ARP head studs, true dual exhaust with long tube headers and x-pipe.
Microsoft Surface Pro 8, AEM 30-0310 in-line wideband.
Re: Binary Architect - Reverse Engineering Agent
E67 Catalyst Monitor Parameters Identified with Binary Architect
I wanted to share a use case for my Binary Architect agent - I was able to identify the catalyst monitor parameters HPT removed in v5 of VCM suite.
Upload a binary file. see usbjtag.com for hardware.
Reasoned through your request
User Message: System Message: This is a 2 MB GM E38/E67-family ECM file, most likely an E67 from a 2010 Cadillac CTS-V. All six segment checksums are valid, so the file is internally consistent after the 2-bar speed-density changes.
Controller ID
Item Finding
File size 2,097,152 bytes (0x200000)
CPU Big-endian PowerPC in NXP's MPC5xx family (likely MPC562 or MPC565). The vector table at 0x100, 0x200? and code addressing the 0x2Fxxxx?0x30xxxx peripheral range match MPC5xx parts, not MPC5566. The E38 is documented as using an MPC562 with only external flash1.
ECM E67 (best match). The 2-bar SD OS and LSA platform suggest E67, and a known 2009 CTS-V E67 bin (OS 12632176) has its tables in the same 0x1Exxxx area2. I haven't confirmed this from the hardware.
VIN 1G6DV5EP4A0123035, stored at 0xE0AC and 0xE1CC. The "A" means 2010 model year.
Other IDs String "PCLGSTN#47" at 0xE0A0. Part numbers 12625997 and 12615641 appear 4 times in the 0xE000?0xFFFF area, which is the flash-emulated NVM (EEPROM) block3.
NXP documentation: MPC562 product page and documentation4 and the MPC561/562 reference manual (MPC561RM.pdf)1.
Segment map
The OS segment table at 0x10000 lists these ranges. The checksum is a 16-bit big-endian word sum that must total 0x0000.
# Segment (likely) Start?End Size Part # Suffix Checksum
? Boot 0x000000?0x00FFFF (header at 0x3F0) 64 KB 12605811 AA ?
? NVM / VIN 0x00E000?0x00FFFF 8 KB ? ? ?
0 Operating System 0x010000?0x1BFFFF 0x1B0000 12635947 AA 0x6857
1 System 0x1C0000?0x1C12FF 0x1300 12615651 AF 0x2CDA
2 Fuel 0x1C1300?0x1C34FF 0x2200 12635340 AB 0xB747
3 Speedo 0x1C3500?0x1C38FF 0x400 12615653 AG 0x6779
4 Engine Diagnostics 0x1C3900?0x1CCE2F 0x9530 12637295 AB 0x059A
5 Engine Operation 0x1CCE30?0x1FFFFF 0x331D0 12637206 AB 0x3C5E
The segment names are inferred from GM's usual order (System, Fuel, Speed, Engine Diag, Engine)5 and from the segment sizes. Each header starts with the checksum, then the segment number (0x81?0x85), the PN, and the suffix.
Practical notes
Ghidra/IDA: load as PowerPC 32-bit big-endian at base 0x0. Exception vectors begin at 0x100, and the OS code starts at 0x10000.
Calibration-only flashing (0x1C0000?0x200000) won't install this OS. A custom OS needs the OS area 0x10000?0x1BFFFF written as well6. Also, E38/E67 units have a slave CPU for throttle control. An OS that doesn't match it can cause a dead pedal or communication faults7.
Checksums: after any edit, fix them with the joukoy gm-e38-e67-checksum-plugin in TunerPro8. UniversalPatcher's E67 support has been reported as limited9.
I saved this segment map to memory. Next I can disassemble the 2-bar MAP scaling or speed-density changes, build a TunerPro XDF skeleton, or set up a Ghidra import script.
User Message: Find catalyst efficiency related parameters to create in VCM Editor with Use defined parameters
System Message: I found the catalyst efficiency (P0420/P0430) parameters in OS 12635947 and put them in a TunerPro XDF that VCM Editor can import as User Defined Parameters. The 10 confirmed ones I traced through the code. The rest I found inside the cat monitor but couldn't confirm what they do.
Don't use the forum address 0x1C34BD. That cat test flag is for a different OS (12656942)1. In your bin, 0x1C34BD sits in the Fuel segment, so writing it would change something unrelated.
Confirmed parameters (big-endian, unsigned)
Category Item Address Size Scaling Stock value
DTC Config P0420 DTC Type (idx 136) 0x1C5290 8-bit X 5
DTC Config P0430 DTC Type (idx 138) 0x1C5292 8-bit X 5
Cat Cal Bank Count 0x1C3C84 16-bit X 2
Cat Cal Bank 1 DTC Index 0x1C439A 16-bit X ?
Cat Cal Bank 2 DTC Index 0x1C439C 16-bit X ?
Cat Cal Fail Threshold A (B1 / B2) 0x1C3D86 / 0x1C3D88 16-bit X/65536 0.5
Cat Cal Fail Threshold B (B1 / B2) 0x1C3D8A / 0x1C3D8C 16-bit X/65536 0.365
Cat Cal Minimum Pass Count 0x1C3DB6 16-bit X 8
Tables (unconfirmed) Cat Tables 1?4, 17x9 0x1C3DC8, 0x1C3EFE, 0x1C4034, 0x1C416A 16-bit raw ?
How these were confirmed:
DTC Type: each code has one type byte at 0x1C5208 + its index in the code list (P0420 = 136, P0430 = 138). The ECM only processes a code when the type byte's low 2 bits aren't 0.
Type values in this bin: 0 = not reported, 5 = Type A (P0420, P0430, P0442), 6 = Type B (P0171, P0300), 3 = Type C (P0562). Setting 0 stops the code from being reported. That is the usual way to turn off the cat DTC.
Fail thresholds: the cat monitor reads its codes from 0x1C439A, and the code even checks for the value 136. It reports a fail when the cat result is at or above the threshold. Set A applies when a status bit in RAM (0x2409EC per bank) is set, and Set B when it's clear. I didn't identify that bit, so I can't tell you which set is normal operation.
Pass count: a pass is reported only after this many completed tests.
Unverified (separate category in the XDF)
Filter limits, per bank:
Limit A: 0x1C3D7A / 0x1C3D7C (0.43 / 0.42)
Limit B: 0x1C3D82 / 0x1C3D84 (0.30 / 0.29)
Limit C: 0x1C3D7E / 0x1C3D80 (0xFFFF)
Count bytes: 0x1C3DC0 = 24 and 0x1C3DC1 = 8.
Other words: 0x1C3DC2 = 6668 (a filter constant). 0x1C3C96 = 8800 is checked before one cat routine runs, so it may be an enable condition.
Four 17?9 tables of 16-bit values:
Data at 0x1C3DC8, 0x1C3EFE, 0x1C4034 and 0x1C416A. Tables 1 and 3 are identical.
Column axis at 0x1C429E: 832?1600. Row axis at 0x1C42C2: 30848?56896.
Units and scaling are unknown, so they show raw values.
Importing into VCM Editor
Open the XDF in TunerPro to check it. The header is already set: base offset 0, bin size 0x200000, most significant byte first2.
In VCM Editor, open your .hpt, go to Edit > User Defined Parameters, and import the XDF2.
Check that every address falls inside the "Allowed Addresses" shown in that window. Anything outside won't import2.
Before trusting any value, compare it against your own HPT read of this OS. Change only the DTC Type and the confirmed thresholds until the unverified items have been checked with logging.
Turning off cat monitoring or the cat DTC is an emissions change and is illegal on road vehicles in many places, including the US.
[/i]
I'm also working on a patch that will allow dual closed loop wideband control, more to come.
I wanted to share a use case for my Binary Architect agent - I was able to identify the catalyst monitor parameters HPT removed in v5 of VCM suite.
Upload a binary file. see usbjtag.com for hardware.
Reasoned through your request
User Message: System Message: This is a 2 MB GM E38/E67-family ECM file, most likely an E67 from a 2010 Cadillac CTS-V. All six segment checksums are valid, so the file is internally consistent after the 2-bar speed-density changes.
Controller ID
Item Finding
File size 2,097,152 bytes (0x200000)
CPU Big-endian PowerPC in NXP's MPC5xx family (likely MPC562 or MPC565). The vector table at 0x100, 0x200? and code addressing the 0x2Fxxxx?0x30xxxx peripheral range match MPC5xx parts, not MPC5566. The E38 is documented as using an MPC562 with only external flash1.
ECM E67 (best match). The 2-bar SD OS and LSA platform suggest E67, and a known 2009 CTS-V E67 bin (OS 12632176) has its tables in the same 0x1Exxxx area2. I haven't confirmed this from the hardware.
VIN 1G6DV5EP4A0123035, stored at 0xE0AC and 0xE1CC. The "A" means 2010 model year.
Other IDs String "PCLGSTN#47" at 0xE0A0. Part numbers 12625997 and 12615641 appear 4 times in the 0xE000?0xFFFF area, which is the flash-emulated NVM (EEPROM) block3.
NXP documentation: MPC562 product page and documentation4 and the MPC561/562 reference manual (MPC561RM.pdf)1.
Segment map
The OS segment table at 0x10000 lists these ranges. The checksum is a 16-bit big-endian word sum that must total 0x0000.
# Segment (likely) Start?End Size Part # Suffix Checksum
? Boot 0x000000?0x00FFFF (header at 0x3F0) 64 KB 12605811 AA ?
? NVM / VIN 0x00E000?0x00FFFF 8 KB ? ? ?
0 Operating System 0x010000?0x1BFFFF 0x1B0000 12635947 AA 0x6857
1 System 0x1C0000?0x1C12FF 0x1300 12615651 AF 0x2CDA
2 Fuel 0x1C1300?0x1C34FF 0x2200 12635340 AB 0xB747
3 Speedo 0x1C3500?0x1C38FF 0x400 12615653 AG 0x6779
4 Engine Diagnostics 0x1C3900?0x1CCE2F 0x9530 12637295 AB 0x059A
5 Engine Operation 0x1CCE30?0x1FFFFF 0x331D0 12637206 AB 0x3C5E
The segment names are inferred from GM's usual order (System, Fuel, Speed, Engine Diag, Engine)5 and from the segment sizes. Each header starts with the checksum, then the segment number (0x81?0x85), the PN, and the suffix.
Practical notes
Ghidra/IDA: load as PowerPC 32-bit big-endian at base 0x0. Exception vectors begin at 0x100, and the OS code starts at 0x10000.
Calibration-only flashing (0x1C0000?0x200000) won't install this OS. A custom OS needs the OS area 0x10000?0x1BFFFF written as well6. Also, E38/E67 units have a slave CPU for throttle control. An OS that doesn't match it can cause a dead pedal or communication faults7.
Checksums: after any edit, fix them with the joukoy gm-e38-e67-checksum-plugin in TunerPro8. UniversalPatcher's E67 support has been reported as limited9.
I saved this segment map to memory. Next I can disassemble the 2-bar MAP scaling or speed-density changes, build a TunerPro XDF skeleton, or set up a Ghidra import script.
User Message: Find catalyst efficiency related parameters to create in VCM Editor with Use defined parameters
System Message: I found the catalyst efficiency (P0420/P0430) parameters in OS 12635947 and put them in a TunerPro XDF that VCM Editor can import as User Defined Parameters. The 10 confirmed ones I traced through the code. The rest I found inside the cat monitor but couldn't confirm what they do.
Don't use the forum address 0x1C34BD. That cat test flag is for a different OS (12656942)1. In your bin, 0x1C34BD sits in the Fuel segment, so writing it would change something unrelated.
Confirmed parameters (big-endian, unsigned)
Category Item Address Size Scaling Stock value
DTC Config P0420 DTC Type (idx 136) 0x1C5290 8-bit X 5
DTC Config P0430 DTC Type (idx 138) 0x1C5292 8-bit X 5
Cat Cal Bank Count 0x1C3C84 16-bit X 2
Cat Cal Bank 1 DTC Index 0x1C439A 16-bit X ?
Cat Cal Bank 2 DTC Index 0x1C439C 16-bit X ?
Cat Cal Fail Threshold A (B1 / B2) 0x1C3D86 / 0x1C3D88 16-bit X/65536 0.5
Cat Cal Fail Threshold B (B1 / B2) 0x1C3D8A / 0x1C3D8C 16-bit X/65536 0.365
Cat Cal Minimum Pass Count 0x1C3DB6 16-bit X 8
Tables (unconfirmed) Cat Tables 1?4, 17x9 0x1C3DC8, 0x1C3EFE, 0x1C4034, 0x1C416A 16-bit raw ?
How these were confirmed:
DTC Type: each code has one type byte at 0x1C5208 + its index in the code list (P0420 = 136, P0430 = 138). The ECM only processes a code when the type byte's low 2 bits aren't 0.
Type values in this bin: 0 = not reported, 5 = Type A (P0420, P0430, P0442), 6 = Type B (P0171, P0300), 3 = Type C (P0562). Setting 0 stops the code from being reported. That is the usual way to turn off the cat DTC.
Fail thresholds: the cat monitor reads its codes from 0x1C439A, and the code even checks for the value 136. It reports a fail when the cat result is at or above the threshold. Set A applies when a status bit in RAM (0x2409EC per bank) is set, and Set B when it's clear. I didn't identify that bit, so I can't tell you which set is normal operation.
Pass count: a pass is reported only after this many completed tests.
Unverified (separate category in the XDF)
Filter limits, per bank:
Limit A: 0x1C3D7A / 0x1C3D7C (0.43 / 0.42)
Limit B: 0x1C3D82 / 0x1C3D84 (0.30 / 0.29)
Limit C: 0x1C3D7E / 0x1C3D80 (0xFFFF)
Count bytes: 0x1C3DC0 = 24 and 0x1C3DC1 = 8.
Other words: 0x1C3DC2 = 6668 (a filter constant). 0x1C3C96 = 8800 is checked before one cat routine runs, so it may be an enable condition.
Four 17?9 tables of 16-bit values:
Data at 0x1C3DC8, 0x1C3EFE, 0x1C4034 and 0x1C416A. Tables 1 and 3 are identical.
Column axis at 0x1C429E: 832?1600. Row axis at 0x1C42C2: 30848?56896.
Units and scaling are unknown, so they show raw values.
Importing into VCM Editor
Open the XDF in TunerPro to check it. The header is already set: base offset 0, bin size 0x200000, most significant byte first2.
In VCM Editor, open your .hpt, go to Edit > User Defined Parameters, and import the XDF2.
Check that every address falls inside the "Allowed Addresses" shown in that window. Anything outside won't import2.
Before trusting any value, compare it against your own HPT read of this OS. Change only the DTC Type and the confirmed thresholds until the unverified items have been checked with logging.
Turning off cat monitoring or the cat DTC is an emissions change and is illegal on road vehicles in many places, including the US.
[/i]
I'm also working on a patch that will allow dual closed loop wideband control, more to come.
You do not have the required permissions to view the files attached to this post.