I'd imagine you change the function that reads the eeprom bytes for immo to always take the immo off route, regardless of what is actually in the eeprom.
finding that in the disassembly is the hard part, though...
Should be pretty straight forward to look what is the immo values addresses to eeprom, then find out what is eeprom starting address at the memory map and used DPP page. From these calculate the whole address by which can search the disassembly and find where it is used at the code.
