Recently I had some free time and want to make a small update to this topic with a very successful outcome.
First I tried to trick the main relay diagnosis with calibration changes and was able to get rid of all main relay DTC.
But the main issue, the throttle body alignment procedure still failed due to DTC P1564 "Under-Voltage during Basic Setting".
A small look into the FR showed the math that was done to check for minimum voltage that is needed to start the alignment UB_UANL: ubuanlr := UB_UANL * SY_UBSQ_W
I looked for it inside the code of my 06A906032AR 0007 disassembly and was able to locate it very quickly in subroutine sub_842288 that takes care of the TBA.
loc_845C24:
F3 F6 B5 8A movb rl3, ubrsq ; Bordnetzspannung über Hauptrelais, Standard-Quantisierung
43 F6 E1 8A cmpb rl3, ubuanlr ; Spannungsschwelle für UMA-Learning in Quantisierung von ubrsq
FD 1B jmpr cc_ULE, loc_845C64 ; Relative Conditional Jump
Then I compared the size and look of that subroutine with my very incomplete disassembly of 4B0906018 0001 and found it to be sub_842288:
loc_842300:
F3 F6 B3 8A movb rl3, ub ; Batteriespannung
43 F6 D2 4E cmpb rl3, UB_UANL ; Integer Compare Byte
FD 1B jmpr cc_ULE, loc_842340 ; Relative Conditional Jump
I converted the logic of that to the AR version, and tested it in car, but it lead to DTC P1559 "Fault in basic settings" and decided to make a completely different approach.
There are three different voltages monitored:
wub - Battery voltage
wubr - Voltage measured at main relay output (Pin 121)
wuhr - Voltage measured at main relay control pin (Pin 21)
Then I checked for the subroutine that moves data into "wubr(_w)" and "wuhr" variables instead of utilizing it in the code and found sub_82F876 to be the ADC reading.
Its pretty easy to understand thanks to DAMOS and some handy scripts from this board its well described.
Here is the ADC read function for the relay voltages:
I decided to try what happens when I directly copy the battery voltage byte "wub" to "wubr" and "wuhr" and word "wub_w" to "wubr_w" like this:
loc_82F9FC:
F3 F4 BA 89 movb rl2, wub ; Batteriespannung; vom AD-Wandler erfaßter Wert
F7 F4 BB 89 movb wubr, rl2 ; Batteriespannung über Hauptrelais; vom AD-Wandler erfaßter Wert
F7 F4 BC 89 movb wuhr, rl2 ; Ansteuerspannnung am HR-Pin
F2 F4 E6 8F mov r4, wub_w ; Batteriespannung; vom AD-Wandler erfaßter Wert (16Bit aus 10Bit-Erfassung)
F6 F4 E4 8F mov wubr_w, r4 ; Batteriespannung über Hauptrelais ; ADC- Wert (16Bit aus 10Bit-Erfassung)
DB 00 rets ; Return from Inter-Segment Subroutine
And it was a success!
Without having to manipulate the main relay calibration, the throttle body alignment finished and the car started right up and runs perfect!
Now you can finally enjoy a completely defined firmware on early, cheap ME7s. I will attach binaries and XDF (including patch) that will work plug and play.
Maybe it'll help someone.
