Hate speed were cutted.
You can't pay to any programmer. You haven't money for this. Nobody will do this work for free. Also you know nothing about Russia, only your propagranda. Russia is a great contry. With great peoples. Your contry stole naciz work and scientist. Yes your contry drop amotic bomb to Heroshima and Nagassaki. Your contry opened so much wars in 20 centry. My contry won naciz with so much casualties. Your contry sat out across the ocean.
Dollar world expastion finishes at the moment. So go and vote for you sleeping Joe (and yes I know something about your contry instead of you). Read some realy independed press. Not controlled by you goverment. But you can't find this press. You leave in your information bubble. And nobody can burst your bubble except you. USA is not great contry. Just a bunch of resource thieves from all over the world. Ask yourself who steals oil in Siria? Aswer will be your government. Ask yourself: who knows about earthquake in Siria? Nobody. Maybe you know something about earthquake in Turkey. But it's in other side of Earth. You don't care about all these. You care only about you. So go and fuck yourself.

Will do, Thanks

Disabling rear lambda with ESKONF for 50WRHJ software.
ESKONF is at 0x1260E. Default value is 0C 00 3C FC 00 FC 33 (7 bytes length) I may be wrong about lengh it can be 6 bytes.
To disable rear lambda and rear lambda heater diagnostics you need to change ESKONF to next: 0C C0 3C FC 00 FF 33

I checked pre facelift cars and non R software. It looks like the bitpair pattern is the same. Second byte must be changed to C0 (6 and 7 bits must be set). And six byte's low two bits must be set.

Zloirock has done his best for free he deserves better yes.

More information on the Denso map format. The first byte is more like an opcode, depending on it's value, it either describing a 2D map, a 3D map or or can be instructed to load some data from one address to the RAM specified in the map description.

Addendum:
In VIDA I know it has a limitation of 10-14 parameters to be monitored at the same time. I want to make a logger, but in your opinion, at what point will the RAM addresses I monitor no longer be able to keep their relationship before the data has changed? CAN can only reply so fast before it's not fast enough.

Thank you rkam, I will research in how the 0xAA command works.

In the meantime I was looking for something specific in the ROM. It was the crank/flywheel value, or more specifically, where No1 piston was aka the crankshaft angle. I saw no mention of it in DHA and I decided to trace pin A48 which is the RAW signal from the Inductance or Hall effect crank/flywheel sensor.
The odd part was, that the raw sensor signal for Crank/Flywheel went to the secondary watchdog chip. I could've missed a branch to the main SH7055 chip, but so far I cannot find a direct connection, which if true and unless I missed it, means that the main chip is receiving the Crank Angle and RPM signal from the second chip.

Secondly, I started to discover what appears to be actual obfuscation of code and jump locations. I did not expect this at all. Perhaps this is what daniel meant.




The function above jumps to r3 + pc which appears like junk bytes, but it's code hidden among "junk" looking data. This is a fairly common obfuscation technique as the disassembler loses the reference point from which to disassemble instructions.
A lot more functions started to make sense now. I wonder if it is worth it to write a deobfuscator.

ROM from CPU2 in one ME7.

According to Sasha_A80 it is a special version of 68HC(9)16 made for Denso.
https://romraider.com/forum/viewtopic.php?f=40&t=8252&p=78123&hilit=bdm#p78123