for the past few weeks I was analyzing bunch of funktionsrahmen functions and found that to completely remove cat/sai/post cat o2 isn't that easy... Sure you can easily force READINESS to be PASSED but that doesn't mean that you are actually disabling functions. For starters  cat converter variables control even minimal ignition angle and NW functions.

I'll try to analyze everything and disable CAT/SAI/POSTCAT O2 in EVERY SINGLE FUNCTION....

For starters let's go to PROKONAL and disable all the usual bits:
CDHSH=0
CDHSHE=0
CDKAT=0
CDLASH=0
CDLSA=0
CDLSH=0
CDSLS=0

Now we go and change these maps:
CWKONABG=0
CWKONLS=1 (for 1 bank first o2 only)
CWLSHA=0
CWSLS=54 (gonna upload SLS function schematics later, but for now just leave this val)

Now let's analyze BBKHZ function (please look at the attached schematics). Too bad there's no complete BBKHZ schematics for turbo engine applications...

What about KFNWKHLLE and KFNWKHE from NWSOLLE? Only info I found about these is that these are enabled when fnwkhe=1. No info on how fnwkhe is set though...

I know this might be overkill and you can disable SLS, but for the sake of better understanding and practice I did complete shutdown of function, including every single map...

P.S> Since all the me7 functions are connected to each other, there are more maps to edit. Gonna keep you all posted if there's interest

Huge DSLSLRS function

CWDSLSY:
b0   b1   b2   b3   b4   b5   b6   b7
-----------------------------------------------------------
0     0     1     1     X     X     0     1     

CWDSLSA:
b0   b1   b2   b3   b4   b5   b6
---------------------------------------------------
1     0     1     1     1     1     0     

CWDSLSAD:
b0   b1
-----------
1      0

Yikes... need some sort of summary when you are all done.. that is a lot to digest

I'll try to sum up everything, but before that I really need your help in defining some variables to check if my logic is correct... Anyone's good with finding variables in memory using ida?

To completely be sure 100% I need someone to find addresses at least of these conditional variables (to 100% be sure of BBKHZ) (see attached file):
B_DSLA
B_FASLA [me7logger found]
B_KATFZ
B_KH [me7logger found]
B_KHA
B_KHAB [me7logger found]
B_KHLL [me7logger found]
B_KHLLE
B_KHLLMX
B_KHN
B_KW
B_LMSSLOF
B_MSLOFF [me7logger found]
B_SLPOFF [me7logger found]
B_SLSFZ
B_TRKH [me7logger found]

Additionally:
FKHAB
FLAKH [me7logger found]
FLAMKH
FMDKH [me7logger found]
IMLPR [me7logger found]
MLSU
NFSKH
NLLKH [me7logger found]

I started this to better understand logical schemes of FR. Also there are few things I want to do like fixing SAI -100% secondary air in VCDS and bunch of other things that we get when we zero out bits. Additionally I want to accelerate all the checks by setting their minimal active time to 0

Just to add some confirmation to the rear O2 code out, I just passed PA emissions inspection with flying colors with no rear O2 sensors.