MS45 Catalyst Configuration (c_conf_cat)

Get detailed info on tuning your DME
Post Reply
Renovelo
Site Admin
Posts: 180
Joined: Thu Aug 08, 2013 7:02 pm

MS45 Catalyst Configuration (c_conf_cat)

Post by Renovelo »

In MS43, there is a parameter called "c_conf_cat" which is responsible for telling the DME what type of catalyst/exhaust configuration the vehicle has. Because MS43 was used in so many regions and applications, BMW put a switch in the DME that allowed for many different exhaust configurations. This is the parameter that allows for turbo tuning since one of the possible configurations is for a single pre-cat O2 sensor. This parameter exists in MS45 also, but it's not documented in terms of what are the possible values that are acceptable as well as the function of each value. We've dug into the disassembly to provide some insights to the community.

As soon as this value is loaded from ROM, it's stored in RAM and then checked to see if the value is 2 or not. If it is, it does some things with "lv_var_lsh_up" and "lv_var_lsh_down" which are other variables in RAM. Both of these variables are responsible for the catalyst/exhaust variant. If it's not 2, then it stores a value of 1 into "lv_var_lsh_up" and "lv_var_lsh_down".

In another function in the disassembly, it takes the value of "c_conf_cat" that it stored in RAM and checks to see if it's equal to 0 or 1. Again, the two RAM variables mentioned above come into play in this logic (as well as many other variables for this function).

In summary, valid values for "c_conf_cat" seem to be 0, 1, 2, and anything else above 2 (all values above 2 are treated equally). As far as "what do these values do?", that would require additional digging through the disassembly. Until then, we're hoping the MS45 community can experiment with these values and post more knowledge in this thread for others. Based on our knowledge and the experience of others who have tuned this parameter, it doesn’t seem to allow for conversion to a single pre-cat O2 sensor like it does in MS43.
BimmerLIFE
Posts: 2
Joined: Wed Dec 30, 2020 11:29 pm

Re: MS45 Catalyst Configuration (c_conf_cat)

Post by BimmerLIFE »

To add to this.

C_CONF_CAT

2= 2 upstream 2 downstream
1= auto learn of 2 upstream and 2 downstream
0=auto learn of 2 upstream with no downstream

There is no calibration option for single bank 02 sensor on ms45. A 1 byte change is needed in the program section
User avatar
josh@severntuning
Posts: 14
Joined: Thu Jul 11, 2019 8:12 pm

Re: MS45 Catalyst Configuration (c_conf_cat)

Post by josh@severntuning »

BimmerLIFE wrote: Wed Dec 30, 2020 11:36 pm To add to this.

C_CONF_CAT

2= 2 upstream 2 downstream
1= auto learn of 2 upstream and 2 downstream
0=auto learn of 2 upstream with no downstream

There is no calibration option for single bank 02 sensor on ms45. A 1 byte change is needed in the program section
I think the change needed is more than 1 byte.
Renovelo
Site Admin
Posts: 180
Joined: Thu Aug 08, 2013 7:02 pm

Re: MS45 Catalyst Configuration (c_conf_cat)

Post by Renovelo »

Changes to a single byte can be pretty powerful when it comes to hacking the OEM firmware. They can allow you to skip an entire part of a function. Here is an example from an important function in a MSS60 binary we're currently reverse engineering:

Image

See all of the red, green, and blue lines? These are possible flows for the logic. Red and green lines are for false and true paths after checking something (basically the result after an "IF" statement). The blue lines are simple branches (basically the equivalent of "GOTO" from old programming languages). A single byte change can force the code to always take one of these branches. For example, we could force the code to always take that green line which would skip almost half of the function in the middle with a single byte change. This is how many password hacks are done to computer software (always take the true path regardless of if the correct password is entered) ;) .

Now, having said all that, we also find it unlikely that a single byte would allow MS45 to properly think the engine is a single bank. For example, if deleting the 2nd bank, is the engine using the STFT and LTFT from Bank 1 on Bank 2? This would require more than a single byte change because this type of logic is likely not built into MS45 by default. Simply skipping a section of a particular function will not force Bank 2 to use Bank 1 trims. It might be possible to skip the section of a function responsible for applying the fuel trims to Bank 2 completely, but this obviously isn't the proper way.

However, we could be completely wrong about this. We haven't looked into this type of hack on MS45 yet.
BimmerLIFE
Posts: 2
Joined: Wed Dec 30, 2020 11:29 pm

Re: MS45 Catalyst Configuration (c_conf_cat)

Post by BimmerLIFE »

I am familiar with how the ecu works ;)

Technically speaking it’s more than a 1 byte change if you include the checksum and associated faults for rear O2 sensor not plugged in. This change uses the bank 1 O2 sensor to control trims for both banks.
Post Reply