You'll find the CEL LUT located after the SSM LUT in the ROM. It should follow something like this:
Code:
25h
1
0FBh
1
5
0
0
2
5
0
0
4
5
0
0
8
5
0
0
10
5
0
0
20
5
0
0
40
5
0
0
80
5
0
0
It will keep repeating the same pattern with the first number(25) going up for each 8 bits, this is the byte you're looking for. The bits are the other numbers you see that are not 5, 0, 0, they correspond to the mask on the byte in the logic. For example you might see the following code in the ROM:
Code:
bset 25h, z, #80
That would be setting the last CEL code in the example I gave. In the example though, I used all 5, 0, 0 which is a disabled or unused code. You would substitute in a real code, like 03/04 04 20 which would be a P0420. The 03/04 is decided by whether the code is a Subaru specific code or a general code I believe.
This should get you started, and you will uncover some logic where you will find CEL delays for many things. From there, you should keep following things around and you'll notice a few routines that keep popping up, those are probably some of the routines to parse the CEL LUT and throw the codes to the OBD-II readers. There is also one routine that handles all of the codes that will effect performance. It groups certain codes together into one single bit-check for use in other logic. For example, the TGV and OCV codes are grouped together in the Group-N ROM and used to change some knock correction related stuff.
Hope that helps!
Andy
