RomRaider

HELP!

Need to disable DCTs for P0037 and P0057 for rear O2 sensors - I have decats and removed the sensors!

It's a JDM ECU so position flags are already off. But still getting these codes.

There is only DCT List 1 available which doesnt show these! See attached.

What am I missing??? need this sorted ASAP!

Determining the correct DTC addresses is the most difficult part of ROM analysis.

So how do you have it available on RR and I don't?

Because I develop definitions myself, and you don’t.

I already warned you not to use DTC disabling in the A2L template

Yes, well you are right there.

Ok well I didn't use any of the DTC disabling from the A2L.xml as P0037 and P0057 don't show up.
Glad you told me that as i probably would have if it displayed.

So what iv done is unlink CF020.xml from CF115.xml.
I copied all the table defs from CF115 into CF020 and then directly ref to A2L.

I'm led to believe all the secondary O2 DTC's are in Location: @ 0xCC00.

So i inserted the below into CF020 -

<table type="1D" name="Secondary O2 Sensor - DTC Disable" category="Secondary O2 Sensor Patch" storagetype="uint8" size="32" storageaddress="0xCC00" userlevel="1">
<description>Secondary O2 Sensor DTC Disable Mask</description>
</table>

If I set this to 0 it should disable all the DTC's related to the secondary O2's?
Yes, no, maybe?

Don't try to kill the engine with random addresses.

Don't try to kill the engine with random addresses.[/quote]

Ok, i used chatgpt plus to perform a proper disassembly under IDA Pro with SH7058 plugin and then Ghidra + SuperH SH-2A processor plugin for all DTC related to the secondary O2's and catalyst efficiency.

✅ What we did:
Disassembled the CF020.bin provided.
Found the diagnostic subroutine reading these addresses directly.
Verified the bit-tests responsible for setting the DTCs.
Confirmed that setting these bitfields to 00 00 00 00 will fully disable them.

Below results confirmed.

Address Controls Disabling Effect
0x7C2A0 Rear O2 Sensor DTCs (P0138, P0158, P0140, P0160) Disable Rear O2 voltage and activity codes
0x7C2A4 Catalyst Efficiency DTCs (P0420, P0430) Disable Catalyst Efficiency codes
0x7C2A8 Rear O2 Heater DTC (P0037) Disable Rear O2 Heater Bank 1
0x7C2AC Rear O2 Heater DTC (P0057) Disable Rear O2 Heater Bank 2

So its telling me to zero out the first 4 byte on hex editor HxD and that will disable it all.

Does this sound about right?

Artificial intelligence has deceived you.

Can you be a bit more helpful pls?
Why wouldnt that work doing it on hex editor?

Do i need the Bitwise support for RomRaider to get this working on RR?

I can see only DTC List 1 is displayed on RR, there are many more in the A2L.

Whats stopping this from working?

So after many hours of disassembly, analysis and verification with ChatGPT - this is what we have.

How the XML entries were verified — Summary
- Loaded the CF020 ROM into disassembler (SH7058 platform)
- Traced real ECU logic that runs Rear O2 sensor and heater diagnostics
- Found exact addresses used by the ECU:
- 0xC000 → DTC enable bitfield
- 0xC054 → Rear O2 Sensor Diagnostic Enable
- 0xC058 → Rear O2 Heater Diagnostic Enable
- Matched each bit position to a specific DTC or diagnostic function
- Built the XML entries to reflect exactly how the ECU accesses and uses those bits

Summary:
Table | Address | Bits | Verified?
Secondary O2 DTC 1 | 0xC000 | 6–15 | yes
Secondary O2 DTC 2 | 0xC000 | 16–19 | yes
Sensor Diag Enable | 0xC054 | 0 = B1, 1 = B2 | yes
Heater Diag Enable | 0xC058 | 0 = B1, 1 = B2 | yes

<table name="Secondary O2 DTC 1" storageaddress="0xC000"/>
<table name="Secondary O2 DTC 2" storageaddress="0xC000"/>
<table name="Rear O2 Sensor Diagnostic Enable" storageaddress="0xC054"/>
<table name="Rear O2 Heater Diagnostic Enable" storageaddress="0xC058"/>

<table type="BitwiseSwitch" name="Secondary O2 DTC 1" category="Options//DTCs//Lists" storagetype="uint32">
<bit position="6" name="P0137 O2S2B1 circuit low voltage"/>
<bit position="7" name="P0157 O2S2B2 circuit low voltage"/>
<bit position="8" name="P0138 O2S2B1 circuit high voltage"/>
<bit position="9" name="P0158 O2S2B2 circuit high voltage"/>
<bit position="10" name="P0139 O2S2B1 slow response"/>
<bit position="11" name="P0159 O2S2B2 slow response"/>
<bit position="12" name="P1146 O2S2B1 overvoltage"/>
<bit position="13" name="P1166 O2S2B2 overvoltage"/>
<bit position="14" name="P1147 O2S2B1 undervoltage"/>
<bit position="15" name="P1167 O2S2B2 undervoltage"/>
<description><!--zSecondaryO2DTC1--></description>
</table>

<table type="BitwiseSwitch" name="Secondary O2 DTC 2" category="Options//DTCs//Lists" storagetype="uint32">
<bit position="16" name="P0037 O2S2B1 heater circuit low"/>
<bit position="17" name="P0057 O2S2B2 heater circuit low"/>
<bit position="18" name="P0038 O2S2B1 heater circuit high"/>
<bit position="19" name="P0058 O2S2B2 heater circuit high"/>
<description><!--zSecondaryO2DTC2--></description>
</table>

<table type="BitwiseSwitch" name="Rear O2 Sensor Diagnostic Enable" category="Options//DTCs//Lists" storagetype="uint32">
<bit position="0" name="Rear O2 Sensor B1 Diagnostic Enable"/>
<bit position="1" name="Rear O2 Sensor B2 Diagnostic Enable"/>
<description><!--zRearO2SensorDiagEnable--></description>
</table>

<table type="BitwiseSwitch" name="Rear O2 Heater Diagnostic Enable" category="Options//DTCs//Lists" storagetype="uint32">
<bit position="0" name="Rear O2 Heater B1 Diagnostic Enable"/>
<bit position="1" name="Rear O2 Heater B2 Diagnostic Enable"/>
<description><!--zRearO2HeaterDiagEnable--></description>
</table>


Please advise if this will work??

This won't work. Your bit addresses are wrong.

Please advise if this will work??[/quote]
This won't work. Your bit addresses are wrong.[/quote]

Aww man... so near yet so far lol

This is fun though; I'm enjoying learning this or at least trying too.

You only mentioned the bits were wrong, so would it be right to assume the storage addresses are correct?
So only need to focus on getting the correct bits.

The analysis noted there are four knock sensor DTC's included in this - so obviously cant just disable it all.
It also found the rear O2 Diagnostic Enables - not sure if you have that or can comment/verify it?

It would be greatly appreciated if you did provide the correct details, but I really hope you would confirm if I eventually did get it right?

While typing this, I got AI to recheck/reverify the bit positions - it's still convinced these bits are 100% correct.

Each DTC was:
Traced through its diagnostic logic,
Matched to its associated bit test instruction,
Confirmed to check a specific bit position in the DTC enable bitmask at 0xC000.

ahhhhhhh

Cheers

This is the retrace result; Basically, starts at Bit 0 rather than Bit 6. Correct?

<table type="BitwiseSwitch" name="Secondary O2 DTC 1" category="Options//DTCs//Lists" storagetype="uint32">
<bit position="0" name="P0137 O2S2B1 Circuit Low Voltage"/>
<bit position="1" name="P0157 O2S2B2 Circuit Low Voltage"/>
<bit position="2" name="P0138 O2S2B1 Circuit High Voltage"/>
<bit position="3" name="P0158 O2S2B2 Circuit High Voltage"/>
<bit position="4" name="P0139 O2S2B1 Slow Response"/>
<bit position="5" name="P0159 O2S2B2 Slow Response"/>
<bit position="6" name="P1146 O2S2B1 Overvoltage"/>
<bit position="7" name="P1166 O2S2B2 Overvoltage"/>
<bit position="8" name="P1147 O2S2B1 Undervoltage"/>
<bit position="9" name="P1167 O2S2B2 Undervoltage"/>
<description><!--zSecondaryO2DTC1--></description>
</table>

<table type="BitwiseSwitch" name="Secondary O2 DTC 2" category="Options//DTCs//Lists" storagetype="uint32">
<bit position="10" name="P0037 O2S2B1 Heater Circuit Low"/>
<bit position="11" name="P0057 O2S2B2 Heater Circuit Low"/>
<bit position="12" name="P0038 O2S2B1 Heater Circuit High"/>
<bit position="13" name="P0058 O2S2B2 Heater Circuit High"/>
<description><!--zSecondaryO2DTC2--></description>
</table>

<table type="BitwiseSwitch" name="Rear O2 Sensor Diagnostic Enable" category="Options//DTCs//Lists" storagetype="uint32">
<bit position="0" name="Rear O2 Sensor B1 Diagnostic Enable"/>
<bit position="1" name="Rear O2 Sensor B2 Diagnostic Enable"/>
<description><!--zRearO2SensorDiagEnable--></description>
</table>

<table type="BitwiseSwitch" name="Rear O2 Heater Diagnostic Enable" category="Options//DTCs//Lists" storagetype="uint32">
<bit position="0" name="Rear O2 Heater B1 Diagnostic Enable"/>
<bit position="1" name="Rear O2 Heater B2 Diagnostic Enable"/>
<description><!--zRearO2HeaterDiagEnable--></description>
</table>

<table name="Secondary O2 DTC 1" storageaddress="0xC000"/>
<table name="Secondary O2 DTC 2" storageaddress="0xC000"/>
<table name="Rear O2 Sensor Diagnostic Enable" storageaddress="0xC054"/>
<table name="Rear O2 Heater Diagnostic Enable" storageaddress="0xC058"/>

I wrote everything I can in PM.

No — you absolutely did not.
What you did is exactly what you always do: circle threads looking for an angle to push private messages and extract money from people who don’t know better.

Here’s the message you sent me — let’s just put it in full view:

"Subject: URGENT HELP! - 350Z CF020 REAR O2 DISABLE
You need to contact the user memberlist.php?mode=viewprofile&u=46604 he will be able to transfer your payment to cryptocurrency. I have been working with him for a long time and he will not refuse you. You can also ask him about the correctness of the definitions I develop. The cost of determining the DTC of your bin is $70."

And let's not forget your previous "sales tactics" (threats) of raising prices to secure a deal.

"Message subject: Re: HELP with ECU defs for CF020 - 2005 JDM 350Z VQ35DE AT
Next time I will raise the price by 50% in a week."

This is like the third time you’ve tried this on me — and from the look of your history, it’s clearly your entire playbook on this forum:
Reply first, offer just enough to bait interest, then drop the payment hook.

You didn’t verify anything.
You didn’t ask what I’d already tested.
You didn’t even acknowledge that I had the correct information — you just ignored it and pivoted straight into your crypto-payment hustle.

It’s painfully obvious at this point that your goal isn’t to contribute, it’s to monetize confusion — preying on less experienced/knowledgeable users and trying to position yourself as the gatekeeper.

Let’s be clear:
This forum was built for community, knowledge sharing, and mutual support.
Not for someone to swoop in, slap a pricetag on every thread, and treat open-source collaboration like a vending machine.

And here’s the real kicker:

Even someone like me — who’s still learning (a dumb dumb) — can figure this out with a little time, effort, and the right AI tools.
You’re not a gatekeeper. You’re just a paywall.

I sincerely hope the moderators take a closer look at your behavior across the board — because this isn’t an isolated incident. It’s a pattern.

For everyone else looking to disable secondary O2 sensors on CF020 - The last insert above works:

- Disable all Rear O2-related DTCs
- Disable both Rear O2 diagnostic enables (sensor + heater)
- Verified on my own car:

Disabling only P0037/P0057 was not enough — they came back after ~20 mins
Full disable = no MIL, no DTCs after long drive
See screenshot for table configuration — tested and confirmed working.

Let’s keep this forum about empowerment, not gatekeeping.
Happy tuning.