Chapter 14 · Firmware Patching & Custom Features

Code Hooks & Patching

Memory segments, code caves, and five working firmware patches in assembly.

Calibration symbols

B_BREMS B_KUPPL KFZWTVS TABGBTS WDKUGDN CWSAWE ESKONF KFLBTS KFTVSA NMOT_W WPED_W CWBLS LAMFA LDRXN +5 more

ECUs covered

06A906032LP

Size

19 symbols · 1 diagram · ~1,527 words

Memory segments, code caves, and five working firmware patches in assembly.

Beyond calibrating static tables and 3D maps, advanced reverse engineering of Bosch ME7.5 enables the insertion of custom executable C167 machine code into the operating system. This allows the integration of modern motorsport capabilities—such as Stationary Launch Control (2-Step), Flat-Foot Shifting (No-Lift Shift), Rolling Antilag, and Left-Foot Braking throttle-cut deactivation—into factory 06A binaries.

All custom microcode implementations in this section adhere strictly to the architectural constraints verified in user:antigravity-verification.

14.1. Memory Segmentation & Code Cave Allocations#

When patching custom routines into a compiled 1024 KB AMD 29F800BB binary, existing function addresses must never be shifted, as this breaks absolute jump tables (JMPS), interrupt vector tables, and indirect function call graphs. Custom routines must be placed in code caves (unallocated padding regions filled with 0xFF bytes by the compiler):

VERIFIED C167CR CODE CAVE REGIONS (1024 KB ME7.5 FLASH)

Cave Name	Start Offset	End Offset	Size (Bytes)	Strategic Architectural Role
Cave 1 (Cal)	0x01DF00	0x01DFFF	256 Bytes	Ideal for fast scalar hooks (Launch/NLS)
Cave 2 (Ext)	0x07F800	0x07FAFF	768 Bytes	Multi-map switching & complex math tables
Cave 3 (Top)	0x0F0000	0x0F7FFF	32,768 Bytes	Complete standalone subsystem injections

C167CR Addressing Constraints#

DPP2 Segmentation for Internal RAM:
- Bit-addressable RAM (0x00FD00–0x00FDFF) is mapped via DPP3 = 0x0003.
- Operands must be prefixed with 0xFDxx (e.g. 0xFD08.2 for clutch switch B_kuppl).
DPP3 Segmentation for SFRs & Bit RAM:

14.2. Periodic Task Scheduler Interception Architecture#

The Bosch ME7.5 operating system executes cyclic control tasks triggered by C167 hardware timer interrupts:

B_10ms (10 ms Task Loop): High-frequency engine dynamics: engine speed calculation, ignition timing lookup, knock control retard, and main rev limiter comparison.
B_20ms (20 ms Task Loop): Air charge control: target torque translation, throttle plate servo control, and boost control PID loop.
B_100ms (100 ms Task Loop): Emissions monitors, fuel tank evaporative purge, and OBD-II readiness counters.

To execute custom logic deterministically, the engineer intercepts the nmax rev limiter comparator inside the B_10ms loop.

  Factory B_10ms Execution Path:
  ┌──────────────────┐       ┌──────────────────────┐       ┌────────────────────┐
  │ Read nmot_w      │ ────► │ Compare nmot >= nmax │ ────► │ Spark/Fuel Cut     │
  │ (RAM 0x380A90)   │       │ (Flash Scalar 0x11314)│      │ if over threshold  │
  └──────────────────┘       └──────────────────────┘       └────────────────────┘

  Patched Execution Path with Code Hook:
  ┌──────────────────┐       ┌──────────────────────┐       ┌────────────────────┐
  │ Read nmot_w      │ ────► │ CALLS 0x01, 0xDF00   │ ────► │ Evaluate Launch,   │
  │ (RAM 0x380A90)   │       │ (Hook to Code Cave 1)│       │ NLS, or Factory Lim│
  └──────────────────┘       └──────────────────────┘       └────────────────────┘

14.3. Feature 1: Stationary Launch Control / 2-Step Rev Limiter#

Functional Logic#

Read current vehicle speed vfzg from RAM 0x3809E8 (MOV R4, 0x89E8).
- Restore standard factory rev limit NMAX (6800\text{ rpm}).
Read clutch pedal switch F36 state (B_kuppl) from bit RAM 0xFD08.2.
If vfzg < 3 km/h AND B_kuppl == 1:
Else:

C167CR Disassembly & Assembly Implementation#

; ==============================================================================
; Custom Bosch ME7.5 Launch Control & 2-Step Routine (C167CR-LM)
; Location: Code Cave 1 (Flash Offset 0x01DF00 / Linear 0x81DF00)
; Intercepted from: B_10ms Rev Limit Routine
; ==============================================================================

            ORG     0x01DF00

Launch_Control_Hook:
            PUSH    R4                          ; Preserve working register R4
            PUSH    R5                          ; Preserve working register R5

            ; 1. Check Clutch Switch Status (B_kuppl: Bit 2 at SFR 0xFD08)
            JNB     0xFD08.2, Restore_Normal_Limit ; If clutch released, branch

            ; 2. Check Vehicle Speed (vfzg at RAM 0x3809E8 -> DPP2: 0x89E8)
            MOV     R4, 0x89E8                  ; Load 1-byte vfzg (speed in km/h * 1.25)
            AND     R4, #0x00FF                 ; Mask high byte
            CMP     R4, #0x0004                 ; Compare with threshold (4 * 1.25 = 5 km/h)
            JPR     cc_ugt, Restore_Normal_Limit ; If speed > 5 km/h, branch to factory limit

            ; 3. Stationary Launch Active -> Load Launch Rev Limit
            ; VNMAX_LAUNCH stored as u16 at 0x01DF50 (e.g. 4000 rpm / 0.25 = 16,000 = 0x3E80)
            MOV     R5, 0xDF50                  ; Load launch limit into R5
            MOV     0x8B14, R5                  ; Overwrite active rev limit buffer in RAM
            JPR     cc_UC, Exit_Hook

Restore_Normal_Limit:
            ; Restore factory NMAX scalar from Flash 0x011314
            MOV     R5, 0x1314                  ; Load stock NMAX (6800 rpm = 0x6A40)
            MOV     0x8B14, R5                  ; Restore active limit buffer in RAM

Exit_Hook:
            POP     R5                          ; Restore R5
            POP     R4                          ; Restore R4
            RETS                                ; Return to B_10ms task caller

; Calibration Scalars in Code Cave:
            ORG     0x01DF50
VNMAX_LAUNCH: DW    0x3E80                      ; 4000 RPM (16000 * 0.25)

14.4. Feature 2: Flat-Foot Shifting / No-Lift Shift (NLS)#

Functional Logic#

In manual transmission vehicles (02J / 02M), when shifting at wide-open throttle, releasing the accelerator pedal drops boost pressure and wastes shift time. Flat-Foot Shifting enables the driver to keep the accelerator pinned at 100% while depressing the clutch:

Conditions Required:
- Lock engine speed to an intermediate holding ceiling VNMAX_NLS (e.g. 5600\text{ rpm}).
- Suppress ignition dwell angle or clamp ignition timing to -10\text{° BTDC} for the duration of the shift (up to a timeout of 400\text{ ms}).
- The turbocharger remains fully spooled through the shift, eliminating boost lag upon clutch re-engagement.
Action:

14.5. Feature 3: Left-Foot Braking (LFB) Throttle Cut Deactivation#

Factory Defect for Performance Driving#

In factory ME7.5 calibrations, pressing the brake pedal while simultaneously applying throttle sets internal flag B_brems. The torque manager immediately commands a throttle cutoff by zeroing driver requested load mifa, frustrating drivers who utilize left-foot braking on track to balance vehicle rotation or spool a turbocharger before corner exit.

Patching Options#

Calibrated Deactivation (CWBLS Codeword): In mature 24B binaries (06A906032LP), find codeword CWBLS (Codeword for Brake Light Switch plausibility) at offset 0x0182E4. Setting CWBLS = 0x00 disables the brake-over-throttle intervention while preserving normal brake lamp operation.
Assembly Instruction NOP Patch: In binaries lacking CWBLS, locate the conditional jump instruction in the torque intervention coordinator:

   ; Factory Code:
   0x0045A2:  JB      0xFD08.0, 0x0045B0     ; If brake pedal active, jump to throttle cut

   ; Patched Code (Replaced with two 2-byte NOPs):
   0x0045A2:  NOP                            ; 0xCC00
   0x0045A4:  NOP                            ; 0xCC00

With this 4-byte patch, the ECU continues honoring driver throttle angle requests regardless of brake pedal position.

14.6. Feature 4: Multi-Map Switching via Cruise Control Stalk (`B_gra`)#

In high-performance setups (e.g. dual-fuel 93-octane pump gas vs. E85 ethanol, or high-boost track mode vs. low-boost valet mode), multi-map switching allows the driver to select between calibration profiles on-the-fly using the factory steering column cruise control buttons (SET, RES, CANCEL).

BOSCH ME7.5 MULTI-MAP SWITCHING ARCHITECTURE

Slot ID	Calibration Profile	Target Boost	Ignition Timing	Target Fueling (LAMFA)
Map 1	93 Octane Daily / Pump	18–20 psi (1.3b)	Base KFZW	Lambda 0.85 (Gasoline)
Map 2	High-Boost E85 / Race	26–28 psi (1.8b)	+6.0° Advance	Lambda 0.78 (Ethanol)
Map 3	Valet / Low-Boost Eco	7 psi (Wastegate)	Retarded -4.0°	Lambda 1.00 (Economy)

Driver Feedback: Check Engine Light (MIL) flashes N times corresponding to selected Map Slot

1. Hardware Trigger Mechanics#

The cruise control switches feed discrete digital inputs directly into the C167 Special Function Registers, mapped to bit-addressable RAM:

B_graset (Cruise SET Button): Bit 0xFD08.4 (Pin 75).
B_grares (Cruise RESUME Button): Bit 0xFD08.5 (Pin 76).
B_graaus (Cruise CANCEL Switch): Bit 0xFD08.6 (Pin 57).

2. Assembly Hook Implementation#

The custom routine intercepts the cruise evaluation logic in B_100ms:

Check if vehicle is stationary (vfzg < 3 km/h) with ignition ON.
- 1 Flash = Map 1 (Pump Gas)
- 2 Flashes = Map 2 (E85 High-Boost)
- 3 Flashes = Map 3 (Valet Mode)
Holding CANCEL and pressing SET increments the active map index register MAP_INDEX (stored in persistent RAM at 0x383F00).
The routine redirects the internal pointer registers for:
Visual Tachometer / MIL Feedback: The routine pulses the Check Engine Light driver transistor (ESKONF Byte 5 / Bit RAM 0xFD0A.1) at 2\text{ Hz}:

14.7. Feature 5: Exhaust Overrun Crackle, Pops & Bangs / Anti-Lag Calibration#

Factory calibrations are tuned for strict emissions and fuel economy, commanding instant fuel cut-off upon throttle release. Exhaust overrun crackles ("pops and bangs") are produced by deliberately delaying fuel cut-off and retarding ignition timing deep into the expansion stroke during deceleration, causing unburned fuel to ignite inside the exhaust manifold and turbine housing.

Key Calibration Parameters (`06A906032LP` / `AWP`)#

Symbol	Address	Stock Value	Overrun Crackle Value	Functional Role
`KFTVSA`	`0x012C56`	`0.00 s`	`1.50 s` – `2.20 s`	Deceleration Fuel Cut-Off Delay: Keeps injectors pulsing for N seconds after throttle release.
`KFZWTVS`	`0x012B4C`	0.0\text{°}	`-18.0°` to `-24.0°`	Ignition Angle during Overrun: Deep spark retard firing after TDC into the open exhaust valve.
`WDKUGDN`	`0x013E08`	1.2\text{°}	`2.5°` – `3.2°`	Overrun Throttle Angle Threshold: Keeps throttle plate slightly cracked to supply air for combustion.
`CWSAWE`	`0x0181A0`	`0x00`	`0x01`	Master Overrun Cut-Off Codeword: Enables auxiliary overrun delay algorithms.

Thermal Safety Constraints & Assembly Timer Limiting#

Exhaust Gas Temperature (EGT) Threshold (TABGBTS): Continuous combustion inside the turbine housing can rapidly elevate turbocharger temperatures past the inconel wheel creep threshold (950\text{°C}). The engineer must verify that component protection (KFLBTS) remains enabled.
Catalytic Converter Integrity: Severe Warning: Overrun crackle calibrations will physically melt or shatter factory ceramic catalytic converter substrates within minutes. A high-flow metallic substrate (200 cpsi) or catless race downpipe is mandatory.
Engine Speed Bounds: In KFTVSA, zero out the delay below 2400\text{ rpm} to ensure quiet, smooth deceleration at parking lot and neighborhood speeds.