Join Date: Aug 2015
Location: Uelversheim, , Germany
Zeppo kindly sent the BINs and a XDF, so the exploration could proceed. It seems that the code section(s) which accesses the immobilizer byte is identified, hence future searches in other BINs can start with the code section and from there on quickly find the immobilizer byte.
The attached picture shows the subs in which the byte is used, one of them, btw, is a OBD function which can be queried with software such as Guzzi/IAWDiag. In the different subs the byte is compared to 1 and 3, so the value range seems to be 1-3.
The byte is also referenced in the sub which contains the dash text, which is sent from the ECU to the dash as part of a CANBus packet.
While studying above inevitably the other relevant subs and tables, scalars and bytes/flags, both in RAM and ROM, were looked at. I'll go thru the interesting subs (fuel, ignition, OBD, CAN, ADC, injector correction, etc, one by one in the next posts.