# Activating / finding feature bytes (cruise, euro2, limiters, …)

Goal: find the byte(s) that toggle a feature, set them correctly, fix checksums, ship.
The method generalizes to any feature on any Bosch ECU.

## Method (proven on Kia cruise; reuse the shape)

1. **Get donors.** Obtain the SAME calibration (or close siblings) with the feature ON and
   OFF. Free sources: factory dumps (chiptuner.ru serial firmwares), big collections
   (see `collection_pipeline.md`), and platform/engine TWINS (e.g. i30 ↔ Cerato share the
   1.6 G4FC + cruise stalk). The donor must match the actual HARDWARE variant.
2. **Align by landmark, not offset.** The relevant block sits at different absolute offsets
   per sub-calibration. Find a constant adjacent pattern (an axis/curve) and read the value
   relative to it:
   ```bash
   python tools/feature_finder.py landmark --dir ./donors --ref mycar.bin \
       --landmark <hex-of-constant-curve> --rel -2 --len 2 --verbose
   ```
   The right value is the one CONSISTENT across many same-ECU donors. A one-off is suspect.
3. **Confirm in Ghidra (optional but ideal).** Find the instruction that reads the value to
   prove it's the gate, not a coincidence. See `ghidra_tricore.md`.
4. **Patch + checksums + validate** — see `bosch_checksums.md`.
5. **Verify surgical** — diff vs original: only the feature bytes + checksum dwords changed;
   tune maps and App-SW untouched.

## Known: cruise on Kia/Hyundai ME17.9.11 (Cerato GTD-B46*)

- The value is the **2 bytes immediately BEFORE the speed-axis curve** landmark
  `08 08 19 1f 25 32 4b 64 7d a3`. On the user's Cerato that's file offset `0x2024E`
  (shifts on other models — hence landmark search).
- `FF FF` = cruise OFF (factory Cerato never offered it). `80 07` = ON (i30 twin + 176
  ME17.9.11 siblings all use 8007). `80 0E` is the **Rio 1.4 value and does NOT work** on
  the 1.6 — wrong hardware family. Lesson: match the donor to the platform.
- The speed-axis curve after the value is identical between OFF and ON donors — so enabling
  is just flipping those 2 bytes; nothing else in calibration needs changing.
- A master-gate also lives in CODE (App-SW): RAM flag gated by a speed threshold. It's the
  same across all these firmwares (incl. the i30 whose cruise works), so the code default is
  fine — calibration flip suffices. Only if a flipped file won't engage on the car would you
  patch the code threshold (+ recompute App-SW CRC). Don't pre-emptively change code.
- Verified build: changing only `0x2024E`→`8007` + the dataset CRC32/ADD16 dwords = 15 bytes
  total vs the tuned base; medc17 10/10; tune preserved.

## Other features (general guidance)

- **Euro2 / cat-off**: usually modifies the DOWNSTREAM (post-cat, sensor-2) O2 diagnostics
  (P0420), not upstream. Collections label these `_E2` / `_e2`. Donor-diff a stock vs its E2.
- **Immo-off**: separate region; collections label `IMMOOFF`/`io`. Risky — verify carefully.
- **Limiters / pedal response**: these are MAPS, not flags. Editing them blind is dangerous
  (lean/knock/over-rev). Don't do it without map definitions (damos/A2L) and ideally live
  monitoring (ELM327). Locating a map via Ghidra + axis landmarks is possible but slow; be
  honest about uncertainty and never ship a blind fuel/timing edit.
