The output of the downstream O2 sensor can be easily mimicked by a simple circuit built on perfboard from about $15 worth of parts available at Radio Shack. The circuit ourput is a square wave, 0-0.9V, with about a 3-second period (build the circuit with trim pots to adjust the period). The ECU only looks at the rate of “zero” crossings from the rear sensor (the rate must be slower than the “zero” crossing rate from the front sensor), so any signal such as a perfect square wave will do.
The perfboard can be mounted anywhere and only requires a 12V supply and a ground. If the rear sensor has a heater, that must be simulated as well. The old sensor is left in place and electrically disconnected.
These “fake sensors” can be bought on the internet (google O2 sensor simulator), but schematics can also be found on the internet and the circuits (there are several designs) are easy to build. They require one or two ICs, and some resistors, diodes, and trim pots.
I have never seen a fake upstream O2 sensor.