Installing a used MSS60 DME without CAS alignment

[dpaul]

Public service announcement

Until recently, if you had a bad DME, it was not possible to simply buy a used one and install it. This is because the DME contains a secret key (SK) which is also encrypted in the CAS. If the keys do not agree, the car will crank but not start. This is the action of the famous EWS (i.e. theft protection) system.

So you'd have to buy a DME and send it along with your CAS, your key and $250-$350 to someone with the appropriate software to align these components. It is not possible to do this with the available BMW software, factory level (BMW Standard Tools) or dealer level (ISTA-D/P).

Now, it is relatively simple, due to the efforts of terra and hobbit382 on NAm3forums (terra is terraphantm on e90post and many other forums).

Terra has written and put into public distribution flashing software for the MSS60. It can read the full flash and install an RSA bypass so that altered bin files will be accepted by the DME. A great tool for tuning among other things.
MSS6x flasher

Once the RSA bypass is in place, edit the bin file to include an EWS bypass as discovered by hobbit382 and flash that file.
ews-delete-testing

All you need are a DCAN cable ($45 from Bimmergeeks - heed the warnings about the type of cable), BMW standard tools software, which of course is free and a PC laptop.

I've just done this - my DME developed a fault on the BSD bus, the major consequence of which was to set the check engine light because the oil condition sensor could not be read. It's a hardware fault requiring DME replacement.

The steps I used are the following although there may be a simpler and quicker workflow:
1) Buy a random MSS60, the cheapest one you can find (mine cost $125) and plug it in
2) Use WinKFP to bring it up to the latest factory software ("241E"). I used expert mode to make sure the appropriate data file was used.
3) Change the VIN to your VIN - this can be done most quickly with NCSExpert or Tool32 in BMW Standard Tools. It can also be done with WinKFP.
4) Use MSS6x flasher to perform a full read, load that file and install the RSA bypass.
5) Use a hex editor to change the byte at change byte 0x65387 from 03 to 01
6) Use MSS6x flasher to flash that full bin.
7) The DME may require "coding" i.e. using NCSExpert with factory or default profile to eliminate the annoying but harmless 2780 "no coding" error.

What is the consequence of deleting EWS? It means that if someone had access to your car long enough to replace the CAS module with their own, they could use their key to steal your car. IMHO worth the risk.

[OzzyGUK]

Hi dpaul, i followed your guide with great success. I also ran into the 2780 no coding error. Do you have a guide on how you coded the mss60 with ncsexpert? Im having no luck