Flashing DME with DCAN

[giodiagnos]

Originally Posted by Alex@Alpine

Send me a text message I can lay out your options for you. 310-560-0808

Hello, can you please share the full dump from MSS60 S65B40 for K-TAG ? :поклон: During the update with the help WINKFP, DME died and cannot be connected! Thank you.

[giodiagnos]

I can't find a full dump for MSS60 , S65B40 to write with K-TAG! Please help.

[dpaul]

Originally Posted by giodiagnos

I can't find a full dump for MSS60 , S65B40 to write with K-TAG! Please help.

Unless your MSS60 is among the earliest produced for the S65, you will not be able to use KTAG or any other BDM-based method to program it. BDM access was disabled at the factory for one of the MPC563 processors. It is not a matter of which software revision (231E, 204E, 241E etc) you have flashed. Without special equipment and expertise, you cannot undo this and under no circumstances can you unlock BDM without also causing a complete erasure of flash memory.

However, you can read and write using OBDII, even write altered calibration files, using this free software, courtesy of @Terraphantm:

https://www.ecuworx.co.uk/how-to/tak...mss6x-flasher/
https://github.com/terraphantm/MSS6x-Flasher

[giodiagnos]

[QUOTE=dpaul;27515532]
However, you can read and write using OBDII, even write altered calibration files, using this free software, courtesy of @Terraphantm:

Why don't you like to read carefully what is written !!! I'm saying that this DME has no connection through the OBD! He does not read or write through the OBD! Through OBD it is not possible to restore it !!!

[dpaul]

[QUOTE=giodiagnos;27545100]

Originally Posted by dpaul

However, you can read and write using OBDII, even write altered calibration files, using this free software, courtesy of @Terraphantm:

Why don't you like to read carefully what is written !!! I'm saying that this DME has no connection through the OBD! He does not read or write through the OBD! Through OBD it is not possible to restore it !!!

Sorry, I missed that part where you say you have no OBDII connection. However, you might want to consider being more circumspect about criticizing people who are trying to help you.

The answer is this: if BMW standard tools cannot connect to the module via OBDII and you have an MSS60 with a BDM-disabled processor, you are fucked.

Let me guess - you tried to flash the DME with a no-name KDCAN cable without the ediabias library update flashed on it.

It sounds like you are asking for binaries suitable for use with a KTAG device. I have written to MSS60 using a cheap Chinese KTAG clone and it works BUT ONLY if you have a very early MSS60 which is not BDM-disabled. You'd have to be very lucky.

If you are that lucky, you do understand that if you overwrite the SK with someone else's files, your car won't start until you program your CAS with a matching SK. That is somewhat difficult if you have CAS3+ in which the SK is encrypted. So make sure you read out the ignition processor where the SK is stored; regardless of how fucked up the code may be, that part will be intact.

So, first determine whether you can read your DME with KTAG. If you can, ask me again and I'll find KTAG compatible binaries for you. They'll get your engine started but of course you'll have to flash the appropriate program and calibration code for your particular vehicle afterwards.

[Mik325tds]

[QUOTE=dpaul;27545607]

Originally Posted by giodiagnos

Sorry, I missed that part where you say you have no OBDII connection. However, you might want to consider being more circumspect about criticizing people who are trying to help you.

The answer is this: if BMW standard tools cannot connect to the module via OBDII and you have an MSS60 with a BDM-disabled processor, you are fucked.

Let me guess - you tried to flash the DME with a no-name KDCAN cable without the ediabias library update flashed on it.

It sounds like you are asking for binaries suitable for use with a KTAG device. I have written to MSS60 using a cheap Chinese KTAG clone and it works BUT ONLY if you have a very early MSS60 which is not BDM-disabled. You'd have to be very lucky.

If you are that lucky, you do understand that if you overwrite the SK with someone else's files, your car won't start until you program your CAS with a matching SK. That is somewhat difficult if you have CAS3+ in which the SK is encrypted. So make sure you read out the ignition processor where the SK is stored; regardless of how fucked up the code may be, that part will be intact.

So, first determine whether you can read your DME with KTAG. If you can, ask me again and I'll find KTAG compatible binaries for you. They'll get your engine started but of course you'll have to flash the appropriate program and calibration code for your particular vehicle afterwards.

dpaul thank you for helping people out even when they get somewhat rude.
Kudos to you, Terra and Martyn for your work on the MSS60 over at the NAM3 forum. That is some good stuff!
I'm happy to read that the ISN/SK is stored on the IGN (right) processor, so that should be still intact after bricking the INJ (left) processor, or do they get both partially corrupted? After unlocking the BDM on the INJ processor and with that clearing all of its contents - do you think one can just flash that side and be good to go again? How about the Injector adaption values? Do the S65 injectors have codes on them that need to be entered into the MSS60? Do you know of any other value that needs to be restored?

[dpaul]

[QUOTE=Mik325tds;27617235]

Originally Posted by dpaul

dpaul thank you for helping people out even when they get somewhat rude.
Kudos to you, Terra and Martyn for your work on the MSS60 over at the NAM3 forum. That is some good stuff!
I'm happy to read that the ISN/SK is stored on the IGN (right) processor, so that should be still intact after bricking the INJ (left) processor, or do they get both partially corrupted? After unlocking the BDM on the INJ processor and with that clearing all of its contents - do you think one can just flash that side and be good to go again? How about the Injector adaption values? Do the S65 injectors have codes on them that need to be entered into the MSS60? Do you know of any other value that needs to be restored?

Please bear with me if I am misinterpreting the questions you have raised.

Problem one - I think I mixed up INJ and IGN, which I seem to always do. The SK is in the "left" processor which is the INJ processor.

Problem two - if one processor is 'bricked" i.e. no longer communicates via OBDII, then your only recourse is to use BDM to re-program it - Terraphantm's program (or Kess V2 and similar) will not help. To address your question directly, I don't know if one processor handles OBDII communication for both or if they do it independently. I don't know if having one processor become unable to communicate via OBDII will affect the other's ability to communicate .

Problem three - reading the SK in a DME where the one processor is bricked. If the processor with the SK is intact but the other is not, then Terra's program might work to extract it but I'm not sure, as described above. The program relies on Ediabas calls to read processor memory which are going to fail for the processor that is bricked even if reads to the other are successful. I don't know how those errors are going to be handled but likely the program will terminate. You'd have to ask Terra. Of course, you could edit the source code to eliminate attempts to read the bricked side and recompile. Then you should be able to get the SK (if OBDII works at all).

Problem four - unlocking the BDM-disabled processor. That requires dedicated debugger hardware/software - you can't do it with Terra's software, BMW Standard Tools or any other auto-oriented flashing software. Terra is pretty clever so maybe he's come up with something simpler by now but I am not aware of it.

Problem five - info necessary to clone/replace the DME. If you have a BDM-enabled MSS60, you need the SK and BDM tools (example KTAG). Perhaps I misremember but S65 injectors are not individually calibrated for flow like the ones in the N54 - the difference between tolerances necessary for low pressure port injection versus high pressure direct injection I suppose.

I apologize for any past, present or future misinformation and hope this helps.

[Mik325tds]

[QUOTE=dpaul;27622188]

Originally Posted by Mik325tds

Please bear with me if I am misinterpreting the questions you have raised.

Problem one - I think I mixed up INJ and IGN, which I seem to always do. The SK is in the "left" processor which is the INJ processor.

Problem two - if one processor is 'bricked" i.e. no longer communicates via OBDII, then your only recourse is to use BDM to re-program it - Terraphantm's program (or Kess V2 and similar) will not help. To address your question directly, I don't know if one processor handles OBDII communication for both or if they do it independently. I don't know if having one processor become unable to communicate via OBDII will affect the other's ability to communicate .

Problem three - reading the SK in a DME where the one processor is bricked. If the processor with the SK is intact but the other is not, then Terra's program might work to extract it but I'm not sure, as described above. The program relies on Ediabas calls to read processor memory which are going to fail for the processor that is bricked even if reads to the other are successful. I don't know how those errors are going to be handled but likely the program will terminate. You'd have to ask Terra. Of course, you could edit the source code to eliminate attempts to read the bricked side and recompile. Then you should be able to get the SK (if OBDII works at all).

Problem four - unlocking the BDM-disabled processor. That requires dedicated debugger hardware/software - you can't do it with Terra's software, BMW Standard Tools or any other auto-oriented flashing software. Terra is pretty clever so maybe he's come up with something simpler by now but I am not aware of it.

Problem five - info necessary to clone/replace the DME. If you have a BDM-enabled MSS60, you need the SK and BDM tools (example KTAG). Perhaps I misremember but S65 injectors are not individually calibrated for flow like the ones in the N54 - the difference between tolerances necessary for low pressure port injection versus high pressure direct injection I suppose.

I apologize for any past, present or future misinformation and hope this helps.

Thank you for clarifying dpaul, even though reading that the SK is in fact on the INJ Processor which is BDM locked, shatters my hopes of recovering it.
In the MSS60 research thread, you mentioned buying a USB Wiggler - did you ever get it to work for unlocking the BDM? I'm afraid non of my old computer hardware has a parallel port option.
So the remaining hope is that the EPIC backup contains the SK but somehow I have to get the MSS60 unbricked first.

Would anyone who has done this before be willing to help me with this?

[dpaul]

[QUOTE=Mik325tds;27622433]

Originally Posted by dpaul

Thank you for clarifying dpaul, even though reading that the SK is in fact on the INJ Processor which is BDM locked, shatters my hopes of recovering it.
In the MSS60 research thread, you mentioned buying a USB Wiggler - did you ever get it to work for unlocking the BDM? I'm afraid non of my old computer hardware has a parallel port option.
So the remaining hope is that the EPIC backup contains the SK but somehow I have to get the MSS60 unbricked first.

Would anyone who has done this before be willing to help me with this?

I couldn't find a hardware debugger cheap enough for me and so I've never attempted clearing censorship in the U3CF array. Terra tried using a Macraigor Wiggler, an ancient debugger that is pretty cheap but not very well supported (I think). In any case, I think he had limited success using that device. I believe he tried using a more expensive device, the PE Micro Cyclone, with better results but you’d have to ask him about it. I'm guessing this approach is not ready for prime time.

I don't know what EPIC backup is so can't help there

I wish I could be more helpful.

EDIT: this "left" and "right" stuff is endless confusing to me. I may still have it confused.

But this I know: the processor memory is mapped so that the BDM-disabled processor addresses low memory while the unlocked one addresses high memory locations. The SK is located at 0x7940 (or thereabouts) i.e. low memory.

So regardless of which is the "left"" or "right" and which is IGN or INJ, the SK is in the locked processor.

[dpaul]

Hey Mik325tds

Just looked at your post on NAM3 - so EPIC is a tuner. No, the read will not have the SK - it's going to be just program and calibration data. In any case, tuner files, reads included, are usually encrypted

[Mik325tds]

Originally Posted by dpaul

Hey Mik325tds

Just looked at your post on NAM3 - so EPIC is a tuner. No, the read will not have the SK - it's going to be just program and calibration data. In any case, tuner files, reads included, are usually encrypted

Thanks for confirming that dpaul. My hope was that once I get my MSS60 communicating again, I could just restore the original files from the tune and be done. Apparently, that is not the case.
How about the option of "virginizing" the MSS60 by deleting VIN and SK and have ISTA-P re-pair it with the CAS? Somehow the dealerships should have an easy way to replace a DME without having to replace the CAS, EWS and keys.

[dpaul]

Originally Posted by Mik325tds

Thanks for confirming that dpaul. My hope was that once I get my MSS60 communicating again, I could just restore the original files from the tune and be done. Apparently, that is not the case.
How about the option of "virginizing" the MSS60 by deleting VIN and SK and have ISTA-P re-pair it with the CAS? Somehow the dealerships should have an easy way to replace a DME without having to replace the CAS, EWS and keys.

There is no "virginizing" an MSS60. As far as I know, dealers order a new DME (or CAS) from Germany and they come with the SK written - a record of which VIN has which SK is kept at the factory. The dealer cannot write the SK at will. There is no routine for synching CAS and DME in ISTA for the MSS60 - the SK must be written at the factory for both modules. Pain in the ass.

Of course it is possible to write to the CAS using relatively inexpensive tools (eprom programmers) but the SK is encrypted in CAS3+ and CAS4 (I believe) and I don't know how to properly encode it. This can be done with non-factory software like BMW Explorer or AutoHexII but that stuff is really expensive

[Mik325tds]

Originally Posted by dpaul

There is no "virginizing" an MSS60. As far as I know, dealers order a new DME (or CAS) from Germany and they come with the SK written - a record of which VIN has which SK is kept at the factory. The dealer cannot write the SK at will. There is no routine for synching CAS and DME in ISTA for the MSS60 - the SK must be written at the factory for both modules. Pain in the ass.

Of course it is possible to write to the CAS using relatively inexpensive tools (eprom programmers) but the SK is encrypted in CAS3+ and CAS4 (I believe) and I don't know how to properly encode it. This can be done with non-factory software like BMW Explorer or AutoHexII but that stuff is really expensive

Thanks again for the information. You are really good at shattering my hopes .

[Mik325tds]

I guess my only option at this point is to replace the set of CAS3, MSS60 and key from a donor car.
Is there anything I need to watch out for when doing this?
As far as I know I'd just copy the FA from my original CAS to the new one, code. Then install in car and let ISTA-P reprogram the CAS and MSS60 to newest SW.
Anything else I'm missing?

Does the DCT contain the ISN as well?

[dpaul]

Originally Posted by Mik325tds

I guess my only option at this point is to replace the set of CAS3, MSS60 and key from a donor car.
Is there anything I need to watch out for when doing this?
As far as I know I'd just copy the FA from my original CAS to the new one, code. Then install in car and let ISTA-P reprogram the CAS and MSS60 to newest SW.
Anything else I'm missing?

Does the DCT contain the ISN as well?

I do not believe the ISN/SK is anywhere except DME and CAS. But I've never had a BMW with auto or DCT and don't pay any attention to transmission issues.

As far as I know, the replacement would involve just the steps you outline. I can't really advise about ISTA-P but I would be concerned because replacing DME, CAS and key is something a dealer would never do in your situation. The dealer would just get you a new DME. ISTA-P is dealer-level software - you never know how it will interpret a non-standard circumstance and what action it will take. WinKFP is so much more transparent. One module at a time, no surprises.

[Mik325tds]

Originally Posted by dpaul

I do not believe the ISN/SK is anywhere except DME and CAS. But I've never had a BMW with auto or DCT and don't pay any attention to transmission issues.

As far as I know, the replacement would involve just the steps you outline. I can't really advise about ISTA-P but I would be concerned because replacing DME, CAS and key is something a dealer would never do in your situation. The dealer would just get you a new DME. ISTA-P is dealer-level software - you never know how it will interpret a non-standard circumstance and what action it will take. WinKFP is so much more transparent. One module at a time, no surprises.

Good point. I'll do WinKFP/NCSexper instead of ISTA-P.
In another thread I read that I should be concerned about the odo mileage of the donor car. If that is higher, my KOMBI would adjust to the higher mileage. (Thanks for that post by you!). I did virginize a KOMBI eeprom on another project before but don't know the process to virginize the CAS odometer. Can you point me into the right direction for that?
I wonder how to read the odo from the CAS before installing it into the car...

[dpaul]

Originally Posted by Mik325tds

Good point. I'll do WinKFP/NCSexper instead of ISTA-P.
In another thread I read that I should be concerned about the odo mileage of the donor car. If that is higher, my KOMBI would adjust to the higher mileage. (Thanks for that post by you!). I did virginize a KOMBI eeprom on another project before but don't know the process to virginize the CAS odometer. Can you point me into the right direction for that?
I wonder how to read the odo from the CAS before installing it into the car...

You can read the mileage from the CAS on the bench with an R270+ clone eeprom programmer and you can re-program it. Other programmers will likely do it also. The R270 software will actually tell you the mileage - you don't have to mess around with the binary directly. The safest thing to do (to avoid the possibility of triggering the tamper dot) is change the CAS mileage to zero - it will then pick up the correct mileage from the KOMBI after you install it.

EDIT: actually the safest thing to do is pay someone with professional tools to do it. But I guess that's just not how we roll!

[Mik325tds]

Originally Posted by dpaul

You can read the mileage from the CAS on the bench with an R270+ clone eeprom programmer and you can re-program it. Other programmers will likely do it also. The R270 software will actually tell you the mileage - you don't have to mess around with the binary directly. The safest thing to do (to avoid the possibility of triggering the tamper dot) is change the CAS mileage to zero - it will then pick up the correct mileage from the KOMBI after you install it.

EDIT: actually the safest thing to do is pay someone with professional tools to do it. But I guess that's just not how we roll!

Correct! Part of the experience is learning how things work. I find that much more satisfying than getting things to run again. Yet, obviously that is the driving force.
Does the CAS also use the M35080 EEprom? I think I used a xprog or actually soldered a new EEprom to virginize the KOMBI.

[dpaul]

Originally Posted by Mik325tds

Correct! Part of the experience is learning how things work. I find that much more satisfying than getting things to run again. Yet, obviously that is the driving force.
Does the CAS also use the M35080 EEprom? I think I used a xprog or actually soldered a new EEprom to virginize the KOMBI.

You don't have to remove the chip - you solder on a few wires from the programmer to the circuit board and off you go. Fixing the mileage is easy but SK and key data are encrypted in CAS3+ and you need professional tools and/or expertise for that. Never used an XPROG so cannot advise there