Flasher MSS6x - Version initiale

Je crois que l'application a été suffisamment prouvée pour être sûre à ce stade et je suis à l'aise de la publier maintenant. Vous pouvez le récupérer ici : https://nam3forum.com/forums/e9x-2008-2013/e9x-coding-tuning/11026-mss6x-flasher-now-released



Fonctionnalité :

• Capacité à lire et écrire des airs et code de programme
• Possibilité de lire la clé secrète ISN (MSS65) / EWS (MSS60) sur OBDII
  • Cela signifie qu'une sauvegarde complète peut être faite entièrement sur OBDII
• Capacité à vider la RAM

Sécurité :

• Le logiciel vérifiera que les binaires chargés sont dans le bon format et l'ordre
• Le logiciel vérifiera que les programmes en cours d'écriture correspondent au matériel que vous essayez de flasher, et vérifiera que tous les morceaux écrits correspondent au logiciel que vous essayez de flasher.
• Si la mélodie ou le programme ne sont pas en stock, le programme s'assurera que vous avez une suppression RSA avant de continuer (vous pouvez remplacer cet avertissement, mais le flash échouera probablement si vous n'avez pas de suppression RSA que je ne pouvais pas détecter).
• Le programme ne vous laissera pas flasher un contournement RSA si le binaire en cours de chargement ne correspond pas à la variante logicielle sur laquelle vous êtes actuellement.

Performance :

• Tune de sauvegarde en 5 minutes
• Sauvegarde complète 45-60 minutes
  • 2 heures en mode long
• Flash tune en environ 1 minute
• Programme complet flash en ~ 12 minutes
• Flash RSA bypass dans ~ 15 minutes

Qui construit les cartes après avoir clignoté?

Bravo !

Bonne nouvelle ~ ! Très bon travail ~ !

Incroyable ! Vous avez fait un travail incroyable dans la communauté MSS54 qui a été d'une grande aide dans le passé pour certaines de mes modifications personnalisées ECU.

tre capable de faire la même chose avec le MSS65 serait une aubaine.

Curieux, quelqu'un a-t-il un référentiel XDF MSS65 pour les adresses hexadécimales afin de manipuler des paramètres dans les binaires d'ECU ?

6xSpd a écrit

Incroyable ! Vous avez fait un travail incroyable dans la communauté MSS54 qui a été d'une grande aide dans le passé pour certaines de mes modifications personnalisées ECU.

tre capable de faire la même chose avec le MSS65 serait une aubaine.

Curieux, quelqu'un a-t-il un référentiel XDF MSS65 pour les adresses hexadécimales afin de manipuler des paramètres dans les binaires d'ECU ?

S'il y en a une, je ne sais pas si elle est publique.

J'ai un A2L pour ce qui semble être une version de pré-production du logiciel MSS60. La seule chose est que je ne me souviens pas pour la vie de moi si c'est quelque chose que j'ai trouvé en train de parcourir Internet ou si c'est quelque chose qui m'a été donné avec l'espoir qu'il reste privé.

Travail incroyable, je suppose que cela fonctionnera pour ceux qui ont la BMW ICOM?
J'ai aussi un câble K+DCAN (non-bimmergeeks) avec le firmware personnalisé mis à jour sans la modification bluetooth, il peut programmer avec succès de nombreux DME sans briquetage.

GORDON.M3 écrit

Travail incroyable, je suppose que cela fonctionnera pour ceux qui ont la BMW ICOM?
J'ai aussi un câble K+DCAN (non-bimmergeeks) avec le firmware personnalisé mis à jour sans la modification bluetooth, il peut programmer avec succès de nombreux DME sans briquetage.

Pas de support ICOM. Pour l'instant, je ne supporte que les câbles K+DCAN (et je suppose qu'un câble K-line normal fonctionnerait sur une voiture K-line -- Je ne pense pas que cela s'applique aux M3). En théorie, je peux supporter n'importe quelle interface prise en charge par EdiabasLib, mais je n'ai rien essayé d'autre que le K+DCAN (et pour l'instant, le programme est essentiellement codé dur pour rechercher un port COM). Pas de soutien pour l'ICOM là-bas à ma connaissance.

Updated the software:

Safety changes:

• Added sanity checks for loaded files.
• Tunes
  • Check that SW reference is compatible with installed program
  • Check that injection and ignition tunes are of the same version
  • Check that injection and ignition tunes are in the correct order
• Full writes:
  • Check that Program Reference is compatible with DME hardware
  • Check that injection and ignition programs are of the same version
  • Check that a tune is loaded in the binary and passes above tune checks
• Added a warning if you attempt to close the application in the middle of a flash process
  • This SHOULD allow the application to keep running while the warning shows, but I did have one instance where the flash got interrupted anyway. Maybe I knocked my cable or something. YMMV
• Disabled all buttons (ident/read/write) during active flash process

New Features:

• Ram dumping - hold shift while you click Read DME, and the software will dump the RAM and save each side as two different files
• EWS4 SK Reading (MSS60 Only) - Reads the injection RAM, searches for the EWS4 SK using a pattern search.
  • If successful, the key is displayed in the application and a file with the SK is saved (file will include the appropriate header to be pasted in directly at 0x7948 of the injection dump)
  • When doing a full read on the MSS60, the DME will search for the SK at the end and add it to the dump before saving the file (I did not thoroughly test this due to the nature of how long full reads take, but I expect it will work fine).

The previous link I shared with everyone should point to the latest version of the app

Now I want to pose a question for everyone about how I should handle the safety of the RSA flashing:
The trick I currently use to defeat RSA has the potential to permanently / unrecoverably brick non-BDMable MSS60s if flashed with a non-EdiabasLib cable
I can change the method slightly so that the bricks will at least be recoverable via WinKFP when using an appropriate interface -- however this method will roughly double the time it takes to do the RSA bypass
So what do you guys prefer I do? As much as it pains me to lose the speed, I'm sorta thinking it would be more responsible to do it the slower way.
Even with the above change, if someone flashes the DME Program (or repeats the RSA bypass) with a non-EdiabasLib cable after an RSA bypass has already been installed, the DME will unrecoverably brick - I cannot get around that.

this is a huge deal Terra, thank you so much!

I feel comfortable releasing the application now. See first post.

Dunno if anyone is interested, but I managed to unlock the BDM port on a locked MSS60. Still trying to work out a way to make it easy for people to do, but at least it's been proven that they can be unlocked.

Do note that if you write/lock a new secret key through tool32 (rather than just writing it directly via BDM), that will relock the DME.

I wish I understood more of what you're talking about Terra! Where is the explanation for simple minded people?

SYT_Shadow wrote

I wish I understood more of what you're talking about Terra! Where is the explanation for simple minded people?

BDM = "Background Debug Mode" - basically it's a tool the engineers would have used while developing the ECU to see what the processors are doing as code executes. That mode can also be used to read/write flash directly to the ECU. Generally useful feature to have - you recover from flashes that make your DME unbootable, and you can use it to create ECU clones in case your original develops a hardware issue or something.

With the E9x M3, BMW started locking the port sometime in the middle of model year 2008. So we couldn't clone ECUs, nor was it possible to recover from bad flashes. It was also believed to make it impossible to recover the EWS data from the DME (though I figured out how to do that over the OBDII port with my app)

Now that the port can be unlocked, we've got basically full control of these things. If you have a bad flash, just restore a backup. If the ECU messes up for some other reason, just copy a backup onto a used one. Etc.

Terraphantm wrote

BDM = "Background Debug Mode" - basically it's a tool the engineers would have used while developing the ECU to see what the processors are doing as code executes. That mode can also be used to read/write flash directly to the ECU. Generally useful feature to have - you recover from flashes that make your DME unbootable, and you can use it to create ECU clones in case your original develops a hardware issue or something.

With the E9x M3, BMW started locking the port sometime in the middle of model year 2008. So we couldn't clone ECUs, nor was it possible to recover from bad flashes. It was also believed to make it impossible to recover the EWS data from the DME (though I figured out how to do that over the OBDII port with my app)

Now that the port can be unlocked, we've got basically full control of these things. If you have a bad flash, just restore a backup. If the ECU messes up for some other reason, just copy a backup onto a used one. Etc.

Sounds like a huge improvement. Thank you

Wonderful job Terra!

Good to see you on here Dunno if you remember me from the ZHP forums.

As someone that has spent countless weeks working on MSS6x DMEs, and I'm not referencing time tuning them as that would amount to years, I'm pretty impressed. Just curious if you are applying any type of patch in order to read the ISN? I had a lot fun nearly a decade ago identifying the Secret keys in both the DME and CAS. Those were the good times. Nice work terra.

The way I've got it setup, it'll try reading the ISN/SK from the real location first, and if that returns FFs (which it will if my patches haven't been written), then it'll dump RAM from the left / injection CPU and do a pattern search. I haven't had that fail on me yet, but maybe there's an odd program version I don't have access to where they actually do clear it from RAM.

I do patch the read routine to allow that section to be read out when doing the RSA bypass, so on an already patched DME it will read the ISN/SK directly rather than searching the RAM for it.

I left tuning after I popped my third set of turbos at Sebring. Terraphantm you’ve renewed my interest. Nice work.

Thanks terra! For now, just updated ecu software to 241E. Verified the before and after using your application. Will take a full read later on.

All over my head but Terra, you’re a a God! Great to see you over here, loved your contributions on M3F.

Fantastic job! Thanks Terraphantm