MSS6x Flasher - Initial Release

great job

Terraphantm wrote

If there is one, I don't know if it's public.

I do have an A2L for what appears to be a pre-production MSS60 software variant. Only thing is I can't remember for the life of me if it's something I found scouring the internet or if it's something that was given to me with the expectation that it stays private.

Thanks for tool! Can you share A2L? I want to tune Schrick 292 cams.

SUBSCRIBED.

Future reference to self...want to get involved in flashing DME.

i just downloaded the software. it is not opening on my laptop. do i need to have it connected to my car with my k+dcan cable first?

bmwfst1 wrote

i just downloaded the software. it is not opening on my laptop. do i need to have it connected to my car with my k+dcan cable first?

Don't think so. Try running as admin or in win 7 compatiblity?

Might need a good install of Ediabas for it to work, though I think he includes the requisite dlls with his software pack.

i figured it out thanks.

Don’t know how many here still use the application, but did release an update the other day

https://github.com/terraphantm/MSS6x-Flasher/releases

Version 1.1.0. Multiple updates since last release:

• Updated Ediabaslib to newer release; .Net 4.8.1 now required
• Default port is now COM1 as EdiabasLib dropped support for D2XX on Windows
• RSA Bypass code is improved and notably faster
• Added ability to restore stock (i.e remove RSA bypass and patches)
• Tunes are now automatically flashed after flashing a program instead of having to click the "flash tune" button
• Reads are now done in "programming mode" and should be about twice as fast as before
• Full reads are now saved in both the combined format and in BDM format (separate files)
• If no VIN is found, VIN will be assumed to be AA00000 for file saving purposes
• MSS60 140E and older no longer require an RSA bypass for tune writes
• Detect if a "pseudo RSA" bypass used by some tuners is present, in which case the loaded file will be flashed without modification (i.e no checksum correction). Recommend manually correcting checksums or disabling checksums if this technique is used
• Decreased size of flash blocks from 254 bytes to 252 bytes - this allows standard D-CAN cables to work without bricking
• More safety checks implemented
• During the RSA bypass, the UC3F censorship routine is now disabled. This does not remove the censorship from the DME (need BDM or mpower32's software for that), but does prevent it from being set again.
• Added ability to request Level 3/4/5 security access to the Advanced Menu. Unclear if there are any uses for level 4/5, but makes it easier to test.
• Now display the "internal" software numbering (i.e v638 for 80E) if it is readable.
• Fixed a few UI issues

Probably more stuff that I'm not remembering. Let me know if you guys have any issues

Definitely still using it thanks!

Amazing
Crazy tool, thanks a lot for that ...
Anyone know how to read complete software of SMG module ? (Quicflash not support this 2005 version)
I help a S85 track tool to delete few DTCs between SMG module and body

airliner33 wrote

Amazing
Crazy tool, thanks a lot for that ...
Anyone know how to read complete software of SMG module ? (Quicflash not support this 2005 version)
I help a S85 track tool to delete few DTCs between SMG module and body

In principal wouldn't be hard to make, though I don't think any of us have a viable RSA bypass for the SMG3 ECU just yet.

If I can be of any help whatsoever, let me know.
I'm going to try reading the TCU with a flexbox in the next few days because I'm working a lot on decompiling the 6hp binary, in particular, making complete XDF files as possible and I know that flexbox can read many TCU full software.
So, I don't have much hope for this Getrag module

Smg3 ecu is fairly different from the contemporary automatics. It’s much closer to the smg2 ecu in the e46 m3. C167 processor - fairly trivial to dump on the bench in ‘boot mode’ from what I recall. Also fairly trivial to defeat rsa via bench flash to make future obdii writes possible. Never figured out how to flash the initial bypass over obd, but didn’t put a ton of work into getting that to work.

I am hunting for an e60 m5 so perhaps could put some work into it if I find the right car. Though to be honest my primary goal is a DCT swap

Totally understandable

Updated the application to handle 0pa/0da files and added some quality of life changes (i.e select the folder where you save read files instead of assuming you want the directory that the application is stored in).

.NET 10 is now required

I did not thoroughly test what happens if you deliberately load an 0pa / 0da from a non-MSS6x DME -- most likely would crash. I'll handle that more gracefully at some point

Terraphantm wrote

Updated the application to handle 0pa/0da files and added some quality of life changes (i.e select the folder where you save read files instead of assuming you want the directory that the application is stored in).

.NET 10 is now required

I did not thoroughly test what happens if you deliberately load an 0pa / 0da from a non-MSS6x DME -- most likely would crash. I'll handle that more gracefully at some point

Hi Terraphantm ,

I’m Hafiz. Sorry to hijack your post but i’m not sure how to reach out to you. Straight to the point, myself and few other people in the community are trying to make a native 8HP swap to E chassis as native as possible.

We have managed to patch on the DME side for MSV80,MSD80 & MSD 81 in order to allow DME to recognise 8th gear. See here

This so far works on E90 chassis. However on E60 chassis and 4WD car this doesn’t work. I have went through and identified the patch needed for DSC unit in the .opa file. However, i am stuck with signature check error after 100% flash with WinKFP. I am assuming this will be related to RSA check.

Will you be able to assist us? Our goal is to make this available for everyone for free and make 8HP swap for E-chassis as native as possible.

Feel free to check our discord https://discord.gg/95zfFh2CY

Link for some details on Cartechnology

Thanks!

thefiztec wrote

Terraphantm wrote

Updated the application to handle 0pa/0da files and added some quality of life changes (i.e select the folder where you save read files instead of assuming you want the directory that the application is stored in).

.NET 10 is now required

I did not thoroughly test what happens if you deliberately load an 0pa / 0da from a non-MSS6x DME -- most likely would crash. I'll handle that more gracefully at some point

Hi Terraphantm ,

I’m Hafiz. Sorry to hijack your post but i’m not sure how to reach out to you. Straight to the point, myself and few other people in the community are trying to make a native 8HP swap to E chassis as native as possible.

We have managed to patch on the DME side for MSV80,MSD80 & MSD 81 in order to allow DME to recognise 8th gear. See here

This so far works on E90 chassis. However on E60 chassis and 4WD car this doesn’t work. I have went through and identified the patch needed for DSC unit in the .opa file. However, i am stuck with signature check error after 100% flash with WinKFP. I am assuming this will be related to RSA check.

Will you be able to assist us? Our goal is to make this available for everyone for free and make 8HP swap for E-chassis as native as possible.

Feel free to check our discord https://discord.gg/95zfFh2CY

Link for some details on Cartechnology

Thanks!

I'm working in the hospital this week so won't have a ton of time to look right now, but will try to take a look when I get a little time.

Do you know what kind of CPU the DSC uses / do you have a disassembly? You can PM me to discuss in more detail if you want.

Terraphantm wrote

I'm working in the hospital this week so won't have a ton of time to look right now, but will try to take a look when I get a little time.

Do you know what kind of CPU the DSC uses / do you have a disassembly? You can PM me to discuss in more detail if you want.

Great! I have drop you a PM.

Hello
Does anyone have an e9x M3 ori file to share?
(Full read performed by this MSS6x flasher)
I am currently decompiling MS65 to be able to create a public xdf based on the xdf available for MS60. It would help me a lot to cross the tables again
Thanks