Any DCT owners changed their final drive / diff ratio?

[olza]

this is GTS HW-NR 7844978 ZB-NR 7845773 - SW-NR 7845781

[olza]

xHP currently supports some DCT transmission and adds the possibility to change the final drive ratio.
Unfortunately I don't have an A2L file for the DCT transmission. I can read it with X17/Flex tool (MagicMotorsport). But don't know the location/value to edit.

In attachment DKG/DCT read from E9X M3.

Internal Flash
Memory configuration
Sector Address Size Type
01 0xA0000000 0x00004000 RW
02 0xA0004000 0x00004000 RW
03 0xA0008000 0x00004000 RW
04 0xA000C000 0x00004000 RW
05 0xA0010000 0x00004000 RW
06 0xA0014000 0x00004000 RW
07 0xA0018000 0x00004000 RW
08 0xA001C000 0x00004000 RW
09 0xA0020000 0x00020000 RW
10 0xA0040000 0x00040000 RW
11 0xA0080000 0x00080000 RW
12 0xA0100000 0x00078000 RW

can you try to rewrite any of first 8 sectors? if so, i can give you patched data with signature check bypass.

[Tomba]

Internal Flash
Memory configuration
Sector Address Size Type
01 0xA0000000 0x00004000 RW
02 0xA0004000 0x00004000 RW
03 0xA0008000 0x00004000 RW
04 0xA000C000 0x00004000 RW
05 0xA0010000 0x00004000 RW
06 0xA0014000 0x00004000 RW
07 0xA0018000 0x00004000 RW
08 0xA001C000 0x00004000 RW
09 0xA0020000 0x00020000 RW
10 0xA0040000 0x00040000 RW
11 0xA0080000 0x00080000 RW
12 0xA0100000 0x00078000 RW

can you try to rewrite any of first 8 sectors? if so, i can give you patched data with signature check bypass.

I don't have a car by hand currently. But can do this once I am working again.
I can change the final drive ratio and read out the memory again after flashing. I suspect they (magicmotorsport) bypass RSA themself. At least as far as I know they do this on Fxx DMEs as well. First flash takes 5-8 minutes. One after that mostly 2 or less minutes. I haven't flashed any DCT yet.

[olza]

I don't have a car by hand currently. But can do this once I am working again.
I can change the final drive ratio and read out the memory again after flashing. I suspect they (magicmotorsport) bypass RSA themself. At least as far as I know they do this on Fxx DMEs as well. First flash takes 5-8 minutes. One after that mostly 2 or less minutes. I haven't flashed any DCT yet.

it may be other deal, note what calibration is in sector 9. and address edited! its 0x271FE!

[olza]

Okay, i can write now changed data to DCT via winkfpt.
So they who have non-stock final gear, or want something else - pm me.

[terra]

olza, do you know what the second 1024-bit RSA key is for? In the full binary posted earlier I see 2: One at 0x1F200 and the other at 0x5A7F8. The first one seems to be what's actually used to validate the signatures. Can't figure out what the second one is used for.

I do have the complete factorization (and therefore the corresponding private key) of the second one, but I just don't know what it's useful for.

[Tomba]

it may be other deal, note what calibration is in sector 9. and address edited! its 0x271FE!

Changed it and works. No limp mode or error codes!
Do you know how to disable error codes?

[olza]

Changed it and works. No limp mode or error codes!
Do you know how to disable error codes?

yes. Did you use your tool to rewrite data? M3/gts version differs with 135/335 not only final ratio, but also wheel factor and other system variables.

[Tomba]

yes. Did you use your tool to rewrite data? M3/gts version differs with 135/335 not only final ratio, but also wheel factor and other system variables.

I used MagicMotorsport FLEX. After I have written the file with different differential ratio the read was exactly the same.
Do you have A2L or disassembled this?

[olza]

I used MagicMotorsport FLEX. After I have written the file with different differential ratio the read was exactly the same.
Do you have A2L or disassembled this?

disassembled. so there is a proof that bmw tools checks signature only after reflash and once )

terra nope. this is how i thinking it is stored.
0x1F200 is "compiler bootloader" public signature key. seed key is at 0x1F100. 0-1FFFF boot.
data signature is at 0x3FE00 - this is what bmw checks after data reflash. 20000 - 3FFFF data
code signature is at 0x40100. 40000 - 16FFFF code...

also there are some hashes in a code for "realtime" code consistency checks. but leave them alone.

Tomba is there A2L for sale somewhere? id like to look. because of too much tables.

[terra]

terra nope. this is how i thinking it is stored.
0x1F200 is "compiler bootloader" public signature key. seed key is at 0x1F100. 0-1FFFF boot.
data signature is at 0x3FE00 - this is what bmw checks after data reflash. 20000 - 3FFFF data
code signature is at 0x40100. 40000 - 16FFFF code...

Yeah I figured out that much. I just don't know what the purpose of the key embedded in the code section is. Maybe a remnant of something else.

[Tomba]

Tomba is there A2L for sale somewhere? id like to look. because of too much tables.

I am really impressed what you and tera do and hope I can educate myself to such level program/disassembling wise. Keep up the good work

And yes, someone offered me an A2L file for M3 DKG but wanted too much money for it. He was quite offended when I told him that. I am confident a new offer by someone else will come in the future.
Most people selling A2L files think they are god, I refuse to play that way. If a new offer comes and you want to contribute in payment of it, just drop me a PM.

[olza]

Yes im interested.

I am preparing own xdf based on analysis. Shiftmaps, logic keys, limits described. Now shift speed and torque corrections. Pressure next.

[pshoey]

I am really impressed what you and tera do and hope I can educate myself to such level program/disassembling wise. Keep up the good work

And yes, someone offered me an A2L file for M3 DKG but wanted too much money for it. He was quite offended when I told him that. I am confident a new offer by someone else will come in the future.
Most people selling A2L files think they are god, I refuse to play that way. If a new offer comes and you want to contribute in payment of it, just drop me a PM.

how much was he asking for the A2L file? I'm happy to participate in a group buy at some point.

[SYT_Shadow]

I'm also interested in assisting.

From what i've read the 3.45 dct works fine, it's the 3.62 that creates problems. However, it seems like a few tuners are able to edit this and make it work properly. I am sure this is not rocket science, but as usual the very few tuners who spent a few hours figuring this out aren't about to tell us abour ir

I wish the xhp dct software worked on the e9x dct. It would be nice to have faster than gts software shifts