Any DCT owners changed their final drive / diff ratio?

[mariusc]

Is it sufficient to change the value at 0x271FE from 4E 0C (3.15) to 24 0E (3.62), save the file and flash back to the car?

[Tomba]

Bringing this back!
Can anyone help changing the diff ratio in a dct?
olza

Send Olza a PM. He can do it

[Denes.S]

Bringing this back!
Can anyone help changing the diff ratio in a dct?
olza

[SYT_Shadow]

I'm also interested in assisting.

From what i've read the 3.45 dct works fine, it's the 3.62 that creates problems. However, it seems like a few tuners are able to edit this and make it work properly. I am sure this is not rocket science, but as usual the very few tuners who spent a few hours figuring this out aren't about to tell us abour ir

I wish the xhp dct software worked on the e9x dct. It would be nice to have faster than gts software shifts

[pshoey]

I am really impressed what you and tera do and hope I can educate myself to such level program/disassembling wise. Keep up the good work

And yes, someone offered me an A2L file for M3 DKG but wanted too much money for it. He was quite offended when I told him that. I am confident a new offer by someone else will come in the future.
Most people selling A2L files think they are god, I refuse to play that way. If a new offer comes and you want to contribute in payment of it, just drop me a PM.

how much was he asking for the A2L file? I'm happy to participate in a group buy at some point.

[olza]

Yes im interested.

I am preparing own xdf based on analysis. Shiftmaps, logic keys, limits described. Now shift speed and torque corrections. Pressure next.

[Tomba]

Tomba is there A2L for sale somewhere? id like to look. because of too much tables.

I am really impressed what you and tera do and hope I can educate myself to such level program/disassembling wise. Keep up the good work

And yes, someone offered me an A2L file for M3 DKG but wanted too much money for it. He was quite offended when I told him that. I am confident a new offer by someone else will come in the future.
Most people selling A2L files think they are god, I refuse to play that way. If a new offer comes and you want to contribute in payment of it, just drop me a PM.

[terra]

terra nope. this is how i thinking it is stored.
0x1F200 is "compiler bootloader" public signature key. seed key is at 0x1F100. 0-1FFFF boot.
data signature is at 0x3FE00 - this is what bmw checks after data reflash. 20000 - 3FFFF data
code signature is at 0x40100. 40000 - 16FFFF code...

Yeah I figured out that much. I just don't know what the purpose of the key embedded in the code section is. Maybe a remnant of something else.

[olza]

I used MagicMotorsport FLEX. After I have written the file with different differential ratio the read was exactly the same.
Do you have A2L or disassembled this?

disassembled. so there is a proof that bmw tools checks signature only after reflash and once )

terra nope. this is how i thinking it is stored.
0x1F200 is "compiler bootloader" public signature key. seed key is at 0x1F100. 0-1FFFF boot.
data signature is at 0x3FE00 - this is what bmw checks after data reflash. 20000 - 3FFFF data
code signature is at 0x40100. 40000 - 16FFFF code...

also there are some hashes in a code for "realtime" code consistency checks. but leave them alone.

Tomba is there A2L for sale somewhere? id like to look. because of too much tables.

[Tomba]

yes. Did you use your tool to rewrite data? M3/gts version differs with 135/335 not only final ratio, but also wheel factor and other system variables.

I used MagicMotorsport FLEX. After I have written the file with different differential ratio the read was exactly the same.
Do you have A2L or disassembled this?

[olza]

Changed it and works. No limp mode or error codes!
Do you know how to disable error codes?

yes. Did you use your tool to rewrite data? M3/gts version differs with 135/335 not only final ratio, but also wheel factor and other system variables.

[Tomba]

it may be other deal, note what calibration is in sector 9. and address edited! its 0x271FE!

Changed it and works. No limp mode or error codes!
Do you know how to disable error codes?

[terra]

olza, do you know what the second 1024-bit RSA key is for? In the full binary posted earlier I see 2: One at 0x1F200 and the other at 0x5A7F8. The first one seems to be what's actually used to validate the signatures. Can't figure out what the second one is used for.

I do have the complete factorization (and therefore the corresponding private key) of the second one, but I just don't know what it's useful for.

[olza]

Okay, i can write now changed data to DCT via winkfpt.
So they who have non-stock final gear, or want something else - pm me.

[olza]

I don't have a car by hand currently. But can do this once I am working again.
I can change the final drive ratio and read out the memory again after flashing. I suspect they (magicmotorsport) bypass RSA themself. At least as far as I know they do this on Fxx DMEs as well. First flash takes 5-8 minutes. One after that mostly 2 or less minutes. I haven't flashed any DCT yet.

it may be other deal, note what calibration is in sector 9. and address edited! its 0x271FE!