MSS6x Flasher - Now released!

[Tatsumaki]

someone could tell me if with any of the 2 cables that I attach. Could I flash my mss60(mss6x soft) without brick problems ??? white yesterday reprogram with an external programmer the atmel162 with ediabaslib and it works fine(cable white). and the blue is as it comes. Thank you!!

[bryce007]

Hi All,

Having a weird issue flashing a 08 M3 MSS65. Unable to load either modified or read bin to the tool - get the error "External Flash Not Valid"

1. Was using a ediabas flashed cable, however untested but mid way programming RSA bypass flash failed.
2. Recovered ECU flashing 241E via ICOM with WINKFP. Car starts and runs fine.
3. Sourced my old bimmergeeks pro cable which I have used 4x before with MSS6x flasher without issue.
4. Did a full read again with working recovered 241E from WinKFP in MSS65 flasher.
5. Edited Full read in ECUWorx without issue.

However, when loading either the modified BIN or even the Full unmodified read in MSS6x flasher I get the instant error "External Flash Not Valid"

Any ideas why this is happenning and what I can do to resolve? As stated above car is running fine and has no faults in ISTA+ after recovering ECU with WinKFP.

[MpowerE36]

You would have to unlock the cpu or replace the cpu and then program it with a backup

If I buy a new cpu, replace it and then program it with a backup (via bdm I suppose), what will be the censor bit values ?

[hobbit382]

I got the ram read I needed, but don’t have a car to test on. If someone has a spare dme they would like to try ews delete on
change 0x65387 from 03 to 01 and report back. I will create a new thread so this doesn’t get cluttered.

[andriym6]

Hi, your pictures arent very well.
I've attached what you want

Write files and dme back to life. Write isn in cas program dme and start the car.
Many thanks for sharing files.

Sent from my SM-N960U using Tapatalk

[MpowerE36]

You would have to unlock the cpu or replace the cpu and then program it with a backup

That's what I was afraid of. As hobbit382 said, it would be great if you could take some time to do a tutorial to explain how to unlock the cpu. I think it could bring back to life some ecu.

[terra]

Yes I am talking about BDM lock. So if a writing via OBD stops during the flash of the internal flash of a locked left processor there is today no solution to recover the ecu ?

You would have to unlock the cpu or replace the cpu and then program it with a backup

[MpowerE36]

If you're talking about the BDM lock it's locked down unless you clear and set the the registers (which will erase the contents of the internal flash). For OBD read lock - I guess it depends on how you do it. The way I know how to do it would not break writes.

Yes I am talking about BDM lock. So if a writing via OBD stops during the flash of the internal flash of a locked left processor there is today no solution to recover the ecu ?

[terra]

Do you know if when left mpc is closed for read, it is also closed for write ?

If you're talking about the BDM lock it's locked down unless you clear and set the the registers (which will erase the contents of the internal flash). For OBD read lock - I guess it depends on how you do it. The way I know how to do it would not break writes.

[MpowerE36]

Left mpc closed for read... so think about, other ways need to get around to change "something" to open it 🙄.

Do you know if when left mpc is closed for read, it is also closed for write ?

[CF-CarParts Motorsport]

I wouldn’t delay too much, as you know in the automotive world it’s only a matter of time before someone else figures it out. Get your money while you can. When I figure it out I will post it publicly, gotta give something back for all the hard work terra has done here.

That's why I am at MEVD17 and MG1 atm. Some MEVD17 tested CAS off also but again... only manual ones.
MSVx + MSSx + most MSD8x ecus allready solved .

And yes 100% with you for terras work since years . Awesome and innovator for many people to start with... so he's a legend and got full respect of me.

[andriym6]

Hi, your pictures arent very well.
I've attached what you want

Thank you.

Sent from my SM-N960U using Tapatalk

[hobbit382]

Haven't seen this in this thread. Sry. So need to test a bit more to secure the solution even more.

it was posted in this thread.
https://nam3forum.com/forums/forum/e...mss60-research

As told, won't share for free because the correct solution was to much time effort.
It's tested in all known MSS60 and MSS65 sw-versions (only MT atm) and atm also running in 4 swap cars as standalone. True standalone .

I wouldn’t delay too much, as you know in the automotive world it’s only a matter of time before someone else figures it out. Get your money while you can. When I figure it out I will post it publicly, gotta give something back for all the hard work terra has done here.

[CF-CarParts Motorsport]

Hi, your pictures arent very well.
I've attached what you want

[andriym6]

Just to follow up on my Bricked MSS85 (M5) DME, and how I recovered it:

Bought KTAG clone off Ebay (You need KTAG, not KESS. Make sure it isn't coming with OBDII connectors.) Apparently a BDM100 off Aliexpress will work also (cheaper, longer to ship), or a Galletto 4 V54.

Opened, ECU, soldered pins on the BDM header connectors (pins came with KTAG).

Installed KTAG software, Make sure you install Visual C++ 2005 and reboot after install or you will get Checksum errors.

Read data from ECU to have a backup of what is there. If you get Checksum errors, STOP and fix them. The reads are worthless with these, and these reads could be important.

At least with KTAG it complained about the protocol being wrong for the right processor (instructions say 117, but it wanted 116). I just used the one it suggested and it worked fine. I believe this is a difference with the Siemens vs Continental DME builds (mine was an '08 and Continental).

Take you backup you made with MSS6X flasher (you did take one, right?), and use a hex editor to break it into 4 files. 0-0x7FFFF, 0x80000-0x27FFFF, 0x280000-0x2FFFFF, and 0x300000-0x4FFFFF. (512kb, 2048kb, 512, 2048)

The first block is the left MPC. The second is the Left External Flash. Third is right MPC, Fourth is right Ext Flash.
Flash these back to the DME. That should be it.

When I did this, I got a DME EWS error. My backup did not have the ISN in it. However, the ISN will be in your BDM backup that you took before you wrote. Open up the left micro backup file read by BDM. ISN is the 6 bytes at 0x7940. Move these to your your Flasher backup file and write back to the ECU.

Even better, make sure you read the ISN with MSS6X flasher before you even try to flash anything back. This will prove that the RSA bypass and everything is working.

You may want to just write to the Left Ext Flash first and the right MPC and flash, and see if you recover it. This will avoid overwriting the ISN if the left MPC is otherwise healthy.

I've now written back to the ECU many, many times with the MSS6X flasher program with no issues. I have no idea what failed, but it was a fluke based on my experience. I'm going to go see if I can find an obvious corruption between my BDM backup and what I was trying to write with the MSS6X flasher.

When I try read in BDM left and right MPC both give me check sum error. C++2005 installed. Flash from left and right read okay no check sum error. Did this mean my boat and MPC corrupted?
Somebody here has full BDM backup which matches to my dme?

Sent from my SM-N960U using Tapatalk