MSS6x Flasher - Now released!

[andriym6]

Hi, your pictures arent very well.
I've attached what you want

Thank you.

Sent from my SM-N960U using Tapatalk

[hobbit382]

Haven't seen this in this thread. Sry. So need to test a bit more to secure the solution even more.

it was posted in this thread.
https://nam3forum.com/forums/forum/e...mss60-research

As told, won't share for free because the correct solution was to much time effort.
It's tested in all known MSS60 and MSS65 sw-versions (only MT atm) and atm also running in 4 swap cars as standalone. True standalone .

I wouldn’t delay too much, as you know in the automotive world it’s only a matter of time before someone else figures it out. Get your money while you can. When I figure it out I will post it publicly, gotta give something back for all the hard work terra has done here.

[CF-CarParts Motorsport]

Hi, your pictures arent very well.
I've attached what you want

[andriym6]

Just to follow up on my Bricked MSS85 (M5) DME, and how I recovered it:

Bought KTAG clone off Ebay (You need KTAG, not KESS. Make sure it isn't coming with OBDII connectors.) Apparently a BDM100 off Aliexpress will work also (cheaper, longer to ship), or a Galletto 4 V54.

Opened, ECU, soldered pins on the BDM header connectors (pins came with KTAG).

Installed KTAG software, Make sure you install Visual C++ 2005 and reboot after install or you will get Checksum errors.

Read data from ECU to have a backup of what is there. If you get Checksum errors, STOP and fix them. The reads are worthless with these, and these reads could be important.

At least with KTAG it complained about the protocol being wrong for the right processor (instructions say 117, but it wanted 116). I just used the one it suggested and it worked fine. I believe this is a difference with the Siemens vs Continental DME builds (mine was an '08 and Continental).

Take you backup you made with MSS6X flasher (you did take one, right?), and use a hex editor to break it into 4 files. 0-0x7FFFF, 0x80000-0x27FFFF, 0x280000-0x2FFFFF, and 0x300000-0x4FFFFF. (512kb, 2048kb, 512, 2048)

The first block is the left MPC. The second is the Left External Flash. Third is right MPC, Fourth is right Ext Flash.
Flash these back to the DME. That should be it.

When I did this, I got a DME EWS error. My backup did not have the ISN in it. However, the ISN will be in your BDM backup that you took before you wrote. Open up the left micro backup file read by BDM. ISN is the 6 bytes at 0x7940. Move these to your your Flasher backup file and write back to the ECU.

Even better, make sure you read the ISN with MSS6X flasher before you even try to flash anything back. This will prove that the RSA bypass and everything is working.

You may want to just write to the Left Ext Flash first and the right MPC and flash, and see if you recover it. This will avoid overwriting the ISN if the left MPC is otherwise healthy.

I've now written back to the ECU many, many times with the MSS6X flasher program with no issues. I have no idea what failed, but it was a fluke based on my experience. I'm going to go see if I can find an obvious corruption between my BDM backup and what I was trying to write with the MSS6X flasher.

When I try read in BDM left and right MPC both give me check sum error. C++2005 installed. Flash from left and right read okay no check sum error. Did this mean my boat and MPC corrupted?
Somebody here has full BDM backup which matches to my dme?

Sent from my SM-N960U using Tapatalk

[CF-CarParts Motorsport]

If we share how to OBD lock, do you share how to do an immo off ?

Nope. I already got obd and bdm lock solution. Only waiting for martyn to mod his tool to implement immo off solution there. But will not be free and also with custom code vin lock (still testing this).

as for bdm lock terra used a wiggler to set the
UC3FMCR from 43 FF 00 FF to 41 FF 00 FF

Haven't seen this in this thread. Sry. So need to test a bit more to secure the solution even more.

care to share your ews delete info?

As told, won't share for free because the correct solution was to much time effort.
It's tested in all known MSS60 and MSS65 sw-versions (only MT atm) and atm also running in 4 swap cars as standalone. True standalone .

[ZiMMie]

I thought you already had obd and bdm lock?

nop address 0x12A70 of injection
and 0x12C2C of ignition

as for bdm lock terra used a wiggler to set the
UC3FMCR from 43 FF 00 FF to 41 FF 00 FF

care to share your ews delete info?

I'll try to get you a ram read this weekend (motor running).

[hobbit382]

OBD lock is easy? Share with us .
BDM Unlock? Where? just set micro config disable for read and write and it's ended.
Never test reading ram via this tool by running engine.

I thought you already had obd and bdm lock?

nop address 0x12A70 of injection
and 0x12C2C of ignition

as for bdm lock terra used a wiggler to set the
UC3FMCR from 43 FF 00 FF to 41 FF 00 FF

care to share your ews delete info?

[MpowerE36]

OBD lock is easy? Share with us .
BDM Unlock? Where? just set micro config disable for read and write and it's ended.
Never test reading ram via this tool by running engine.

If we share how to OBD lock, do you share how to do an immo off ?

You just have to locate RAM_lesen function in the program. After that it is easy.

[CF-CarParts Motorsport]

obd read lock is easy, and now that terra has posted the info to bdm unlock, I feel a few could follow those footsteps to bdm lock both sides.

OBD lock is easy? Share with us .
BDM Unlock? Where? just set micro config disable for read and write and it's ended.
Never test reading ram via this tool by running engine.

[hobbit382]

Do you mean you want to sniff?

no, just a ram read while the engine is running.

I’m able to correct checksums manually, but now that terras flasher is available, it corrects automatically.

obd read lock is easy, and now that terra has posted the info to bdm unlock, I feel a few could follow those footsteps to bdm lock both sides.

thanks again for sharing the ram dumps.

[CF-CarParts Motorsport]

do you happen to have any dumbs with the vehicle running? I haven’t tried to do a ram read on a running vehicle, but I’m assuming you can?

Do you mean you want to sniff?
In attachment a really old one (060E).

The biggest problem for me was checksum after changed values for immo delete. This takes most of time to figure out and solve it correctly.
After was to integrate full obd and bdm lock + VIN lock.

Injection (left) Internal flash - 512KB
Injection (left) External flash - 2MB
Ignition (right) Internal flash - 512KB
Ignition (right) External Flash - 2MB

[hobbit382]

In which file size format you were working? This offset only can be in fullread... but in 3FExxx section there shouldn't be code .
Just a hint. The correct immo off (working and tested, without CAS Unit (in mss60 and mss65)) is in left side of ecu . Maybe other ways are possible but in left side.
Attach you several Rams of different versions of working DMEs from me

the ram starts at 3F8000, offset that value to get the address from terras ram read since it’s only reading the ram.

thank you for the dumps, I’m not seeing the values I expected, but it is helpful.

do you happen to have any dumbs with the vehicle running? I haven’t tried to do a ram read on a running vehicle, but I’m assuming you can?

[andriym6]

Search in the threader... addresses are written down before .


In which file size format you were working? This offset only can be in fullread... but in 3FExxx section there shouldn't be code .
Just a hint. The correct immo off (working and tested, without CAS Unit (in mss60 and mss65)) is in left side of ecu . Maybe other ways are possible but in left side.
Attach you several Rams of different versions of working DMEs from me

Thank you for point me. Read full thread but some reason missed it.

Sent from my SM-N960U using Tapatalk

[CF-CarParts Motorsport]

Can you share how to recover through the BDM. I order ktag but don't know how to splice backup file to write in the left and right processor.
Thank you.

Search in the threader... addresses are written down before .

a year ago I was able to get a mss60 to start off a used dme by forcing 3FEB12 to 0. It ran but ran rough and threw a bunch of faults. I thought might have been checksum related. Due to the flash times with kess and not having a test vehicle I left it at that until I found your amazing app. Then I realized it’s not a checksum issue and need to find different way to bypass ews.

I’m trying to see the values of 3FCEE0 and 3FCEE1 which I believe to be ews_st and ews_stw_st

also 3FEB10 would be helpful.

In which file size format you were working? This offset only can be in fullread... but in 3FExxx section there shouldn't be code .
Just a hint. The correct immo off (working and tested, without CAS Unit (in mss60 and mss65)) is in left side of ecu . Maybe other ways are possible but in left side.
Attach you several Rams of different versions of working DMEs from me

[hobbit382]

Anything in particular you're looking for? The app itself can dump the RAM

working on ews delete. I need a ram read from a working dme, maybe even a ram read from a running vehicle?

a year ago I was able to get a mss60 to start off a used dme by forcing 3FEB12 to 0. It ran but ran rough and threw a bunch of faults. I thought might have been checksum related. Due to the flash times with kess and not having a test vehicle I left it at that until I found your amazing app. Then I realized it’s not a checksum issue and need to find different way to bypass ews.

I’m trying to see the values of 3FCEE0 and 3FCEE1 which I believe to be ews_st and ews_stw_st

also 3FEB10 would be helpful.