MSS6x Flasher - Now released!

[CF-CarParts Motorsport]

If we share how to OBD lock, do you share how to do an immo off ?

Nope. I already got obd and bdm lock solution. Only waiting for martyn to mod his tool to implement immo off solution there. But will not be free and also with custom code vin lock (still testing this).

as for bdm lock terra used a wiggler to set the
UC3FMCR from 43 FF 00 FF to 41 FF 00 FF

Haven't seen this in this thread. Sry. So need to test a bit more to secure the solution even more.

care to share your ews delete info?

As told, won't share for free because the correct solution was to much time effort.
It's tested in all known MSS60 and MSS65 sw-versions (only MT atm) and atm also running in 4 swap cars as standalone. True standalone .

[ZiMMie]

I thought you already had obd and bdm lock?

nop address 0x12A70 of injection
and 0x12C2C of ignition

as for bdm lock terra used a wiggler to set the
UC3FMCR from 43 FF 00 FF to 41 FF 00 FF

care to share your ews delete info?

I'll try to get you a ram read this weekend (motor running).

[hobbit382]

OBD lock is easy? Share with us .
BDM Unlock? Where? just set micro config disable for read and write and it's ended.
Never test reading ram via this tool by running engine.

I thought you already had obd and bdm lock?

nop address 0x12A70 of injection
and 0x12C2C of ignition

as for bdm lock terra used a wiggler to set the
UC3FMCR from 43 FF 00 FF to 41 FF 00 FF

care to share your ews delete info?

[MpowerE36]

OBD lock is easy? Share with us .
BDM Unlock? Where? just set micro config disable for read and write and it's ended.
Never test reading ram via this tool by running engine.

If we share how to OBD lock, do you share how to do an immo off ?

You just have to locate RAM_lesen function in the program. After that it is easy.

[CF-CarParts Motorsport]

obd read lock is easy, and now that terra has posted the info to bdm unlock, I feel a few could follow those footsteps to bdm lock both sides.

OBD lock is easy? Share with us .
BDM Unlock? Where? just set micro config disable for read and write and it's ended.
Never test reading ram via this tool by running engine.

[hobbit382]

Do you mean you want to sniff?

no, just a ram read while the engine is running.

I’m able to correct checksums manually, but now that terras flasher is available, it corrects automatically.

obd read lock is easy, and now that terra has posted the info to bdm unlock, I feel a few could follow those footsteps to bdm lock both sides.

thanks again for sharing the ram dumps.

[CF-CarParts Motorsport]

do you happen to have any dumbs with the vehicle running? I haven’t tried to do a ram read on a running vehicle, but I’m assuming you can?

Do you mean you want to sniff?
In attachment a really old one (060E).

The biggest problem for me was checksum after changed values for immo delete. This takes most of time to figure out and solve it correctly.
After was to integrate full obd and bdm lock + VIN lock.

Injection (left) Internal flash - 512KB
Injection (left) External flash - 2MB
Ignition (right) Internal flash - 512KB
Ignition (right) External Flash - 2MB

[hobbit382]

In which file size format you were working? This offset only can be in fullread... but in 3FExxx section there shouldn't be code .
Just a hint. The correct immo off (working and tested, without CAS Unit (in mss60 and mss65)) is in left side of ecu . Maybe other ways are possible but in left side.
Attach you several Rams of different versions of working DMEs from me

the ram starts at 3F8000, offset that value to get the address from terras ram read since it’s only reading the ram.

thank you for the dumps, I’m not seeing the values I expected, but it is helpful.

do you happen to have any dumbs with the vehicle running? I haven’t tried to do a ram read on a running vehicle, but I’m assuming you can?

[andriym6]

Search in the threader... addresses are written down before .


In which file size format you were working? This offset only can be in fullread... but in 3FExxx section there shouldn't be code .
Just a hint. The correct immo off (working and tested, without CAS Unit (in mss60 and mss65)) is in left side of ecu . Maybe other ways are possible but in left side.
Attach you several Rams of different versions of working DMEs from me

Thank you for point me. Read full thread but some reason missed it.

Sent from my SM-N960U using Tapatalk

[CF-CarParts Motorsport]

Can you share how to recover through the BDM. I order ktag but don't know how to splice backup file to write in the left and right processor.
Thank you.

Search in the threader... addresses are written down before .

a year ago I was able to get a mss60 to start off a used dme by forcing 3FEB12 to 0. It ran but ran rough and threw a bunch of faults. I thought might have been checksum related. Due to the flash times with kess and not having a test vehicle I left it at that until I found your amazing app. Then I realized it’s not a checksum issue and need to find different way to bypass ews.

I’m trying to see the values of 3FCEE0 and 3FCEE1 which I believe to be ews_st and ews_stw_st

also 3FEB10 would be helpful.

In which file size format you were working? This offset only can be in fullread... but in 3FExxx section there shouldn't be code .
Just a hint. The correct immo off (working and tested, without CAS Unit (in mss60 and mss65)) is in left side of ecu . Maybe other ways are possible but in left side.
Attach you several Rams of different versions of working DMEs from me

[hobbit382]

Anything in particular you're looking for? The app itself can dump the RAM

working on ews delete. I need a ram read from a working dme, maybe even a ram read from a running vehicle?

a year ago I was able to get a mss60 to start off a used dme by forcing 3FEB12 to 0. It ran but ran rough and threw a bunch of faults. I thought might have been checksum related. Due to the flash times with kess and not having a test vehicle I left it at that until I found your amazing app. Then I realized it’s not a checksum issue and need to find different way to bypass ews.

I’m trying to see the values of 3FCEE0 and 3FCEE1 which I believe to be ews_st and ews_stw_st

also 3FEB10 would be helpful.

[andriym6]

My feedback on MSS6x flasher and Bimmergeeks cable. I did approximately 10 program flashes without problems. Then I tried another program flash but the writing had stopped for no reason during the "injection program region 2". The progression bar of MSS6x flasher had stopped to progress and the led of the Bimmergeeks cable had stopped flashing. I don't know what was the problem.

Now, I am going to try to recover it via bdm.

Can you share how to recover through the BDM. I order ktag but don't know how to splice backup file to write in the left and right processor.
Thank you.

Sent from my SM-N960U using Tapatalk

[terra]

I just stubbled across this. Terra you are amazing. This flasher is so much better than using kess.

does anyone happen to have a ram read they would mind sharing?

Anything in particular you're looking for? The app itself can dump the RAM

[hobbit382]

I just stubbled across this. Terra you are amazing. This flasher is so much better than using kess.

does anyone happen to have a ram read they would mind sharing?

[MpowerE36]

My feedback on MSS6x flasher and Bimmergeeks cable. I did approximately 10 program flashes without problems. Then I tried another program flash but the writing had stopped for no reason during the "injection program region 2". The progression bar of MSS6x flasher had stopped to progress and the led of the Bimmergeeks cable had stopped flashing. I don't know what was the problem.

Now, I am going to try to recover it via bdm.