MSS6x Flasher - Now released!

[mik325tds]

I read the entire forum from 1 to 256 posts 2 times, I thought I missed something! I realized that this can be done using the MSS flasher, but then when Dme passes the identification! But in my case, there is no OBD connection! One way to fix this is through BDM! but I have no thoughts in my head how this can be done. Dear CF-Car Parts Motorsport, please advise, push me to the right side, where to start?

It really isn't quite obvious. I read over that statement as well when terra mentioned the "below thread". Look up the MSS60 research thread - it's all there.
terra and everyone that has helped: Awesome work and thank you for sharing your tool and knowledge. Amazing.

[CF-CarParts Motorsport]

I dont know what you do there but I think its better if you will stay away from this ecu.

[[email protected]]

MSS Flasher correcting Checksum ?

[[email protected]]

I'm not at all interested in immo off! Because I sync it in 2 minutes, it's easier! I can remove MPC563 from MSV70 and solder to MSS60. But then I don't have, a full dump from processor L, to write! If I write a full dump from processor R to processor L. Doesn't it work?

[CF-CarParts Motorsport]

If you dont have any "bench-obd" connection any more you just can desolder and swap mcu...
I will not share how to because its atm also a way to get around mine protection for immo off.

[[email protected]]

I read the entire forum from 1 to 256 posts 2 times, I thought I missed something! I realized that this can be done using the MSS flasher, but then when Dme passes the identification! But in my case, there is no OBD connection! One way to fix this is through BDM! but I have no thoughts in my head how this can be done. Dear CF-Car Parts Motorsport, please advise, push me to the right side, where to start?

[CF-CarParts Motorsport]

Left mpc closed for read... so think about, other ways need to get around to change "something" to open it 🙄.

[[email protected]]

But seams it clients car... so get a spare mss60, read ISN... write to CAS from car (if CAS3+ need a key for descryption of cas) and after do the coding stuff .

No, a friend's car. I already did it! I wrote this in 251 posts.
I wanted to ask. Who read the full dump from MSS60 through BDM ? Please share. Maybe, this will be the most beams birthday gift! I can revive the brick !
Do you think this method can be used to revive him, at least to get in communication through the OBD?

[CF-CarParts Motorsport]

Its possible to get arround.
I think Terra also did before. Read Threader with open eyes .

With developer tools also able to get you hands through.
But seams it clients car... so get a spare mss60, read ISN... write to CAS from car (if CAS3+ need a key for descryption of cas) and after do the coding stuff .

[[email protected]]

You cant read left side mcu because bdm of this is blocked by bmw in configurations.

now that there is no way out, it is not possible to restore it?

[CF-CarParts Motorsport]

You cant read left side mcu because bdm of this is blocked by bmw in configurations.

[[email protected]]

Hello Guru, I have a BMW E92, 2009 , MSS60 , S65B40. I wanted to update the Firmware on DME WINKFP with D-CAN cable. As a result, I got a brick! DME is not detected. I tried to read the K-TAG the BDM . I read the memory of R perfectly! And L memory could not the read , a checksum error appears! I was lent the same DME MSS60, I have AUTOHEX II, I read SK (ISN) from it and wrote it down in CAS. The car started up and works! I wanted to clone it, to write on my DME, didn't work! The same situation with the checksum! How can I restore my DME, where can I get a dump for it to restore via BDM ? I put files reading with KTAG and KESS here.Please help me to restore, the car has been standing for a week! Thanks.

[alfons38]

Good work thanks to all people

[beastpilot]

Just to follow up on my Bricked MSS85 (M5) DME, and how I recovered it:

Bought KTAG clone off Ebay (You need KTAG, not KESS. Make sure it isn't coming with OBDII connectors.) Apparently a BDM100 off Aliexpress will work also (cheaper, longer to ship), or a Galletto 4 V54.

Opened, ECU, soldered pins on the BDM header connectors (pins came with KTAG).

Installed KTAG software, Make sure you install Visual C++ 2005 and reboot after install or you will get Checksum errors.

Read data from ECU to have a backup of what is there. If you get Checksum errors, STOP and fix them. The reads are worthless with these, and these reads could be important.

At least with KTAG it complained about the protocol being wrong for the right processor (instructions say 117, but it wanted 116). I just used the one it suggested and it worked fine. I believe this is a difference with the Siemens vs Continental DME builds (mine was an '08 and Continental).

Take you backup you made with MSS6X flasher (you did take one, right?), and use a hex editor to break it into 4 files. 0-0x7FFFF, 0x80000-0x27FFFF, 0x280000-0x2FFFFF, and 0x300000-0x4FFFFF. (512kb, 2048kb, 512, 2048)

The first block is the left MPC. The second is the Left External Flash. Third is right MPC, Fourth is right Ext Flash.
Flash these back to the DME. That should be it.

When I did this, I got a DME EWS error. My backup did not have the ISN in it. However, the ISN will be in your BDM backup that you took before you wrote. Open up the left micro backup file read by BDM. ISN is the 6 bytes at 0x7940. Move these to your your Flasher backup file and write back to the ECU.

Even better, make sure you read the ISN with MSS6X flasher before you even try to flash anything back. This will prove that the RSA bypass and everything is working.

You may want to just write to the Left Ext Flash first and the right MPC and flash, and see if you recover it. This will avoid overwriting the ISN if the left MPC is otherwise healthy.

I've now written back to the ECU many, many times with the MSS6X flasher program with no issues. I have no idea what failed, but it was a fluke based on my experience. I'm going to go see if I can find an obvious corruption between my BDM backup and what I was trying to write with the MSS6X flasher.

[CF-CarParts Motorsport]

beastpilot where are you from?
If you from Germany, send (or come locally with) ecu + ews modul to us and we can recover it or at least resync ecu with ews . If interested write a pn.
About BDM:wikipedia.org/wiki/Background_debug_mode_interface
In MSS65 / MSS60 there are two seperate MPC56x processors (one injection side other is ignition side and both communicate together).
So you have to read both sides mpc and flash seperate via bdm pad.
In early MSS60 isn't bdm lock. In later onces ~ 2009 and above there is bdm "lock" but there are ways to get around, also terra got the solution (he mentioned early in this threader).