MSS6x Flasher - Now released!

[[email protected]]

But seams it clients car... so get a spare mss60, read ISN... write to CAS from car (if CAS3+ need a key for descryption of cas) and after do the coding stuff .

No, a friend's car. I already did it! I wrote this in 251 posts.
I wanted to ask. Who read the full dump from MSS60 through BDM ? Please share. Maybe, this will be the most beams birthday gift! I can revive the brick !
Do you think this method can be used to revive him, at least to get in communication through the OBD?

[CF-CarParts Motorsport]

Its possible to get arround.
I think Terra also did before. Read Threader with open eyes .

With developer tools also able to get you hands through.
But seams it clients car... so get a spare mss60, read ISN... write to CAS from car (if CAS3+ need a key for descryption of cas) and after do the coding stuff .

[[email protected]]

You cant read left side mcu because bdm of this is blocked by bmw in configurations.

now that there is no way out, it is not possible to restore it?

[CF-CarParts Motorsport]

You cant read left side mcu because bdm of this is blocked by bmw in configurations.

[[email protected]]

Hello Guru, I have a BMW E92, 2009 , MSS60 , S65B40. I wanted to update the Firmware on DME WINKFP with D-CAN cable. As a result, I got a brick! DME is not detected. I tried to read the K-TAG the BDM . I read the memory of R perfectly! And L memory could not the read , a checksum error appears! I was lent the same DME MSS60, I have AUTOHEX II, I read SK (ISN) from it and wrote it down in CAS. The car started up and works! I wanted to clone it, to write on my DME, didn't work! The same situation with the checksum! How can I restore my DME, where can I get a dump for it to restore via BDM ? I put files reading with KTAG and KESS here.Please help me to restore, the car has been standing for a week! Thanks.

[alfons38]

Good work thanks to all people

[beastpilot]

Just to follow up on my Bricked MSS85 (M5) DME, and how I recovered it:

Bought KTAG clone off Ebay (You need KTAG, not KESS. Make sure it isn't coming with OBDII connectors.) Apparently a BDM100 off Aliexpress will work also (cheaper, longer to ship), or a Galletto 4 V54.

Opened, ECU, soldered pins on the BDM header connectors (pins came with KTAG).

Installed KTAG software, Make sure you install Visual C++ 2005 and reboot after install or you will get Checksum errors.

Read data from ECU to have a backup of what is there. If you get Checksum errors, STOP and fix them. The reads are worthless with these, and these reads could be important.

At least with KTAG it complained about the protocol being wrong for the right processor (instructions say 117, but it wanted 116). I just used the one it suggested and it worked fine. I believe this is a difference with the Siemens vs Continental DME builds (mine was an '08 and Continental).

Take you backup you made with MSS6X flasher (you did take one, right?), and use a hex editor to break it into 4 files. 0-0x7FFFF, 0x80000-0x27FFFF, 0x280000-0x2FFFFF, and 0x300000-0x4FFFFF. (512kb, 2048kb, 512, 2048)

The first block is the left MPC. The second is the Left External Flash. Third is right MPC, Fourth is right Ext Flash.
Flash these back to the DME. That should be it.

When I did this, I got a DME EWS error. My backup did not have the ISN in it. However, the ISN will be in your BDM backup that you took before you wrote. Open up the left micro backup file read by BDM. ISN is the 6 bytes at 0x7940. Move these to your your Flasher backup file and write back to the ECU.

Even better, make sure you read the ISN with MSS6X flasher before you even try to flash anything back. This will prove that the RSA bypass and everything is working.

You may want to just write to the Left Ext Flash first and the right MPC and flash, and see if you recover it. This will avoid overwriting the ISN if the left MPC is otherwise healthy.

I've now written back to the ECU many, many times with the MSS6X flasher program with no issues. I have no idea what failed, but it was a fluke based on my experience. I'm going to go see if I can find an obvious corruption between my BDM backup and what I was trying to write with the MSS6X flasher.

[CF-CarParts Motorsport]

beastpilot where are you from?
If you from Germany, send (or come locally with) ecu + ews modul to us and we can recover it or at least resync ecu with ews . If interested write a pn.
About BDM:wikipedia.org/wiki/Background_debug_mode_interface
In MSS65 / MSS60 there are two seperate MPC56x processors (one injection side other is ignition side and both communicate together).
So you have to read both sides mpc and flash seperate via bdm pad.
In early MSS60 isn't bdm lock. In later onces ~ 2009 and above there is bdm "lock" but there are ways to get around, also terra got the solution (he mentioned early in this threader).

[beastpilot]

I have an MSS65, not an MSS60, so I believe all of those can be BDM'd from what I read. I understand no cable is 100%- just mentioned to show that I wasn't using a guarantee brick cable.

Can someone point me to a good resource to learn about BDM programming? My google searches are failing me. Is BDM any different than JTAG?

I'm only trying to fix one, and a used ECU is only $200, so it's not worth spending a bunch on a programmer, but of course I might kill the new one too, so I'd rather BDM. I'm pretty skilled at soldering so I don't need all the frames, I can just tag some wires on.

[Tomba]

I appear to have bricked my MSS65 in a 2008 M5.
It's not the cable- I read the ECU, turned off cold start, and programmed it back. Worked fine. I programmed the cable with EdbiasLib firmware personally.
Turns out I liked the cold start. I put it back and re-programmed.
In the middle of the program I got an "unable to set address," so I re-started. Seemed to work fine, went through the whole process normally. This was a full flash, not tune.
However, when I power cycled, I got no fuel pump prime.
The DME flasher says "unknown/unsupported" when I try and connect again. It just appears to not be talking at all.
The DME comes up red in ISTA as missing. I tried Tool32 and it can't find the ECU. It finds other modules.

The engine does crank, just never starts. I think this is CAS though.

I'm pretty handy with electronics. Can I recover a MSS65 from the inside? What kind of BDM programmer do I need? I'm an EE so I have all sorts of JTAG and other stuff around.

If I just grab another ECU, will I have an issue re-programming it or anything with CAS, given I have the full original backup?

I bricked a MSS60. Used a non EdiabasLib cable, very stupid. I ordered BimmerGeeks cable and needed to flash a M5.2 ECU. That one aborted half way for no reason. Then used my ICOM to do the job. For me a cable with EdiabasLib firmware isn't 100% safe. Back up tools are a must for me. Unfortunately MSS60 isn't BDM able yet for all versions.
I also have a hard time to unlock ECUs with the latest software version on it. Kess isn't able to unlock them.

For your problem,
Get your hands on BDM programmer. With your full read I would suspect you can "repair" the current files in the ECU. I personally have MagicMotorsport equipment. But cost wise I wouldn't suspect you buy the full package. Search for KTAG, these should be able to read your ECU. Might consider soldering BDM headers on your ECU or a BDM frame with adapter.

[beastpilot]

I appear to have bricked my MSS65 in a 2008 M5.
It's not the cable- I read the ECU, turned off cold start, and programmed it back. Worked fine. I programmed the cable with EdbiasLib firmware personally.
Turns out I liked the cold start. I put it back and re-programmed.
In the middle of the program I got an "unable to set address," so I re-started. Seemed to work fine, went through the whole process normally. This was a full flash, not tune.
However, when I power cycled, I got no fuel pump prime.
The DME flasher says "unknown/unsupported" when I try and connect again. It just appears to not be talking at all.
The DME comes up red in ISTA as missing. I tried Tool32 and it can't find the ECU. It finds other modules.

The engine does crank, just never starts. I think this is CAS though.

I'm pretty handy with electronics. Can I recover a MSS65 from the inside? What kind of BDM programmer do I need? I'm an EE so I have all sorts of JTAG and other stuff around.

If I just grab another ECU, will I have an issue re-programming it or anything with CAS, given I have the full original backup?

[CF-CarParts Motorsport]

Epoustouflant
Yes . Today get my hands on M3 E92 and I can tell you it works also there.
CAS can be delete and bridge relays to fire up. For the moment only for manual cars, for DKG need think about
get around ISN problem with DKG and CAS delete.

Andy2424
We are based near Stuttgart, BW, Germany.
For questions feel free to sent messages.


Goals now is to test other versions and progress with encryption and the possibility to add to the tool .
Locking ECU is solved but the struggle is to share and keep the stuff in the same time 😅.
If anybody gets ideas or hints (I also got some for testing) please give me a message.

[ccfj1]

I can add functionality to the flasher - what do we want to add? Let's get a list going.

The only ones I can think of that would be handy would be

1: Cold start delete
2: Sync ISN to CAS (I know this one may not be possible, so maybe at least display the ISN)
3: Change Vin

I have a s60 2008 M3 DME on the bench, I'll be flashing (with icom) to latest Firmeware, then dumping the dme with the flasher, I also have one of Maryns ediabaslib leads, so writing back should be no problem.

Happy to help test new options.

[Jony787]

I got my hands on a e92 m3 and I love it but im having issues with cas and I need to replace it.
I have galleto v54 and a dcan cable that just loaded ediabaslib ( is there a way to check if is loaded propertly?)

Is there a difference between v54 full load and your software full load???. Also the v54 pulls a warning that a full read and full write need to happen before any changes made, Im gessing this is the RSA bypass?

bimmergeeks cable on its wake just to be safe.

I would like to know the process of rewriting the SK or leaving it in blank to let a new cas alignment write a new sk to dme.

I understand the point of reading the sk but it it it will be nice to have proper procedure of editing and writing it back. Maybe implemented on software?

My m3 is 2008

thanks in advance for any help provided.

[pshoey]

Are there any plans to extend the tool?? (like code options etc (cold start delete etc)).

Honestly, I’m busy enough nowadays that I don’t really have time to add functionality. But if anyone else wants to, the source code is there.

I can add functionality to the flasher - what do we want to add? Let's get a list going.