MSS6x Flasher - Now released!

[CF-CarParts Motorsport]

Epoustouflant
Yes . Today get my hands on M3 E92 and I can tell you it works also there.
CAS can be delete and bridge relays to fire up. For the moment only for manual cars, for DKG need think about
get around ISN problem with DKG and CAS delete.

Andy2424
We are based near Stuttgart, BW, Germany.
For questions feel free to sent messages.


Goals now is to test other versions and progress with encryption and the possibility to add to the tool .
Locking ECU is solved but the struggle is to share and keep the stuff in the same time 😅.
If anybody gets ideas or hints (I also got some for testing) please give me a message.

[ccfj1]

I can add functionality to the flasher - what do we want to add? Let's get a list going.

The only ones I can think of that would be handy would be

1: Cold start delete
2: Sync ISN to CAS (I know this one may not be possible, so maybe at least display the ISN)
3: Change Vin

I have a s60 2008 M3 DME on the bench, I'll be flashing (with icom) to latest Firmeware, then dumping the dme with the flasher, I also have one of Maryns ediabaslib leads, so writing back should be no problem.

Happy to help test new options.

[Jony787]

I got my hands on a e92 m3 and I love it but im having issues with cas and I need to replace it.
I have galleto v54 and a dcan cable that just loaded ediabaslib ( is there a way to check if is loaded propertly?)

Is there a difference between v54 full load and your software full load???. Also the v54 pulls a warning that a full read and full write need to happen before any changes made, Im gessing this is the RSA bypass?

bimmergeeks cable on its wake just to be safe.

I would like to know the process of rewriting the SK or leaving it in blank to let a new cas alignment write a new sk to dme.

I understand the point of reading the sk but it it it will be nice to have proper procedure of editing and writing it back. Maybe implemented on software?

My m3 is 2008

thanks in advance for any help provided.

[pshoey]

Are there any plans to extend the tool?? (like code options etc (cold start delete etc)).

Honestly, I’m busy enough nowadays that I don’t really have time to add functionality. But if anyone else wants to, the source code is there.

I can add functionality to the flasher - what do we want to add? Let's get a list going.

[Andy2424]

Hi Mates,

Greetings from a bimmer enthusiast from germany and hope all of you got healthy times.

Hi, where is your home Base?

[Epoustouflant]

That is absolutely amazing news.

[CF-CarParts Motorsport]

Hi Mates,
First: I don't know if it's allowed to post, because it's a kind of teaser and advertise so if it isn't okay please mention me and delete it.

I am very happy to tell you that we got a tested and working MSS65 Immo off .
In fact of MSS60 and MSS65 are siblings and for bench test (because for the moment I can`t grab my no hands on an M3) also works for S65B40 and the solution are nearly the same.
True and full EWS / CAS delete. It is tested on several sw-versions of MSS65 (will test all of em in real).
For moments it's just tested in E60 M5 but we are building also adapter harnesses for swaps (E28, E30, E36, E46...) and in next months engine swap of S85B50 is done to a E3x Chassis and also harness is ready for playing .
So really easy plug and play standalone solutions will come for reasonable prices (~40% of known solutions from competitors).

For the moment I am very busy with finding all the rest needens for swap modification in code, I got nearly all stuff sorted out.
Also I am thinking about a way to protect, encrypt the solution (because we doing business with this) but be able to integrate in Martyns Tool so all of you can solve it easily - for the moment just to get your hands by sending ecu and ecu will be locked by code and mechanically.

Just for a hint (and maybe there are also other ways) but we solve it in left side of ecu .

In fact of we also got several and good knowledge in tune this BMW NA Engines I am maybe able to help you out in this place. If some of you need any help with don't hesitate to ask .
If I got time I help you out (series engines, tuned (decat, plenum mods and also for annoying pop and bang stuff).


Greetings from a bimmer enthusiast from germany and hope all of you got healthy times.

[terra]

Honestly, I’m busy enough nowadays that I don’t really have time to add functionality. But if anyone else wants to, the source code is there.

[ccfj1]

Great tool Terra...many thanks

Have a e9x s60 dme turning up this week, will try this with my bench.

Are there any plans to extend the tool?? (like code options etc (cold start delete etc)).

[pshoey]

Don't know about the MHD cable but definitely not ICOM as the EdiabasLib library doesn't support ICOM.

[kmn1235]

You guys know if MHD/XHP cable is EdiabasLib compliant so I could use that cable to flash MSS6X safely? How about ICOM?

[pshoey]

Does anyone on here build and sell bench setups for the MSS60/65 DME? Or could I commission someone to undertake the task? If so PM me please.

Lambda1 is correct, super easy to make one. Here are some pictures of most recent effort.

[Lambda1]

Mate its super easy 5-6 wires need.
I would bulid some with original BMW Parts but isn't really worth if you check new parts prices .
Only parts ~60€.

[M3Gallo]

Does anyone on here build and sell bench setups for the MSS60/65 DME? Or could I commission someone to undertake the task? If so PM me please.

[terra]

The keys that are used in the app to sign the seed and decrypt the signature, they are from the file SGIDC.as2 in the gdaten directory?

I'm trying to work out the format of the lines in that file - I'm assuming each line contains several keys combined and they are probably encrypted by another key??

I'm very familiar with the F/G series keys but never looked into the E series stuff. Happy to share F/G series knowledge.

Any help would be much appreciated, thanks.

P.

They’re triple des encrypted. I’ll dig up the keys later. You can find them if you disassemble WinKFP. The symmetric encryption keys I thinks are encrypted with something else.

For the rsa authenticated modules, each line contains the modulus and private exponent for level 3 security access (ECU Programming Mode). Public exponent is always 7 for security access.