MSS6x Flasher - Now released!

[Lambda1]

Mate its super easy 5-6 wires need.
I would bulid some with original BMW Parts but isn't really worth if you check new parts prices .
Only parts ~60€.

[M3Gallo]

Does anyone on here build and sell bench setups for the MSS60/65 DME? Or could I commission someone to undertake the task? If so PM me please.

[terra]

The keys that are used in the app to sign the seed and decrypt the signature, they are from the file SGIDC.as2 in the gdaten directory?

I'm trying to work out the format of the lines in that file - I'm assuming each line contains several keys combined and they are probably encrypted by another key??

I'm very familiar with the F/G series keys but never looked into the E series stuff. Happy to share F/G series knowledge.

Any help would be much appreciated, thanks.

P.

They’re triple des encrypted. I’ll dig up the keys later. You can find them if you disassemble WinKFP. The symmetric encryption keys I thinks are encrypted with something else.

For the rsa authenticated modules, each line contains the modulus and private exponent for level 3 security access (ECU Programming Mode). Public exponent is always 7 for security access.

[pshoey]

The keys that are used in the app to sign the seed and decrypt the signature, they are from the file SGIDC.as2 in the gdaten directory?

I'm trying to work out the format of the lines in that file - I'm assuming each line contains several keys combined and they are probably encrypted by another key??

I'm very familiar with the F/G series keys but never looked into the E series stuff. Happy to share F/G series knowledge.

Any help would be much appreciated, thanks.

P.

[MpowerE36]

Uploaded everything to github: https://github.com/terraphantm/MSS6x-Flasher

Please be gentle with your criticism. I'm a doctor, not a programmer, this is mostly cobbled together with what I was able to teach myself :P

Thank you for your work Terra. You did an impressive job here.

Thank you also for taking the time to explain all of your work on these ECU in the github.

[pshoey]

There are always multiple ways to achieve the same result - if this is the result of teaching yourself C# - I congratulate you - I'll start teaching myself to become a doctor - I bet I don't get as good a result as this!!

Thanks for sharing.

[terra]

Uploaded everything to github: https://github.com/terraphantm/MSS6x-Flasher

Please be gentle with your criticism. I'm a doctor, not a programmer, this is mostly cobbled together with what I was able to teach myself :P

[Lambda1]

Possible for MSS60 and MSS65 also with options for Swap like also Limiter at 5500rpm with lost abs signal, with full power and no CAN-bus problems. No Emulator, in file.

[terra]

For MSS60 ?

I mean really, on any dme that has program write capabilities, EWS delete is possible. You just have to figure out what instructions to bypass.

[dmlf]

You don't need, but isn't freely officially released atm . Is possible in file.

For MSS60 ?

[Lambda1]

I've given up on hopes for an EWS/CAS delete

You don't need, but isn't freely officially released atm . Is possible in file.

[sjsuM5]

You could make a full backup, flash to stock with WinKFP, and then flash your backup back.

Ended up using the binary modification tool to edit my DME file after backing up the DME using MSS6x flasher. Will be taking M5 to get smog tested this weekend...

[dmlf]

Ah right ! So it may be patchable I guess... Would be fun

[terra]

The obd read protection has nothing to do with the UC3FMCR register. The read code is simply set to return 0xFF when reading certain addresses.

[dmlf]

[*]If successful, the key is displayed in the application and a file with the SK is saved (file will include the appropriate header to be pasted in directly at 0x7948 of the injection dump)

I don't understand why the SK would be at this position, I saw that you where able to dump the UC3FMCR which was 43 FF 00 FF, which means PROTECT = FF so the only protection would be through SBPROTECT + SBEN .
But in the datasheet the first two blocks layout is 16K (SB[0] + 48K ; 48K +16K SB[1] ), so 0x7948 would be inside the remainer of BLOCK[0] right ?
which should not protected

I am lost