MSS6x Flasher - Now released!

[SYT_Shadow]

From Wikipedia:
"Background debug mode (BDM) interface is an electronic interface that allows debugging of embedded systems. Specifically, it provides in-circuit debugging functionality in microcontrollers. It requires a single wire and specialized electronics in the system being debugged. It appears in many Freescale Semiconductor products."

FWIW Freescale is the developer of the MPC563 processors used in the MSS60/65 DMEs. So those processors (and many, many, many others) implement BDM as a method for debugging.

BDM access requires removing the DME from the vehicle and opening the case. Access is usually through a set of pads on the circuit board. There are inexpensive clones of tools like KTAG which can be used to BDM read/write the MPC563. You will also need a device to allow stable contact with pads or you'll have to solder a header to them for that purpose.

It doesn't sound like this is something I can do on my own

[dpaul]

What is BDM?

From Wikipedia:
"Background debug mode (BDM) interface is an electronic interface that allows debugging of embedded systems. Specifically, it provides in-circuit debugging functionality in microcontrollers. It requires a single wire and specialized electronics in the system being debugged. It appears in many Freescale Semiconductor products."

FWIW Freescale is the developer of the MPC563 processors used in the MSS60/65 DMEs. So those processors (and many, many, many others) implement BDM as a method for debugging.

BDM access requires removing the DME from the vehicle and opening the case. Access is usually through a set of pads on the circuit board. There are inexpensive clones of tools like KTAG which can be used to BDM read/write the MPC563. You will also need a device to allow stable contact with pads or you'll have to solder a header to them for that purpose.

[SYT_Shadow]

You'll have to read it via BDM after unlocking the DME.

Process would generally be:

1) Restore DME to stock and read that backup
2) Unlock the left CPU (this will delete the contents of that CPU in its entirety).
3) Restore your backup to that left CPU via BDM
4) Flash your tune back using your tuner's cable or whatever
5) Read the tune via BDM

From there, one could probably figure out what needs to be changed to allow OBD reads with the tuned program.

What is BDM?

[scoopy128]

Hi whats the difference between the kdcan cable for s54 to s65

[terra]

In theory we would indeed be able to reflash our tune afterwards, as we already had it to begin with.

I'm just not sure how to read it when the program says it cannot read

You'll have to read it via BDM after unlocking the DME.

Process would generally be:

1) Restore DME to stock and read that backup
2) Unlock the left CPU (this will delete the contents of that CPU in its entirety).
3) Restore your backup to that left CPU via BDM
4) Flash your tune back using your tuner's cable or whatever
5) Read the tune via BDM

From there, one could probably figure out what needs to be changed to allow OBD reads with the tuned program.

[SYT_Shadow]

I don’t think so. The used dme I bought had a build date near there and was locked until I unlocked it.

If you’d be able to reflash your tune afterwards, I suppose you can restore to stock, do a full backup, unlock the dme, restore the backup, flash the tune, and then read the full contents over bdm.

In theory we would indeed be able to reflash our tune afterwards, as we already had it to begin with.

I'm just not sure how to read it when the program says it cannot read

[MSSAddict]

terra hi

i send You a private message
can You look please my message
thank you

[terra]

This is a bit confusing.

If one of my cars was not tuned, what are the steps?
-flash the car with 240E software to coincide with the tuned car version
-execute a 'rsa bypass' with the tool?
-load tune
?


I'm pretty happy I can enable cold start on the stroker engine now!

That would basically be the process, yes. If it’s on 241E, you could just use the 240E tune (they’re interchangeable)

[SYT_Shadow]

This is a bit confusing.

If one of my cars was not tuned, what are the steps?
-flash the car with 240E software to coincide with the tuned car version
-execute a 'rsa bypass' with the tool?
-load tune
?


I'm pretty happy I can enable cold start on the stroker engine now!

[terra]

If both ECU have a custom tune the RSA bypass is already installed and so you just have to load the correct tune and push "flash tune".

Assuming both ECUs are on the same program version

[alfalfa]

If both ECU have a custom tune the RSA bypass is already installed and so you just have to load the correct tune and push "flash tune".

[SYT_Shadow]

It's odd. It worked fine.

I went to the E92, identify DME, then 'read tune'. It reads it and saves it on the drive.
Then I went to the E90, identify DME, then 'read tune'. It reads it as well.

So now all I have to do is go to the E90, take file from the E92 and 'load tune'?

[terra]

My build date is 2008-04-10 is that early enough?

I don’t think so. The used dme I bought had a build date near there and was locked until I unlocked it.

If you’d be able to reflash your tune afterwards, I suppose you can restore to stock, do a full backup, unlock the dme, restore the backup, flash the tune, and then read the full contents over bdm.

[tdott]

If you can do a BDM backup then it'd be possible to defeat the bypass in there and reflash, but unless you own a very early M3, your DME will be BDM locked.

My build date is 2008-04-10 is that early enough?

[terra]

Shouldn't we be able to bypass tune read protections on the ECUs?

What if I have a tune with read protection but want to remove or add cold start for example? There should be a way to do that

Unfortunately with the way the flash routines are setup on the MSS6x, it's not really doable without wiping out the tune altogether. If you can do a BDM backup then it'd be possible to defeat the bypass in there and reflash, but unless you own a very early M3, your DME will be BDM locked.