MSS6x Flasher - Now released!

[MSSAddict]

omhl Ok 👍 perfect I understand
terra Let's wait terra to see his answer

[omhl]

i editted my post a little bit more. just so you know.

I would wait for terra to confirm though, I don't want to give out bad information.

[MSSAddict]

You have to read your full binary then load the same full binary you just read then press RSA BYPASS SLOW.
If you are going to be writing full programs in future , you will need to do another full read to get the full binary with RSA bypass intact in your read. Your original full read will not have the RSA bypass.

I would do it just to have a backup.

Otherwise, you can work off your partial binary and flash tunes. cuz your not working in the program space anymore.

At least this is from what I understand.

omhl Ah ok 👌 thank You

[omhl]

terra hi
I'm waiting for my D-CAN bimmergeek cable, for now I have read my partial file and my fullbinary, if I want to flash a modified partial file (by myself), I have to load the new partial file, then on #advanced # then I have to flash the RSA BY PASS (slow), I wait about 15 min for it to be finished, and I can flash my new modified partial file, is that correct please?
the tool is new I discover the software 😅
Thank you to you and to all the people who participated from the loan or from far away in this fabulous tool

You have to read your full binary then load the same full binary you just read then press RSA BYPASS SLOW. What it does is that it takes your FULL BIN you just read and changes some values for checksum. I actually compared the read before and after RSA bypass so I know the full binary gets changed after the bypass. From what I read from past, the way the algo tricking works is that checksums runs for x amount of time on a section of the program space - all the rsa bypass does is it tricks it into calculating it correctly until time runs out?

If you are going to be writing full programs in future , you will need to do another full read to get the full binary with RSA bypass intact in your read. Your original full read will not have the RSA bypass.
I would do it just to have a backup anyways.

Otherwise, you can work off your partial binary and flash tunes. cuz your not working in the program space anymore.

At least this is from what I understand.

[MSSAddict]

terra
Thank you for your quick reply
I preferred to buy a bimmergeek cable all the same, if I flash a Fullbinary of 5120ko which I modified with the tool of Martyn , should I flash the RSA By Pass for a fullbinary please?or just flash directly as a partial file?
thank You

[MSSAddict]

Martyn
And I also want to thank Martyn who always answers questions with passion, he’s a very serious and very helpful person, he also develops fantastic tools
thx
Chris///

[terra]

If you have an MSS65, then all you have to do is flash the modified partial. No need to mess with any RSA Bypass or anything like that. For an MSS60, you need the RSA Bypass. Fast version will take about 12-15 minutes, slow version will take about twice as long. End result should be the same either way.

If your car is a D-CAN car (September 2007 or newer E60/E63, or any E9x M3), then you need the bimmergeeks cable in order to do a flash.

[MSSAddict]

terra hi
I'm waiting for my D-CAN bimmergeek cable, for now I have read my partial file and my fullbinary, if I want to flash a modified partial file (by myself), I have to load the new partial file, then on #advanced # then I have to flash the RSA BY PASS (slow), I wait about 15 min for it to be finished, and I can flash my new modified partial file, is that correct please?
the tool is new I discover the software 😅
Thank you to you and to all the people who participated from the loan or from far away in this fabulous tool

[terra]

Is there flash counter for MSS60 using your tool? I know in WINKFP UIF writes records it or something.

I shoulda asked that first before going ham.

MSS6x doesn't have a flash counter. There is a UIF limit unlike some other newer BMW DMEs, but this app won't touch the UIF. Even if you did max out the UIF limit, you could still flash the DME, you just wouldn't be able to change the reported software number, VIN, etc.

[omhl]

Is there flash counter for MSS60 using your tool? I know in WINKFP UIF writes records it or something.

I shoulda asked that first before going ham.

[terra]

Minor update to the app. Only new function is when you read the ISN from the MSS65, it'll show the CAS format in addition to the DME format (like below). Otherwise some typo fixes.

[omhl]

Yep, comfort mode. I did a Program Update 7848137 to 7854376. So I'm fairly confident that the entire program space was overwritten.

i'll give another crack at this. Terra's post #79 is really helpful

It was a problem with my XDF lol. sorry user mistake and reminds me that I need to double check my work.

[Martyn]

When you flashed back to stock did you use comfort mode? If so, did you tick the ‘force program programming in comfort mode’? Every time I’ve had to flash a tuned E92 I’ve had to revert the program space before it would accept another tune.

[omhl]

I'll check into this again tommorow. my eyes hurt from looking at hex and tunerpro is being glitchy so it might be from that as well.
i have a mix of frieling, alienkess, and fgtech bins so its possible i'm mixing them up.

[terra]

Hmm, 241E should be 241E, weird. Some values might vary year to year, but they should still be in the correct locations - I can't really explain why the program was tripping up unless your changes were to things I check for consistency.

For the tune, I check the following:

0x0 -> 0x7 and 0x10000 -> 0x10007 are 5A5A5A5ACCCCCCCC (this check failing will throw a "not a valid tune" message)
The strings at 0x256 and 0x10256 are equal to each other and match the program version (and I don't check. the 3rd digit - i.e 240E vs 241E, since the DME doesn't actually care if those differ between the tune and program -- in fact, you'll find a stock 241E flash will still call itself 240E in the tune)
And I make sure that each half is in the correct order (0x252 == 1, 0x10252 == 2).

If those are all true, it *should* accept the tune.


For a full read, if you were getting the "not a valid program" message, then that means either 10000 -> 10007 or 290000 -> 2900007 were not equal to 5A5A5A5A33333333