MSS6x Flasher - Now released!

[hansbrix]

So given the new news on the m5board, I was wonder what you guys think about how can we figure out if the code to control the DCT/DKG is indeed there? Couldn’t we just use WinKFP to flash a MSS65 DME with a euro calibration then evaluate the difference in the code? I have a bimmergeeks cable coming but I have a few running M5s I could play with. I just have never flashed or updated modules yet on the M5 since I’m been busy fixing the myriad of mechanical stuff. I’m gonna try installing ISTA/P also since I think that plus an ICOM is require to update the I level of the car. But for the DME only, is it that I can use WinKFP with the appropriate datens to flash the DME. I suppose if someone already has the full bin of a euro DME we can just use terra’s nifty tool here? We’d have to edit the VIN and other stuff though right?

[terra]

So at some point I accidentally introduced a bug that skipped over the signature check when flashing a tune to the MSS60. Fixed version is uploaded now, I recommend all testers redownload.

[terra]

The one-stop electronics is probably one of the easier ones to modify. It already has AVR ISP header on board, so you don't need to do any soldering. Just plug in the programmer and program the chip

[tdott]

Just to confirm that the Frieling iflash adapter that comes with most after market tunes, will not work with Ediabas (inpa/ncs/ista/etc) software, therefore doesn't work with this flasher.
I've read conflicting info on that before, but tested it myself with no success.

I'm buying a bimmergeek cable vs modifying my old one-stop-electronic cable I've had for years.

[terra]

Sorry for the delay. Got so many PMs that I missed a couple. Responded to you

[Dash1]

pm'ed you terra

[terra]

Quick question in how big a full read bin should be for a MSS65. My full read was 5.00 MB (5,242,880 bytes). Does this seem correct? I ask because a few months back I was looking at doing some tuning and found a bin that someone uploaded, I think it was a BDM read. That one was 1.00 MB (1,048,576 bytes). What accounts for the stark difference and what should be the correct size of a full bin?

5MB is correct. It's structured like so

Injection (left) Internal flash - 512KB
Injection (left) External flash - 2MB
Ignition (right) Internal flash - 512KB
Ignition (right) External Flash - 2MB

The tune is stored in the last 64K of each internal flash. Program code is spread between the internal and external flashes. Most of the external flash is empty, but is still necessary to make a full backup and to generate an RSA patch.

The bin you found was likely a dump of both internal flashes.

[hansbrix]

Quick question in how big a full read bin should be for a MSS65. My full read was 5.00 MB (5,242,880 bytes). Does this seem correct? I ask because a few months back I was looking at doing some tuning and found a bin that someone uploaded, I think it was a BDM read. That one was 1.00 MB (1,048,576 bytes). What accounts for the stark difference and what should be the correct size of a full bin?

[terra]

Another update:
Cosmetic stuff:

• Added an app icon. Definitely subject to change, just wanted to try
• Added a little note that the application is provided by free by this forum, and a have a link to this thread for the latest version (of course for the time being you need to contact me to download a copy)
• Changed some text notifications

Functional changes:

• Sped up full reads by skipping over areas that should be blank. Should bring the total read time down to approximately 45 minutes
• The long read option is still available in the advanced menu
• If the read file size is smaller than expected (i.e one of the read requests failed), the application won't save those dumps

[Martyn]

Will this allow me to do a complete read of my existing ECU and modify that file? I have a tune on on my car which has disabled cold start and it would be nice to re-enable it and make some other changes without losing the benefits of the tune that is current installed. Assuming the hex address locations will be known (I don't have this information and would love to find it) for where such changes need to be made.

I have the BL KCAN cable as well.

I've tested the full read from MSS6x Flasher with my software and it works fine.

https://www.ecuworx.co.uk/2020/04/12/e60-e61-m5-e63-e64-m6-mss65-binary-modification-tool-released/

[terra]

Will this allow me to do a complete read of my existing ECU and modify that file? I have a tune on on my car which has disabled cold start and it would be nice to re-enable it and make some other changes without losing the benefits of the tune that is current installed. Assuming the hex address locations will be known (I don't have this information and would love to find it) for where such changes need to be made.

I have the BL KCAN cable as well.

Yes it should enable you to do that assuming your tuner didn't implement any sort of read lock. I don't think there's a public xdf or a2l. MartynT's application should be good for making simpler modifications like that.

[6ixSPD]

Will this allow me to do a complete read of my existing ECU and modify that file? I have a tune on on my car which has disabled cold start and it would be nice to re-enable it and make some other changes without losing the benefits of the tune that is current installed. Assuming the hex address locations will be known (I don't have this information and would love to find it) for where such changes need to be made.

I have the BL KCAN cable as well.

[Martyn]

ECU wouldn't accept a job. Gateway module probably would, but I do feel like communicating with multiple modules during a flash process is a good way to introduce writing errors.

Understood! Perhaps just a check of 'STAT_PHY_UKL15_WERT' via 'status_ukl15' prior to starting a full flash might be a good idea? If voltage < 12.5 perhaps throw a pop up or something?

*Edit* status_ukl15 doesn't exist in MSS6x.prg so ignore me

[terra]

ECU wouldn't accept a job. Gateway module probably would, but I do feel like communicating with multiple modules during a flash process is a good way to introduce writing errors.

[Martyn]

Awesome!

I was going to suggest adding a voltage status of KL15 but I'm guessing the ECU won't accept job requests whilsts its in flashing mode or busy with a current job.

I'll have a think regarding the name.