Announcement

Collapse
No announcement yet.

MSS6x Flasher - Now released!

Collapse
This is a sticky topic.
X
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

  • kaiv
    replied

    Used Terra's flasher for the first time; indent, full read, ISN/secret key, RSA bypass and reflash with edited file. All went smoothly and worked perfectly. Thanks Terra and contributors!



    Edit: Answered my own question :P
    Last edited by kaiv; 12-04-2023, 01:08 PM.

    Leave a comment:


  • TANKER_WX
    replied
    Originally posted by Martyn View Post
    That's probably where I'd start.

    Do a ZUSB update to 240/241E with WinKFP to get you back to a 100% stock place and then try again.
    Sure, thx Martyn!

    I will try this procedure.

    Leave a comment:


  • Martyn
    replied
    That's probably where I'd start.

    Do a ZUSB update to 240/241E with WinKFP to get you back to a 100% stock place and then try again.

    Leave a comment:


  • TANKER_WX
    replied
    Originally posted by Tomba View Post

    I am not 100% sure, but I would suspect that during a RSA bypass the signature check is also bypassed on the program memory. Apparently it did on the first picture. Again, not 100% sure.
    2nd picture says that program is not available / not fully OK.
    These are conditions coming from ECU after/during flashing [PROGRAMMIERSTATUS].

    Are you able to upload your original full files here? Any chance the ECU has been tuned before?
    it should be stock file. i am the only owner of this car.
    So, u mean i can flash back to original full file by winkfp. and do RSA bypass again?

    sure. i am going to copy my full file tomorrow.

    Leave a comment:


  • Tomba
    replied
    Originally posted by TANKER_WX View Post

    I already readyout the full ECU file by ​MSS6X 1.0.0.3 Flasher and keep it safe.

    However, the RSA bypass is failed. I flash the original full file back to the DME by MSS6X 1.0.0.3, the car can be started normally.

    So, I try to do RSA bypass again, and it failed again.(u may find more ditail from attachment).

    Would u plz tell me how can i finish the RSA bypass using MSS6X flasher 1.0.0.3? or anytihing wrong with my software?

    The program version is 231E, and more detail info plz check the attachment.

    I am not 100% sure, but I would suspect that during a RSA bypass the signature check is also bypassed on the program memory. Apparently it did on the first picture. Again, not 100% sure.
    2nd picture says that program is not available / not fully OK.
    These are conditions coming from ECU after/during flashing [PROGRAMMIERSTATUS].

    Are you able to upload your original full files here? Any chance the ECU has been tuned before?

    Leave a comment:


  • TANKER_WX
    replied
    hi terra, Martyn,

    firstly great thx for yours to develop this nice app that i can make something happen on my car many thx.

    i am a newer here, i spend hours to read this thread fully. but i still cant fix my problem. So here it is:

    I bought ECUWorx Flashing Cable for E60 M5, E65 M6 and E92 M3, and the key from ECUWorx. I am willing to flash my 2013 bmw E92m3..

    I already download and install every software step by step (the system of my computer is window 10, COM1 LATENCY1, unzip ECUWORX-E6X-E9X-DME-Update to C:/ EC-APPS/NFS, copy 10flash.prg and

    MS_S65.PRG from MSS6X_Flasher_PreReqs to C:/Ediabas/ECU, etc..)

    I already readyout the full ECU file by ​MSS6X 1.0.0.3 Flasher and keep it safe.

    However, the RSA bypass is failed. I flash the original full file back to the DME by MSS6X 1.0.0.3, the car can be started normally.

    So, I try to do RSA bypass again, and it failed again.(u may find more ditail from attachment).

    Would u plz tell me how can i finish the RSA bypass using MSS6X flasher 1.0.0.3? or anytihing wrong with my software?

    The program version is 231E, and more detail info plz check the attachment.

    Many thx mate!

    Sincerely,

    Tanker.

    Attached Files
    Last edited by TANKER_WX; 10-31-2023, 08:34 AM.

    Leave a comment:


  • terra
    replied
    Originally posted by adrianj73 View Post
    Greets all new poster here and reading through the old posts to catch up. As a quick question, has the CENSOR lock on the one MPC been figured out yet? There’s actually a bit of code in every mss60 version I’ve looked at (a lot) that flips the CENSOR back on, but it’s a single byte change to make it like the other MPC.

    Also, the OBD read lock is a simple KWP2000 look up table change (IIRC) and works identically between mss60 and mss65.

    Again, old memory and need to refresh a few weeks, but IIRC MPC 563 writes flash in blocks, so I always wondered if it was possible to specify only a single block of flash to write that wouldn’t force writing all the other blocks (I.e. revert KWP lookup table to stock).
    I did succeed in disabling the censor via BDM. Mpower36 managed to over OBD. Clearing the censor does erase the entirety of the cpu flash. So ideally you’d have a backup beforehand (Mpower36’s software presumably backs it up and restores)

    Writing and locking an EWS SK via tool32 will enable censor mode. Otherwise it stays unlocked.

    Theres plenty of potential ways to disable OBD reading.

    The CPU does write / erase in blocks, but unfortunately the built in erase routines don’t. You can only erase the tune or the entirety of the program (without the ability to upload your own custom code to RAM that is).

    Unfortunately erasing the tune or program makes the DME disregard all read commands until a valid tune and program combination are written back.

    Leave a comment:


  • Tomba
    replied
    Hi, Welcome to the forum! Nice you join us.

    Originally posted by adrianj73 View Post
    As a quick question, has the CENSOR lock on the one MPC been figured out yet?
    Vincent [MpowerE36] https://nam3forum.com/forums/member/1186-mpowere36. Has done it.
    Hi, I develop a new MSS60 program and a Python script to unlock via OBD the BDM access to the injector CPU memory. They also allow to know if the injector CPU is BDM locked or not. The program can be written with MSS6x Flasher. Don’t know yet what I will do with them. The program is finished and released but the script is


    Leave a comment:


  • adrianj73
    replied
    Greets all new poster here and reading through the old posts to catch up. As a quick question, has the CENSOR lock on the one MPC been figured out yet? There’s actually a bit of code in every mss60 version I’ve looked at (a lot) that flips the CENSOR back on, but it’s a single byte change to make it like the other MPC.

    Also, the OBD read lock is a simple KWP2000 look up table change (IIRC) and works identically between mss60 and mss65.

    Again, old memory and need to refresh a few weeks, but IIRC MPC 563 writes flash in blocks, so I always wondered if it was possible to specify only a single block of flash to write that wouldn’t force writing all the other blocks (I.e. revert KWP lookup table to stock).

    Leave a comment:


  • Tomba
    replied
    Originally posted by dasvolk View Post
    I'm having a problem with the tool on an MSS65. The car had Jim Colley's FAMS tune on it, and it couldn't read it so I overwrote the tuning with stock via WinKFP (switching to a different tuner.) No matter what I do I'm getting that "something went wrong please try again" at the end of the read. Clearly the cable works because I can do whatever I please with it using WinKFP and other tools. Is it possible that in spite of completely overwriting the DME there's some sort of read block still extant with the old tuning? Or am I doing something else wrong? I installed just BMW Standard Tools and the flasher on a different laptop but am still getting the same results.
    I believe that error is related to the file size. The downloaded file size doesn't meet the expected one.
    No error codes in the ECU?
    Have you reflashed complete ECU (ASW and Flash // Program and Data) or only flash/data?​ Maybe some setting in ASW/Program section refuses to give data.

    Leave a comment:


  • dasvolk
    replied
    I'm having a problem with the tool on an MSS65. The car had Jim Colley's FAMS tune on it, and it couldn't read it so I overwrote the tuning with stock via WinKFP (switching to a different tuner.) No matter what I do I'm getting that "something went wrong please try again" at the end of the read. Clearly the cable works because I can do whatever I please with it using WinKFP and other tools. Is it possible that in spite of completely overwriting the DME there's some sort of read block still extant with the old tuning? Or am I doing something else wrong? I installed just BMW Standard Tools and the flasher on a different laptop but am still getting the same results.

    Leave a comment:


  • Verner
    replied
    It takes at least 1h, I check hex value read it starts again from 0.

    Leave a comment:


  • Tomba
    replied
    Originally posted by Verner View Post
    Hi, Great SW, (I have done another MSS60 before). This time also MSS60.
    Problem is that this car newer finish read, instead it start again reading as a loop, both full and maps read. Tested with BimmerGeek expert and own made Ediabaslib inpa cable, Two different Win10 laptops. Both has Ediabas ecu files.
    I readed maps example about 10x, one time it save file. But I can't write without Full+RSA-patch. I donn't have time to try 10x full read.
    I tested write ori maps back, it flash maps two times before end succesfully.
    Also one time ignition was off, no lights on dash, still it keeps reading.
    Whats is wrong?​
    How long does your full read take?
    It may look it is reading it 10 times, but in reality it reads different memory contents. Full read would at least take up to 1 hour.

    Leave a comment:


  • Verner
    replied
    Hi, Great SW, (I have done another MSS60 before). This time also MSS60.
    Problem is that this car newer finish read, instead it start again reading as a loop, both full and maps read. Tested with BimmerGeek expert and own made Ediabaslib inpa cable, Two different Win10 laptops. Both has Ediabas ecu files.
    I readed maps example about 10x, one time it save file. But I can't write without Full+RSA-patch. I donn't have time to try 10x full read.
    I tested write ori maps back, it flash maps two times before end succesfully.
    Also one time ignition was off, no lights on dash, still it keeps reading.
    Whats is wrong?​

    Edit. Working now. I was too busy to wait.
    If somebody want do cold start disable, please send message.
    Attached Files
    Last edited by Verner; 08-08-2023, 08:30 AM.

    Leave a comment:


  • --Aramis--
    replied
    Finaly all is OK, it's just an offset in the address, we have compared a MSS6xflasher full bin with à Dimsport bin that it seems just a partial read

    Leave a comment:

Working...
X