MSS6x Flasher - Now released!

[terra]

terra
Do you plan to add a CPU lock/unlock feature to your software someday? In future updates?

At present no, I don’t think I quite have the skills to do so (well cpu lock I could add, would rather not).

As far as unlocking goes, imo not high priority to be able to do it over obdii. We can make a full backup without unlocking anything. And if you need to restore a bricked DME, you can just unlock it with the BDM device when the time comes. Pretty easy with the ulink nt device https://nam3forum.com/forums/forum/e...h-the-mss60-65

[MSSAddict]

terra
Do you plan to add a CPU lock/unlock feature to your software someday? In future updates?

[MSSAddict]

I just tested it with a 520E/160E program for the MSS65, and everything works perfectly. I also tested it with my MSS60 241E, and everything works perfectly. Great job!

[terra]

Thanks for testing all that- glad it works well for you! I’ll look into the 170e file shortly, thanks for sending that as well.
Reset DME is basically just rebooting it. Same as the steuergeraet reset job in tool32

[MSSAddict]

Hi Terra,

I tested your new version, and everything seems to be working perfectly.

I noticed that the full read speed is much faster: about 40 minutes compared to 1 hour before.

The RSA bypass is also much faster.

The Flash Tune feature works well after flashing the program section.

Adding files in BDM format is perfect.

The whole thing seems stable.

I was able to test the factory reset (RSA bypass removal) and it works: you just need to load the original full binary.


I sent you a 170E MSS60


Just one question, please: what does “Reset DME” mean?

[terra]

Application updated https://github.com/terraphantm/MSS6x...ses/tag/v1.1.0

Version 1.1.0. Multiple updates since last release:

• Updated Ediabaslib to newer release; .Net 4.8.1 now required
• Default port is now COM1 as EdiabasLib dropped support for D2XX on Windows
• RSA Bypass code is improved and notably faster
• Added ability to restore stock (i.e remove RSA bypass and patches)
• Tunes are now automatically flashed after flashing a program instead of having to click the "flash tune" button
• Reads are now done in "programming mode" and should be about twice as fast as before
• Full reads are now saved in both the combined format and in BDM format (separate files)
• If no VIN is found, VIN will be assumed to be AA00000 for file saving purposes
• MSS60 140E and older no longer require an RSA bypass for tune writes (also of note, if you have any software variants between 140E and 220E, please send them to so that I can determine where the exact cutoff is for the RSA bypass requirement)
• Detect if a "pseudo RSA" bypass used by some tuners is present, in which case the loaded file will be flashed without modification (i.e no checksum correction). Recommend manually correcting checksums or disabling checksums if this technique is used
• Decreased size of flash blocks from 254 bytes to 252 bytes - this allows standard D-CAN cables to work without bricking
• More safety checks implemented
• During the RSA bypass, the UC3F censorship routine is now disabled. This does not remove the censorship from the DME (need BDM or mpower32's software for that), but does prevent it from being set again.
• Added ability to request Level 3/4/5 security access to the Advanced Menu. Unclear if there are any uses for level 4/5, but makes it easier to test.
• Now display the "internal" software numbering (i.e v638 for 80E) if it is readable.
• Fixed a few UI issues

Probably more stuff that I'm not remembering. Let me know if you guys have any issues

[terra]

interesting, being able to flash the boot section without BDM would be nice.

So I did try just straight up changing the hardware reference and flashing (and also changing security access keys to the MSS65 ones). While it does accept the flash and respond to some INPA commands, it doesn't seem to boot completely as a lot of commands just don't work. Flashing back to MSS65 code from there worked fine, it wasn't bricked or anything.

That boot section does have a number of differences so I'm not sure replacing it is avoidable, though would have to study the differences closer.

I'm sure mpower32 would have the means to overwrite the boot sector given the other things his software can do (i.e clear censorship mode and restore the flash). I'm not skilled enough to write code to do that reliably myself.

[hobbit382]

interesting, being able to flash the boot section without BDM would be nice.

[terra]

So while I doubt most people will run into this (seems like no one else reported anything similar in the last 6 years) - for future reference if you have an RSA bypass'd DME and later on use WinKFPs expert mode to do some flashing and accidentally pick the wrong DME (i.e MSS60 file on MSS65 or vice versa), the DME will happily overwrite its bootloader with the new one. And this breaks a bunch of things... the DME doesn't actually want to run due to the hardware string not matching, and the RSA keys will no longer match what they should be, so security access is broken and the correct binaries will no longer have a valid signature as far as the DME is concerned. I was able to ultimately recover without BDM with a bunch of hacky changes to my app, but something to keep in mind. Unfortunately I don't think there's a fantastic way for me to protect against that sort of issues. From what I recall, other BMW DMEs would normally not copy the new bootloader if the hardware string doesn't match rather than complaining after the fact.

Good news is that might mean it's possible to crossflash MSS60 code to the MSS65 without BDM using a similar trick to what we do to get the CSL flash to work on non-CSL DMEs. I'll have to dig into the non-writeable code a little deeper to see if there's any major compatibility issues there.

[terra]

So for whatever it's worth, this application seems to work fine on Windows for ARM, except you need to change the port from FTDI0 to COM1 (or whatever COM port you have the cable assigned to). It appears the ARM version of the FTDI driver doesn't support D2XX mode.

From what I recall, I had used D2XX mode in the first place because I found it to be more stable, but so far it seems stable enough here.

For completeness, this is using an M1 Macbook Pro with Windows 11 for ARM running in VMWare

[BigRussia]

I suspect you have an issue with the tach, rather than an issue with the DME software. Personally, if you're happy with the tune, then I'd leave it alone.

Perhaps try a tach/kombi cluster test with INPA and see if it behaves.

Cool thanks for that insight, I have INPA so I'll try to see if it can do a KOMBI test of the warmup dial, I didnt even think of doing that so worth a shot!

Yeah no issues with the AA tune, car is a daily with just the AA Signature xpipe and mufflers. The two features of the MSS60 Binary Modification Tool I wanted to use were Engine Temp Rev Limit (and hoping as extra benefit it might also resolve that weird warmup dial issue) and tuning the throttle mappings, since I find Comfort too soggy and dead down low and Sport to be too touchy and stabby in that same initial pedal tip-in, so was looking to tune those closer together like I did on the E46 using the MSS54 Tool (and has been fantastic btw!). Was thinking to make Comfort fully linear if possible.

BTW if anyone is interested I made a thread on M3post about the warmup dial issue, and here's a couple of the most extreme instances lol (usually it gets stuck around 6.5-7.2k RPM ranges when it does mess up, but then will usually sorts itself next drive or overnight):

[Martyn]

I suspect you have an issue with the tach, rather than an issue with the DME software. Personally, if you're happy with the tune, then I'd leave it alone.

Perhaps try a tach/kombi cluster test with INPA and see if it behaves.

[BigRussia]

060E is very old software, which is why my tool is advising you to upgrade, clearly if you do this you'll lose your AA tune, however it will allow you to perform an RSA bypass aftwards as it'll be back to stock.

Oh interesting that Active didn't update the software when doing their tune, the previous owner had it done only like a year or so ago at Active's HQ here in Miami (same time he had them do the full exhaust install, it was a package).
Slightly unrelated but I wonder if my software being so out of date and with their likely ancient tune is causing another issue I'm having with the tach warmup dial going on the firtz and getting stuck at random rpms even with the car fully warmed up (doesnt force a rev limiter though). Also I am not familiar with the software updating process, did some google searching and read a few threads but didn't seem to be a definitive guide to the process, could you point me to one if you know of?

Do you mind sharing the 060E full read here?

Yes of course, I attached the Full Read 5120kb file here thanks!

[terra]

Do you mind sharing the 060E full read here?

[Martyn]

060E is very old software, which is why my tool is advising you to upgrade, clearly if you do this you'll lose your AA tune, however it will allow you to perform an RSA bypass aftwards as it'll be back to stock.