Figured out what to change in the program to read the SK from the true location. Same patch should work to read the ISN from the MSS65 as well. I'll update the app later today. But basically at this point we can make a full backup entirely over OBDII. Now if we can figure out how to reenable BDM on the MSS60, that means cloning these things and recovering from bricks will no longer be a problem.
-
-
Great work!
I'm sure a while back I read on the M5Board that Jim Colley had identified and defeated the second processor lock, it might be worth reaching out to him to see if he can point you in the right direction.Comment
-
Sent him a PM - looks like he hasn't logged in for a couple months though, so we'll see.Originally posted by Martyn View PostComment
-
Another update:- Added patch to allow reading protected memory segments
- This will be applied any time an RSA delete or Full Write is done
- Added ISN reading to the MSS65
- It will prompt you to do an RSA Bypass if it can't be read
- MSS60 SK read will now attempt to read it directly before dumping RAM and searching for it. Should be a little faster if you've already patched an RSA delete
- Changed name/directory structure a bit
Comment
- Added patch to allow reading protected memory segments
-
Sent terra a PM with the same info. I was able to successfully do a full and partial read of my MSS65 in my 2008 M5 SMG. I'm doing it in the car, I don't have a bench setup. The full read took about 2.5 hours. I have a K+DAN cable from one-stop electronics that I bought almost 2 years ago. I don't know how to flash the cable itself. (http://www.one-stop-electronics.com/...&product_id=16). I didn't try writing since I have no updated tune or file to write.Comment
-
Another update
-Changed up the layout a bit.
-Eliminated the full binary checkbox, there is now a separate button to read a full program
-Read RAM and Read ISN / SK are now under the "Advanced Menu" -- shift+click no longer does anything
-Added current byte being read/written to the status text
-Added a status message noting if a read has been completed
-Progress bar is now colored #009ADA
Thus far the application feels pretty safe. Even when a flash does fail due to disconnected power or so, the DMEs are staying alive. So I'm feeling comfortable for a wider release soon.
Anyone have thoughts on a different name for the application? Also anyone have any ideas about a logo, icon, etc? Something that emphasizes the relationship to this forum would be preferable.Comment
-
Awesome!
I was going to suggest adding a voltage status of KL15 but I'm guessing the ECU won't accept job requests whilsts its in flashing mode or busy with a current job.
I'll have a think regarding the name.Comment
-
ECU wouldn't accept a job. Gateway module probably would, but I do feel like communicating with multiple modules during a flash process is a good way to introduce writing errors.Comment
-
Understood! Perhaps just a check of 'STAT_PHY_UKL15_WERT' via 'status_ukl15' prior to starting a full flash might be a good idea? If voltage < 12.5 perhaps throw a pop up or something?Originally posted by terra View Post
*Edit* status_ukl15 doesn't exist in MSS6x.prg so ignore me
Last edited by Martyn; 04-16-2020, 02:17 AM.Comment
-
Will this allow me to do a complete read of my existing ECU and modify that file? I have a tune on on my car which has disabled cold start and it would be nice to re-enable it and make some other changes without losing the benefits of the tune that is current installed. Assuming the hex address locations will be known (I don't have this information and would love to find it) for where such changes need to be made.
I have the BL KCAN cable as well.Comment
-
Yes it should enable you to do that assuming your tuner didn't implement any sort of read lock. I don't think there's a public xdf or a2l. MartynT's application should be good for making simpler modifications like that.Originally posted by 6ixSPD View PostComment
-
I've tested the full read from MSS6x Flasher with my software and it works fine.Originally posted by 6ixSPD View Post
Comment
-
Another update:
Cosmetic stuff:- Added an app icon. Definitely subject to change, just wanted to try
- Added a little note that the application is provided by free by this forum, and a have a link to this thread for the latest version (of course for the time being you need to contact me to download a copy)
- Changed some text notifications
Functional changes:- Sped up full reads by skipping over areas that should be blank. Should bring the total read time down to approximately 45 minutes
- The long read option is still available in the advanced menu
- If the read file size is smaller than expected (i.e one of the read requests failed), the application won't save those dumps
Comment
-
Quick question in how big a full read bin should be for a MSS65. My full read was 5.00 MB (5,242,880 bytes). Does this seem correct? I ask because a few months back I was looking at doing some tuning and found a bin that someone uploaded, I think it was a BDM read. That one was 1.00 MB (1,048,576 bytes). What accounts for the stark difference and what should be the correct size of a full bin?Comment
-
5MB is correct. It's structured like soOriginally posted by hansbrix View Post
Injection (left) Internal flash - 512KB
Injection (left) External flash - 2MB
Ignition (right) Internal flash - 512KB
Ignition (right) External Flash - 2MB
The tune is stored in the last 64K of each internal flash. Program code is spread between the internal and external flashes. Most of the external flash is empty, but is still necessary to make a full backup and to generate an RSA patch.
The bin you found was likely a dump of both internal flashes.Comment
Comment