MSS6x Flasher - Now released!

[terra]

Greets all new poster here and reading through the old posts to catch up. As a quick question, has the CENSOR lock on the one MPC been figured out yet? There’s actually a bit of code in every mss60 version I’ve looked at (a lot) that flips the CENSOR back on, but it’s a single byte change to make it like the other MPC.

Also, the OBD read lock is a simple KWP2000 look up table change (IIRC) and works identically between mss60 and mss65.

Again, old memory and need to refresh a few weeks, but IIRC MPC 563 writes flash in blocks, so I always wondered if it was possible to specify only a single block of flash to write that wouldn’t force writing all the other blocks (I.e. revert KWP lookup table to stock).

I did succeed in disabling the censor via BDM. Mpower36 managed to over OBD. Clearing the censor does erase the entirety of the cpu flash. So ideally you’d have a backup beforehand (Mpower36’s software presumably backs it up and restores)

Writing and locking an EWS SK via tool32 will enable censor mode. Otherwise it stays unlocked.

Theres plenty of potential ways to disable OBD reading.

The CPU does write / erase in blocks, but unfortunately the built in erase routines don’t. You can only erase the tune or the entirety of the program (without the ability to upload your own custom code to RAM that is).

Unfortunately erasing the tune or program makes the DME disregard all read commands until a valid tune and program combination are written back.

[Tomba]

Hi, Welcome to the forum! Nice you join us.

As a quick question, has the CENSOR lock on the one MPC been figured out yet?

Vincent [MpowerE36] https://nam3forum.com/forums/member/1186-mpowere36. Has done it.

https://nam3forum.com/forums/forum/e9x-2008-2013/e9x-coding-tuning/166648-unlock-mss60-cpu-via-obd

[adrianj73]

Greets all new poster here and reading through the old posts to catch up. As a quick question, has the CENSOR lock on the one MPC been figured out yet? There’s actually a bit of code in every mss60 version I’ve looked at (a lot) that flips the CENSOR back on, but it’s a single byte change to make it like the other MPC.

Also, the OBD read lock is a simple KWP2000 look up table change (IIRC) and works identically between mss60 and mss65.

Again, old memory and need to refresh a few weeks, but IIRC MPC 563 writes flash in blocks, so I always wondered if it was possible to specify only a single block of flash to write that wouldn’t force writing all the other blocks (I.e. revert KWP lookup table to stock).

[Tomba]

I'm having a problem with the tool on an MSS65. The car had Jim Colley's FAMS tune on it, and it couldn't read it so I overwrote the tuning with stock via WinKFP (switching to a different tuner.) No matter what I do I'm getting that "something went wrong please try again" at the end of the read. Clearly the cable works because I can do whatever I please with it using WinKFP and other tools. Is it possible that in spite of completely overwriting the DME there's some sort of read block still extant with the old tuning? Or am I doing something else wrong? I installed just BMW Standard Tools and the flasher on a different laptop but am still getting the same results.

I believe that error is related to the file size. The downloaded file size doesn't meet the expected one.
No error codes in the ECU?
Have you reflashed complete ECU (ASW and Flash // Program and Data) or only flash/data? Maybe some setting in ASW/Program section refuses to give data.

[dasvolk]

I'm having a problem with the tool on an MSS65. The car had Jim Colley's FAMS tune on it, and it couldn't read it so I overwrote the tuning with stock via WinKFP (switching to a different tuner.) No matter what I do I'm getting that "something went wrong please try again" at the end of the read. Clearly the cable works because I can do whatever I please with it using WinKFP and other tools. Is it possible that in spite of completely overwriting the DME there's some sort of read block still extant with the old tuning? Or am I doing something else wrong? I installed just BMW Standard Tools and the flasher on a different laptop but am still getting the same results.

[Verner]

It takes at least 1h, I check hex value read it starts again from 0.

[Tomba]

Hi, Great SW, (I have done another MSS60 before). This time also MSS60.
Problem is that this car newer finish read, instead it start again reading as a loop, both full and maps read. Tested with BimmerGeek expert and own made Ediabaslib inpa cable, Two different Win10 laptops. Both has Ediabas ecu files.
I readed maps example about 10x, one time it save file. But I can't write without Full+RSA-patch. I donn't have time to try 10x full read.
I tested write ori maps back, it flash maps two times before end succesfully.
Also one time ignition was off, no lights on dash, still it keeps reading.
Whats is wrong?

How long does your full read take?
It may look it is reading it 10 times, but in reality it reads different memory contents. Full read would at least take up to 1 hour.

[Verner]

Hi, Great SW, (I have done another MSS60 before). This time also MSS60.
Problem is that this car newer finish read, instead it start again reading as a loop, both full and maps read. Tested with BimmerGeek expert and own made Ediabaslib inpa cable, Two different Win10 laptops. Both has Ediabas ecu files.
I readed maps example about 10x, one time it save file. But I can't write without Full+RSA-patch. I donn't have time to try 10x full read.
I tested write ori maps back, it flash maps two times before end succesfully.
Also one time ignition was off, no lights on dash, still it keeps reading.
Whats is wrong?

Edit. Working now. I was too busy to wait.
If somebody want do cold start disable, please send message.

[--Aramis--]

Finaly all is OK, it's just an offset in the address, we have compared a MSS6xflasher full bin with à Dimsport bin that it seems just a partial read

[--Aramis--]

Hi All,

I'm from France,

I have a 2007 M3 manual with (i suppose) an ESS map, retrieve as 240E by MSS6x Flasher but impossible to read, i have got this message "“Something went wrong, please try again” " when i have tried to read it.

so with winkfp and daten V60 i have writen an OEM 241E map and program with success (car start and drive 150 km)

after that i have done a full read with MSS6x Flasher with success (1h read time)

i have begin to try to identify maps with winOLS but i could'nt find any values at "standards" offset (Vmax, manual gearbox ratio, ignition timings) and when i found one axis scales and datas are Inconsistent

We have to compare the map with a friend that have an another tool (dimsport new genius) and with his car map and we find that the map are not the same size (his file 5,25Mo and mine 5,00 Mo) and the dimsport tool says there is a problem with ram size in my map extracted by MSS6x Flasher, see capture after

I don't have done the RSA bypass write with MSS6x Flasher, is it the origin of the problem?

What do you think or advice about this case?

I want to do some modification with Ecuworks in the first time but if the full read is corrupted i don't want to modify it and rewrite it in the MSS60...

I think before i write it i would be able to find "standard" value via winols at the commons offset for them

terra and MpowerE36 and others if you have any advices, thanks




Here my full BIN

[Nick_E92]

Hey yall, new to custom tuning but trying to learn as much as possible. have used all off the shelf flashers and am a computer science major in collage right now. Want to learn more and dive deeper into the E92 M3 i got just a few months ago. Before i had an n54 (still do) and have learned a lot there doing all the work myself. want to learn more about the s65. Does anyone have an XDF file for the MSS60 i could use in TunerPro to begin looking at the parameters. i have done a full read on MSS6X Quickflash and have my bin here. Thanks. I have done a primary cat delete with macht schnell test pipes and want to kill the codes for emissions. as well begin learning how to pull a bit more power and exhaust overrun single crack when i shift (manual transmission.) Id love to talk over the phone if anyone has some free time to teach or ill be on the look out here as well. 770-880-8525

[MpowerE36]

I did it 2 years ago and I confirm that it is not easy. Here my topic about it :

https://nam3forum.com/forums/forum/e9x-2008-2013/e9x-coding-tuning/114162-mss60-obd-locked

[terra]

I’m working on MSS60 that might be OBD locked..

I Bench read with HEXTAG left and right side..

is there a known way to unlock these without losing the current tune…or will I have to re-flash with winkfp to get OBD read and write enabled again.

I don’t want to say it’s impossible, but it’s not trivial. The read function is programmed to return all FFs if you force the DME into a non-running state, and the program can’t be overwritten without erasing the tune.

[MARQAW]

I’m working on MSS60 that might be OBD locked..

I Bench read with HEXTAG left and right side..

is there a known way to unlock these without losing the current tune…or will I have to re-flash with winkfp to get OBD read and write enabled again.

[desmo01]

ALRIGHT. As I am not a TOTAL idiot, I did originally read the ECU program/tune out when I started. This will come up later.

So I did a full read after reflashing with WinKFP (errors present). Went to load this read into the flasher and no dice.

SO, I then loaded up the original full program file (1st read if you will), and it loaded fine into the flasher. It loaded in no problem, so went ahead and flashed the RSA bypass, and flashed the original program file/tune into the ECU.
Success! No errors, normal redline, car started fine.

So then I loaded up the program file I originally modified with Martyn's tool (on 1st read file) and flashed that.
Again, success (god it's nice the cold start is gone).

Much happier.

Terra and Martyn thank you all so much for coming out with these tools, I have 2 85s and now an S65 and I would not do so without your tools being out there. Again thank you.
If you all find yourselves in Ohio please advise so I can buy the beer!

When executing the RSA bypass (and all the other work) this time I did it with a different computer (same cable). I think the root cause to my original issue was something fucghky with my software setup in my other computer.

Turns out garbage in, garbage out.....is a thing....

Regards to all.