MSS6x Flasher - Now released!

[TANKER_WX]

That's probably where I'd start.

Do a ZUSB update to 240/241E with WinKFP to get you back to a 100% stock place and then try again.

Sure, thx Martyn!

I will try this procedure.

[Martyn]

That's probably where I'd start.

Do a ZUSB update to 240/241E with WinKFP to get you back to a 100% stock place and then try again.

[TANKER_WX]

I am not 100% sure, but I would suspect that during a RSA bypass the signature check is also bypassed on the program memory. Apparently it did on the first picture. Again, not 100% sure.
2nd picture says that program is not available / not fully OK.
These are conditions coming from ECU after/during flashing [PROGRAMMIERSTATUS].

Are you able to upload your original full files here? Any chance the ECU has been tuned before?

it should be stock file. i am the only owner of this car.
So, u mean i can flash back to original full file by winkfp. and do RSA bypass again?

sure. i am going to copy my full file tomorrow.

[Tomba]

I already readyout the full ECU file by MSS6X 1.0.0.3 Flasher and keep it safe.

However, the RSA bypass is failed. I flash the original full file back to the DME by MSS6X 1.0.0.3, the car can be started normally.

So, I try to do RSA bypass again, and it failed again.(u may find more ditail from attachment).

Would u plz tell me how can i finish the RSA bypass using MSS6X flasher 1.0.0.3? or anytihing wrong with my software?

The program version is 231E, and more detail info plz check the attachment.

I am not 100% sure, but I would suspect that during a RSA bypass the signature check is also bypassed on the program memory. Apparently it did on the first picture. Again, not 100% sure.
2nd picture says that program is not available / not fully OK.
These are conditions coming from ECU after/during flashing [PROGRAMMIERSTATUS].

Are you able to upload your original full files here? Any chance the ECU has been tuned before?

[TANKER_WX]

hi terra, Martyn,

firstly great thx for yours to develop this nice app that i can make something happen on my car many thx.

i am a newer here, i spend hours to read this thread fully. but i still cant fix my problem. So here it is:

I bought ECUWorx Flashing Cable for E60 M5, E65 M6 and E92 M3, and the key from ECUWorx. I am willing to flash my 2013 bmw E92m3..

I already download and install every software step by step (the system of my computer is window 10, COM1 LATENCY1, unzip ECUWORX-E6X-E9X-DME-Update to C:/ EC-APPS/NFS, copy 10flash.prg and

MS_S65.PRG from MSS6X_Flasher_PreReqs to C:/Ediabas/ECU, etc..)

I already readyout the full ECU file by MSS6X 1.0.0.3 Flasher and keep it safe.

However, the RSA bypass is failed. I flash the original full file back to the DME by MSS6X 1.0.0.3, the car can be started normally.

So, I try to do RSA bypass again, and it failed again.(u may find more ditail from attachment).

Would u plz tell me how can i finish the RSA bypass using MSS6X flasher 1.0.0.3? or anytihing wrong with my software?

The program version is 231E, and more detail info plz check the attachment.

Many thx mate!

Sincerely,

Tanker.

[terra]

Greets all new poster here and reading through the old posts to catch up. As a quick question, has the CENSOR lock on the one MPC been figured out yet? There’s actually a bit of code in every mss60 version I’ve looked at (a lot) that flips the CENSOR back on, but it’s a single byte change to make it like the other MPC.

Also, the OBD read lock is a simple KWP2000 look up table change (IIRC) and works identically between mss60 and mss65.

Again, old memory and need to refresh a few weeks, but IIRC MPC 563 writes flash in blocks, so I always wondered if it was possible to specify only a single block of flash to write that wouldn’t force writing all the other blocks (I.e. revert KWP lookup table to stock).

I did succeed in disabling the censor via BDM. Mpower36 managed to over OBD. Clearing the censor does erase the entirety of the cpu flash. So ideally you’d have a backup beforehand (Mpower36’s software presumably backs it up and restores)

Writing and locking an EWS SK via tool32 will enable censor mode. Otherwise it stays unlocked.

Theres plenty of potential ways to disable OBD reading.

The CPU does write / erase in blocks, but unfortunately the built in erase routines don’t. You can only erase the tune or the entirety of the program (without the ability to upload your own custom code to RAM that is).

Unfortunately erasing the tune or program makes the DME disregard all read commands until a valid tune and program combination are written back.

[Tomba]

Hi, Welcome to the forum! Nice you join us.

As a quick question, has the CENSOR lock on the one MPC been figured out yet?

Vincent [MpowerE36] https://nam3forum.com/forums/member/1186-mpowere36. Has done it.

https://nam3forum.com/forums/forum/e9x-2008-2013/e9x-coding-tuning/166648-unlock-mss60-cpu-via-obd

[adrianj73]

Greets all new poster here and reading through the old posts to catch up. As a quick question, has the CENSOR lock on the one MPC been figured out yet? There’s actually a bit of code in every mss60 version I’ve looked at (a lot) that flips the CENSOR back on, but it’s a single byte change to make it like the other MPC.

Also, the OBD read lock is a simple KWP2000 look up table change (IIRC) and works identically between mss60 and mss65.

Again, old memory and need to refresh a few weeks, but IIRC MPC 563 writes flash in blocks, so I always wondered if it was possible to specify only a single block of flash to write that wouldn’t force writing all the other blocks (I.e. revert KWP lookup table to stock).

[Tomba]

I'm having a problem with the tool on an MSS65. The car had Jim Colley's FAMS tune on it, and it couldn't read it so I overwrote the tuning with stock via WinKFP (switching to a different tuner.) No matter what I do I'm getting that "something went wrong please try again" at the end of the read. Clearly the cable works because I can do whatever I please with it using WinKFP and other tools. Is it possible that in spite of completely overwriting the DME there's some sort of read block still extant with the old tuning? Or am I doing something else wrong? I installed just BMW Standard Tools and the flasher on a different laptop but am still getting the same results.

I believe that error is related to the file size. The downloaded file size doesn't meet the expected one.
No error codes in the ECU?
Have you reflashed complete ECU (ASW and Flash // Program and Data) or only flash/data? Maybe some setting in ASW/Program section refuses to give data.

[dasvolk]

I'm having a problem with the tool on an MSS65. The car had Jim Colley's FAMS tune on it, and it couldn't read it so I overwrote the tuning with stock via WinKFP (switching to a different tuner.) No matter what I do I'm getting that "something went wrong please try again" at the end of the read. Clearly the cable works because I can do whatever I please with it using WinKFP and other tools. Is it possible that in spite of completely overwriting the DME there's some sort of read block still extant with the old tuning? Or am I doing something else wrong? I installed just BMW Standard Tools and the flasher on a different laptop but am still getting the same results.

[Verner]

It takes at least 1h, I check hex value read it starts again from 0.

[Tomba]

Hi, Great SW, (I have done another MSS60 before). This time also MSS60.
Problem is that this car newer finish read, instead it start again reading as a loop, both full and maps read. Tested with BimmerGeek expert and own made Ediabaslib inpa cable, Two different Win10 laptops. Both has Ediabas ecu files.
I readed maps example about 10x, one time it save file. But I can't write without Full+RSA-patch. I donn't have time to try 10x full read.
I tested write ori maps back, it flash maps two times before end succesfully.
Also one time ignition was off, no lights on dash, still it keeps reading.
Whats is wrong?

How long does your full read take?
It may look it is reading it 10 times, but in reality it reads different memory contents. Full read would at least take up to 1 hour.

[Verner]

Hi, Great SW, (I have done another MSS60 before). This time also MSS60.
Problem is that this car newer finish read, instead it start again reading as a loop, both full and maps read. Tested with BimmerGeek expert and own made Ediabaslib inpa cable, Two different Win10 laptops. Both has Ediabas ecu files.
I readed maps example about 10x, one time it save file. But I can't write without Full+RSA-patch. I donn't have time to try 10x full read.
I tested write ori maps back, it flash maps two times before end succesfully.
Also one time ignition was off, no lights on dash, still it keeps reading.
Whats is wrong?

Edit. Working now. I was too busy to wait.
If somebody want do cold start disable, please send message.

[--Aramis--]

Finaly all is OK, it's just an offset in the address, we have compared a MSS6xflasher full bin with à Dimsport bin that it seems just a partial read

[--Aramis--]

Hi All,

I'm from France,

I have a 2007 M3 manual with (i suppose) an ESS map, retrieve as 240E by MSS6x Flasher but impossible to read, i have got this message "“Something went wrong, please try again” " when i have tried to read it.

so with winkfp and daten V60 i have writen an OEM 241E map and program with success (car start and drive 150 km)

after that i have done a full read with MSS6x Flasher with success (1h read time)

i have begin to try to identify maps with winOLS but i could'nt find any values at "standards" offset (Vmax, manual gearbox ratio, ignition timings) and when i found one axis scales and datas are Inconsistent

We have to compare the map with a friend that have an another tool (dimsport new genius) and with his car map and we find that the map are not the same size (his file 5,25Mo and mine 5,00 Mo) and the dimsport tool says there is a problem with ram size in my map extracted by MSS6x Flasher, see capture after

I don't have done the RSA bypass write with MSS6x Flasher, is it the origin of the problem?

What do you think or advice about this case?

I want to do some modification with Ecuworks in the first time but if the full read is corrupted i don't want to modify it and rewrite it in the MSS60...

I think before i write it i would be able to find "standard" value via winols at the commons offset for them

terra and MpowerE36 and others if you have any advices, thanks




Here my full BIN