MSS6x Flasher - Now released!

[binary420]

Hi everyone,

Was wondering if anyone has ever encountered this before?


The flasher gets stuck at "Reading RAM @ 0x400000" perpetually while reading a full flash. So far it has happened three out of four times. First time was on my 2011 E92, tried it a second time and it worked as advertised. Third time was on a friend's 2008 E90, got stuck as seen in the figure. Tried it a fourth time with the same result. Any leads or help would be appreciated!

FYI, I'm using a bimmergeeks cable, confirmed all device settings were correct (com1, 1 ms latency, etc.)

even while your latency and com port are correctly configured,
the complete configuration of the kdcan cable driver may not be complete

change the file extension of the attached .txt file to a .exe and copy it into c:\ediabas\hardware\obd\

if that folder doesnt exist, create it.
run the program, and it will pop up a cmd with roughly 10 diferent settings.

if they are all properly configured, they will say: value xxx expected xxx "OK"
if the expected and actual values are not the same, you'll need to edit those settings in your registry (regedit)

the location in the registry is SYSTEM\CurrentControlSet\Services\Serial

you may have to add some of the settings if they arent already listed, or change the settings that dont match the cmd window.

once changed, re-run the program till all the settings say "OK"

attached are screenshots of the cmd and registry with all the correct values.

[Dash1]

Hi everyone,

Was wondering if anyone has ever encountered this before?


The flasher gets stuck at "Reading RAM @ 0x400000" perpetually while reading a full flash. So far it has happened three out of four times. First time was on my 2011 E92, tried it a second time and it worked as advertised. Third time was on a friend's 2008 E90, got stuck as seen in the figure. Tried it a fourth time with the same result. Any leads or help would be appreciated!

FYI, I'm using a bimmergeeks cable, confirmed all device settings were correct (com1, 1 ms latency, etc.)

[binary420]

Yes you can buy a KTag or FGTech v54 to try flashing your backup but if your injection processor is bdm locked, you won't be able to recover it. You need a special debugger tool to unlock the bdm access of this processor. If you want more information about it you can read the "MSS60 Research" topic from Terra.

Thanks for the reference to that thread.
helpful
couple quick questions.

I have been searching for a set which has a DME, CAS, and key already matching to make things easier.

Will that in fact make things easier or am i wasting my time since ill have to program them anyway if i want my original vin programmed?

Because ive found a few of these prematched sets, but none that have a perfect match to my dme/cas3 part #s.

also, how important is it to have a part number (both for dme and cas) that match the original exactly.

Realoem shows that mss60 are retrospectively interchangeable, and dct / manual doesn't matter.

But every ebay listing is very strongly stating to make sure to match part numbers exactly.
and some are listed as manual only, and some DCT only..

I get it on their end, so people arent buying the wrong shit and returning
but just want to be clear about that from actual knowledgeable people,

Do the part numbers need to be identical for any reason? Or as long as it shows on realoem as interchangeable, It can be cloned to without issue?

[isma_s54]

hello guys the program work good read all flashes good but when i load full flash i cant baypass rsa
mss60
the program load only tune

[MpowerE36]

Yes you can buy a KTag or FGTech v54 to try flashing your backup but if your injection processor is bdm locked, you won't be able to recover it. You need a special debugger tool to unlock the bdm access of this processor. If you want more information about it you can read the "MSS60 Research" topic from Terra.

[binary420]

So based on what I've found online, it seems my only options are to either buy some device to possibly be able to bdm flash the backup to the ecu,
or otherwise to buy a replacement mss60 ecu.

And if I want it to work with my car, I'd either need to immo off flash the new dme,
or buy a matching dme/cas/key set

Is there no other solution to recover the dme with say nfs emergency flash or something?

[binary420]

One thing that wasn't made clear to me in the directions is:

Once rsa bypass is added, is it permanently bypassed?
Or can it be relocked again?
the instructions say add the bypass first time, then flashes can be performed at will,
But wasn't clear what exactly that meant

My non-coder self was left scratching my head on what that means.
But now I'd very much love to just get it fixed

Especially now after it got bricked

[binary420]

So yes your dme is bricked. The only way to recover it is to write a full binary via bdm. Do you know if your injection processor is bdm locked ?

I tried reading it with tool32 ident, and winkfp, and scan tool but nothing could read it.

Then I tried for shits and giggles with an older program in bmwkiller software package, and it showed something in German saying "~~german~~blocked" so that might be what yr referring to.

I have a x431 scanner and an xprog3 programmer can this be performed with that or I gotta order a different programmer

And then is there any guide / walk through for performing this unlock

In other words no I don't know if its locked.
I had flashed the rsa bypass previously though so unless winkfp added it back then should b unlocked

[MpowerE36]

Sadly no

So yes your dme is bricked. The only way to recover it is to write a full binary via bdm. Do you know if your injection processor is bdm locked ?

[binary420]

Does MSS6XFlasher succeed to identify your dme ?

Is there any way to auto recover with Battery reset or similar? Or can it be recovered on bench? Luckily I have the full backup but I'd prefer to fix this one if at all possible

[binary420]

Does MSS6XFlasher succeed to identify your dme ?

Sadly no

[MpowerE36]

I had flashed my 2008 e92 m3 s65 with mss6x flasher
took the full backup, injected the bypass, all went smooth.

I then Flashed it again with 1 byte changed for immo off.
it also was successful..

However my whole initial reason for doing all this was because i was having issues syncing my dme/cas, and engine was cranking but not starting.

I read about the immo off solution to bypass the syncing requirement, so i thought id give it a go.

The modified flash was also successfully, but engine still was not starting.

So I then eventually attempted an update with winkfp to bring it back to stock, and it got to 100% and errorer out.

Now it's not responding in winkfp

Please tell me my ecu isn't permanently fucked

Does MSS6XFlasher succeed to identify your dme ?

[binary420]

I had flashed my 2008 e92 m3 s65 with mss6x flasher
took the full backup, injected the bypass, all went smooth.

I then Flashed it again with 1 byte changed for immo off.
it also was successful..

However my whole initial reason for doing all this was because i was having issues syncing my dme/cas, and engine was cranking but not starting.

I read about the immo off solution to bypass the syncing requirement, so i thought id give it a go.

The modified flash was also successfully, but engine still was not starting.

So I then eventually attempted an update with winkfp to bring it back to stock, and it got to 100% and errorer out.

Now it's not responding in winkfp

Please tell me my ecu isn't permanently fucked

[Ghost]

Hey guys, maybe somebody know if there will be more features coming soon for the mss6x flasher? And is it possible to read/write a 2011 DME which is tuned before with a custom flash?

I want to buy everthing i need for this tools, but before it starts i have to know this.

thanks!

[Cubieman]

Use the bimmergeeks cable to flash back to stock with Winkfp.

Thanks, will try that tomorrow, I hope the bimmergeeks cable works with winKFP.

I don't understand why the cable works fine with INPA/ISTA etc. on an E46 M3/ two different 2007 M5's but not a 2010 M6.


Edit: Got the cable to work by changing an ini file in edbias