MSS6x Flasher - Now released!

[Tomba]

Hello everybody,

I am new to the forum and tbh, I only signed up to the forum because of this tool. I bought a new to me e60 M5 6MT with a lot of miles and therefore try to do some preventative maintenance. While I was looking for new injectors (which are discontinued from Bosch for S85 engine), I came across this tool. After reading lots of threads, this sounds awesome. Thank you very much for providing stuff like this FOR FREE!!!

Even tough I read every thread out there about this tool (at least that is what I think), I have some questions. My plan is to purchase a second MSS65 DME, get a bench set-up and configure the software according to my likes. This way I can play around a little and just swap out the DME while keeping the original one as it is (I don't think prices for used DMEs will change a lot, so I don't think I will loose a lot of money when I opt to sell one DME again).

A 2nd hand ECU is always welcome as prices might go higher and you have one for spare. For the modifications you want you won't need it actually.

I have some questions regarding the following topics (I want to use the Bin Mod Tool from ECUWorx where possible):

Would this work? What would I need to do if do not want to remove EWS and just use the ISN from my original DME? Do Full Read on old DME, flash this to the new DME using flash program, update to Euro Software using WINKFP and continue with the steps from above (without EWS removal and RSA bypass already done)?

You can divide the ECU memory in 3 contents, (1) Boot, (2) ASW Application SoftWare or Program and (3) CAL Calibration or Data.
You need Boot to start up the ECU. The ASW actually is the program that runs inside the ECU and uses constants, maps and other values from CAL to run. Sometimes there are different country or power output variants and these are mainly different between CAL. ASW runs equally.

Most of the things you want to edit are in the CAL(3), only EWS delete requires RSA bypass for modification on the ASW/Program on MSS65. For MSS60 from version (?) it requires RSA bypass on CAL level too to work correctly.

For EWS, it is not possible to modify your ISN inside the ECU by OBD tools (correct me if I am wrong). The memory locations are not possible to write/modify according to my knowledge. To do so you actually need a BDM tool (instead of connected to the OBD port you are directly connecting to the ECU circuit board to access the memories). I think KTAG (clone) might help you out on this one.

It is possible to make EWS off by OBD as the ASW/Program is changed to do so.

Your original ECU won't need RSA bypass as your EWS is working and the values you want to edit are in CAL.
Your 2nd hand ECU would need RSA bypass for EWS delete. Or if you buy the BDM tool, make a full clone of your original ECU. Then you also won't need RSA bypass.
MSS65 is always BDM-able, MSS60 needs RSA bypass and another tool to unlock it if updated to one of the latest versions.

original or cloned MSS65 ECU
- Read partial, modify and flash back.

2nd hand ECU
- Update with WinKFP
- Read full file
- RSA bypass with full file (with EWS removed)
- modify Tune (CAL/Data) and flash back

Not sure if your CAS will like it if you swap ECUs around. You might need to reset CAS and DME once you put back in the original ECU. Can be done by Tool32/ISTA.

One last question: Is the picture below correct to create a bench set-up for an MSS65? I checked with wiring diagrams from TIS and I think this is fine.



Thanks a lot for reading all of this and maybe someone can even help me with some of my points.

Seems fine to me.

[PeterPan]

Hello everybody,

I am new to the forum and tbh, I only signed up to the forum because of this tool. I bought a new to me e60 M5 6MT with a lot of miles and therefore try to do some preventative maintenance. While I was looking for new injectors (which are discontinued from Bosch for S85 engine), I came across this tool. After reading lots of threads, this sounds awesome. Thank you very much for providing stuff like this FOR FREE!!!

Even tough I read every thread out there about this tool (at least that is what I think), I have some questions. My plan is to purchase a second MSS65 DME, get a bench set-up and configure the software according to my likes. This way I can play around a little and just swap out the DME while keeping the original one as it is (I don't think prices for used DMEs will change a lot, so I don't think I will loose a lot of money when I opt to sell one DME again).

I have some questions regarding the following topics (I want to use the Bin Mod Tool from ECUWorx where possible):

• Speed Limit Removal: flash tune or flash program?
• EWS Removal: flash tune or flash program?
• Is EWS Removal even needed when I have the original DME available to do a full read (I don't want to modify the original DME, so no RSA bypass or anything)?

I want to do the following:

1. Flash new DME with Euro software
2. Do full read
3. (Do RSA bypass, not sure if needed)
4. Use MSS6x Flasher and Bin Mod Tool to
   1. remove Speed Limiter
   2. EWS (not sure if needed)
   3. modify program for 6MT
   4. later modify program for S65 injectors (which can't be done with the Bin Mod Tool atm, but there is a guy in another forum who is willing to help with this kind of stuff)
5. Use MSS6x Flasher to flash tune (or program?)

Would this work? What would I need to do if do not want to remove EWS and just use the ISN from my original DME? Do Full Read on old DME, flash this to the new DME using flash program, update to Euro Software using WINKFP and continue with the steps from above (without EWS removal and RSA bypass already done)?

One last question: Is the picture below correct to create a bench set-up for an MSS65? I checked with wiring diagrams from TIS and I think this is fine.



Thanks a lot for reading all of this and maybe someone can even help me with some of my points.

[MpowerE36]

I think you only write a partial that is why your ecu is still locked. You need to overwrite the program to unlock it.

Just answer to your mail. It went to my spam.

[patator03]

Hi MpowerE36 and thanks for you quick reply !

I already try to flash stock file with my AUTEL diagnose , seems to be OEM now , but maybe still obd locked

I wonder if this error is due to my cable , or obd locked . You confirm it is obd locked ?

I can write ORI file with another tool ( AUTOTUNER ) , but i'm really scare to write something without having a real backup/full read

Do you think there is a safer way to write oem program ?

I just bought 5 minutes ago ecuworx cable , in order to be safe and have proper flash tool

By the way i tried to join you by mail , in order to take you tool for unlock my CPU ^^

[MpowerE36]

If you don't care about your current tune, you can write an oem program and tune then make your full backup.

[MpowerE36]

Hi guys , Tried to read my brother's M3 E93 .

I can ID it with sucess , but i have this error when i'm trying to read full flash .

My cable is working well from obdauto ( i'm in France ) , works with INPA , or mhd flasher for example, this is not china copy

Everything seems to be correctly installed , with a functionnal ediabas install .

On your tutorial at the beginning i saw that you said "All E9x M3s and 2008+ M5s will require a K+D-CAN cable that is flashed with the EdiabasLib firmware " but currently in europe, i don't know if my cable is flashed with this firmware .

can it be the problem for connect to my ECU while trying to read it ?

Thanks people who will help me !

Your ecu is obd locked.

https://nam3forum.com/forums/forum/e9x-2008-2013/e9x-coding-tuning/114162-mss60-obd-locked

[patator03]

Hi guys , Tried to read my brother's M3 E93 .

I can ID it with sucess , but i have this error when i'm trying to read full flash .

My cable is working well from obdauto ( i'm in France ) , works with INPA , or mhd flasher for example, this is not china copy

Everything seems to be correctly installed , with a functionnal ediabas install .

On your tutorial at the beginning i saw that you said "All E9x M3s and 2008+ M5s will require a K+D-CAN cable that is flashed with the EdiabasLib firmware " but currently in europe, i don't know if my cable is flashed with this firmware .

can it be the problem for connect to my ECU while trying to read it ?

Thanks people who will help me !

[patator03]

Hello guy's

Just in order to said thanks to Terra , for create and improve his flasher .

My brother bought an M3 E93 , and want to tune it but L MPC is locked ( year 2011 )

I tried to use some Famous chiptuning flash tool , can't do it via obd , or can't unlock via BDM .

I will try your soft as soon as i receive my cable , but before tried it , i'd like to thank you anyway ^^

[kaiv]

Used Terra's flasher for the first time; indent, full read, ISN/secret key, RSA bypass and reflash with edited file. All went smoothly and worked perfectly. Thanks Terra and contributors!



Edit: Answered my own question :P

[TANKER_WX]

That's probably where I'd start.

Do a ZUSB update to 240/241E with WinKFP to get you back to a 100% stock place and then try again.

Sure, thx Martyn!

I will try this procedure.

[Martyn]

That's probably where I'd start.

Do a ZUSB update to 240/241E with WinKFP to get you back to a 100% stock place and then try again.

[TANKER_WX]

I am not 100% sure, but I would suspect that during a RSA bypass the signature check is also bypassed on the program memory. Apparently it did on the first picture. Again, not 100% sure.
2nd picture says that program is not available / not fully OK.
These are conditions coming from ECU after/during flashing [PROGRAMMIERSTATUS].

Are you able to upload your original full files here? Any chance the ECU has been tuned before?

it should be stock file. i am the only owner of this car.
So, u mean i can flash back to original full file by winkfp. and do RSA bypass again?

sure. i am going to copy my full file tomorrow.

[Tomba]

I already readyout the full ECU file by MSS6X 1.0.0.3 Flasher and keep it safe.

However, the RSA bypass is failed. I flash the original full file back to the DME by MSS6X 1.0.0.3, the car can be started normally.

So, I try to do RSA bypass again, and it failed again.(u may find more ditail from attachment).

Would u plz tell me how can i finish the RSA bypass using MSS6X flasher 1.0.0.3? or anytihing wrong with my software?

The program version is 231E, and more detail info plz check the attachment.

I am not 100% sure, but I would suspect that during a RSA bypass the signature check is also bypassed on the program memory. Apparently it did on the first picture. Again, not 100% sure.
2nd picture says that program is not available / not fully OK.
These are conditions coming from ECU after/during flashing [PROGRAMMIERSTATUS].

Are you able to upload your original full files here? Any chance the ECU has been tuned before?

[TANKER_WX]

hi terra, Martyn,

firstly great thx for yours to develop this nice app that i can make something happen on my car many thx.

i am a newer here, i spend hours to read this thread fully. but i still cant fix my problem. So here it is:

I bought ECUWorx Flashing Cable for E60 M5, E65 M6 and E92 M3, and the key from ECUWorx. I am willing to flash my 2013 bmw E92m3..

I already download and install every software step by step (the system of my computer is window 10, COM1 LATENCY1, unzip ECUWORX-E6X-E9X-DME-Update to C:/ EC-APPS/NFS, copy 10flash.prg and

MS_S65.PRG from MSS6X_Flasher_PreReqs to C:/Ediabas/ECU, etc..)

I already readyout the full ECU file by MSS6X 1.0.0.3 Flasher and keep it safe.

However, the RSA bypass is failed. I flash the original full file back to the DME by MSS6X 1.0.0.3, the car can be started normally.

So, I try to do RSA bypass again, and it failed again.(u may find more ditail from attachment).

Would u plz tell me how can i finish the RSA bypass using MSS6X flasher 1.0.0.3? or anytihing wrong with my software?

The program version is 231E, and more detail info plz check the attachment.

Many thx mate!

Sincerely,

Tanker.

[terra]

Greets all new poster here and reading through the old posts to catch up. As a quick question, has the CENSOR lock on the one MPC been figured out yet? There’s actually a bit of code in every mss60 version I’ve looked at (a lot) that flips the CENSOR back on, but it’s a single byte change to make it like the other MPC.

Also, the OBD read lock is a simple KWP2000 look up table change (IIRC) and works identically between mss60 and mss65.

Again, old memory and need to refresh a few weeks, but IIRC MPC 563 writes flash in blocks, so I always wondered if it was possible to specify only a single block of flash to write that wouldn’t force writing all the other blocks (I.e. revert KWP lookup table to stock).

I did succeed in disabling the censor via BDM. Mpower36 managed to over OBD. Clearing the censor does erase the entirety of the cpu flash. So ideally you’d have a backup beforehand (Mpower36’s software presumably backs it up and restores)

Writing and locking an EWS SK via tool32 will enable censor mode. Otherwise it stays unlocked.

Theres plenty of potential ways to disable OBD reading.

The CPU does write / erase in blocks, but unfortunately the built in erase routines don’t. You can only erase the tune or the entirety of the program (without the ability to upload your own custom code to RAM that is).

Unfortunately erasing the tune or program makes the DME disregard all read commands until a valid tune and program combination are written back.