MSS6x Flasher - Now released!

[MARQAW]

I’m working on MSS60 that might be OBD locked..

I Bench read with HEXTAG left and right side..

is there a known way to unlock these without losing the current tune…or will I have to re-flash with winkfp to get OBD read and write enabled again.

[terra]

I’m working on MSS60 that might be OBD locked..

I Bench read with HEXTAG left and right side..

is there a known way to unlock these without losing the current tune…or will I have to re-flash with winkfp to get OBD read and write enabled again.

I don’t want to say it’s impossible, but it’s not trivial. The read function is programmed to return all FFs if you force the DME into a non-running state, and the program can’t be overwritten without erasing the tune.

[MpowerE36]

I did it 2 years ago and I confirm that it is not easy. Here my topic about it :

https://nam3forum.com/forums/forum/e9x-2008-2013/e9x-coding-tuning/114162-mss60-obd-locked

[Nick_E92]

Hey yall, new to custom tuning but trying to learn as much as possible. have used all off the shelf flashers and am a computer science major in collage right now. Want to learn more and dive deeper into the E92 M3 i got just a few months ago. Before i had an n54 (still do) and have learned a lot there doing all the work myself. want to learn more about the s65. Does anyone have an XDF file for the MSS60 i could use in TunerPro to begin looking at the parameters. i have done a full read on MSS6X Quickflash and have my bin here. Thanks. I have done a primary cat delete with macht schnell test pipes and want to kill the codes for emissions. as well begin learning how to pull a bit more power and exhaust overrun single crack when i shift (manual transmission.) Id love to talk over the phone if anyone has some free time to teach or ill be on the look out here as well. 770-880-8525

[--Aramis--]

Hi All,

I'm from France,

I have a 2007 M3 manual with (i suppose) an ESS map, retrieve as 240E by MSS6x Flasher but impossible to read, i have got this message "“Something went wrong, please try again” " when i have tried to read it.

so with winkfp and daten V60 i have writen an OEM 241E map and program with success (car start and drive 150 km)

after that i have done a full read with MSS6x Flasher with success (1h read time)

i have begin to try to identify maps with winOLS but i could'nt find any values at "standards" offset (Vmax, manual gearbox ratio, ignition timings) and when i found one axis scales and datas are Inconsistent

We have to compare the map with a friend that have an another tool (dimsport new genius) and with his car map and we find that the map are not the same size (his file 5,25Mo and mine 5,00 Mo) and the dimsport tool says there is a problem with ram size in my map extracted by MSS6x Flasher, see capture after

I don't have done the RSA bypass write with MSS6x Flasher, is it the origin of the problem?

What do you think or advice about this case?

I want to do some modification with Ecuworks in the first time but if the full read is corrupted i don't want to modify it and rewrite it in the MSS60...

I think before i write it i would be able to find "standard" value via winols at the commons offset for them

terra and MpowerE36 and others if you have any advices, thanks




Here my full BIN

[--Aramis--]

Finaly all is OK, it's just an offset in the address, we have compared a MSS6xflasher full bin with à Dimsport bin that it seems just a partial read

[Verner]

Hi, Great SW, (I have done another MSS60 before). This time also MSS60.
Problem is that this car newer finish read, instead it start again reading as a loop, both full and maps read. Tested with BimmerGeek expert and own made Ediabaslib inpa cable, Two different Win10 laptops. Both has Ediabas ecu files.
I readed maps example about 10x, one time it save file. But I can't write without Full+RSA-patch. I donn't have time to try 10x full read.
I tested write ori maps back, it flash maps two times before end succesfully.
Also one time ignition was off, no lights on dash, still it keeps reading.
Whats is wrong?

Edit. Working now. I was too busy to wait.
If somebody want do cold start disable, please send message.

[Tomba]

Hi, Great SW, (I have done another MSS60 before). This time also MSS60.
Problem is that this car newer finish read, instead it start again reading as a loop, both full and maps read. Tested with BimmerGeek expert and own made Ediabaslib inpa cable, Two different Win10 laptops. Both has Ediabas ecu files.
I readed maps example about 10x, one time it save file. But I can't write without Full+RSA-patch. I donn't have time to try 10x full read.
I tested write ori maps back, it flash maps two times before end succesfully.
Also one time ignition was off, no lights on dash, still it keeps reading.
Whats is wrong?

How long does your full read take?
It may look it is reading it 10 times, but in reality it reads different memory contents. Full read would at least take up to 1 hour.

[Verner]

It takes at least 1h, I check hex value read it starts again from 0.

[dasvolk]

I'm having a problem with the tool on an MSS65. The car had Jim Colley's FAMS tune on it, and it couldn't read it so I overwrote the tuning with stock via WinKFP (switching to a different tuner.) No matter what I do I'm getting that "something went wrong please try again" at the end of the read. Clearly the cable works because I can do whatever I please with it using WinKFP and other tools. Is it possible that in spite of completely overwriting the DME there's some sort of read block still extant with the old tuning? Or am I doing something else wrong? I installed just BMW Standard Tools and the flasher on a different laptop but am still getting the same results.

[Tomba]

I'm having a problem with the tool on an MSS65. The car had Jim Colley's FAMS tune on it, and it couldn't read it so I overwrote the tuning with stock via WinKFP (switching to a different tuner.) No matter what I do I'm getting that "something went wrong please try again" at the end of the read. Clearly the cable works because I can do whatever I please with it using WinKFP and other tools. Is it possible that in spite of completely overwriting the DME there's some sort of read block still extant with the old tuning? Or am I doing something else wrong? I installed just BMW Standard Tools and the flasher on a different laptop but am still getting the same results.

I believe that error is related to the file size. The downloaded file size doesn't meet the expected one.
No error codes in the ECU?
Have you reflashed complete ECU (ASW and Flash // Program and Data) or only flash/data? Maybe some setting in ASW/Program section refuses to give data.

[adrianj73]

Greets all new poster here and reading through the old posts to catch up. As a quick question, has the CENSOR lock on the one MPC been figured out yet? There’s actually a bit of code in every mss60 version I’ve looked at (a lot) that flips the CENSOR back on, but it’s a single byte change to make it like the other MPC.

Also, the OBD read lock is a simple KWP2000 look up table change (IIRC) and works identically between mss60 and mss65.

Again, old memory and need to refresh a few weeks, but IIRC MPC 563 writes flash in blocks, so I always wondered if it was possible to specify only a single block of flash to write that wouldn’t force writing all the other blocks (I.e. revert KWP lookup table to stock).

[Tomba]

Hi, Welcome to the forum! Nice you join us.

As a quick question, has the CENSOR lock on the one MPC been figured out yet?

Vincent [MpowerE36] https://nam3forum.com/forums/member/1186-mpowere36. Has done it.

https://nam3forum.com/forums/forum/e9x-2008-2013/e9x-coding-tuning/166648-unlock-mss60-cpu-via-obd

[terra]

Greets all new poster here and reading through the old posts to catch up. As a quick question, has the CENSOR lock on the one MPC been figured out yet? There’s actually a bit of code in every mss60 version I’ve looked at (a lot) that flips the CENSOR back on, but it’s a single byte change to make it like the other MPC.

Also, the OBD read lock is a simple KWP2000 look up table change (IIRC) and works identically between mss60 and mss65.

Again, old memory and need to refresh a few weeks, but IIRC MPC 563 writes flash in blocks, so I always wondered if it was possible to specify only a single block of flash to write that wouldn’t force writing all the other blocks (I.e. revert KWP lookup table to stock).

I did succeed in disabling the censor via BDM. Mpower36 managed to over OBD. Clearing the censor does erase the entirety of the cpu flash. So ideally you’d have a backup beforehand (Mpower36’s software presumably backs it up and restores)

Writing and locking an EWS SK via tool32 will enable censor mode. Otherwise it stays unlocked.

Theres plenty of potential ways to disable OBD reading.

The CPU does write / erase in blocks, but unfortunately the built in erase routines don’t. You can only erase the tune or the entirety of the program (without the ability to upload your own custom code to RAM that is).

Unfortunately erasing the tune or program makes the DME disregard all read commands until a valid tune and program combination are written back.

[TANKER_WX]

hi terra, Martyn,

firstly great thx for yours to develop this nice app that i can make something happen on my car many thx.

i am a newer here, i spend hours to read this thread fully. but i still cant fix my problem. So here it is:

I bought ECUWorx Flashing Cable for E60 M5, E65 M6 and E92 M3, and the key from ECUWorx. I am willing to flash my 2013 bmw E92m3..

I already download and install every software step by step (the system of my computer is window 10, COM1 LATENCY1, unzip ECUWORX-E6X-E9X-DME-Update to C:/ EC-APPS/NFS, copy 10flash.prg and

MS_S65.PRG from MSS6X_Flasher_PreReqs to C:/Ediabas/ECU, etc..)

I already readyout the full ECU file by MSS6X 1.0.0.3 Flasher and keep it safe.

However, the RSA bypass is failed. I flash the original full file back to the DME by MSS6X 1.0.0.3, the car can be started normally.

So, I try to do RSA bypass again, and it failed again.(u may find more ditail from attachment).

Would u plz tell me how can i finish the RSA bypass using MSS6X flasher 1.0.0.3? or anytihing wrong with my software?

The program version is 231E, and more detail info plz check the attachment.

Many thx mate!

Sincerely,

Tanker.