MSS6x Flasher - Now released!

[terra]

Got v 1.0.0.1. I can identify the DME, but when I click read full flash nothing happens. If I try read tune it works.

EDIT: Nope, got a 'something went wrong' at the end of read tune.

What version software are you on, and is your car already tuned?

That error means the two sides aren't equal in size.

[Flaco]

Got v 1.0.0.1. I can identify the DME, but when I click read full flash nothing happens. If I try read tune it works.

EDIT: Nope, got a 'something went wrong' at the end of read tune.

[Flaco]

Nevermind it showed up now.

[Flaco]

I'm logged in but don't see any link on the 1st post?

[terra]

Link didn't work for me, anyone else have issues? It opens a tab and says "invalid file specified"

It's an attachment to the first post. Edited the post to make it more prominent. You'll need to be logged in to download it

[Martyn]

Link didn't work for me, anyone else have issues?

The link has been pulled now and the final release uploaded to the first post.

[patsbimmer1]

Link didn't work for me, anyone else have issues? It opens a tab and says "invalid file specified"

[terra]

Released the application. Available for download as an attachment on the first post. I updated the version number to 1.0.0.0, but otherwise there is no change compared to the last beta uploaded.

[terra]

New version.

Changes:
Moved the RSA bypass to the "Advanced" menu, and added a slow and fast version. Slow is probably technically safer, but IMO the risk with fast is negligible if you're using a good cable.
I now verify the binary being flashed for an RSA bypass is a stock file and matches the program version you are currently on. If those conditions are not met, the program will refuse to let you go do the RSA bypass.
Now before tune and program writes, I check if the tune / program is stock and whether or not you have an RSA bypass. If the tune (MSS60 only) or program (both) are not stock and you don't have an RSA bypass, you'll get a warning saying the flash might fail. But you won't be forced to stop the flash in case you have an RSA bypass that I can't easily detect.
I put my money where my mouth is and did several flashes on my (currently) locked MSS60. No issues whatsoever so far.

Same link as before will work to download the latest version (someone let me know if it does not). I think I will be releasing shortly, after which point the latest version will be hosted here on the first post.

[terra]

Very respectable plan. Seems any project like this requires people with different skills sets, it's a shame that those guys don't want to contribute back. Are they saying that there were no program modifications made either??

Sure sounds like that's what they're saying (at least Peter, the other guy seems to be even less willing to share)

No hacking Just good old fashioned time, money, development. 4 years since Nuno wanted to do it, we made good head-way around 2 years ago, but mostly in the last 6-8 months did we really hone it down, we're not forum people. I have a business which tunes cars globally now, but for Nuno and his brother it's just a love and passion for the brand. I nearly gave up many times saying it couldn't be done, but they kept me going. A lot of late nights, over many years now. All with stressfull full-time jobs, this was an escape probably more than anything.

Friends for years, he's not a customer in any way shape or form, just love BMW's and wanted it to succeed. The cost involved is just too much for most, so I can see why so many have tried and failed, and it's been left to the "DIY'ers" which I guess is where the 140+ page thread has come from on other forums, with obviously a lot of clever people on it. What Jim has done, and continues to try and do is outstanding, absolutely incredible.

Most recently we have the paddle's working, OEM M6 steering wheel. No aftermarket ECU/TCU/Piggyback or anything else of the sorts anywhere on this car. We will try and get a video this weekend. A bit more in-depth to prove it.

Jim isn't wrong in that respect, but he's not right either, but not a lot was known about the TCU at the time. They know how to talk to each-other, they actually demand very little from each-other. It's been over-complicated.

Main issues have really been because the car started from 0, it was stripped down to a bare shell, so we had to start from the ground up. We will probably build another one, an M5 this time, without any of the race-car complications it should be a lot easier, plus we have the knowledge of what we've done already, could probably get the whole thing done in a week or 2 this time. Already have some interested parties from the UAE and elsewhere who want us to install the conversion on twin turbo beasts as they're fed up with Manual/SMG and realistically DCT is the next possible modification for these amazing engines.

From his words, it sounds like there was no software involved and no translation needed between torque messages etc. Sounds like most of the work was fixing the mess they made of the car in the first place really.

I don't know if I really believe that. Not like any of us are going to be able to rip the software from their car.

I can see that the DCT computer only needs some inputs and outputs, because it truly acts as a blackbox. I don't have a M3 or a DCT, just an M5 6MT and M5 SMG. We know that there is a usecase where the DME really doesn't need to know that much about the engine when it's mated to the 6MT.

The BDM lock is only on the MSS60 right? I thought I read that the MSS65 doesn't have the BDM lock, there's not that much out there about the MSS65 vs the MMS60

Yeah I don't know - I can imagine not needing a crazy amount of information, but I would think they still need to know how to talk to each other to get things like launch control, rev matching, etc working right

BDM lock is indeed only MSS60. Even late models were never locked as best as I can tell (though who knows what the situation would be if you bought a new DME today).

[hansbrix]

Very respectable plan. Seems any project like this requires people with different skills sets, it's a shame that those guys don't want to contribute back. Are they saying that there were no program modifications made either??

I can see that the DCT computer only needs some inputs and outputs, because it truly acts as a blackbox. I don't have a M3 or a DCT, just an M5 6MT and M5 SMG. We know that there is a usecase where the DME really doesn't need to know that much about the engine when it's mated to the 6MT.

The BDM lock is only on the MSS60 right? I thought I read that the MSS65 doesn't have the BDM lock, there's not that much out there about the MSS65 vs the MMS60

[terra]

I agree all the more reason why we need to figure this out though. What are you guys using to view the bin? I'm assuming you're not using a conventional hex editor? Still new to the BMW/ Siemens stuff, but really want to learn more. I have winOLS installed but my experience with calibration work is on GM PCMs using the HP tuners, which is basically a complete IDE for editing the cal.

Honestly I haven't been messing with actual tuning yet. Right now my main goal has been to analyze the read/write routines and the various security mechanisms on the DME. To that end, a lot of my work has been disassembling the DME software, mostly the second stage boot code, in things like IDA and Ghidra. Also generally logged what all the commands flying around during a WinKFP flash were and things like that.

My next personal goal is to disable the BDM lock on the DME so that 1) we can recover these things if we mess up while OBD flashing (not very likely when limiting yourself to tune modifications, but once you start making program modifications the chance of error increases), and 2) so that we can clone DMEs in the case one needs to be replaced for hardware failure

[hansbrix]

Yeah I dunno. They don't seem like assholes like Gintani, but I just have a very hard time believing that you can essentially plug everything in and just have it work without having to do any software manipulation on either the DME, EGS, or both.

I agree all the more reason why we need to figure this out though. What are you guys using to view the bin? I'm assuming you're not using a conventional hex editor? Still new to the BMW/ Siemens stuff, but really want to learn more. I have winOLS installed but my experience with calibration work is on GM PCMs using the HP tuners, which is basically a complete IDE for editing the cal.

[patsbimmer1]

Joined just to follow this thread! Can't wait to try it in my '11 e90 m3!

[terra]

Yeah I dunno. They don't seem like assholes like Gintani, but I just have a very hard time believing that you can essentially plug everything in and just have it work without having to do any software manipulation on either the DME, EGS, or both.