MSS6x Flasher - Now released!

[Tomba]

I already readyout the full ECU file by MSS6X 1.0.0.3 Flasher and keep it safe.

However, the RSA bypass is failed. I flash the original full file back to the DME by MSS6X 1.0.0.3, the car can be started normally.

So, I try to do RSA bypass again, and it failed again.(u may find more ditail from attachment).

Would u plz tell me how can i finish the RSA bypass using MSS6X flasher 1.0.0.3? or anytihing wrong with my software?

The program version is 231E, and more detail info plz check the attachment.

I am not 100% sure, but I would suspect that during a RSA bypass the signature check is also bypassed on the program memory. Apparently it did on the first picture. Again, not 100% sure.
2nd picture says that program is not available / not fully OK.
These are conditions coming from ECU after/during flashing [PROGRAMMIERSTATUS].

Are you able to upload your original full files here? Any chance the ECU has been tuned before?

[TANKER_WX]

I am not 100% sure, but I would suspect that during a RSA bypass the signature check is also bypassed on the program memory. Apparently it did on the first picture. Again, not 100% sure.
2nd picture says that program is not available / not fully OK.
These are conditions coming from ECU after/during flashing [PROGRAMMIERSTATUS].

Are you able to upload your original full files here? Any chance the ECU has been tuned before?

it should be stock file. i am the only owner of this car.
So, u mean i can flash back to original full file by winkfp. and do RSA bypass again?

sure. i am going to copy my full file tomorrow.

[Martyn]

That's probably where I'd start.

Do a ZUSB update to 240/241E with WinKFP to get you back to a 100% stock place and then try again.

[TANKER_WX]

That's probably where I'd start.

Do a ZUSB update to 240/241E with WinKFP to get you back to a 100% stock place and then try again.

Sure, thx Martyn!

I will try this procedure.

[kaiv]

Used Terra's flasher for the first time; indent, full read, ISN/secret key, RSA bypass and reflash with edited file. All went smoothly and worked perfectly. Thanks Terra and contributors!



Edit: Answered my own question :P

[patator03]

Hello guy's

Just in order to said thanks to Terra , for create and improve his flasher .

My brother bought an M3 E93 , and want to tune it but L MPC is locked ( year 2011 )

I tried to use some Famous chiptuning flash tool , can't do it via obd , or can't unlock via BDM .

I will try your soft as soon as i receive my cable , but before tried it , i'd like to thank you anyway ^^

[patator03]

Hi guys , Tried to read my brother's M3 E93 .

I can ID it with sucess , but i have this error when i'm trying to read full flash .

My cable is working well from obdauto ( i'm in France ) , works with INPA , or mhd flasher for example, this is not china copy

Everything seems to be correctly installed , with a functionnal ediabas install .

On your tutorial at the beginning i saw that you said "All E9x M3s and 2008+ M5s will require a K+D-CAN cable that is flashed with the EdiabasLib firmware " but currently in europe, i don't know if my cable is flashed with this firmware .

can it be the problem for connect to my ECU while trying to read it ?

Thanks people who will help me !

[MpowerE36]

Hi guys , Tried to read my brother's M3 E93 .

I can ID it with sucess , but i have this error when i'm trying to read full flash .

My cable is working well from obdauto ( i'm in France ) , works with INPA , or mhd flasher for example, this is not china copy

Everything seems to be correctly installed , with a functionnal ediabas install .

On your tutorial at the beginning i saw that you said "All E9x M3s and 2008+ M5s will require a K+D-CAN cable that is flashed with the EdiabasLib firmware " but currently in europe, i don't know if my cable is flashed with this firmware .

can it be the problem for connect to my ECU while trying to read it ?

Thanks people who will help me !

Your ecu is obd locked.

https://nam3forum.com/forums/forum/e9x-2008-2013/e9x-coding-tuning/114162-mss60-obd-locked

[MpowerE36]

If you don't care about your current tune, you can write an oem program and tune then make your full backup.

[patator03]

Hi MpowerE36 and thanks for you quick reply !

I already try to flash stock file with my AUTEL diagnose , seems to be OEM now , but maybe still obd locked

I wonder if this error is due to my cable , or obd locked . You confirm it is obd locked ?

I can write ORI file with another tool ( AUTOTUNER ) , but i'm really scare to write something without having a real backup/full read

Do you think there is a safer way to write oem program ?

I just bought 5 minutes ago ecuworx cable , in order to be safe and have proper flash tool

By the way i tried to join you by mail , in order to take you tool for unlock my CPU ^^

[MpowerE36]

I think you only write a partial that is why your ecu is still locked. You need to overwrite the program to unlock it.

Just answer to your mail. It went to my spam.

[PeterPan]

Hello everybody,

I am new to the forum and tbh, I only signed up to the forum because of this tool. I bought a new to me e60 M5 6MT with a lot of miles and therefore try to do some preventative maintenance. While I was looking for new injectors (which are discontinued from Bosch for S85 engine), I came across this tool. After reading lots of threads, this sounds awesome. Thank you very much for providing stuff like this FOR FREE!!!

Even tough I read every thread out there about this tool (at least that is what I think), I have some questions. My plan is to purchase a second MSS65 DME, get a bench set-up and configure the software according to my likes. This way I can play around a little and just swap out the DME while keeping the original one as it is (I don't think prices for used DMEs will change a lot, so I don't think I will loose a lot of money when I opt to sell one DME again).

I have some questions regarding the following topics (I want to use the Bin Mod Tool from ECUWorx where possible):

• Speed Limit Removal: flash tune or flash program?
• EWS Removal: flash tune or flash program?
• Is EWS Removal even needed when I have the original DME available to do a full read (I don't want to modify the original DME, so no RSA bypass or anything)?

I want to do the following:

1. Flash new DME with Euro software
2. Do full read
3. (Do RSA bypass, not sure if needed)
4. Use MSS6x Flasher and Bin Mod Tool to
   1. remove Speed Limiter
   2. EWS (not sure if needed)
   3. modify program for 6MT
   4. later modify program for S65 injectors (which can't be done with the Bin Mod Tool atm, but there is a guy in another forum who is willing to help with this kind of stuff)
5. Use MSS6x Flasher to flash tune (or program?)

Would this work? What would I need to do if do not want to remove EWS and just use the ISN from my original DME? Do Full Read on old DME, flash this to the new DME using flash program, update to Euro Software using WINKFP and continue with the steps from above (without EWS removal and RSA bypass already done)?

One last question: Is the picture below correct to create a bench set-up for an MSS65? I checked with wiring diagrams from TIS and I think this is fine.



Thanks a lot for reading all of this and maybe someone can even help me with some of my points.

[Tomba]

Hello everybody,

I am new to the forum and tbh, I only signed up to the forum because of this tool. I bought a new to me e60 M5 6MT with a lot of miles and therefore try to do some preventative maintenance. While I was looking for new injectors (which are discontinued from Bosch for S85 engine), I came across this tool. After reading lots of threads, this sounds awesome. Thank you very much for providing stuff like this FOR FREE!!!

Even tough I read every thread out there about this tool (at least that is what I think), I have some questions. My plan is to purchase a second MSS65 DME, get a bench set-up and configure the software according to my likes. This way I can play around a little and just swap out the DME while keeping the original one as it is (I don't think prices for used DMEs will change a lot, so I don't think I will loose a lot of money when I opt to sell one DME again).

A 2nd hand ECU is always welcome as prices might go higher and you have one for spare. For the modifications you want you won't need it actually.

I have some questions regarding the following topics (I want to use the Bin Mod Tool from ECUWorx where possible):

Would this work? What would I need to do if do not want to remove EWS and just use the ISN from my original DME? Do Full Read on old DME, flash this to the new DME using flash program, update to Euro Software using WINKFP and continue with the steps from above (without EWS removal and RSA bypass already done)?

You can divide the ECU memory in 3 contents, (1) Boot, (2) ASW Application SoftWare or Program and (3) CAL Calibration or Data.
You need Boot to start up the ECU. The ASW actually is the program that runs inside the ECU and uses constants, maps and other values from CAL to run. Sometimes there are different country or power output variants and these are mainly different between CAL. ASW runs equally.

Most of the things you want to edit are in the CAL(3), only EWS delete requires RSA bypass for modification on the ASW/Program on MSS65. For MSS60 from version (?) it requires RSA bypass on CAL level too to work correctly.

For EWS, it is not possible to modify your ISN inside the ECU by OBD tools (correct me if I am wrong). The memory locations are not possible to write/modify according to my knowledge. To do so you actually need a BDM tool (instead of connected to the OBD port you are directly connecting to the ECU circuit board to access the memories). I think KTAG (clone) might help you out on this one.

It is possible to make EWS off by OBD as the ASW/Program is changed to do so.

Your original ECU won't need RSA bypass as your EWS is working and the values you want to edit are in CAL.
Your 2nd hand ECU would need RSA bypass for EWS delete. Or if you buy the BDM tool, make a full clone of your original ECU. Then you also won't need RSA bypass.
MSS65 is always BDM-able, MSS60 needs RSA bypass and another tool to unlock it if updated to one of the latest versions.

original or cloned MSS65 ECU
- Read partial, modify and flash back.

2nd hand ECU
- Update with WinKFP
- Read full file
- RSA bypass with full file (with EWS removed)
- modify Tune (CAL/Data) and flash back

Not sure if your CAS will like it if you swap ECUs around. You might need to reset CAS and DME once you put back in the original ECU. Can be done by Tool32/ISTA.

One last question: Is the picture below correct to create a bench set-up for an MSS65? I checked with wiring diagrams from TIS and I think this is fine.



Thanks a lot for reading all of this and maybe someone can even help me with some of my points.

Seems fine to me.

[PeterPan]

Thanks a lot Tomba.

You can divide the ECU memory in 3 contents, (1) Boot, (2) ASW Application SoftWare or Program and (3) CAL Calibration or Data.
You need Boot to start up the ECU. The ASW actually is the program that runs inside the ECU and uses constants, maps and other values from CAL to run. Sometimes there are different country or power output variants and these are mainly different between CAL. ASW runs equally.

That cleared up things for me. I was also reading through some other DME software threads (mainly in this forum) and figured, that it takes a little more effort to fully clone a DME. I believe I will just delete the EWS on the second DME and sync the CAS in case I am going to fit the original DME again. I guess I have to do this (sync CAS to original DME) no matter if I clone the original DME or remove the EWS on the second one.

Most of the things you want to edit are in the CAL(3), only EWS delete requires RSA bypass for modification on the ASW/Program on MSS65. For MSS60 from version (?) it requires RSA bypass on CAL level too to work correctly.

Okay nice. So just to confirm: removing speed limiter, modifying Euro software for manual transmission and changing injector properties can all be edited within the Calibration Space (3).

Another thing just popped into my mind. Do you get any mileage related problems or fault codes when switching DMEs? Haven't read anything about that topic, so I guess no problems. I thought the DME is also saving the mileage of the car. Will the DME update it's mileage as soon as you put it in the car?

2nd hand ECU
- Update with WinKFP
- Read full file
- RSA bypass with full file (with EWS removed)
- modify Tune (CAL/Data) and flash back

I see. Wasn't aware that the RSA bypass process is basically a full flash with some additional steps carried out. So I would do a full read, change HEX address according to this post and use the modified file to do/flash a RSA bypass. Thanks a lot!

[Tomba]

Thanks a lot Tomba.



That cleared up things for me. I was also reading through some other DME software threads (mainly in this forum) and figured, that it takes a little more effort to fully clone a DME. I believe I will just delete the EWS on the second DME and sync the CAS in case I am going to fit the original DME again. I guess I have to do this (sync CAS to original DME) no matter if I clone the original DME or remove the EWS on the second one.

Might be the case! Sometimes you could just put the original back and it will start. But as I don't know and I don't like surprises like a non starting car, I tell there is a possibility.

Okay nice. So just to confirm: removing speed limiter, modifying Euro software for manual transmission and changing injector properties can all be edited within the Calibration Space (3).

If the changes you want to make are in the CAL/Data/Tune file then no RSA bypass is necessary on MSS65.
I suspect manual/SMG config is in CAL/Data/Tune.
The rest for sure is. I can make the changes to your file if you need help.

Another thing just popped into my mind. Do you get any mileage related problems or fault codes when switching DMEs? Haven't read anything about that topic, so I guess no problems. I thought the DME is also saving the mileage of the car. Will the DME update it's mileage as soon as you put it in the car?

CAS and KOMBI/IKE are the masters and are the only 2 modules I am aware of that could directly change the mileage.
Example1
Your care has 100.000 [km] and this is stored in both CAS and KOMBI, you pick up a used CAS or KOMBI with 150.000 [km] and fit it to your car,
Your non swapped ECU will now take over the higher mileage. Only way to revert it is to change memory on CAS or KOMBI with probably desoldering and eprom change. CAS can be read with programmers and no desoldering of chips is required. You still need soldering skills to attach the small wires to the circuit board.

Example2
Your care has 100.000 [km] and this is stored in both CAS and KOMBI, you pick up a used CAS or KOMBI with 75.000 [km] and fit it to your car,
Your swapped/2nd hand ECU will now take over the higher mileage. No issues there as it wont higher your cars mileage.

I am sure that if you use a higher mileage DME example 1 wont happen. So it is safe. I am sure the mileage is stored somewhere, mainly to report at which mileage error codes were stored (example).
From memory mileage is send on the CAN-BUS to all modules. I am not 100% sure but I would think it takes that mileage.

I see. Wasn't aware that the RSA bypass process is basically a full flash with some additional steps carried out. So I would do a full read, change HEX address according to this post and use the modified file to do/flash a RSA bypass. Thanks a lot!

Yes, after RSA bypass you would still need to flash a Tune, be aware of that.