MSS6x Flasher - Now released!

[[email protected]]

I'm not at all interested in immo off! Because I sync it in 2 minutes, it's easier! I can remove MPC563 from MSV70 and solder to MSS60. But then I don't have, a full dump from processor L, to write! If I write a full dump from processor R to processor L. Doesn't it work?

[CF-CarParts Motorsport]

If you dont have any "bench-obd" connection any more you just can desolder and swap mcu...
I will not share how to because its atm also a way to get around mine protection for immo off.

[[email protected]]

I read the entire forum from 1 to 256 posts 2 times, I thought I missed something! I realized that this can be done using the MSS flasher, but then when Dme passes the identification! But in my case, there is no OBD connection! One way to fix this is through BDM! but I have no thoughts in my head how this can be done. Dear CF-Car Parts Motorsport, please advise, push me to the right side, where to start?

[CF-CarParts Motorsport]

Left mpc closed for read... so think about, other ways need to get around to change "something" to open it 🙄.

[[email protected]]

But seams it clients car... so get a spare mss60, read ISN... write to CAS from car (if CAS3+ need a key for descryption of cas) and after do the coding stuff .

No, a friend's car. I already did it! I wrote this in 251 posts.
I wanted to ask. Who read the full dump from MSS60 through BDM ? Please share. Maybe, this will be the most beams birthday gift! I can revive the brick !
Do you think this method can be used to revive him, at least to get in communication through the OBD?

[CF-CarParts Motorsport]

Its possible to get arround.
I think Terra also did before. Read Threader with open eyes .

With developer tools also able to get you hands through.
But seams it clients car... so get a spare mss60, read ISN... write to CAS from car (if CAS3+ need a key for descryption of cas) and after do the coding stuff .

[[email protected]]

You cant read left side mcu because bdm of this is blocked by bmw in configurations.

now that there is no way out, it is not possible to restore it?

[CF-CarParts Motorsport]

You cant read left side mcu because bdm of this is blocked by bmw in configurations.

[[email protected]]

Hello Guru, I have a BMW E92, 2009 , MSS60 , S65B40. I wanted to update the Firmware on DME WINKFP with D-CAN cable. As a result, I got a brick! DME is not detected. I tried to read the K-TAG the BDM . I read the memory of R perfectly! And L memory could not the read , a checksum error appears! I was lent the same DME MSS60, I have AUTOHEX II, I read SK (ISN) from it and wrote it down in CAS. The car started up and works! I wanted to clone it, to write on my DME, didn't work! The same situation with the checksum! How can I restore my DME, where can I get a dump for it to restore via BDM ? I put files reading with KTAG and KESS here.Please help me to restore, the car has been standing for a week! Thanks.

[alfons38]

Good work thanks to all people

[beastpilot]

Just to follow up on my Bricked MSS85 (M5) DME, and how I recovered it:

Bought KTAG clone off Ebay (You need KTAG, not KESS. Make sure it isn't coming with OBDII connectors.) Apparently a BDM100 off Aliexpress will work also (cheaper, longer to ship), or a Galletto 4 V54.

Opened, ECU, soldered pins on the BDM header connectors (pins came with KTAG).

Installed KTAG software, Make sure you install Visual C++ 2005 and reboot after install or you will get Checksum errors.

Read data from ECU to have a backup of what is there. If you get Checksum errors, STOP and fix them. The reads are worthless with these, and these reads could be important.

At least with KTAG it complained about the protocol being wrong for the right processor (instructions say 117, but it wanted 116). I just used the one it suggested and it worked fine. I believe this is a difference with the Siemens vs Continental DME builds (mine was an '08 and Continental).

Take you backup you made with MSS6X flasher (you did take one, right?), and use a hex editor to break it into 4 files. 0-0x7FFFF, 0x80000-0x27FFFF, 0x280000-0x2FFFFF, and 0x300000-0x4FFFFF. (512kb, 2048kb, 512, 2048)

The first block is the left MPC. The second is the Left External Flash. Third is right MPC, Fourth is right Ext Flash.
Flash these back to the DME. That should be it.

When I did this, I got a DME EWS error. My backup did not have the ISN in it. However, the ISN will be in your BDM backup that you took before you wrote. Open up the left micro backup file read by BDM. ISN is the 6 bytes at 0x7940. Move these to your your Flasher backup file and write back to the ECU.

Even better, make sure you read the ISN with MSS6X flasher before you even try to flash anything back. This will prove that the RSA bypass and everything is working.

You may want to just write to the Left Ext Flash first and the right MPC and flash, and see if you recover it. This will avoid overwriting the ISN if the left MPC is otherwise healthy.

I've now written back to the ECU many, many times with the MSS6X flasher program with no issues. I have no idea what failed, but it was a fluke based on my experience. I'm going to go see if I can find an obvious corruption between my BDM backup and what I was trying to write with the MSS6X flasher.

[CF-CarParts Motorsport]

beastpilot where are you from?
If you from Germany, send (or come locally with) ecu + ews modul to us and we can recover it or at least resync ecu with ews . If interested write a pn.
About BDM:wikipedia.org/wiki/Background_debug_mode_interface
In MSS65 / MSS60 there are two seperate MPC56x processors (one injection side other is ignition side and both communicate together).
So you have to read both sides mpc and flash seperate via bdm pad.
In early MSS60 isn't bdm lock. In later onces ~ 2009 and above there is bdm "lock" but there are ways to get around, also terra got the solution (he mentioned early in this threader).

[beastpilot]

I have an MSS65, not an MSS60, so I believe all of those can be BDM'd from what I read. I understand no cable is 100%- just mentioned to show that I wasn't using a guarantee brick cable.

Can someone point me to a good resource to learn about BDM programming? My google searches are failing me. Is BDM any different than JTAG?

I'm only trying to fix one, and a used ECU is only $200, so it's not worth spending a bunch on a programmer, but of course I might kill the new one too, so I'd rather BDM. I'm pretty skilled at soldering so I don't need all the frames, I can just tag some wires on.

[Tomba]

I appear to have bricked my MSS65 in a 2008 M5.
It's not the cable- I read the ECU, turned off cold start, and programmed it back. Worked fine. I programmed the cable with EdbiasLib firmware personally.
Turns out I liked the cold start. I put it back and re-programmed.
In the middle of the program I got an "unable to set address," so I re-started. Seemed to work fine, went through the whole process normally. This was a full flash, not tune.
However, when I power cycled, I got no fuel pump prime.
The DME flasher says "unknown/unsupported" when I try and connect again. It just appears to not be talking at all.
The DME comes up red in ISTA as missing. I tried Tool32 and it can't find the ECU. It finds other modules.

The engine does crank, just never starts. I think this is CAS though.

I'm pretty handy with electronics. Can I recover a MSS65 from the inside? What kind of BDM programmer do I need? I'm an EE so I have all sorts of JTAG and other stuff around.

If I just grab another ECU, will I have an issue re-programming it or anything with CAS, given I have the full original backup?

I bricked a MSS60. Used a non EdiabasLib cable, very stupid. I ordered BimmerGeeks cable and needed to flash a M5.2 ECU. That one aborted half way for no reason. Then used my ICOM to do the job. For me a cable with EdiabasLib firmware isn't 100% safe. Back up tools are a must for me. Unfortunately MSS60 isn't BDM able yet for all versions.
I also have a hard time to unlock ECUs with the latest software version on it. Kess isn't able to unlock them.

For your problem,
Get your hands on BDM programmer. With your full read I would suspect you can "repair" the current files in the ECU. I personally have MagicMotorsport equipment. But cost wise I wouldn't suspect you buy the full package. Search for KTAG, these should be able to read your ECU. Might consider soldering BDM headers on your ECU or a BDM frame with adapter.

[beastpilot]

I appear to have bricked my MSS65 in a 2008 M5.
It's not the cable- I read the ECU, turned off cold start, and programmed it back. Worked fine. I programmed the cable with EdbiasLib firmware personally.
Turns out I liked the cold start. I put it back and re-programmed.
In the middle of the program I got an "unable to set address," so I re-started. Seemed to work fine, went through the whole process normally. This was a full flash, not tune.
However, when I power cycled, I got no fuel pump prime.
The DME flasher says "unknown/unsupported" when I try and connect again. It just appears to not be talking at all.
The DME comes up red in ISTA as missing. I tried Tool32 and it can't find the ECU. It finds other modules.

The engine does crank, just never starts. I think this is CAS though.

I'm pretty handy with electronics. Can I recover a MSS65 from the inside? What kind of BDM programmer do I need? I'm an EE so I have all sorts of JTAG and other stuff around.

If I just grab another ECU, will I have an issue re-programming it or anything with CAS, given I have the full original backup?