Announcement

Collapse
No announcement yet.

MSS60 Research

Collapse
X
 
  • Filter
  • Time
  • Show
Clear All
new posts

    #46
    Originally posted by terra View Post
    I got the interface working. Had to set the parallel port mode in the VM bios to "Output Only" instead of bidirectional / EPP / ECP. Doesn't really make sense to me since it seems like communications are going both ways... but who knows.

    .
    Just noticed this in the Macgraigor FAQ:

    "What mode must my parallel port be in?

    As far as the parallel port is concerned, a Wiggler is a simple uni-directional device. It will work with the parallel port in any mode EXCEPT "ECP". It will NOT work in ECP mode at all.

    The Raven works best with a parallel port in EPP mode. It may work in ECP mode. If the parallel port is in an older mode, such as uni-directional, AT, or compatible, the Raven will work but slower."


    So its a feature, not a bug

    Comment


      #47
      Originally posted by dpaul View Post

      You are first.

      I feel I have searched exhaustively and PM'd everyone who seemed to have even a shred of relevant information. There are few comments out there from people who thought they knew how to do it or even claim to have done it. But no one sharing any useful information or proof of the accomplishment.

      Again, awesome.
      Yeah, I saw the usual internet badasses who claimed that had some knowledge of the dark arts and could do it. But no one who said how.

      Even if I do come up with a good script (effectively all I did was disable the watchdog and then follow the steps in the reference manual on setting / clearing the censor), I do think this is unfortunately a bit beyond most people. Fewer and fewer people own desktops nowadays, which is pretty much required for the PCIe parallel port (USB will not work). I guess an expresscard parallel port should work, but how many laptops even have expresscard nowadays? Thunderbolt to PCIe or exprescard adapters do exist, but at that point you may as well buy the more expensive pemicro stuff.

      And the reality is even back when they were mainstream, parallel ports have always been notoriously finicky - there will be trouble shooting involved no matter what.

      Originally posted by dpaul View Post

      Just noticed this in the Macgraigor FAQ:

      "What mode must my parallel port be in?

      As far as the parallel port is concerned, a Wiggler is a simple uni-directional device. It will work with the parallel port in any mode EXCEPT "ECP". It will NOT work in ECP mode at all.

      The Raven works best with a parallel port in EPP mode. It may work in ECP mode. If the parallel port is in an older mode, such as uni-directional, AT, or compatible, the Raven will work but slower."


      So its a feature, not a bug



      Ha I saw the ECP part, but I didn't notice the "simple uni-directional device" part. I guess that must relate to individual pin behavior rather than the device as a whole? In any case, I did have to force the virtual bios to "output only" rather than bidirectional or EPP.

      Comment


        #48
        So looking into the shadow memory a little bit more, there may indeed be a difference between MSS60 and MSS65 there.

        On my MSS65, the first 4 bytes (UC3FCFIG) are set to 0, everything else is FF. This is the case for both processors.

        On my MSS60, the injection side was impossible to read. On the ignition side, the first 4 bytes are set to 20 41 00 00

        The differences translate to:

        Bus pins drive strength — This bit determines the bus pins’ (address, data, and control) driving capability to be either full or reduced drive. The bus default drive strength is full; upon default, it also causes the CLKOUT drive strength to be full. See Table 6-7 for more information. BDRV controls the default state of COM[1] in the SIUMCR. 0 Full drive 1 Reduced drive
        -MSS65 = Full drive
        -MSS60 = Reduced drive

        Debug pins configuration — See Section 6.2.2.1.1, “SIU Module Configuration Register (SIUMCR)” for this field definition. The default value is that these pins function as: VFLS[0:1], BI, BR, BG and BB. See Table 6-8.
        -MSS65 = VFLS[0:1] BI BG BR BB
        -MSS60 = VFLS[0:1] STS VF0 VF1 VF2

        Interlock write select — This bit determines which interlock write operation should be used during the clear censorship operation. IWS always comes from the UC3FCFIG, it will never use the external reset configuration word (RSTCONF=0) or the default internal reset configuration word (RSTCONF=1 and HC=1). 0 Interlock write is a write to any UC3F array location 1 Interlock write is a write to the UC3FMCR register.
        MSS65 = 0 (Interlock write = write to any UC3F array)
        MSS60 = 1 (Interlock write = write to UC3FMCR register)


        I don't know for sure how much of a difference any of that stuff makes, and whether or not I should assume the injection / ignition sides should be set the same. I feel like best would be to get a dump of a factory unlocked one, but that's easier said than done without buying one myself.

        Comment


          #49
          So interestingly, my DME managed to relock itself.

          What I had done: Wrote ignition side's shadow memory to injection side, wrote a "virgin" flash to me DME (blank SK, blank AIF), wrote a new AIF entry with WinKFP, wrote and locked a new SK with tool32. I suspect that last bit triggered a lock routine, but it's hard to say for sure.

          Edit: Pretty sure it's writing (or more likely locking) the SK via tool32 command that locked the CPU. Makes some sense that they'd be delivered to BMW in an unlocked state and only lock themselves after the SK is burned in. With the ability to read full dumps and unlock it doesn't really matter, but I'd say just write the SK at the time of the BDM programming instead of waiting to do it in tool32.

          Comment


            #50
            So for whatever it's worth, I got myself a Cyclone MAX and while in theory it could work great, currently it does not.

            I can get it to clear the censor bits (03 -> 00), but it errors out when trying to set it to 1 or 2 (or even back to 3 for that matter). If I set it via wiggler, the cyclone is happy to program the flash, and it is far faster than any of the automotive interfaces I've tried. However it errors out on the external flash despite selecting the correct chip... so that limits its usefulness. I suspect same will apply for the Multilink BDM / FX interfaces.

            I posted on PEMicro's forums, maybe they can get a patch going. We'll see.

            edit:

            On another note, my neighbor let me borrow his e92 M3 to mess with. Cloned his ECU onto my bench MSS60 and threw it in the car - starts right up like it belongs.

            Comment

            Working...
            X