MSS60 XDF Mappings

[omhl]

Hey everyone,

I'm trying to create an XDF to share with the forum with the binaries that we are reading from the MSS6X Flasher.

Just sharing some of my identifying findings using the MSS6X Flasher so far. Hopefully we can identify some more mappings! I am looking for servotronic comfort/sport addresses. pedal throttle map comfort/sport, ignition min(KF TZ VL MIN), WOT Fueling. I won't bother with cold start, o2 dtc stuff since ECUWORX tool can handle that.

Please share if you have any!

This is from 241E read.

RPM Limiter:
0x6062
1x8
16 bit
Columns: 0x6052

values:
8000 8300 8300 8300 8300 8300 8300 8300

TEMP RPM
0x6088
6x1
columns: 0x6088
row conversion: (X*0.1)-273.2 to degrees

-25.0 0.0 25.0 50.0 60.0 80.0
5000.0 6000.0 6500.0 7000.0 7500.0 8300.

Vanos Admission:
0xA862
16x12 table
16 bit
Row: 0xA82A
Column: 0xA84A
Conversion: X/10

stock values:
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 112.0 103.5 97.7
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 113.7 105.0 100.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 113.7 103.9 98.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 113.7 101.1 95.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 118.0 97.0 87.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 131.0 123.7 114.0 87.0
131.0 130.9 131.0 131.0 131.0 131.0 131.0 131.0 131.0 123.6 116.0 83.0
131.0 131.0 131.0 130.0 127.0 126.0 124.0 124.0 128.1 124.0 115.7 83.0
131.0 131.0 131.2 130.0 127.0 127.0 127.1 130.0 128.5 122.5 115.7 83.0
131.0 131.0 131.0 131.0 130.0 130.0 130.0 130.0 126.6 122.8 114.9 92.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 130.0 124.4 118.1 112.4 93.0
131.0 131.0 131.0 131.0 131.0 131.0 131.0 129.0 118.6 114.2 109.3 99.8
131.0 131.0 131.0 131.0 131.0 131.0 131.0 123.6 112.8 111.6 107.9 104.0
131.0 131.0 131.0 131.0 131.0 131.0 125.8 108.7 99.4 101.3 103.8 108.2
131.0 131.0 131.0 131.0 131.0 131.0 122.0 102.0 94.1 96.0 101.5 112.0
131.0 131.0 131.0 131.0 131.0 131.0 121.9 100.1 92.2 95.8 103.5 120.0


Vanos Admission Heating (KATH):
0xABD6
16x12
16 bit
Row: 0xAB9E
Column: 0xABBE
Conversion: X/10

stock values:
131.0 131.0 131.0 131.0 131.0 131.0 131.0 126.8 123.0 109.0 98.5 97.7
131.0 131.0 131.0 131.0 131.0 130.9 129.3 124.0 119.0 110.7 100.0 100.0
131.0 131.0 129.0 125.6 123.0 120.3 117.0 119.0 119.0 116.7 98.9 98.0
131.0 131.0 127.3 120.5 117.1 115.8 114.4 117.2 124.8 117.0 95.5 95.0
131.0 131.0 127.3 120.4 117.0 116.0 115.0 117.3 125.7 117.0 91.0 77.0
131.0 131.2 127.0 120.0 118.0 116.0 115.0 117.0 125.0 123.7 106.0 77.0
131.0 130.9 129.1 124.0 118.0 116.5 116.6 119.1 127.0 123.6 111.0 77.0
131.0 131.3 129.7 125.0 118.0 117.0 117.6 120.6 128.1 124.0 110.7 75.0
131.0 131.0 131.2 130.0 127.0 127.0 127.1 130.0 128.5 122.5 110.7 78.0
131.0 131.0 131.0 131.0 130.5 130.0 130.0 130.0 126.6 122.8 114.9 87.0
131.0 131.0 131.0 131.0 131.0 131.0 131.3 130.0 124.4 118.1 112.4 93.0
131.0 131.0 131.0 131.0 131.0 131.0 131.9 129.0 118.6 114.2 109.3 99.8
131.0 131.0 131.0 131.0 131.0 131.0 131.3 123.6 112.8 111.6 107.9 105.0
131.0 131.0 131.0 131.0 131.0 131.0 125.8 108.7 99.4 101.3 103.8 110.0
131.0 131.0 131.0 131.0 131.0 131.0 122.0 102.0 94.1 96.0 101.5 112.0
131.0 131.0 131.0 131.0 131.0 131.0 121.9 100.1 92.2 95.8 103.5 120.0



WOT Ignition Timing KF_TZ_VL
0x28E1EC
16x3
Row: 0x28E1C2
Column: 0x28E1E6
Conversion: x/10

stock values:
3.0 3.0 3.0
16.0 16.0 16.0
20.0 20.0 20.0
27.0 27.0 27.0
30.0 30.0 30.0
30.0 30.0 30.0
34.0 34.0 34.0
33.0 33.0 33.0
33.0 33.0 33.0
31.0 31.0 31.0
33.0 33.0 33.0
33.0 33.0 33.0
30.0 30.0 30.0
30.0 30.0 30.0
30.0 30.0 30.0
31.0 31.0 31.0
32.0 32.0 32.0
32.0 32.0 32.0


Limp Mode Pedal
0x28ACC6
10x1
Column: 0x28ACB2
Conversion: x/10

00 08 16 25 30 35 40 43 46 50

[alfalfa]

Cool idea. Please add to software version to these informations. 240e/241e aka V762 is the same but it differs to older ones.

[terra]

I think in general it makes sense to just have everyone standardize one a single software variant. 240E/241E is probably a good one to do.

[omhl]

is there that many variants out there? Maybe we could just list the offsets that differ per variant.

or did you mean stock values are different between the variants.

[alfalfa]

There are so many variants like official MSS60 Software out there. Just the the 240e/241e share the data.
If you know how a a2l is generated you know there is no stable offset. It always depends in which address the new application data is packed. So you have a range of application data and integrate a new label it will be anywhere in this range. You have some data in front of this label with no needed offset and the data behind need the offset of the new integrated label.

I think terra's idea will be the best. Standardize 240e/241e for this thread.

[Locha7777]

hello i have files for M3 e92 where is make pop and bang if you can handle something with that i can give it you

[hotsd101]

this should help.
mostly in german but very easy to identify virtually everything

http://s000.tinyupload.com/index.php?file_id=99321849121425428317

http://s000.tinyupload.com/index.php?file_id=18347161709163219273

[hotsd101]

also complete inj and ign a2l

http://s000.tinyupload.com/index.php?file_id=76985708348244175672

[terra]

Sweet. That inj/ign a2l is a pre-release firmware, but should be a great starting point for generating an XDF.

[MpowerE36]

Hi everyone,

Does anyone know if the immo off for MSS60/MSS65 has not yet become public ?

I intend to look at the disassembled injection program where K_EWS_FETRAWE_WEG is used (Permitted mileage for automatically activating the production mode with the EWS-DME comparison). Maybe the EWS disable byte is used in this aera of the program...

[terra]

I don't believe it's public yet. I don't personally know how to do it. I've been disassembling the software and trying to wrap my mind around it. Have a couple areas that look promising, but I'm not seeing anything quite like the MSS54 where it's a single byte in the parameter space. That prototype firmware linked to above also apears to be from a point in development when the MSS60 was still EWS3, so there are some differences to work through.

[MpowerE36]

I think I've found the K_EWS_FETRAWE_WEG parameter in the injection program (see screenshot). There is no other parameters use in this subfunction but there are several parameters use in child and parent functions which are not identified in the "inj.a2l" (ex : 0x708D0 or 0x79CB7), so maybe it is a good lead. Unfortunately, I’m not yet familiar with this MPC5xx assembler language to understand what the program does in this aera.

[MpowerE36]

this should help.
mostly in german but very easy to identify virtually everything

http://s000.tinyupload.com/index.php...49121425428317

http://s000.tinyupload.com/index.php...61709163219273

I didn't succeed in opening the "5.06.doc". It seems to be damaged. Is it the same for you ?

Strange thing : it seems to be exactly the same funktionsrahmen documents than the MSS54. Only the name of the project has changed. But when you look at the .a2l, it is clear that there have been many evolutions in the MSS60. The MSS60 funktionsrahmen documents seem to be different when I look at the preview available in this website : http://jmgarage.ru/funktionsrahmens-and-documentation/

[terra]

I think I've found the K_EWS_FETRAWE_WEG parameter in the injection program (see screenshot). There is no other parameters use in this subfunction but there are several parameters use in child and parent functions which are not identified in the "inj.a2l" (ex : 0x708D0 or 0x79CB7), so maybe it is a good lead. Unfortunately, I’m not yet familiar with this MPC5xx assembler language to understand what the program does in this aera.

Turning on auto comments makes it much easier to follow when you don’t have the instruction set memorized.

[terra]

Long shot, but anyone here have access to M3 GT4 software? Wondering if those have a factory EWS Delete.