MSS60 XDF Mappings

[KClemente]

It will be very similar to MSD80/81 in which there will also be a Vorsteuerungkorrektur which is a "fuel scalar" map which will make alternative fuels much easier to tune. Here is an MSS60 damos I have no use for. It will only open on WinOLS 4 and higher.

Rename .txt into .rar to open.

[afv]

Hello I've merge some info in a text file so I put them here.

241E guide

Tune location:

Tune 0x00000-0x0FFFF Full 0x070000-0x07FFFF
Tune 0x10000-0x1FFFF Full 0x2F0000-0x2FFFFF

V-max map:

0xB090-0xB137
Full bin offset +7000

5x 8x2map, [08 00] separator

Stock:
00 00 00 01 00 02 00 03 00 04 00 05 00 06 00 07
11 60 11 60 11 60 11 60 11 60 11 60 11 60 11 60
last:
00 00 00 01 00 02 00 03 00 04 00 05 00 06 00 07
0F C0 0F C0 0F C0 0F C0 0F C0 0F C0 0F C0 0F C0

Full speed:
00 00 00 01 00 02 00 03 00 04 00 05 00 06 00 07
1F 40 1F 40 1F 40 1F 40 1F 40 1F 40 1F 40 1F 40
all

Rev limiter:

0x6052-0x6071
Full bin offset +7000

Rev limit = Hex value in decimals

Pedal:

Full bin offset +2F0000

Pedal position 0x1ACB2-0x1ACC5

Limp map 0x1ACC6-0x1ACD9

DTCs

Each DTC has a 26 byte row

To delete a DTC, null 3rd to 10th and the 13 byte

The DTC code is on the 2 first byte, all code id coulb be find on tool32


Cats efficiency:

Full bin offset +7000


Bank 1 0x170C-0x1725

Row:
27 89 04 20 00 00 00 00 00 00 01 01 01 01 01 01 02 00 58 00 58 01 58 1E 5C 55


Bank 2 0x1726-0x173F

Row:
27 8A 04 30 00 00 00 00 00 00 01 01 01 01 01 01 02 00 58 00 58 01 58 1F 5C 55


Secondary air pump (SAP):

Full bin offset +7000

0x1AF8-0x1B02

Row:
27 AF 00 00 00 00 00 00 14 11 01 01 01 01 01 01 02 00 58 02 58 03 5C D6 5C DB

and

27 82 .. ..

I've also done a very quick XDF file with some maps I found, someones not enough really identified (they include a "?" in their title. Change the extension of the txt to xdf.

Do someone has a full winols version to explore the ols file existing? It could be interesting to port the maps to an xdf file i think.

[dmlf]

Rev limiter:

0x6052-0x6071
Full bin offset +7000

Rev limit = Hex value in decimals

Here are some other rpm limiters I found :

Martyn I noticed that your bin modification tool only lists the "hot" oil rpm limiters, maybe you could add the cold one too !

[nick380]

Hi everyone, I'm fairly new to the ECU scoping game, but I'm interested in helping, as I've never done this before and would love to learn. I have a buddy with an E92 M3 MSS60. I used to have one and always hated never being able to check out the tune myself. I've recently been helping another friend with his MS54HP E46 M3, and discovered the .zip also contained Function frames for the MSS60 at least partially translated, with the remainder still in German. This got me interested into learning more about that ECU. I'm sure you guys have found this already, considering you've mentioned the functions in this thread. If not I can link it as well. What do I need to get started in finding tables in the address spaces within the DME? Will I need the car? I can do some googling, but so far WinOLS and a dump from the DME? I hope to tune his M3 and also be able to learn more about understanding address locations and how to find them and create an XDF and bin for tuning.

Link to MSS60 Function frame partially translated: https://file.io/H2gr0LizxMNZ


Thanks guys,

Nick

[dmlf]

2 new values identified :
K_GANG_I_HA_HS - Final drive Manual - 0x13632
K_GANG_I_HA_DKG - Final drive DCT - 0x13634

x/1024
Precision 3

[dmlf]

Guys, any tips on decompiling my bin with IDA ? I find myself stuck know, I've a bunch of maps that I see in the bin but can't identify further. If I could correlate block diagrams from the funktionrahmen to some decompiled subroutine I guess I could identify them ?
terra Martyn ?

[terra]

Guys, any tips on decompiling my bin with IDA ? I find myself stuck know, I've a bunch of maps that I see in the bin but can't identify further. If I could correlate block diagrams from the funktionrahmen to some decompiled subroutine I guess I could identify them ?
terra Martyn ?

Are you already familiar with IDA and want to know specifics like memory map and whatnot? Or is this a more general question?

[dmlf]

Well I have a version of IDA installed and already did some tinkering with embedded systems ( jtag, gdb, crosscompilation, creating board support packages ).
I need some help guiding me through because I am pretty certain I am completly oblivious on a lot of the power of IDA.


Would a full read of one side ( inj or ign ) would be a good starting point ? Will I miss some boot code ?

[dmlf]

Hey guys, I think I've found KF_TI_SOLL_MIN ( minimum injection time ) and KF_TI_SOLL_UB_OFFS ( injector dead times )


Comments are welcome

[dmlf]

K_KH_N_MAX ( RPM threshold for cat preheat deactivation ) -> set this to a low value to deactivate cold start.

[dmlf]

@16AEE
KL_MD_RF_MAX_ROH ( Max relative Filling / RPM )

20x1

X : RPM x 1 , precision 0
relative filling, x/10000 , precision 3

[MtoufP]

hi guys
thank you for sharing i'm slowly interested in the s65 do you know where the exhaust vanos tables are, and exhaust heating, i found the intake / and heating vanos tables but the exhaust tables i have a doubt, thank you
for 240e soft

[isma_s54]

here damos file
if any membre have map pack please send here

https://www88.zippyshare.com/v/xeuRPyOQ/file.html

[tdott]

K_KH_N_MAX ( RPM threshold for cat preheat deactivation ) -> set this to a low value to deactivate cold start.

Is this the stock cold start max rpm value in the screenshot or lowered value to deactivate code start?

[MtoufP]

Yes