Unlock MSS60 CPU via OBD

[MpowerE36]

Hi,

I develop a new MSS60 program and a Python script to unlock via OBD the BDM access to the injector CPU memory. They also allow to know if the injector CPU is BDM locked or not. The program can be written with MSS6x Flasher.

Don’t know yet what I will do with them. The program is finished and released but the script is just a prototype.

[pshoey]

Could definitely be included in the flasher program - would be a nice addition if you wanted to contribute it.

Congrats on getting it to work - whatever you decide to do with it.

pshoey

[Tomba]

Thanks Vincent!

So to sum up,
- ECU must be working,
- Flash patch with MSS6X Flasher
- Run python script to unlock / set censorship
- BDM ready :-)

Does it also work with 241e program?
Should the ECU first be RSA bypassed to work?

[MpowerE36]

Yes, ECU must be working in order to flash the custom program via obd. You also need to do a RSA bypass to flash this program. My program is based on a 231E but after unlocking the injector CPU, you can re-flash the 241E program or any other program and tune.

[MpowerE36]

I added some features :

- lock injection CPU
- evaluate the BDM access state of the ignition CPU
- lock/unlock ignition CPU

The last thing to add would be to virginize the ECU (clear Secret Key and AIF information)

[alclot]

Hello world. It is my firts post and I hope firts of a lot of them.
I found interesting this post. I have unit which I want clone. Where I can download this software to unlock mcu of the unit please?
Thanks a lot

[hobbit382]

Hi,

I develop a new MSS60 program and a Python script to unlock via OBD the BDM access to the injector CPU memory. They also allow to know if the injector CPU is BDM locked or not. The program can be written with MSS6x Flasher.

Don’t know yet what I will do with them. The program is finished and released but the script is just a prototype.

very cool! I would like to try this out

[MpowerE36]

I am currently working on a public release. It will be available in few weeks. Send me a PM if you are interested.

[tdott]

In layman terms, or those not familiar with this level of stuff.

What does unlocking BDM access to the injection CPU allow you to do?

Just trying to understand what this could be used for.

[MpowerE36]

It allows to recover the dme via bdm at any time (if an obd programming goes wrong for example) or clone a dme.

[tdott]

It allows to recover the dme via bdm at any time (if an obd programming goes wrong for example) or clone a dme.

The ECU cloning has my attention, would your software be able to do that also?

[MpowerE36]

The ECU cloning has my attention, would your software be able to do that also?

Not sure for the first version but it will be easy to add it later. But when the injector cpu is bdm unlocked, it is easy to clone a dme with bdm tools (Ktag, FGtech)

[MpowerE36]

I will do lots of validation this week but it is almost finished (only 231E, 240E and 241E programs are supported).

[MpowerE36]

Validation is complete.

Please, use a cable which allows to write in the dme without any problems. My tool is not more risky than another flasher.

No need to do an RSA bypass. It automatically detects if dme needs one.

I've also developped an unrestricted version for professional.

[CZs65]

Is this available to be downloaded. I need to unlock from my ESS tune.