Unlock MSS60 CPU via OBD

[MpowerE36]

Unlocking cpu and unlocking ess tune are two different things. The first one allows to access to the flash memory of the injection cpu via BDM. It is usefull to recover or clone a dme. The second one is a modification that ess does in the bootloader to "kill" the ram_lesen function. This function is called via OBD request.

I made a post about your problem here :

https://nam3forum.com/forums/forum/e9x-2008-2013/e9x-coding-tuning/114162-mss60-obd-locked

[adrianj73]

If you don’t mind sharing, I’d like to give it a try.

Does this script alter the section of code in the external flash that resets the CENSOR bit too? Or is there a chance it will get triggered and reset the bit?

[patator03]

Hello there ,

Did you finish your public release ? ^^

My brother bought an M3 E93 , and need a tune for his Catdelete . car is year 2011 , and cpu is locked via bdm , so i'm scare to write anything via obd without a proper backup .

I bought correct K/DCan cable ( OBDAUTO) and i will try MSSFLAsher as soon as possible , but i need to know if your cpuunlock tool can be bought

Thanks again

[Tomba]

Hello there ,

Did you finish your public release ? ^^

My brother bought an M3 E93 , and need a tune for his Catdelete . car is year 2011 , and cpu is locked via bdm , so i'm scare to write anything via obd without a proper backup .

I bought correct K/DCan cable ( OBDAUTO) and i will try MSSFLAsher as soon as possible , but i need to know if your cpuunlock tool can be bought

Thanks again

Contact him by PM.
In order to use his tool you will still need to RSA bypass the ECU by OBD. -> you will still need to flash it by OBD!

1. Read full flash with ediabaslib cable
2. Perform RSA Bypass with full file.
3. From this point you can write partial files to the ECU by OBD (BDM remains locked)
4. Once you use Vincent's tool you can unlock BDM in case you want to make a complete backup.

[MpowerE36]

Contact him by PM.
In order to use his tool you will still need to RSA bypass the ECU by OBD. -> you will still need to flash it by OBD!

1. Read full flash with ediabaslib cable
2. Perform RSA Bypass with full file.
3. From this point you can write partial files to the ECU by OBD (BDM remains locked)
4. Once you use Vincent's tool you can unlock BDM in case you want to make a complete backup.

My tool automatically does the RSA bypass if it is nessecary

[Marhd]

Hi there,

I am new to this.

I would just like to confirm whether (after unlocking BDM with your tool)
doing a full BDM backup includes the ISN and SK of the DME in question.

Essentially I want to clone a damaged DME via BDM without disabling the EWS (Just so the car is fully stock and can visit the dealership again without worries).
Is this possible or would I still need to modify the CAS to match the ISN?

Please let me know,
thanks.

PS, could you please send me a link to your tool (I do not have PM privileges yet as I am new)

[Tomba]

I would just like to confirm whether (after unlocking BDM with your tool)
doing a full BDM backup includes the ISN and SK of the DME in question.

Yes, the data would include it.
If you clone it (copy content to another ECU) you won't have to worry about ISN/SK.

Essentially I want to clone a damaged DME via BDM without disabling the EWS (Just so the car is fully stock and can visit the dealership again without worries).
Is this possible or would I still need to modify the CAS to match the ISN?

It is possible as suggested above,

1. Unlock BDM on damaged ECU [by OBD tool] and make full reads of both processors [with BDM tool] (internal flash, external flash and if present serial eprom <- doubt it is present, but if you have good tool it will automatic detect it)
2. Unlock BDM [by OBD tool] on 2nd hand ECU and write all content (internal, external flash) from original ECU to 2nd hand ECU for each processor [with BDM tool]. (I would also read 2nd hand ECU before writing and save it, just in case).

If you don't have BDM unlock tool you could do the following
1. Perform RSA bypass on 2nd hand ECU with MSS6X Flasher, then read ISN/SK [by OBD interface/tool]
2. Write ISN/SK in CAS from 2nd hand ECU [by tool that reads/write CAS -> example R270]
3. Not 100% sure, might need to sync ECU again [with OBD interface and use Tool32 or ISTA/D] (1.CAS:dme_startwert_abgleich, 2. DME/MSS60:ews_srtartwert;0x01, 3. DME/MSS60:ews_empfang)
4. Ready to go.

I personally would update ECU to latest software before doing RSA-bypass/BDM unlock. Once car visits the dealership and an update is performed ISTA/P will check software versions of all ECUs and will skip the ones that are already at the required level. Preventing the RSA-bypass/BDM unlock to be erased and overwritten again.

[Marhd]

Yes, the data would include it.
If you clone it (copy content to another ECU) you won't have to worry about ISN/SK.



It is possible as suggested above,

1. Unlock BDM on damaged ECU [by OBD tool] and make full reads of both processors [with BDM tool] (internal flash, external flash and if present serial eprom <- doubt it is present, but if you have good tool it will automatic detect it)
2. Unlock BDM [by OBD tool] on 2nd hand ECU and write all content (internal, external flash) from original ECU to 2nd hand ECU for each processor [with BDM tool]. (I would also read 2nd hand ECU before writing and save it, just in case).

If you don't have BDM unlock tool you could do the following
1. Perform RSA bypass on 2nd hand ECU with MSS6X Flasher, then read ISN/SK [by OBD interface/tool]
2. Write ISN/SK in CAS from 2nd hand ECU [by tool that reads/write CAS -> example R270]
3. Not 100% sure, might need to sync ECU again [with OBD interface and use Tool32 or ISTA/D] (1.CAS:dme_startwert_abgleich, 2. DME/MSS60:ews_srtartwert;0x01, 3. DME/MSS60:ews_empfang)
4. Ready to go.

I personally would update ECU to latest software before doing RSA-bypass/BDM unlock. Once car visits the dealership and an update is performed ISTA/P will check software versions of all ECUs and will skip the ones that are already at the required level. Preventing the RSA-bypass/BDM unlock to be erased and overwritten again.

Thank you for that reply, it makes it very clear.
The sequence is exactly what I expected, and thank you for the tip regarding the ECU software update, I don't think we will want to do any mods after cloning the ECU, but its handy to know this none the less.

Now I just need to actually get the unlock tool (Can't send MpowerE36 a PM yet, being as I am new😅) and order up a KTAG or Galleto 4, which of the two do you recommend? are the Aliexpress clones any good?

Thanks

[Tomba]

Now I just need to actually get the unlock tool (Can't send MpowerE36 a PM yet, being as I am new😅)

Thanks

I suspect he will contact you once he is reading this.

order up a KTAG or Galleto 4, which of the two do you recommend? are the Aliexpress clones any good?

Thanks

I am using original magic motorsport (Flex/X17/BDM V3) tools, in addition I also have a clone Kess KTAG (BDM) and KessV2 (OBD) tool.
I would expect both Galleto and KTAG to work with this ECU, please check before buying. Clones do the job, but always make back ups of original data in case it goes wrong!

[Erde]

Great work. Thank you for sharing.

[rvg30]

MpowerE36 please send me a pm, I am trying to send you one, but I am too new on the forum. Thank you

[rvg30]

Vincent, I received your PM, but for some reason, the forum doesn't authorize me to reply or send a new DM. Can you please send me another PM with your contact information? Thank you!

[MpowerE36]

My email is in the description of my videos on YouTube