CA/LA Smog

[thegenius46m]

Just a heads up to the guys who aren't as computer savvy... ANY changes done to the dme will technically change the checksum. So yes even if you enabled sport mode memory, you technically will fail. Honestly I think its only a matter of time till this gets thrown out in court for being overly ridiculous. Anything modified in the dme that doesn't impact emissions in any way, shape, or form and cause you to fail smog. That includes even an smg tune where the shift parameters were modified on the dme side. SMG unit flash would be unrelated. But yes this is beyond ridiculous.

[IamFODI]

Mods/admins just deleted some political commentary and otherwise uselessly contentious posts. Please, everyone, let's remember why we're here.

[repoman89]

It's calculated. Exactly how it's calculated isn't entirely clear to me. IIRC @gpetersen found that if you brute force the checksum such that the calculated checksum is equal to the stock value, then the CVN is also correct. So it's either itself a CRC16 (of each half) with a different initial value and/or polynomial, or it's some sort of calculation that's done to the calculated checksum.

Probably wouldn't be crazy difficult to hardcode the program to return a valid value

That’s my recollection as well, and looking at some notes the checksum is also calculated in a strange way (reorder each data segment half minus the last two bytes of the first half, get CRC16 on that, write it in the location of the two removed bytes). I saved p0lar’s Perl implementation of that calculation from the old forum and was going to translate to python to make a brute forcer tool … too lazy to do the actual math. I have the main part of the brute forcer script, including a table of cal IDs vs expected CRCs that I pulled from the old forum, just needed to get the checksum calculator right. There are lots of long sequences of zeros in my binary at least, figured it’d be harmless to use a couple of them to force a collision

I started all that in 2019 because there were rumors that MA was collecting CVN data to flag if it changed year over year .. don’t think anything ever came of it, and also they’re oddly lax about OBD2 emissions, exempting anything 15 years or older.

[siamkazi]

Just a heads up to the guys who aren't as computer savvy... ANY changes done to the dme will technically change the checksum. So yes even if you enabled sport mode memory, you technically will fail. Honestly I think its only a matter of time till this gets thrown out in court for being overly ridiculous. Anything modified in the dme that doesn't impact emissions in any way, shape, or form and cause you to fail smog. That includes even an smg tune where the shift parameters were modified on the dme side. SMG unit flash would be unrelated. But yes this is beyond ridiculous.

Thank you for this, I am not ashamed to admit that I was googling terms/abbreviations more than I would like to admit 😂

On a more serious note, this is no bueno at all. Curious to see how the next 30 days pan out for others (including other makes/models i.e. GTR's Evo's etc).

[2004LSB]

Pardon my ignorance on coding and tuning, but hypothetically if one were to reflash canned tunes back to the factory / default tune, this shouldn't create any issues with the CVN / checksum data correct? How about swapping ECUs with a virgin one?

[Tbonem3]

Flashing back to your original factory file should be fine. BAR even said so, I think I remember reading in one of the posted links.

[sev]

Flashing back to your original factory file should be fine. BAR even said so, I think I remember reading in one of the posted links.

the dilemma is you have limited flashes... of course unless you buy mssflasher

[old///MFanatic]

Pardon my ignorance on coding and tuning, but hypothetically if one were to reflash canned tunes back to the factory / default tune, this shouldn't create any issues with the CVN / checksum data correct?

That's basically what CARB wants you to do. It's really not that huge an issue. People should be more worried about headers and no cats than this. Heck Dinan's tune is CARB approved so they're in the clear. And those with the Conforti Shark tune can just swap it in, back and forth. Which makes me wonder if tuners are going to start offering it like the "Shark Injector" for this reason. I'm sure more coding qualified people can answer that question.

"Beginning July 19, 2021, vehicles with software not provided by the original equipment manufacturer (OEM) or approved through a California Air Resources Board (CARB) Executive Order (EO) will fail Smog Check.

Before your vehicle will pass a Smog Check, you must have the vehicle’s software restored to the OEM software version. Once the software is restored, have your vehicle reinspected by a licensed Smog Check station".

[heinzboehmer]

I think people are more concerned about running any sort of change on their tune, not just performance/emissions related ones.

In my case, I have to run a couple changes to the tune to get my car to work correctly (I originally had a non-HP which I converted part of the hardware to HP spec so some software changes are required). Also it's just a bit ridiculous that changing something like the temp at which your tach lights go off will make you fail smog.

[Samsonite79]

Pardon my ignorance on coding and tuning, but hypothetically if one were to reflash canned tunes back to the factory / default tune, this shouldn't create any issues with the CVN / checksum data correct? How about swapping ECUs with a virgin one?

Don't forget your eVIN has the match too, they use that to check if you are hot plugging or clean plugging.

[Tbonem3]

the dilemma is you have limited flashes... of course unless you buy mssflasher

Yes, and I wonder what if resetting the counter causes a problem?

[heinzboehmer]

Yes, and I wonder what if resetting the counter causes a problem?

Nah it's just an artificial limit set by BMW. The chips themselves can probably be written to on the order of 100k+ times.

Skimmed the datasheet and found that they're guaranteed to be able to be erased 1,000,000 times, but not sure under what circumstances or whatever. Point is, you don't really have to worry about that.

[Tbonem3]

I meant with respect to passing smog

[heinzboehmer]

Pretty sure the checksum is generated from the 64kb partial (or tune as it's sometimes called too). The flash counter is stored in another part of memory, so no, resetting it would not pose an issue.

[Samsonite79]

I meant with respect to passing smog

the number of flashes doesn't show up in the generic OBDII pid or mode 9 data, at least from what I can see. But INPA does show the # of flashes, and also the flash # increases if you modify the AIF data (rewriting the vin#) with tool32 too... so it's an artificial # like every mentioned.