California Will Start Testing for ECU Tunes During Smog Checks

[Irhase46m3]

Hi There - I had my smog check done the day it went into effect 07/19/21 - My car has the BuildJournal tune, aside from that its stock (headers, SAP, cats, etc) - I was able to pass smog without any issues. The Tune was recently added (within the last year) - A few things relevant from the smog report:

Smog Check Inspection Station Information - Software Version/OIS ID: 21.1.1227.0/CV003995

My thought here is that its possible that the station software wasn't yet update to the ECU check OR that its possible its just not checking older cars pre-2008.

Hope this info helps!

[skristedja]

So it's been several days now since the new rules went into effect. Has anyone heard whether pre-2008 cars are failing for tunes? I'm still waiting on a response to my public records request.

[Samsonite79]

Thanks! This is very helpful.

[terra]

That'll be great! As long as we get the calibration # to CVNs that's the most important. I tell you my "CAL#: 7842974 CVN#: 7D CC 4B 79" on my 2003 m3 6sp. MSS54 non-hp.

I think GM provides this on their TIS online or tech info. I'm sure BMW has something like this but I'm not sure where to look. Thanks man!

That matches the CVNs stored in the comments of the WinKFP file. So we essentially already have the list of valid CVNs. I still don't know how it's calculated, beyond knowing that if the calculated checksum matches the stock values, the CVN will also be correct.

Here's a quick and dirty python script to calculate MSS54 checksums. If we identify a consistent set of 2 empty / unused bytes, then we could use those two bytes to force the checksum to whatever we want

import sys
import struct
import hashlib

def crc_16_fast(crc,msg):

table = (
0x0000, 0xc0c1, 0xc181, 0x0140, 0xc301, 0x03c0, 0x0280, 0xc241,
0xc601, 0x06c0, 0x0780, 0xc741, 0x0500, 0xc5c1, 0xc481, 0x0440,
0xcc01, 0x0cc0, 0x0d80, 0xcd41, 0x0f00, 0xcfc1, 0xce81, 0x0e40,
0x0a00, 0xcac1, 0xcb81, 0x0b40, 0xc901, 0x09c0, 0x0880, 0xc841,
0xd801, 0x18c0, 0x1980, 0xd941, 0x1b00, 0xdbc1, 0xda81, 0x1a40,
0x1e00, 0xdec1, 0xdf81, 0x1f40, 0xdd01, 0x1dc0, 0x1c80, 0xdc41,
0x1400, 0xd4c1, 0xd581, 0x1540, 0xd701, 0x17c0, 0x1680, 0xd641,
0xd201, 0x12c0, 0x1380, 0xd341, 0x1100, 0xd1c1, 0xd081, 0x1040,
0xf001, 0x30c0, 0x3180, 0xf141, 0x3300, 0xf3c1, 0xf281, 0x3240,
0x3600, 0xf6c1, 0xf781, 0x3740, 0xf501, 0x35c0, 0x3480, 0xf441,
0x3c00, 0xfcc1, 0xfd81, 0x3d40, 0xff01, 0x3fc0, 0x3e80, 0xfe41,
0xfa01, 0x3ac0, 0x3b80, 0xfb41, 0x3900, 0xf9c1, 0xf881, 0x3840,
0x2800, 0xe8c1, 0xe981, 0x2940, 0xeb01, 0x2bc0, 0x2a80, 0xea41,
0xee01, 0x2ec0, 0x2f80, 0xef41, 0x2d00, 0xedc1, 0xec81, 0x2c40,
0xe401, 0x24c0, 0x2580, 0xe541, 0x2700, 0xe7c1, 0xe681, 0x2640,
0x2200, 0xe2c1, 0xe381, 0x2340, 0xe101, 0x21c0, 0x2080, 0xe041,
0xa001, 0x60c0, 0x6180, 0xa141, 0x6300, 0xa3c1, 0xa281, 0x6240,
0x6600, 0xa6c1, 0xa781, 0x6740, 0xa501, 0x65c0, 0x6480, 0xa441,
0x6c00, 0xacc1, 0xad81, 0x6d40, 0xaf01, 0x6fc0, 0x6e80, 0xae41,
0xaa01, 0x6ac0, 0x6b80, 0xab41, 0x6900, 0xa9c1, 0xa881, 0x6840,
0x7800, 0xb8c1, 0xb981, 0x7940, 0xbb01, 0x7bc0, 0x7a80, 0xba41,
0xbe01, 0x7ec0, 0x7f80, 0xbf41, 0x7d00, 0xbdc1, 0xbc81, 0x7c40,
0xb401, 0x74c0, 0x7580, 0xb541, 0x7700, 0xb7c1, 0xb681, 0x7640,
0x7200, 0xb2c1, 0xb381, 0x7340, 0xb101, 0x71c0, 0x7080, 0xb041,
0x5000, 0x90c1, 0x9181, 0x5140, 0x9301, 0x53c0, 0x5280, 0x9241,
0x9601, 0x56c0, 0x5780, 0x9741, 0x5500, 0x95c1, 0x9481, 0x5440,
0x9c01, 0x5cc0, 0x5d80, 0x9d41, 0x5f00, 0x9fc1, 0x9e81, 0x5e40,
0x5a00, 0x9ac1, 0x9b81, 0x5b40, 0x9901, 0x59c0, 0x5880, 0x9841,
0x8801, 0x48c0, 0x4980, 0x8941, 0x4b00, 0x8bc1, 0x8a81, 0x4a40,
0x4e00, 0x8ec1, 0x8f81, 0x4f40, 0x8d01, 0x4dc0, 0x4c80, 0x8c41,
0x4400, 0x84c1, 0x8581, 0x4540, 0x8701, 0x47c0, 0x4680, 0x8641,
0x8201, 0x42c0, 0x4380, 0x8341, 0x4100, 0x81c1, 0x8081, 0x4040
)

for byte in msg:
if sys.version_info[0] < 3:
crc = table[(crc^ord(byte))&0xff] ^ (crc >>8)
else:
crc = table[(crc^byte)&0xff] ^ (crc >>8)
return crc & 0xFFFF

if len(sys.argv) == 1:
if sys.version_info[0] < 3:
filename = raw_input("Enter path/filename: ")
else:
filename = input("Enter path/filename: ")
print ("Note: You can also give filename as a command line argument\n")
else:
filename = sys.argv[1]

def getChecksums(file):
file.seek(0,2)
size = file.tell()
slaveStored = 0
slaveCalc = 0
masterStored = 0
masterCalc = 0
if size == 65536:
initial = 0

file.seek(0x3ffc)
slaveStored = struct.unpack('>H',file.read(2))[0]
file.seek(0x4000)
calcCS = initial
calcCS = crc_16_fast(calcCS,file.read(0x4000))
file.seek(0)
calcCS = crc_16_fast(calcCS,file.read(0x3ffc))
slaveCalc = calcCS

file.seek(0xbffc)
masterStored = struct.unpack('>H',file.read(2))[0]
file.seek(0xC000)
calcCS = initial
calcCS = crc_16_fast(calcCS,file.read(0x4000))
file.seek(0x8000)
calcCS = crc_16_fast(calcCS,file.read(0x3ffc))
masterCalc = calcCS



if size == 32768:
initial = 0x4400

file.seek(0x3ffc)
slaveStored = struct.unpack('>H',file.read(2))[0]
file.seek(0)
calcCS = initial
calcCS = crc_16_fast(calcCS,file.read(0x3ffc))
slaveCalc = calcCS


file.seek(0x7ffc)
masterStored = struct.unpack('>H',file.read(2))[0]
file.seek(0x4000)
calcCS = initial
calcCS = crc_16_fast(calcCS,file.read(0x3ffc))
masterCalc = calcCS

return slaveStored, slaveCalc, masterStored, masterCalc


in_file = open(filename,"rb")

slaveStored, slaveCalc, masterStored, masterCalc, = getChecksums(in_file)

print ("Slave Checksum (stored): " + hex(slaveStored))
print ("Slave Checksum (calculated): " + hex(slaveCalc))
print ("Master Checksum (stored): " + hex(masterStored))
print ("Master Checksum (calculated): " + hex(masterCalc))

Edit: Well the indents aren't showing up properly, but if you know python, I think you can figure out where the indents are supposed to be.

Edit 2: I'll have to double check the disassembly to make sure there's no code references there, but honestly the two bytes right before the checksum in each half are probably good enough

[Samsonite79]

I'm going to put together a public records request on the CARB to get the dataset they're using to check CVNs against. Anyone have any other ideas on what to look for?

That'll be great! As long as we get the calibration # to CVNs that's the most important. I tell you my "CAL#: 7842974 CVN#: 7D CC 4B 79" on my 2003 m3 6sp. MSS54 non-hp.

I think GM provides this on their TIS online or tech info. I'm sure BMW has something like this but I'm not sure where to look. Thanks man!

[jet_dogg]

Why do we always have identical concurrent threads going on? This one, diff problems, cooling system, vanos rattles, csl trunk threaks, etc.

This forum is hilarious.

[IamFODI]

Why so strict down there?

Excellent question, but beyond the scope of this thread and sadly likely to lead to spicy posts (like the ones we've already had to edit/delete).

If you're interested in this and want to know what people here think, I'd suggest posting in OT. Can't imagine it'd go well but would love to be surprised.

[lastMleft]

Why so strict down there?

[skristedja]

I'm going to put together a public records request on the CARB to get the dataset they're using to check CVNs against. Anyone have any other ideas on what to look for?

[IamFODI]

Mods/admins just deleted some political commentary, personal attacks, and otherwise uselessly contentious posts. Please, everyone, let's remember why we're here.

[Samsonite79]

I definitely want to finish it, just need to find some time. Currently dealing with cleaning and refinishing a flooded basement so the car aka test bed is in storage to make room for storing basement crap in the garage :/ Defeating “undefeatable” nanny regulations is always a fun time and worthy endeavor

Sorry to hear about your flood, but definitely encouraging to hear that it's possible to defeat the CVN check, I'm looking forward to that. Some part of me wish the old M3forum.net wasn't gone so much information and details are lost and most the community members moved on better things. Thanks for your hard work man.

[Icecream]

Disabling EWS on the original DME will alter the CVN, making it look the same as a tune to any OBD2 reader. Pretty sure swapping DMEs back and forth needs EWS disabled on both but I’m not 100% on that.

I disabled it on one and left my stock one alone. Both worked fine.

[repoman89]

You wanna finish it and accept donations from the community? Lol

I definitely want to finish it, just need to find some time. Currently dealing with cleaning and refinishing a flooded basement so the car aka test bed is in storage to make room for storing basement crap in the garage :/ Defeating “undefeatable” nanny regulations is always a fun time and worthy endeavor

[sev]

just got back from the smog place. He said its going to be bedlam come monday. Also lots of enhanced checking of stuff by smog techs. Including heavy scrutiny on cats.

He showed me part of the new procedure and that involved entering in the test group number on the emmissions sticker

[EthanolTurbo]

I started writing a python tool that can force the cal ID / CVN to arbitrary values on our cars by modifying unused areas of the binary (it’s just a CRC16 IIRC on the MSS54 and HP which can be forced to any value by changing any two bytes). Didn’t finish it because Massachusetts doesn’t do OBD2 inspection for cars 15 years or older… I skipped inspection in 2020 instead lol. This is definitely defeatable though on our cars if anybody cares to spend the time creating a tool.

You wanna finish it and accept donations from the community? Lol