MSx70 Flasher - Alpha

[Tomba]

Thanks for the reply.
The steps i made are:
1 - Read full with the flasher
2 - Modify the bin with DTC off
And now I'm not sure how to continue.
I've got RSA Bypass from bimmerlabs website, but it's in 0pa instead of .bin and it's using autmated batch script to flash it. Can I flash it and then Load my modified .bin file in Flasher and Flash Tune?
I just don't want to brick my DME.

Just follow the steps above. Just use the flasher option RSA bypass. No need to download additional files, the flasher will do it for you.

[kvotaa]

See first post



1. Read full
2. Write ORIGNAL Full with RSA bypass
3. Write ori Tune to complete process
4. Check working of ECU
5. Modifiy TUNE and load Tune (If adjustment in Tune are done, it is not necessary to flash full binaries after RSA bypass!)

Thanks for the reply.
The steps i made are:
1 - Read full with the flasher
2 - Modify the bin with DTC off
And now I'm not sure how to continue.
I've got RSA Bypass from bimmerlabs website, but it's in 0pa instead of .bin and it's using autmated batch script to flash it. Can I flash it and then Load my modified .bin file in Flasher and Flash Tune?
I just don't want to brick my DME.

[Tomba]

I have N52 525xi. I dumped full flash and disabled DTC P0420 P0430. Do i have to flash RSA bypass to flash back my tune with DTC off?

See first post

MSx70 Flasher - Alpha Release


Functionality:

• Ability to read and write tunes and program code
  • An RSA bypass must first be flashed to write custom tunes/programs - this requires a full stock binary to be available
• A full backup of the external and internal flash can be made over OBDII.
  • It is not currently known how to backup the SPI data without BDM
• Automatic checksum correction for flashed tunes and programs

1. Read full
2. Write ORIGNAL Full with RSA bypass
3. Write ori Tune to complete process
4. Check working of ECU
5. Modifiy TUNE and load Tune (If adjustment in Tune are done, it is not necessary to flash full binaries after RSA bypass!)

[kvotaa]

I have N52 525xi. I dumped full flash and disabled DTC P0420 P0430. Do i have to flash RSA bypass to flash back my tune with DTC off?

[MsRaZoRR]

Since the audience here is a bit more into ECUs, i think its a good thread to place this.

MSS70 seems to use the same MAF signal conversion as MSV70 which limits it to 1024kg/h. We came up with an untested solution for this.



This is the parts where the MAF ADC signal gets left shifted. If you nop this, its possible to measure 2048kg/h.

Therefor simply seach the file for "55 6B 0B FC 7D 8C 5B 96" and replace both occurances with "60 00 00 00 7D 8C 5B 96".

After doing that, edit "id_maf_tab" conversion to " X*0.03125 " and reenter the characteristics.

On another note, the standard MAF seems to be nerfed by BMW and could measure more than 1024kg/h.


I extrapolated that curve and came to something that could measure up to 1222kg/h.



If somebody wants to try that, let me know

I want to try this method. I am running turbo n52 daily currently in a maf-less operation.

[Tomba]

Good to know there is a workaround. I only don't know a car to test it on to consume more than 1024kg/h of air.
I did have seen an G-Power compressor on a Z4 with MSS70 in the past but I believe they removed MAF from it and went alpha-n.....

[sda2]

Since the audience here is a bit more into ECUs, i think its a good thread to place this.

MSS70 seems to use the same MAF signal conversion as MSV70 which limits it to 1024kg/h. We came up with an untested solution for this.



This is the parts where the MAF ADC signal gets left shifted. If you nop this, its possible to measure 2048kg/h.

Therefor simply seach the file for "55 6B 0B FC 7D 8C 5B 96" and replace both occurances with "60 00 00 00 7D 8C 5B 96".

After doing that, edit "id_maf_tab" conversion to " X*0.03125 " and reenter the characteristics.

On another note, the standard MAF seems to be nerfed by BMW and could measure more than 1024kg/h.


I extrapolated that curve and came to something that could measure up to 1222kg/h.



If somebody wants to try that, let me know

[PWX]

I want to give a feedback on this flasher for MSV70 ECUs. Tried on my N52 engine with MSV70 ecu program version 921S software version 0GI1S HW reference 0049PP0 followed the first time use procedure but after i flash the RSA bypass with a full flash the ecu bricks itself reporting error DME Checksum

Update: Be careful when compiling the source I accidentally changed the encoding which resulted in partially different full read of the stock binary.

How did you accidentally change the encoding?

Feedback. My initial RSA bypass attempt was unsuccessful. DME reported a write error at a certain address. After that I tried again and everything was going well until the signature verification step. So now I have DME in "Signaturprüfung PAF nicht durchgeführt / Signature check PAF not done" state.
I had tuned firmware, not factory. And, unfortunately, I can't restore the factory firmware with WinKFP, because SP-Daten doesn't include an update for my ecu 7559500.

[PWX]

I successfully done the full/tune read... based on the file sizes.
1. I already have tuned firmware, do I need an RSA patch? This was done using Kess.
2. If I successfully flashed my AT using my cable and xHP, does that mean my cable is good enough for DME flashing?

BTW maybe anyone has xdf for MSV70 (9PP82L)? 9PPL921S xdf not fits

[rudkinp]

That's really great stuff. I am apreciate it.

Already did one full read MSV70(worked well) but I wonder if is it possible to make it work with ICOM ? I assume that would be safer than KDcan.
After making RSA bypass with MSx70 flasher can I flash edited .0da files with winkfp ?

[SYT_Shadow]

This is incredible, thank you so much Terra and Co for this software. This is one of the best things to happen to the community ever!

[qze]

hello.
first of all, thank you so much for sharing this kind software for free. its simply impressive

Today, i tried to read from MSV70 but it doesnt work quite well, i think it just reads out junk data which is 41kb for full read.
the cable i use has latest ediabaslib from github which is working fine with MSS60 flasher, so my assumption is not the cable problem.

is there any solution for this problem? or do i missing something important to do?

terra

[MsRaZoRR]

Update is not completely clear. Did it mean to say - "Be careful when compiling the source. I accidentally changed the encoding which resulted in partially different full read of the stock binary" ?

Yes correct sorry I missed a letter. I corrected it

[Slideways]

I want to give a feedback on this flasher for MSV70 ECUs. Tried on my N52 engine with MSV70 ecu program version 921S software version 0GI1S HW reference 0049PP0 followed the first time use procedure but after i flash the RSA bypass with a full flash the ecu bricks itself reporting error DME Checksum

Update: Be careful when compiling the source accidentally changed the encoding which resulted in partially different full read of the stock binary.

Update is not completely clear. Did it mean to say - "Be careful when compiling the source. I accidentally changed the encoding which resulted in partially different full read of the stock binary" ?

[MsRaZoRR]

I want to give a feedback on this flasher for MSV70 ECUs. Tried on my N52 engine with MSV70 ecu program version 921S software version 0GI1S HW reference 0049PP0 followed the first time use procedure but after i flash the RSA bypass with a full flash the ecu bricks itself reporting error DME Checksum

Update: Be careful when compiling the source I accidentally changed the encoding which resulted in partially different full read of the stock binary.