MSx70 Flasher - Alpha

[MsRaZoRR]

Since the audience here is a bit more into ECUs, i think its a good thread to place this.

MSS70 seems to use the same MAF signal conversion as MSV70 which limits it to 1024kg/h. We came up with an untested solution for this.



This is the parts where the MAF ADC signal gets left shifted. If you nop this, its possible to measure 2048kg/h.

Therefor simply seach the file for "55 6B 0B FC 7D 8C 5B 96" and replace both occurances with "60 00 00 00 7D 8C 5B 96".

After doing that, edit "id_maf_tab" conversion to " X*0.03125 " and reenter the characteristics.

On another note, the standard MAF seems to be nerfed by BMW and could measure more than 1024kg/h.


I extrapolated that curve and came to something that could measure up to 1222kg/h.



If somebody wants to try that, let me know

I want to try this method. I am running turbo n52 daily currently in a maf-less operation.

[kvotaa]

I have N52 525xi. I dumped full flash and disabled DTC P0420 P0430. Do i have to flash RSA bypass to flash back my tune with DTC off?

[Tomba]

I have N52 525xi. I dumped full flash and disabled DTC P0420 P0430. Do i have to flash RSA bypass to flash back my tune with DTC off?

See first post

MSx70 Flasher - Alpha Release


Functionality:

• Ability to read and write tunes and program code
  • An RSA bypass must first be flashed to write custom tunes/programs - this requires a full stock binary to be available
• A full backup of the external and internal flash can be made over OBDII.
  • It is not currently known how to backup the SPI data without BDM
• Automatic checksum correction for flashed tunes and programs

1. Read full
2. Write ORIGNAL Full with RSA bypass
3. Write ori Tune to complete process
4. Check working of ECU
5. Modifiy TUNE and load Tune (If adjustment in Tune are done, it is not necessary to flash full binaries after RSA bypass!)

[kvotaa]

See first post



1. Read full
2. Write ORIGNAL Full with RSA bypass
3. Write ori Tune to complete process
4. Check working of ECU
5. Modifiy TUNE and load Tune (If adjustment in Tune are done, it is not necessary to flash full binaries after RSA bypass!)

Thanks for the reply.
The steps i made are:
1 - Read full with the flasher
2 - Modify the bin with DTC off
And now I'm not sure how to continue.
I've got RSA Bypass from bimmerlabs website, but it's in 0pa instead of .bin and it's using autmated batch script to flash it. Can I flash it and then Load my modified .bin file in Flasher and Flash Tune?
I just don't want to brick my DME.

[Tomba]

Thanks for the reply.
The steps i made are:
1 - Read full with the flasher
2 - Modify the bin with DTC off
And now I'm not sure how to continue.
I've got RSA Bypass from bimmerlabs website, but it's in 0pa instead of .bin and it's using autmated batch script to flash it. Can I flash it and then Load my modified .bin file in Flasher and Flash Tune?
I just don't want to brick my DME.

Just follow the steps above. Just use the flasher option RSA bypass. No need to download additional files, the flasher will do it for you.

[StormBreaker]

Great tool and thanks for sharing it for free. I have a quesiton. I find a tune that i want to flash on my MSV70, but it's .FLS extension. What is the difference between .bin and .fls? Can i flash it in "Flash Tune" in the flasher?

[Tomba]

Great tool and thanks for sharing it for free. I have a quesiton. I find a tune that i want to flash on my MSV70, but it's .FLS extension. What is the difference between .bin and .fls? Can i flash it in "Flash Tune" in the flasher?

It could be a direction to flash (fls). check if the file size and version is equal as your tune.

[Adrivingkoala]

Hello! I’m trying to recover my MSV70 from an E85 that I attempted to do an RSA Delete on. WinKFP is not working with an error for communication - SECURITY_ACCESS_DENIED_SECURITY_ACC.

Was losing hope, but looks like your MSx70 Flasher tool is able to identify the ECU and read the tune and full flash.

it’s shows in state - Programm nicht vorhanden Oder nicht v

After reading the full flash and attempting to load the file. I get the following error - Program does not match hardware.

Loading the tune works fine. But I was hoping to resurrect the DME starting with the program.

Any ideas to help?

[Tomba]

Hello! I’m trying to recover my MSV70 from an E85 that I attempted to do an RSA Delete on.

Did you first read the complete flash of your own ECU?
If yes, can you upload these files?

WinKFP is not working with an error for communication - SECURITY_ACCESS_DENIED_SECURITY_ACC.

ECU might be stuck in a programming state.

Was losing hope, but looks like your MSx70 Flasher tool is able to identify the ECU and read the tune and full flash.

it’s shows in state - Programm nicht vorhanden Oder nicht v

Programm nicht vorhanden Oder nicht vollständig
Program not available or not complete. -> something didn't went OK during flashing.

You have Program and Data. You can compare Program with full read and Data with partial/Tune read.

After reading the full flash and attempting to load the file. I get the following error - Program does not match hardware.

As above, I suspect program is not available and therefore a mismatch happens once comparing program from ECU and program from your uploaded file

Loading the tune works fine. But I was hoping to resurrect the DME starting with the program.

Any ideas to help?

Maybe a rescue flash can help you out. Otherwise BDM the ECU and check files of BDM readout with your full read before you attempted RSA bypass.
Other try is, to just Flash full file (without RSA bypass) once succeeded flash partial.
First we need to know what you did and if you have your full and partial reads before doing RSA bypass

[Don Fipsi]

Hello,
first I want to thank the community to make the calibration work possible for everyone, who is interested. Unfortually I got some trouble flashing the RSA Bypass. This is how I proceeded:
1. connected power supply to the car and set to 14,2V and turned all electric consumers off (e.g. hedalights, fan of the climatcontroll etc. Car was charging with around 7A with KL15 on and up to 16A during flashing. Power supply is capable of up to 25A, so power supply was not the issue)
2. Done a backup of partial und full flash. Both had the correct size of 128kb and 2024kb and the DME status was "Normalbetrieb"
3. Loaded the full flash -> advanced -> RSA Bypass
4. Everything went well until the external flash was written and the internal flash was starting. This error message ocurred:

5.After 5-10 nothing happend so I stopped the programm and tried to flash the tune with 128kb. I got "flash failed" and the DME Status changed to "Signaturprüfung PAF nicht durchgeführt". Tried to start the car, but started is cranking but engine doesen't start.
6. Then I tried to reflash the RSA Bypass. This time internal and external flash seemed to be ok, but the final result was "flash failed" and the DME Status changed to "Signaturprüfung PAF nicht durchgeführt", which equals Flash_Programmier_Status = 5 in Tool32, which is not good...


Now I try to recover my ECU, but don't have a real clue how to. I can connect to the ECU via Tools32 and have Flash_Programmier_Status = 5 and found the following aif.



It seemed that my ECU got updated to a newer SW in 2008. Therefore its not possible to just look at the stickers on the ECU and buy a exact same one used and just reflash my full read to it. Has anyone a Idea how I can Fix my ECU and why the RSA Bypass failed in the first place?
And whats the differnce between the "Flash Tune" and "Flash Programm" button, when full read is loaded?

[Tomba]

Has anyone a Idea how I can Fix my ECU and why the RSA Bypass failed in the first place?

No idea why it went wrong on the first place. Don't know which cable you used?

To fix your ECU you can first try to flash full file without RSA bypass. Just load the full binary and then Flash Program. Once finished successfully Flash Tune.

And whats the differnce between the "Flash Tune" and "Flash Programm" button, when full read is loaded?

A Full file contains both Program (Full) and Data (Tune). Once you did the RSA bypass you no longer need the "big file". You only flash the small file with adjustment in it.


OEM WinKFP/ISTA/P flashing goes as follows,
You flash your ECU with Program (*.0pa) and once finished you load the data (*.0da). The flashing tool is build like that.
It is possible that with equal program data different data sets are used (power variants, country variants). The program (0pa) picks the tables/curves and constants to run the engine from the data (tune) file.

[Don Fipsi]

Thanks for the explanation. Load Full binary and flash programm didn't helped. Had to reflash the whole ECU with WINkfp. It worked, now the ECU is back to life
In the name of sience I tried to flash the RSA Bypass again. After starting the RSA Bypass I noticed that at the beginning it is trying to erase the current flash. A few seconds later the status is "Failed ereasing flash" and then it is starting to flash the external flash and later on the internal. Exactly like last time it failed flashing the internal flash, this time at 0x40ACF3. DME status swithes to "programm nicht vorhanden oder verfügbar". I reloaded the file and pressed flash programm -> later on it was checking the signature -> and again flash failed with DME Status "Signaturprüfung PAF nicht durchgeführt", which equals to Flash_Programmier_Status = 5. I have to reflash the ECU again with WINkfp...

I'm using the MAX Diag2+ dCan cable. It is a well known Cable for BMW coding in Germany and costs about 70€. Hopefully it's not the reason, but I don't think so, because flashing with WINkfp works...

[Tomba]

Did you update to latest version for your ECU?

[Don Fipsi]

I stuck to the same software, which was previously on the car. It’s a SW from 2008, but there were a few more later on in 2008. I used the ZUSB-Nr.: 7581280

With this SW I have the 921S Dataset, were the XDF can be found in the internet. I don’t know, if the newer SW shares the same 921S. Therefore I didn’t update