MSx70 Flasher - Alpha

[michee]

Hi !
Im trying to do a RSA Delete on my MSV70, But I keep hitting a brick wall:
I get the following errors when doing any type of writing:

• MSx70 Flasher → "Failed to set flash address" — (no specific address shown)
• Quickflash → "Unable to erase ECU"
• WinKFP → "SECURITY_ACCESS_DENIED"

what works:

• INPA connects and reads perfectly
• MSx70 Flasher identifies DME and reads full 2MB binary successfully
• Quickflash identifies DME correctly

In INPA I can see that the DME program version is 0.0.0.0 ? and the software is from 2014.
Suspecting previous owner tried to tune it but failed and corrupted the DME partially ?
Its a 2006 BMW E61 523i (N52, Siemens MSV70), with Cable: BimmerGeeks Basic K+DCAN (FT232RL)
and I'm unable to flash anything via OBD.

Looking for advice.

[kvotaa]

Hello. I updated my bmw e60 msv70 ECU to the latest firmware. Before that I had rsa bypass flashed and had some tune changes. Do I have to repeat the steps from the beginning flashing rsa bypass, tune etc on the new untouched firmware?

[e90330]

Hi every one need some help here msv70 n52b25 e90 want to turn of downstream o2 sensors cuz i have 29f4 and 29f5 catalyst conversion codes i have tuner pro and xdf file from ms4x wiki for the msv 70 already have a full read of the ecu just need some tutorial how to disable it. Thanks in advance

Did you figure out how?

[E90ern52]

Hi every one need some help here msv70 n52b25 e90 want to turn of downstream o2 sensors cuz i have 29f4 and 29f5 catalyst conversion codes i have tuner pro and xdf file from ms4x wiki for the msv 70 already have a full read of the ecu just need some tutorial how to disable it. Thanks in advance

[pindour]

Hello, sorry to post here but i can't send a message
I have a request for you, could you please calculate the signature of MANSP2 - 9195746A.0pa The signature is at ce0400...
Or any way to authenticate ecu?
Thanks Zdenek

[armenh7]

For those of you having it fail when trying to flash RSA bypass, just use the files from bimmerlab and flash it with winkfp. Once done, use MSV70 flasher to write the tune portion. It worked for me.

[Tomba]

I´m back doing some testing with a sparepart ECU on a rough bench flash setup with alligator crimps etc. (might not have the best connection). So far I can only identify the ECU. But when I try to read the flash I only get 0kb bin files. The read out only takes about 5 seconds and there is no progress on the green bar. Then suddenly the window for the saving path pops up. Not sure if it´s because of the bench setup or because of the specific software/program of the ECU. I can read the ECU with INPA as well with out problems in the bench setup. Can´t test the spareparts ECU in my car or my main ECU on the bench because my car is a few hundret kilometers away at the moment...

Any expirience with program 740S software 0AA2S?

Try to flash it with WinKFP?

[Don Fipsi]

I´m back doing some testing with a sparepart ECU on a rough bench flash setup with alligator crimps etc. (might not have the best connection). So far I can only identify the ECU. But when I try to read the flash I only get 0kb bin files. The read out only takes about 5 seconds and there is no progress on the green bar. Then suddenly the window for the saving path pops up. Not sure if it´s because of the bench setup or because of the specific software/program of the ECU. I can read the ECU with INPA as well with out problems in the bench setup. Can´t test the spareparts ECU in my car or my main ECU on the bench because my car is a few hundret kilometers away at the moment...

Any expirience with program 740S software 0AA2S?

[Don Fipsi]

I stuck to the same software, which was previously on the car. It’s a SW from 2008, but there were a few more later on in 2008. I used the ZUSB-Nr.: 7581280

With this SW I have the 921S Dataset, were the XDF can be found in the internet. I don’t know, if the newer SW shares the same 921S. Therefore I didn’t update

[Tomba]

Did you update to latest version for your ECU?

[Don Fipsi]

Thanks for the explanation. Load Full binary and flash programm didn't helped. Had to reflash the whole ECU with WINkfp. It worked, now the ECU is back to life
In the name of sience I tried to flash the RSA Bypass again. After starting the RSA Bypass I noticed that at the beginning it is trying to erase the current flash. A few seconds later the status is "Failed ereasing flash" and then it is starting to flash the external flash and later on the internal. Exactly like last time it failed flashing the internal flash, this time at 0x40ACF3. DME status swithes to "programm nicht vorhanden oder verfügbar". I reloaded the file and pressed flash programm -> later on it was checking the signature -> and again flash failed with DME Status "Signaturprüfung PAF nicht durchgeführt", which equals to Flash_Programmier_Status = 5. I have to reflash the ECU again with WINkfp...

I'm using the MAX Diag2+ dCan cable. It is a well known Cable for BMW coding in Germany and costs about 70€. Hopefully it's not the reason, but I don't think so, because flashing with WINkfp works...

[Tomba]

Has anyone a Idea how I can Fix my ECU and why the RSA Bypass failed in the first place?

No idea why it went wrong on the first place. Don't know which cable you used?

To fix your ECU you can first try to flash full file without RSA bypass. Just load the full binary and then Flash Program. Once finished successfully Flash Tune.

And whats the differnce between the "Flash Tune" and "Flash Programm" button, when full read is loaded?

A Full file contains both Program (Full) and Data (Tune). Once you did the RSA bypass you no longer need the "big file". You only flash the small file with adjustment in it.


OEM WinKFP/ISTA/P flashing goes as follows,
You flash your ECU with Program (*.0pa) and once finished you load the data (*.0da). The flashing tool is build like that.
It is possible that with equal program data different data sets are used (power variants, country variants). The program (0pa) picks the tables/curves and constants to run the engine from the data (tune) file.

[Don Fipsi]

Hello,
first I want to thank the community to make the calibration work possible for everyone, who is interested. Unfortually I got some trouble flashing the RSA Bypass. This is how I proceeded:
1. connected power supply to the car and set to 14,2V and turned all electric consumers off (e.g. hedalights, fan of the climatcontroll etc. Car was charging with around 7A with KL15 on and up to 16A during flashing. Power supply is capable of up to 25A, so power supply was not the issue)
2. Done a backup of partial und full flash. Both had the correct size of 128kb and 2024kb and the DME status was "Normalbetrieb"
3. Loaded the full flash -> advanced -> RSA Bypass
4. Everything went well until the external flash was written and the internal flash was starting. This error message ocurred:

5.After 5-10 nothing happend so I stopped the programm and tried to flash the tune with 128kb. I got "flash failed" and the DME Status changed to "Signaturprüfung PAF nicht durchgeführt". Tried to start the car, but started is cranking but engine doesen't start.
6. Then I tried to reflash the RSA Bypass. This time internal and external flash seemed to be ok, but the final result was "flash failed" and the DME Status changed to "Signaturprüfung PAF nicht durchgeführt", which equals Flash_Programmier_Status = 5 in Tool32, which is not good...


Now I try to recover my ECU, but don't have a real clue how to. I can connect to the ECU via Tools32 and have Flash_Programmier_Status = 5 and found the following aif.



It seemed that my ECU got updated to a newer SW in 2008. Therefore its not possible to just look at the stickers on the ECU and buy a exact same one used and just reflash my full read to it. Has anyone a Idea how I can Fix my ECU and why the RSA Bypass failed in the first place?
And whats the differnce between the "Flash Tune" and "Flash Programm" button, when full read is loaded?

[Tomba]

Hello! I’m trying to recover my MSV70 from an E85 that I attempted to do an RSA Delete on.

Did you first read the complete flash of your own ECU?
If yes, can you upload these files?

WinKFP is not working with an error for communication - SECURITY_ACCESS_DENIED_SECURITY_ACC.

ECU might be stuck in a programming state.

Was losing hope, but looks like your MSx70 Flasher tool is able to identify the ECU and read the tune and full flash.

it’s shows in state - Programm nicht vorhanden Oder nicht v

Programm nicht vorhanden Oder nicht vollständig
Program not available or not complete. -> something didn't went OK during flashing.

You have Program and Data. You can compare Program with full read and Data with partial/Tune read.

After reading the full flash and attempting to load the file. I get the following error - Program does not match hardware.

As above, I suspect program is not available and therefore a mismatch happens once comparing program from ECU and program from your uploaded file

Loading the tune works fine. But I was hoping to resurrect the DME starting with the program.

Any ideas to help?

Maybe a rescue flash can help you out. Otherwise BDM the ECU and check files of BDM readout with your full read before you attempted RSA bypass.
Other try is, to just Flash full file (without RSA bypass) once succeeded flash partial.
First we need to know what you did and if you have your full and partial reads before doing RSA bypass

[Adrivingkoala]

Hello! I’m trying to recover my MSV70 from an E85 that I attempted to do an RSA Delete on. WinKFP is not working with an error for communication - SECURITY_ACCESS_DENIED_SECURITY_ACC.

Was losing hope, but looks like your MSx70 Flasher tool is able to identify the ECU and read the tune and full flash.

it’s shows in state - Programm nicht vorhanden Oder nicht v

After reading the full flash and attempting to load the file. I get the following error - Program does not match hardware.

Loading the tune works fine. But I was hoping to resurrect the DME starting with the program.

Any ideas to help?