Flashing the MK60 with ZCP software

[D-O]

Back in 2021 I also tinkered around with the MK60 and started with simply checking the EEPROM. Turns out, that even that is encrypted. I changed the VIN from BV71030JZ45078 to BV71030JZ45079 and a lot of the memory content suddenly changed.

MK Motorsport Flash is the legitimate ATE/Teves Motorsport Flash, as the guy he sends it to was working for them back in the days. The unit is NOT opened during the flash, so it has to happen over CAN or K-Line.

I know that there was a Mini part number for a cable that came with those units to flash them.

Also there is a Discord for MK60e5 development, but lacking a racecar, i didnt bother to follow this in depth.

Does this mean the MK Flash is not just ABS, but stability control as well?

[terra]

Was this a factory race mk60 for which car?

I believe so. From the Z4 motorsport catalog

[sda2]

Back in 2021 I also tinkered around with the MK60 and started with simply checking the EEPROM. Turns out, that even that is encrypted. I changed the VIN from BV71030JZ45078 to BV71030JZ45079 and a lot of the memory content suddenly changed.

MK Motorsport Flash is the legitimate ATE/Teves Motorsport Flash, as the guy he sends it to was working for them back in the days. The unit is NOT opened during the flash, so it has to happen over CAN or K-Line.

I know that there was a Mini part number for a cable that came with those units to flash them.

Also there is a Discord for MK60e5 development, but lacking a racecar, i didnt bother to follow this in depth.

[eacmen]

I wonder if this is orderable https://www.schmiedmann.com/en/produ...4-50-8-298-264

Was this a factory race mk60 for which car?

[terra]

I wonder if this is orderable https://www.schmiedmann.com/en/produ...4-50-8-298-264

[Bry5on]

This looks interesting.

Looks like that might just be the ABS flash on the Motorola MCU? From my understanding the Motorola handles ABS and the TI handles traction control. They don’t mention anything about traction control, steering angle sensor/ratio, wheelbase, track or the location of the accelerometer placement. Wonder if it’s deleted or untouched?

[D-O]

This looks interesting.

[karter16]

Edit:

So chucking a quickly converted DSCM90 0PA into cpu_rec, I get a hit for "mcore" - while that could be a false positive, those microcontrollers look period correct? Example of one https://www.digikey.com/en/products/...CFCPU33/506191

Nice work! RISC processor (which would match with the TI chip if I'm right about it being the TMS470 series), onboard flash memory, correct pin count. Only thing is that the external clock pins don't seem right, but to be sure we'd need to trace a board to check.

[George Hill]

I believe it's like most contemporary MCUs in that the rom with the actual code is integral to the MCU. The ST chip just contains the little bit of data that's 'codable' (VIN, NCS config data, and so on)

There were E6x/E9x generation BMWs with WinKFP flashable MK60 variants which might be useful from a research standpoint. But I couldn't even get as far as figuring out what ISA the code corresponds to.

Oh man, maybe the move is to disassemble the e60 generation and modify the CAN IDs it transmits to so that it’s compatible with the e46.. I understand that some variants have programmable wheelbase, track, steering ratio, Ackerman, etc.

Just configure an e60 unit and install into an e46.

Of course I just threw away an E60 module 2 weeks ago

Good thoughts!! I tossed that MK60 years ago but I’m sure we can get our hands on another

Cracking this code would be absolutely epic. Can you imagine m-track mode being the default and never needing to switch modes? What a luxury! I’ll get my hands on another and chop it open, unless George Hill already has one handy… 👀

I might have an E46 Non-M module kicking around here. I'll look.

[terra]

That sounds about right.

Facelift E85/E86 Z4s came with an MK60 that looks suspiciously similar to an MK60e5, but can communicate with all the (admittedly frankensteined) E46 modules. Might be worth experimenting with getting the Z4 FW working on a regular e5, then go from there.

yeah the E85 facelift dsc is an mk60e5 that speaks the “old” cam bus language. It does have some of the more modern features like hill hold and brake drying (the latter depends on an extra can bus message from the cluster to tell the module if the rain sensor sees rain). I actually have one of those that I played with on a bench years ago. That should be feasible to get to work in our cars, though a custom mount would have to be made. Whether or not we can reprogram it beyond the small amount of NCS configurable data is another matter. From what i gather from my notes, i couldn't get any of the kwp2000 commands that would allow for sticking the module in flashing mode to work.

From what I have written down, the E9x M3 module is only secured by 512-bit RSA, so that should be trivial to flash with modified code and data if we figure out anything useful there (assuming we can find the public key to do the factoring on). I don't know how feasible it would make that work fully integrated into our cars (perhaps if the E85 variant of the code is still mostly in there). But for race car purposes, seems like having a K-line or Can-bus reprogrammable module would be useful

Edit:

So chucking a quickly converted DSCM90 0PA into cpu_rec, I get a hit for "mcore" - while that could be a false positive, those microcontrollers look period correct? Example of one https://www.digikey.com/en/products/...CFCPU33/506191

[heinzboehmer]

I think it’s just the integral pressure sensors that replace the e46’s master cylinder sensors. heinzboehmer and I had discussed this before but I’ve forgotten.

That sounds about right.

Facelift E85/E86 Z4s came with an MK60 that looks suspiciously similar to an MK60e5, but can communicate with all the (admittedly frankensteined) E46 modules. Might be worth experimenting with getting the Z4 FW working on a regular e5, then go from there.

[Bry5on]

Yeah the E5 variant right. That would be the ultimate if it's doable. I think it has a bunch of extra sensors over the E46 version though right


Sent from my iPhone using Tapatalk

I think it’s just the integral pressure sensors that replace the e46’s master cylinder sensors. heinzboehmer and I had discussed this before but I’ve forgotten.

[karter16]

Oh man, maybe the move is to disassemble the e60 generation and modify the CAN IDs it transmits to so that it's compatible with the e46.. I understand that some variants have programmable wheelbase, track, steering ratio, Ackerman, etc.

Yeah the E5 variant right. That would be the ultimate if it's doable. I think it has a bunch of extra sensors over the E46 version though right


Sent from my iPhone using Tapatalk

[Bry5on]

Oh man, maybe the move is to disassemble the e60 generation and modify the CAN IDs it transmits to so that it’s compatible with the e46.. I understand that some variants have programmable wheelbase, track, steering ratio, Ackerman, etc.

Just configure an e60 unit and install into an e46.

[karter16]

Yeah I agree it's definitely an MCU and perhaps more relevant for our purposes anyway. But does seem to be more custom than most of the other MCUs found in various modules of our cars. The mask (1L93E) doesn't seem to correspond to any publicly available MCUs.

Perhaps should take another crack at disassembling some of the winkfp files that correspond to the E6x generation MK60s. Presumably they'd use similar microcontrollers and would help narrow things down.

Good idea - so winkfp has binary data for the E6x generation units does it. I agree that it would be pretty likely that the microcontrollers would be of the same family at least.

FWIW my somewhat educated guess is that the TI chip is a TMS470 family variant. Package, pin count, clock speed and ROM size are all appropriate for the era, plus they are identified as being commonly used in Automotive ABS units, etc.