Flashing the MK60 with ZCP software

[karter16]

Man, that repo linked above has a ton of info. I'm pretty sure https://github.com/cmg5461/mk60e5-fi...ls/mk60_can.py can be adapted to work with the MK60, if we can figure out how to get it to boot into the bootloader.

Seed/key pairs I read from my car match the transform functions in the repo for the e5, so that means the encryption scheme is highly likely to be the same.

In theory, all I need now is an MK60 FW dump and the rest should be reverse engineerable.

Worth having a read through this section of the facts.md as well https://github.com/cmg5461/mk60e5-fi...?plain=1#L1052

[heinzboehmer]

Worth having a read through this section of the facts.md as well https://github.com/cmg5461/mk60e5-fi...?plain=1#L1052

Yep! Should have given a bit more context.

On the MK60e5, the seed/key pair gets you "coding" access (security level 2). To get programming access (security level 5), you need to authenticate with a 128 bit keyed-MD5, which is fortunately stored in FW, so all you need is to read through a dump to find it.

The catch is that you need that FW dump to find the key that gets you programming access, but you also need programming access to get a dump from the MK60 non-destructively. If only BMW had given us a .0pa for it...

Then there's also the problem of signing a modified image. This part uses RSA, but it isn't super secure on the MK60e5, so you can find the private key by factoring. I'm guessing this step will be similarly trivial on the MK60.

It's looking like I'm probably going to have to get another MK60 unit to open up and read the flash directly from. But no sense in doing that if I can't first verify that the unit actually supports programming mode (or some other method of getting to the bootloader).

[terra]

If you share whichever keys you need factored, I should be able have my computer going at it. These days I can do them in under 24 hours each.

does your disassembly indicate whether the pre-BN2000 can communication and K-line mode exist at all in the code? I had hoped there would be a configuration switch since the Z4M Mk60e5 module does speak the old language.

I think it might be reasonable to poke at the modules with CCP and XCP comms anyway, not impossible for BMW to have left it in an older module. Someone I was corresponding with found the E60 dsc module did leave XCP open and allowed for a full dump

[George Hill]

heinzboehmer If you need an MK60 that can be sacrificed, I've got a few non-M here I will gladly send you.

[heinzboehmer]

If you share whichever keys you need factored, I should be able have my computer going at it. These days I can do them in under 24 hours each.

does your disassembly indicate whether the pre-BN2000 can communication and K-line mode exist at all in the code? I had hoped there would be a configuration switch since the Z4M Mk60e5 module does speak the old language.

I think it might be reasonable to poke at the modules with CCP and XCP comms anyway, not impossible for BMW to have left it in an older module. Someone I was corresponding with found the E60 dsc module did leave XCP open and allowed for a full dump

Awesome, will send some keys your way when I get to that point.

I'll need to check the disassembly for that when I get back home. I left the LLM to reconcile the work it had done in ghidra with the disassembly and symbol attribution work in that other repo. Hoping to have a nice and clean ghidra project to share soon, so that others can look through it too.

And good to know about XCP! I have a script to poke at the MK60 both via CAN and K line to try and get to the bootloader, but I haven't tested it yet. I've got an 817.3 module in my car and it would really suck to mess that one up

heinzboehmer If you need an MK60 that can be sacrificed, I've got a few non-M here I will gladly send you.

I'll definitely take you up on that!

I do think there's a lot to learn from the non-M modules, but I also fear that they're gonna be missing the flashing functionality in the bootloader. Getting a dump of the program would still be very valuable.

Internet lore says only 813.3/817.3 can be flashed, so unsure what the path is for the non-M modules. I would be surprised if the HW was limiting the flashing and instead expect that the 813.3/817.3 were the only ones that shipped with the FW routines for flashing.

Wouldn't be surprised if the non-M modules can be BDM flashed with the fully featured bootloader, but that involves both cutting the case open and having a binary to flash.

[Bry5on]

Awesome, will send some keys your way when I get to that point.

I'll need to check the disassembly for that when I get back home. I left the LLM to reconcile the work it had done in ghidra with the disassembly and symbol attribution work in that other repo. Hoping to have a nice and clean ghidra project to share soon, so that others can look through it too.

And good to know about XCP! I have a script to poke at the MK60 both via CAN and K line to try and get to the bootloader, but I haven't tested it yet. I've got an 817.3 module in my car and it would really suck to mess that one up



I'll definitely take you up on that!

I do think there's a lot to learn from the non-M modules, but I also fear that they're gonna be missing the flashing functionality in the bootloader. Getting a dump of the program would still be very valuable.

Internet lore says only 813.3/817.3 can be flashed, so unsure what the path is for the non-M modules. I would be surprised if the HW was limiting the flashing and instead expect that the 813.3/817.3 were the only ones that shipped with the FW routines for flashing.

Wouldn't be surprised if the non-M modules can be BDM flashed with the fully featured bootloader, but that involves both cutting the case open and having a binary to flash.

I wouldn’t be surprised if it were hardware-only, to the contrary. There are already hardware changes for the m-track pin, it might have a permanent pull down enable somewhere on the board.

[heinzboehmer]

I wouldn’t be surprised if it were hardware-only, to the contrary. There are already hardware changes for the m-track pin, it might have a permanent pull down enable somewhere on the board.

Yeah I guess that's a fair point. I'd still be surprised if the HW wasn't physically flashable, though. Lot more effort to implement HW fuses than it is to ship with a different bootloader or some extra populated component, like you suggested.

It sounds like you're gonna be opening up the unit either way, if you want to use one of the non-flashable ones. So cutting a trace or bridging some pads isn't too much extra work bs BDM flashing a new bootloader.

[liam821]

The SP_DATEN files do include the MK60e5 firmware, and different versions, so I'm going to assume there is a way to do a firmware update via CAN. Unfortunately, the files don't contain the e46 mk60 firmware.

[heinzboehmer]

The SP_DATEN files do include the MK60e5 firmware, and different versions, so I'm going to assume there is a way to do a firmware update via CAN. Unfortunately, the files don't contain the e46 mk60 firmware.

Yep, looking like KWP2000 over CAN is how the MK60e5 gets flashed.

does your disassembly indicate whether the pre-BN2000 can communication and K-line mode exist at all in the code? I had hoped there would be a configuration switch since the Z4M Mk60e5 module does speak the old language.

Just checked and there is no evidence of either, unfortunately. There's PT-CAN and F-CAN handlers, but nothing else. There's also a serial module (think it's for the wheel speed sensors), but there's no KWP handler that interacts with it.

Also, am kinda struggling to figure out how to share what I have. Ghidra project is looking pretty good (as in "correct", not as in "pretty"), but I hesitate to just throw it on GitHub cause the code is technically copyrighted. Open to suggestions.