DIY: BDM ST Manufactured M29F400BB MSS54HP Flash using a USBJTAG u-Link NT

[JBanzhaf]

I know the usual go to for BDM-ing the flash on the MSS54HP DME's is the Galletto 4. Unfortunately, some of the MSS54HP's have ST manufactured flash chips instead of AMD manufactured flash chips. The Galletto is only compatible with the AMD manufactured flash version of the MSS54HP. After coming across an MSS54HP with ST manufactured flash, I worked with USBJTAG to create a configuration in order to BDM the ST manufactured flash. As of the current version of the USBJTAG software, the MSS54HP configuration is not included. The next version should include the configuration. The configuration and script files are attached to this post. I have yet to test it, but I think a different configuration will be required to flash the AMD manufactured flash on some MSS54HP's (I need to remove the DME from my car to test the AMD flash). If needed, this should be not hard for USBJTAG to add. These are the steps to add the configuration, add the script, and flash the DME. This method can be used to flash the CSL 32500 boot sector onto an MSS54HP with the standard 32300 boot sector, for a CSL conversion. The u-Link NT can be purchased here: https://www.usbjtag.com/

1. After installing the program and drivers, open the program and click "OK" in the first window that opens. Register your u-Link NT. Navigate to Help > Goto Configure folder. Copy both .XML files into the folder overwriting the existing norflash file.


2. Navigate to Tools > Config. Navigate to the script directory and paste the .USP script file into it.


3. Relaunch the program. Navigate back to Config and search for ECUMSS54HP and click OK.

4. Before connecting the u-Link to your computer, connect it to either the master or slave BDM headers on the DME using the provided color coded jumper cable, as such:

5. Power on the DME and connect the u-Link the the computer.

6. To make sure everything is connected correctly, first click the Detect Chip button. If the connection is successful with no error messages, read and save a backup of the flash. Load your desired .BIN file. Write the .BIN file onto the flash.

7. Power off the DME and unplug the u-Link from the computer. Repeat steps 4-7 for the 2nd flash (master or slave).

8. Flash your desired tune with a matching boot sector, using your OBD flashing software of choice.

If you encounter an error during step 6, make sure that all of the connections between the u-Link in the BDM header are good and that the DME is powered on. If you have further issues, the support provided on the USBJTAG website is very good. Thanks again to USBJTAG for providing the necessary configuration XML's.

Thanks,
Joel @joelbanzhaf

[msp9994]

Would you be able to repost the pinout for step 4?

It isn't visible anymore

[karter16]

Would you be able to repost the pinout for step 4?

It isn't visible anymore

fwiw the MSS54 config is now built into the software by default - if you select it and click on the connection diagram button it will show you the mapping.

[karter16]

Adding a note here that I found on Windows 11 at least that after installing the correct drivers for the uLink NT and getting it working, after some time Windows then went off and found some IOS imaging device driver that it decided to use instead. It was necessary for me to go to device manager and select the correct driver each time the uLinkNT is plugged in. If you find the software suddenly doesn't detect your uLink NT after it previously working then I would advise checking this.

[terra]

Hmm, looks like this supports MPC5xx CPUs too. Might be worth looking into for MSS6x purposes, especially if they can implement a clear censor function

[JBanzhaf]

msp9994 Sorry for the slow response. I don't know why that Image was lost from the original post. Unfortunately I didn't save it, myself. I had to go back through all of my stuff to re-figure it out, as it's been a while since i've done this, in order to recreate it. I'm about 99% sure I have the pinout right, so please report back whether or not it works. Terra, this should definitely be able to work with the MPC5xx CPUs in the MSS6x. If you're interested in that, contact usbjtag. I'm sure they can setup a configuration for it. The owner was very helpful in setting up the MSS54 configuration with me, over the phone.

[msp9994]

Thank you for this!

I'm still waiting for my uLink to arrive. Will report back as soon as I've tried this out

[karter16]

I'm about 99% sure I have the pinout right, so please report back whether or not it works.

Yep this is definitely correct. For clarity - in case anyone is using a different cable with non-matching colours (e.g. the cable I used had the rainbow reversed):

DS: BDM Connector Pin 1 -> Not Connected
BERR: BDM Connector Pin 2 -> uLink NT Pin 4
GND: BDM Connector Pin 3 -> uLink NT Pin 2 (note BDM pin 3 and 5 are tied, so only need to connect one of)
DCK: BDM Connector Pin 4 -> uLink NT Pin 6
GND: BDM Connector Pin 5 -> uLink NT Pin 2 (note BDM pin 3 and 5 are tied, so only need to connect one of)
FRZ: BDM Connector Pin 6 -> uLink NT Pin 3
RST: BDM Connector Pin 7 -> uLink NT Pin 5
DSI: BDM Connector Pin 8 -> uLink NT Pin 10
Unused: BDM Connector Pin 9 -> Not Connected
DSO: BDM Connector Pin 10 -> uLink NT Pin 8

[msp9994]

Finally got my u-Link and tried this out. This pinout seems to be fine. It seems to write ok as well.
But the DME EEPROM data seems incomplete?

I can see the DME in INPA and BMW Scanner but if I try to read the EEPROM data over OBD, It doesn't read anything. (Both BMWFlash and BMW Scanner 1.4.0)
BMWFlash connects but just gets stuck at "requesting DME information".

Does the screenshot below look like eveything is Ok?



Error from MSSFlasher

[karter16]

Finally got my u-Link and tried this out. This pinout seems to be fine. It seems to write ok as well.
But the DME EEPROM data seems incomplete?

I can see the DME in INPA and BMW Scanner but if I try to read the EEPROM data over OBD, It doesn't read anything. (Both BMWFlash and BMW Scanner 1.4.0)
BMWFlash connects but just gets stuck at "requesting DME information".

Does the screenshot below look like eveything is Ok?



Error from MSSFlasher

Looks like the write completed and successfully tested which means it validated that it wrote what you asked it to.

What did you ask it to write? How did you construct the binaries that you flashed?


Sent from my iPhone using Tapatalk

[msp9994]

Basically followed most of this guide.

https://github.com/YulCmr/MSS54_HP_CSL_Clone_info_gathering/blob/master/step_by_step_guide.mkd#4-CSL-Binary-selection

Picked the recommended CSL binary there.

https://github.com/YulCmr/MSS54_HP_CSL_Clone_info_gathering/blob/master/CSL_full_binary_dump/ZB7837328_SW7837329_Std_EOBD.bin

Also tried a few other CSL binaries from other sources but all have the same symptoms.

I change the VIN on the binary to mine before flashing. INPA reads the VIN, Software/Hardware numbers, etc just fine.
Nothing else works.

Am I missing something?

[karter16]

Basically followed most of this guide.

https://github.com/YulCmr/MSS54_HP_CSL_Clone_info_gathering/blob/master/step_by_step_guide.mkd#4-CSL-Binary-selection

Picked the recommended CSL binary there.

https://github.com/YulCmr/MSS54_HP_CSL_Clone_info_gathering/blob/master/CSL_full_binary_dump/ZB7837328_SW7837329_Std_EOBD.bin

Also tried a few other CSL binaries from other sources but all have the same symptoms.

I change the VIN on the binary to mine before flashing. INPA reads the VIN, Software/Hardware numbers, etc just fine.
Nothing else works.

Am I missing something?

And you have the binary split into two parts, one for master, one for slave and are definitely flashing the right half to each?


Sent from my iPhone using Tapatalk

[msp9994]

And you have the binary split into two parts, one for master, one for slave and are definitely flashing the right half to each?

Ok. That isn't something I've been doing, or know how to do.

Is there a tool used to split the binary into 2 halves?

Any help would be greatly approciated.

[karter16]

Yeah that guide skips over that rather crucial step.

The MSS54 DME has two processors (Master and Slave) on it, and each processor has it's own EEPROM. For ease when flashing over OBD2 most programs concatenate the files together into a single binary. Depending on how this has been done sometimes the Master comes first, and in others the Slave comes first.

In the binary you have linked above the Master is first

I'm not sure what operating system you're using on your computer, so terminal commands to split will differ - if you let me know I can tell you what command to use. Another option would be to open the binary in a hex editor and split it that way. The file must be split exactly in half 0x0 thru 0x7FFFF is the master and 0x80000 thru 0xFFFFF is the slave.

You'll then flash the master binary to the master EEPROM (as per the diagram in the guide you're following) and likewise for the slave.

Hope that makes sense?

[msp9994]

Another option would be to open the binary in a hex editor and split it that way. The file must be split exactly in half 0x0 thru 0x7FFFF is the master and 0x80000 thru 0xFFFFF is the slave.

Thanks for this. Will try using a hex editor. I'm on Windows 11