BMW M5 Forum and M6 Forums banner

1 - 20 of 220 Posts

·
Registered
Joined
·
5,679 Posts
Discussion Starter #1 (Edited)
Moderator comment in blue:

These rules have been developed to govern tuning discussions. Posts and posters running afoul of these rules will be treated harshly. These rules may change.

1. Board members and administrators need to respect laws and act fairly. Together, we will endeavor to promote honest behavior and discourage the opposite.

2. Any information/knowledge that has been obtained by an individual will not be shared if that person does not have a legal/written right to do so. "Information" includes any vendor's DAMOS files, strategies, screenshots, proprietary software. The tune you purchased (or that came with your car) may not be yours to share; it is certainly someone else’s work product. If you were employed by a tuner and have a confidentiality/non-disclosure agreement, obey it. Members assume personal liability by acts to the contrary.

3. Any vendor believing that information is being posted illegally or in violation of agreements should use Report Post and provide factual/legal basis for the objection. Threads/posts may be locked/hidden during discovery.

4. Members need to recognize that there are grave inherent risks to using information garnered via these discussions. The Board and Autoguide assume no responsibility for what Members do to their cars as a consequence (e.g. bricking their DMEs, breaking their vehicles, resulting injuries, etc).

OP's original post now follows:
Well guys, in an effort to see what we can figure out about our cars, I thought I'd start a thread here similar to the MSS54 thread over on M3forum.

Comprehensive MSS54/MSS54HP DME Information - BMW M3 Forum.com (E30 M3 | E36 M3 | E46 M3 | E92 M3 | F80/X)

There is a much larger audience there and a lot of talent and unlike myself, they actually know what they're doing judging from the results in their thread.

So, this is intended as an information exchange and a learning process.

I will preface all this with a caveat: I have no idea what I'm doing here! This is a learning process for me. I am in no way responsible for anything that happens to your car. Keep in mind that if you start mucking around with your DME, you can potentially brick it and your car may no longer function as a means of transportation.


The goals here would be to figure out what functions are able to be changed in the DME (speed limiter, RPM limiter, etc) as well as figuring out where the maps (fuel pulse, VANOS timings, etc) are stored and how to manipulate them.

One of the first obstacles is the MSS65 memory space itself, as it can only be written a given number of times and each flash uses one of those spots. This was overcome on the MSS54 and although the method of flash counting may be different, maybe we can figure out something here too.

So anyone who has anything to contribute, jump on in and let's get it rolling. :typing:


Edit: MSS65 Versioning Information is located in the table below. The binary string can be found in the DME reads and will correlate which ZUSB the binary is built on.

mss65 versions.jpg

Thanks to Ferris for the legwork and notes on version differences.
 

·
Registered
Joined
·
1,356 Posts
Regarding the flashes count.

It seems 14 is the magic number on the flash slots bmw allows. These flash slots(UIF) store the VIN(ask me about my bout of dyslexia :) ) and the software version info. To my knowledge and as an experiment on one of my Z3 writes they do not to need to be used. I'm not sure, at this point, if not writing the UIF makes for "unlimited"* flashes.

*With in reason for flash write cycles.
 

·
Registered
Joined
·
1,356 Posts
I also have a hunch that the rev limiter entries per gear start at data address 0x4C9C (when using code file 7842121A.0p all corresponding data files for this code files follows the same data addresses). I think the DME recognizes only 6 gears + neutral. Perhaps 7 for the SMG piggy backs on 6 . I'm going to do some data logging to confirm this later this week.

The first thing I'd like to do is use bmw flash to modify this param and see if the rev limit changes or if I can't get that to work try to figure out how winkfp calculates the file checksum. The lines in the data flash are simply the Intel Hex format standard. I could also confirm this is if someone is running an aftermarket tune that raises the rev limit. Though I feel somewhat dirty verifying things this way.
 

·
Registered
Joined
·
57 Posts
I just wanted to throw my hat in here, and to reserve one of the upper posts for updates as I can help you guys out. :byebye:

I don't have an E60 M5, but it is one of my favourite cars, so I'll help in whatever ways I can.

So, without further ado.. who's got .0PA and .0DA files they feel like contributing? ;) I'll modify the software I wrote for the E36 M3, E39 M5 and E46 M3 to convert them to binaries, and we'll see what it takes to correct checksums.

:cheers:
 

·
Registered
Joined
·
1,356 Posts
I just wanted to throw my hat in here, and to reserve one of the upper posts for updates as I can help you guys out. :byebye:

I don't have an E60 M5, but it is one of my favourite cars, so I'll help in whatever ways I can.

So, without further ado.. who's got .0PA and .0DA files they feel like contributing? ;) I'll modify the software I wrote for the E36 M3, E39 M5 and E46 M3 to convert them to binaries, and we'll see what it takes to correct checksums.

:cheers:
That would be great and we appreciate the help. I'll PM you my email
 

·
Registered
Joined
·
57 Posts
Here you go guys, first bits of info to prove what can be done.

At offset 0x146E in binary 7842800, you can find your rev limits per gear:
00 00 00 01 00 02 00 03 00 04 00 05 00 06 00 07
1B 58 20 3A 20 3A 20 3A 20 3A 20 3A 20 3A 20 3A

0x1B58 = 7000
0x203A = 8250

Neutral: 7000 RPM
1st gear: 8250 RPM
2nd gear: 8250 RPM
3rd gear: 8250 RPM
4th gear: 8250 RPM
5th gear: 8250 RPM
6th gear: 8250 RPM
Reverse: 8250 RPM

I also found some versioning info I'll have to look at later:
0569Q60Z520EEAES1
0569Q60Z520EEAES1
0569Q60Z520EEAES1
V912

It's located in two places in the first binary I examined:
0569Q60Z520EEAES1
0569Q60Z520EEAES1
0569Q60Z520EEAES1
V912

------
Version information for every file in the directory (.0DA converted to .bin -> 65536 = 64kb files, 2 segments per file):


0569Q60Z160EEAES1V452
0569Q60Z160EEAJS1V452
0569Q60Z160EEARS1V452
0569Q60Z160EEAUH1V452
0569Q60Z160EEAUS1V452
0569Q60Z160EEAVS1V452
0569Q60Z160EEAWS1V452
0569Q60Z160EEAYS1V452
0569Q60Z160EEAZS1V452

0569Q60Z520EEAES1V912
 

·
Registered
Joined
·
5,679 Posts
Discussion Starter #7
I think I'm a bit daft and should be asleep by now. I've found similar strings in the 0da files, but none as concise as you posted or at that offset. Stil searching...
 

·
Registered
Joined
·
1,356 Posts
I think I'm a bit daft and should be asleep by now. I've found similar strings in the 0da files, but none as concise as you posted or at that offset. Stil searching...
I think P0lars offset is after the file is converted to Binary so the line directive, address and checksum are all stripped off
 

·
Registered
Joined
·
5,679 Posts
Discussion Starter #9
I could also confirm this is if someone is running an aftermarket tune that raises the rev limit. Though I feel somewhat dirty verifying things this way.
Yeah, I would like to avoid this line of thought too. There are some great tuners/sponsors here on the board and I'm sure this thread will not be popular with them just with the nature of the discussion. Let's try to avoid the fallout and keep it an honest effort.
 

·
Registered
Joined
·
5,679 Posts
Discussion Starter #10
I think P0lars offset is after the file is converted to Binary so the line directive, address and checksum are all stripped off
confirmed. I need to grab the perl script to convert mine.

Sorry guys, I'll be the slow kid in class as we move forward. Screw the "no child left behind" crap, I'll manage.
 

·
Registered
Joined
·
57 Posts
confirmed. I need to grab the perl script to convert mine.

Sorry guys, I'll be the slow kid in class as we move forward. Screw the "no child left behind" crap, I'll manage.
heh, Correct, I converted them to binaries - HOWEVER, be advised that I'm still not 100% sure on these until someone can get me a DME read with an appropriately organized binary. I presume the order is as follows, based on the MSS54HP, which MAY not be correct:

Slave 16kb segment 2
Slave 16kb segment 1
Master 16kb segment 2
Master 16kb segment 1

I have no way to confirm this yet.
 

·
Registered
Joined
·
1,356 Posts
heh, Correct, I converted them to binaries - HOWEVER, be advised that I'm still not 100% sure on these until someone can get me a DME read with an appropriately organized binary. I presume the order is as follows, based on the MSS54HP, which MAY not be correct:

Slave 16kb segment 2
Slave 16kb segment 1
Master 16kb segment 2
Master 16kb segment 1

I have no way to confirm this yet.
I'm not sure this how the files are done. If you look through the data files there are 6 or so segment entries of which a few nothing gets programmed in. I think the best bet is going to be to change the parser such that you start at some base address and then offset from there on the segment records. You'll have a better view of exactly the data fits in rom. Though I'm not sure how the processor handles chip selects and maps them into address space.
 

·
Registered
Joined
·
57 Posts
I'm not sure this how the files are done. If you look through the data files there are 6 or so segment entries of which a few nothing gets programmed in. I think the best bet is going to be to change the parser such that you start at some base address and then offset from there on the segment records. You'll have a better view of exactly the data fits in rom. Though I'm not sure how the processor handles chip selects and maps them into address space.
I'm quite sure it's not correct, that much is certain, but though the offsets may be incorrect (at the time of this writing), there will be some maps/curves/values that don't cross segment boundaries that can be positively identified!
 

·
Registered
Joined
·
5,679 Posts
Discussion Starter #14
You know, once we get this figured out, I bet there's a bunch of useful tweaks to be made in the SMG module too. ;)
 

·
Registered
Joined
·
57 Posts
Giving this HTML table thing a shot...how's this look?
Awful, heh.

Over at m3forum.net, the mods enabled the
tags, as well as a few others, such as sub and sup scripts. It's been a tremendous help in organizing and displaying information.
 

·
Registered
Joined
·
5,679 Posts
Discussion Starter #18
Ferris: I'm not sure what Daten I have, but do you show any versions on your MSS65.dat file that aren't on that list?
 

·
Registered
Joined
·
5,679 Posts
Discussion Starter #20
Well, that should significantly narrow the scope of the search then. By orders of magnitude over the E46 guys. However, I think they orders of magnitude in participation over us...

Responding to email during next meeting. (SSShhhh!)
 
1 - 20 of 220 Posts
Top