DIY - DME/ECU Read Write and Tuning Guide

[su_root]

Disclaimer: All information provided is for educational purposes. I am not responsible for any direct or indirect damage that may occur to your property as a result of the information provided here.

[2016-05-19]
KTAG/KTM100 with BDM frame and adapters is inbound. My intention is to document a regular guys attempt at homebrew DME/ECU tuning my 2016MY F82 M.

Attachments:
BMW-Bosch DME MEVD172G Wiring Guide: NT_BOSCH_MEVD172G_IROM_TC1797_BMW.pdf

[2016-05-25]
Parts arrived this morning. Below are pictures of what was included in the box.
-KTAGKTM100 Clone
-12v/1A AC Adapter
-USB2.0 A-to-B Cable
-Cables to wire up to the DME



Prepping Bench PC:
The instructions provided recommend the use of WinXP/7, disabling all network connections and malware detection programs. I was in a rush to stage the software and connect the flashing tool to ensure all was OK so I tested the following setup on a Win10Pro x64 machine. I also made the changes below before starting:
-Disable Driver Signature Enforcement - REQUIRED or Dimsport driver will not install and device will show as 'Unknown' under Device Manager
-Disable AV/Malware Software - I use Webroot/Defender and shut them off
-Disable LAN/WLAN adapters

After making the changes above to my PC I powered up the adapter and plugged in the USB cable. Windows warned me of the unsigned driver and continued the install.

Bringing up KTM100 I see all is recognized correctly. You can also see below that the DME is supported and a plugin is available to communicate with that DME and calculate the correct checksum. I think Im ready to start!




[2016-06-13]
On Sunday I was able to get the car on the dyno and grab some factory numbers.

I want to thank the guys(one guy who runs the place) over at GarageYourself.com for providing some baseline Dyno runs on their DynoDynamics unit. For anyone in the SouthFlorida/Miami area that enjoys working on their own car but cant find the space or tools this place is quite unique. Drive in with your own car and they provide everything..car lifts, hand tools, air tools, tire changing machine, sand blaster and even a fabrication area with welding tools and an engine lathe. Very useful.

www.GarageYourself.com



And now the results:


Short video of the run. Check your volume before playing, its pretty loud.

[su_root]

Phase 1 - Reading the DME:

Here she is. Bosch MEVD172G DME.

Below are a few pictures of the outside of the unit. I cleaned up a bit of sand around the unit to make sure nothing gets in while I attempt to open it up.




After about 30 minutes with a small blade going around the edges of the unit I was able to open the casing up. Luckily the components are not close to the edge of the case so as you're going around it with a blade you don't have to worry too much. But as always be careful not to jam the blade too deep; you may accidentally damage some of the surface mounted components.




Wired up the unit to the KTM100 clone using the PDF I posted earlier. Reading procedure is as follows:

1. Connect wires from the provided harnesses to the DME pins as shown in the Bosch PDF including BOOT pin.
2. Power ON KTM100 and connect to USB on PC
3. Launch KTM100 Application
4. Connect the harness side of the cables to the KTM100
5. Click 'ID' in KTM100 Application to verify DME communication.
6. Done. Now you can carry out the function you need (read/write/etc)

[su_root]

Phase 2 - Tuning:

You have two options:

1. Acquire and LEARN tuning software like WinOLS or similar, and spend time and resources on custom dyno tuning the car(which is quite honestly way above my level of expertise).

2. Take your dumped files and send them off to a tuner for tuning service. Most US tuners will flat out turn your business away. I wont call them out here but I would encourage you to contact them and listen to their response first hand. So USA is out. Sort of.

@protuningfreaks ProTuningFreaks (PTF) supports the DIY guys like myself and the Community. After sending my unencrypted DME files to them they validated all was green and offered to help. Kudos!


[2016-06-17]
I installed the DME back into the car yesterday afternoon. It was pretty nerve wrecking to sit in the car and push the 'Start' button. I was very confident I followed all the right steps but theres always that sense of uncertainty in the back of your mind. What if i damaged something? At that moment I didnt care if the remaps actually yielded any results; I was just hoping the car would crank back up. I held my breath, pushed 'Start' and the car sprung back to life. It was such a sense of accomplishment.

Thoughts..throttle response in noticeably sharper and the car definitely pulls harder. Unfortunately its been raining all day here in SFlorida and all the roads are wet so I havent attempted WOT.

[WoohooSoCal]

"The package is in the open.""

"Repeat, the package is in the open."

[te37]

Oh man "home brew" and "ecu tuning" in the same sentence.

[su_root]

While I wait for hardware to arrive I identified and attached the wiring guide for the Bosch MEVD172G DME in OP. My plan was to work on this over the weekend but the gf made some last minute plans and I'll be up at the theme parks for the weekend with some friends. I'll try to at least dump the DME before this weekend.

[te37]

Please give me your girlfriends number so I may call her and politely tell her that you must have this weekend off in order to work on a project for a WHOLE ENTIRE CAR COMMUNITY lol

[aboulfad]

it seems there has been an explosion of flashing/DME/tuning discussions and DIYs in the past few weeks Are you removing your DME or working on another DME? and what software are you using, ECU-explorer (no, using BSL-ADP ~ 1000eur !!! )?

[su_root]

Originally Posted by aboulfad

it seems there has been an explosion of flashing/DME/tuning discussions and DIYs in the past few weeks Are you removing your DME or working on another DME? and what software are you using, ECU-explorer (no, using BSL-ADP ~ 1000eur !!! )?

I agree, there has been no lack of new software being announced and released to the market as of late. I'm labeling those retail tunes.

What needs to be understood is that there are two phases to the process of tuning or remapping your DME.

Phase 1- gaining read/write access to the DME. Fxx DMEs are password protected(TPROT) and bootmode tools for Infinity Tricore DMEs have been available for some time from makers like EVC and CMD Flashtec to name a few. However, as you pointed out, these tools are prohibitively expensive for the DIY'er to attempt this on his/her own. The well established shops invest in these tools and eventually come to market with their software. Some see this as the easy phase since it's simply wiring up a few pins and clicking a button. Recently, clones of these tools have made their way to market. This brings the price to play way down and is what prompted this writeup.

Phase2- Tuning. Once you have your original DME file you have to edit it, aka remap it. Editing seems to work around the concept of maps. Maps are areas of the file that correspond to values like ignition timing or air fuel, etc. This isn't an exact science. More of an art some would say and takes time, resources and experience. I believe this is why we are just now seeing the tunes come to market. The mad scientists at respected shops have been hard at work on the dyno editing the different maps and are now ready to come to market with not only the performance remaps(HP/Torque), but also bonus remaps like 'ZCP burble' and GTS roar, etc.

Here is where I see the most value in my write up to the community. Once you dump your own DME you have a choice. 1)Do you learn to tune your own car or 2)you simply send your file to a European tuner like Heinz OLS(www.heinz-ols.be), Sedox Performance(sedox-performance.com), B&C Consulting(www.bcconsulting.be) or any of the US based tuners like ACM(www.autocouturemotoring.com) or VF(www.vfengineering.com). Point is having your own DME file opens up a world of options for tuning.

I'm still learning each day as I go through this process and some of my content may change as I learn and correct previous statements. Do not take my findings as law.

[su_root]

Tools came in today Updates on OP

[te37]

Mhmm cant wait to read through this after dinner lol

[aboulfad]

Originally Posted by te37

Mhmm cant wait to read through this after dinner lol

That makes two of us That is one area I'd like to learn and having a thread like this is awesome. It looks like the ultimate this to do to your car well aside from driving it

[te37]

I would like the ability to pull my own DME send my file to a tuner and then upload it back to the DME. Save the hassle of downtime and my worst fear, having the DME lost in shipping!

[aboulfad]

Originally Posted by te37

I would like the ability to pull my own DME send my file to a tuner and then upload it back to the DME. Save the hassle of downtime and my worst fear, having the DME lost in shipping!

this is what the OP is trying to do too here with the more affordable KTAG KTM100 Clone (~400Usd). That would mean the DIYer would have to purchase the gear mentioned above to potentially read his DME.

su_root , what's the total bill so far?

[milk242]

Off topic, but I always wondered how on other platforms they are able to bypass the tprot over obd2. Do they just find an exploit in the code?

[packetpilot]

Originally Posted by milk242

Off topic, but I always wondered how on other platforms they are able to bypass the tprot over obd2. Do they just find an exploit in the code?

My guess (and a wildly uneducated one at that) is that the buses needed to throw the DME into a TPROT password dump state are no longer accessible via the cabin's OBDII port. Prior, they had been, and an adequately-equipped device would be able to signal to the DME to dump the TPROT bytes, would store them, flip the DME into boot mode (via the equivalent of our "Pin 19" on the MEVD17.2.G in our cars--perhaps another bus unavailable via OBDII) and store the stock file, and then write its own file.

This is just conjecture, again, and is based only from my understanding of how my Cobb AP behaved with my N54 e82.

[Mandi90TT]

Good discussion here, guys. Keep up the good work

[te37]

Originally Posted by thisisdave

My guess (and a wildly uneducated one at that) is that the buses needed to throw the DME into a TPROT password dump state are no longer accessible via the cabin's OBDII port. Prior, they had been, and an adequately-equipped device would be able to signal to the DME to dump the TPROT bytes, would store them, flip the DME into boot mode (via the equivalent of our "Pin 19" on the MEVD17.2.G in our cars--perhaps another bus unavailable via OBDII) and store the stock file, and then write its own file.

This is just conjecture, again, and is based only from my understanding of how my Cobb AP behaved with my N54 e82.

So what are the other flash tuning companies doing to the DME that lets them write to the full memory? Because if I remember correctly one company told me that once they bench flash my DME and send it back to me I can change maps on my own (go up to stage 2 or back to stock) through the OBD port.

[packetpilot]

Originally Posted by te37

So what are the other flash tuning companies doing to the DME that lets them write to the full memory? Because if I remember correctly one company told me that once they bench flash my DME and send it back to me I can change maps on my own (go up to stage 2 or back to stock) through the OBD port.

I've read that they're replacing a key pair. I don't know if TPROT is key-based or password-based, but if the latter, then I'd imagine they're replacing the password.

It is also apparently possible (per Infineon's own MemTool software) to turn of TPROT in some cases, so they may be doing that.

[CaryTheLabelGuy]

Just now seeing this thread. Keep up the good work!

I will be watching this thread closely, as there is nothing more I'd like to do than to tune/flash my own DME.

[specterbmw]

This is awsome OP, way to go keep up the good work

You need a fund so we can donate to your work so the whole community benefits.

[su_root]

Originally Posted by aboulfad

this is what the OP is trying to do too here with the more affordable KTAG KTM100 Clone (~400Usd). That would mean the DIYer would have to purchase the gear mentioned above to potentially unlock his DME.

su_root , what's the total bill so far?

That's correct. At about $500 USD at the moment.