ZCP DME flash Semi-Successful on Non-ZCP F8X

[packetpilot]

Originally Posted by aboulfad

I wish I was that smart... The only person I know capable of that is TM but thisisdave is good too !

Nah. Aside from aligning md5/shasums of hexdump segments aligning with flash segs, and comparing with the checksum values in the header XML, everything else has been blindly flailing about. Nothing smart going on here, probably rather dumb really (program count on one of the donor car's ecus is 35, DME is at 12 I think).

[aboulfad]

What you guys observed earlier regarding DME FSC CP code needed may be the only way, until someone figures out something new! Btw, is program count like the nb of times the ECU has been flashed? Kudos to you and the donor car for having more "balls" then the rest of us I just ordered the 4 inexpensive PSUs and will join the efforts in recking my car soon

[packetpilot]

Wonder how long this post'll last (and the gists)... but:

BG2 (non-ZCP) US S55 Map hexdump

Comp US S55 Map hexdump

diff of the two

[aboulfad]

Ok that's cool! Now what? Btw it only dawned on me when I looked at the gists and saw your avatar and remembered you were the guy who wanted to setup the Git project to store the cheat codes... I knew your username was familiar BTW, you can extract FSC codes using Esys.

[packetpilot]

Originally Posted by aboulfad

Ok that's cool! Now what? Btw it only dawned on me when I looked at the gists and saw your avatar and remembered you were the guy who wanted to setup the Git project to store the cheat codes... I knew your username was familiar BTW, you can extract FSC codes using Esys.

I don't know; I'm kind of stuck since nobody local has an ICOM cable to loan me, it seems. Will probably order one for delivery early this week if I can find a source that can rapidly ship.

Extracting an FSC code via e-sys isn't something I'm familiar with, but will read up. If extraction does not equal removal, then perhaps we can get people to start (privately) sharing the last 7 of their VIN and their FSC codes... but I'd wager there wouldn't exactly be many willing to offer that up.

[ferrarif1]

Originally Posted by thisisdave

I don't know; I'm kind of stuck since nobody local has an ICOM cable to loan me, it seems. Will probably order one for delivery early this week if I can find a source that can rapidly ship.

Extracting an FSC code via e-sys isn't something I'm familiar with, but will read up. If extraction does not equal removal, then perhaps we can get people to start (privately) sharing the last 7 of their VIN and their FSC codes... but I'd wager there wouldn't exactly be many willing to offer that up.

I've never gone hunting for FSC codes in E-sys, where are they listed in E-Sys?

I looked for a "power increase" conversion in ISTA/P and there is no such animal. Obviously you can add an FSC code but need to knew the code first.

[aboulfad]

I'll PM you both the details.

[packetpilot]

So I have ISTA/P running with ICOM emulation over ENET. (Man, it seems so slow.)

Only connected once thus far to get somewhat familiar. It was with my Non-ZCP map, but with 7MA+7MN in my VO.

Checked the box initially that said no module had been exchanged.

Interestingly, it told me it couldn't find the (correct) DME, and part of the complete measures plan was to remove the DME.

I wonder how it'll behave when I have the ZCP map flashed to the ECU.

Interesting to see the conversion of (a) increased top speed, and (b) enable engine-off heating (I miss that from my e82), so I plan to poke at those two at the least.

More tomorrow! (that is, later today)

[aboulfad]

Increase VMAX requires FSC Code

[ferrarif1]

Originally Posted by thisisdave

So I have ISTA/P running with ICOM emulation over ENET. (Man, it seems so slow.)

Only connected once thus far to get somewhat familiar. It was with my Non-ZCP map, but with 7MA+7MN in my VO.

Checked the box initially that said no module had been exchanged.

Interestingly, it told me it couldn't find the (correct) DME, and part of the complete measures plan was to remove the DME.

I wonder how it'll behave when I have the ZCP map flashed to the ECU.

Interesting to see the conversion of (a) increased top speed, and (b) enable engine-off heating (I miss that from my e82), so I plan to poke at those two at the least.

More tomorrow! (that is, later today)

ISTA/P will behave the same way with the DME regardless of the map you have loaded. That is the screen shot I posted in the other thread.

[packetpilot]

Originally Posted by ferrarif1

ISTA/P will behave the same way with the DME regardless of the map you have loaded. That is the screen shot I posted in the other thread.

Yeah, I now see. I wonder if this is an artifact of having a newer psdzdata than ISTA/P--I'm only guessing that's what you're doing (I have 58.3 placed into an older ISTA/P and just now update the F020 line in ileveltoversion.csv).

Perhaps I should indicate that an ECU had been exchanged at the outset with ISTA/P, although that'd probably involve getting in (even more) over my head.

There doesn't seem to be a whole lot overtly deducible about SWT codes despite the some seemingly-related data in ISTA/P's data/ecudata/{BASE|$chassis}/data/gdaten/swtconf0.dat...

But I did at least find this:

Power Kit Enabling Code N63 (MSD851) 0085 (AppID 133) 0001 Envelope/Download ASAP
Power Kit Enabling Code N55 0086 (AppID 134) 0001 Envelope/Download ASAP
Power Kit Enabling Code N54 (MSD81) 0093 (AppID 147) 0001 Download ASAP
Power Kit Enabling Code N54 (MSD81) 0096 (AppID 150) 0001 Download ASAP
Power Kit M M5 S63B44 (tü) (MEVD1728) 0097 (AppID 151) 0001 Download ASAP
Power Kit M M5 S63B44 (tü) (MEVD1728) 0098 (AppID 152) 0001 Download ASAP

...so AppID is probably between 153-155 or perhaps 135-137... with corresponding (sequentially-incrementing) four-digit decimal value (unsure what that's about whatsoever).

It also seems like there might be a way to disable whether an SWT file is even read:

$FCI_PREC;995639;Interpretierter Fehler: Read SWT Files: kein SWT-Index angegeben.;1000;;1000;;1000;;1000,coapiReadSwtFiles,1
$FCI_PREC;995643;Interpretierter Fehler: Read SWT Files: kein Pfad zu %s.;1000;;1000;;1000;;1000,coapiReadSwtFiles,5;1->1
$FCI_PREC;995647;Interpretierter Fehler: Read SWT Files: kein Pfad zu %s.;1000;;1000;;1000;;1000,coapiReadSwtFiles,7;1->1
$FCI_PREC;995651;Interpretierter Fehler: Read SWT Files: SetRealCodierDatum fehlgeschlagen.;1000;;1000;;1000;;1000,coapiReadSwtFiles,12
$FCI_PREC;995655;Interpretierter Fehler: Read SWT Files: ReadIniFile2 fehlgeschlagen.;1000;;1000;;1000;;1000,coapiReadSwtFiles,9
$FCI_PREC;995659;Interpretierter Fehler: Read SWT Files: TraceSystemData fehlgeschlagen.;1000;;1000;;1000;;1000,coapiReadSwtFiles,10

(source: FciConfig.csv)

Or perhaps modifying SWTconf0.dat within ecudata/F020 is the right approach, perhaps just adding a line for 0x12 that will override the way it behaves...

;SWT-Logistikdatei 'SWTconf0.dat'
#SWTconf.dat Generierung vom 02.08.06
#Abzulegen im Verzeichnis 'data\gdaten' des Servicepakets
#Die erste Zeile wurde nicht systemseitig generiert. Sie wird von der Applikation CarServer ben�tigt und darf nicht ge�ndert werden.
#AN,SG-Name,PABD,PSGBD,SGBD,FABD,Auth.,SWT-Typ
-,-,-,-,00SWTKWP,00SWTKWP,Keine,-
0x10,JNAV60,31JNAV60,08FLASH,00SWTKWP,00swtkwp,Asymetrisch,classic light
0x13,MSS70,07MSS70,08FLASH,00SWTKWS,00swtkws,Asymetrisch,short light
0x4,NIVI65,161NIV65,08FLASH,01SWT,01swt,Asymetrisch,classic light
0x5,NIVI65,161NIV65,08FLASH,01SWT,01swt,Asymetrisch,classic light
0x8,JNAV60,31JNAV60,08FLASH,00SWTKWP,00swtkwp,Asymetrisch,short light

...just armchair speculation after directory spelunking before I go out and try a few more things...

[packetpilot]

AppID for ZCP is 265. (0x109).

FSCSCertStatus not available
FSCStatus not available
AppNr./UpgrIdx 265(0x109)/1(0x01)
SWTType SWTclassic light

<--
FSCSCertStatus not available
FSCStatus not available
AppNr./UpgrIdx 233(0xE9)/1(0x01)
SWTType SWTclassic light

Unsure what ID 233 is, but apparently it's on my DME, mayhaps causing a conflict.

12: OK - SWIDs: 265/1, 233/1

EDIT: 233 (0xE9) is for VMAX increase, or so I've read.

[aboulfad]

Originally Posted by thisisdave

AppID for ZCP is 265. (0x109).

FSCSCertStatus not available
FSCStatus not available
AppNr./UpgrIdx 265(0x109)/1(0x01)
SWTType SWTclassic light

<--
FSCSCertStatus not available
FSCStatus not available
AppNr./UpgrIdx 233(0xE9)/1(0x01)
SWTType SWTclassic light

Unsure what ID 233 is, but apparently it's on my DME, mayhaps causing a conflict.

12: OK - SWIDs: 265/1, 233/1

EDIT: 233 (0xE9) is for VMAX increase, or so I've read.

I thought I sent you the info on the appIDs, no? And now you have confirmed 100% that you need the 0x109 FSC code as both statuses are "not available"!

[terahertz]

There is a FSC generator floating around the internet. I used it for my e90 to activate map updates using the map version's app id and another file you pull out of your car. The only problem is it doesn't create the certificate file that is also needed when loading an FSC via ESYS, so I don't know if it would work.

Just putting that out there if anybody wants to look at it. I'm guessing it may be able to generate the FSC, but since it isn't signed by BMW it most likely won't work.

[aboulfad]

Originally Posted by terahertz

There is a FSC generator floating around the internet. I used it for my e90 to activate map updates using the map version's app id and another file you pull out of your car. The only problem is it doesn't create the certificate file that is also needed when loading an FSC via ESYS, so I don't know if it would work.

Just putting that out there if anybody wants to look at it. I'm guessing it may be able to generate the FSC, but since it isn't signed by BMW it most likely won't work.

That is the only FSC generator out there, just for maps! Anything else requires an FSC code from BMW, that there are some resellers out there but for some minor codes: 6NR, ...

[packetpilot]

Originally Posted by aboulfad

I thought I sent you the info on the appIDs, no? And now you have confirmed 100% that you need the 0x109 FSC code as both statuses are "not available"!

You indeed did (and I'd forgotten--sleep deprivation has its downside!), and my car confirms that info. :-)

I asked a local BMW OEM parts reseller whether he can sell me an FSC code; according to other posts by ************** it's pretty laissez faire when it comes to BMW allowing the purchase of FSC codes that weren't originally on the car. Since have the engine that was EOL'd in January (no bedplate modification), I wonder if that'd be a red flag for the sale from BMW's perspective.

One development last night is that ISTA/P wanted to add 7ME to my car in its measures plan; I wonder if this is correlated to the requested VMAX increase conversion/retrofit. The measures plan was not (and of course could not be) carried out, since its execution relies on the removal of my DME. Don't think the car would be very fast without one.

Aside from figuring out the CRC methods for the binaries (which can seemingly be pretty complex voodoo, along with figuring out which bit(s) of the bin require the SWT/FSC, I'm kind of stumped.

Since the DME programming counter is at 32 of a maximum 60 (this *must* include hitting the "code" and "code fdl" buttons in E-SYS, since there is no way I've gone ZCP-and-back 16 times), and since I don't want to be desoldering EPROMs any time soon in order to reset that counter, I'm going to slow down on the actual car, maybe dig into some CRC studies, and perhaps source an MEVD172G DME from a salvage yard, since they are in a whole slew of BMW models.

[aboulfad]

Originally Posted by thisisdave

...

Since my DME programming counter is at 32 of a maximum 60...

Crazy !!! BTW, where do you see that ? i think list price for our DME is around $1200 USD, I think the G is also used for the F30, so its possible that it exists in a salvage yard, but from my only salvage experience to go get an e46 battery negative cable (the short one), is you get there and the car is gutted by scavengers...

I applaud your tenacity BTW, do you ever drive your car if you flashed/coded the DME like 30 times !!!

[terahertz]

Does the program counter have anything to do with the "Update VCM after TAL execution" and "Update MSM after TAL execution" options in ESYS?

How are you reading the program counter?

[aboulfad]

Those two options seem to be used when performing a I-step update, in order to update the car's I-step and some security stuff... no one really knows, but the consensus is to check them when doing a complete I-step update, and to uncheck them when updating one ECU. But I don't think they cause the counter to increase as Thisisdave was just swapping the swfl files and maintaining the same I-step.

[packetpilot]

Originally Posted by terahertz

Does the program counter have anything to do with the "Update VCM after TAL execution" and "Update MSM after TAL execution" options in ESYS?

How are you reading the program counter?

Reading the program counter with the Transmitter external application in E-SYS.

Originally Posted by aboulfad

Those two options seem to be used when performing a I-step update, in order to update the car's I-step and some security stuff... no one really knows, but the consensus is to check them when doing a complete I-step update, and to uncheck them when updating one ECU. But I don't think they cause the counter to increase as Thisisdave was just swapping the swfl files and maintaining the same I-step.

Not quite; I was misguided and for the first many times I did this (really up until the last couple rounds) I had my I-STEP (last) the same as my shipment I-STEP, so it could've incremented where unnecessary.

Perhaps I should try to swap the swfl files in the leanest way possible (no coding mode, no programming mode, no updates to MSM/VCM) and see whether my programming counter increments for the DME. It's probably worthwhile as (a) I'm presently in "super efficient throttle mode with practically no boost" (limp) and (b) knowing this would probably determine the direction I take in the near-term.

[aboulfad]

jeez, you are not giving up, and your car is sitting idle in your garage i take it ???

[packetpilot]

Originally Posted by aboulfad

jeez, you are not giving up, and your car is sitting idle in your garage i take it ???

Nope, it's my DD. Don't really mind it in grand///Ma mode for driving the ten mins to/from the campus from home.