ECU counters and stats

[aboulfad]

Originally Posted by Celestion

If it wasn't for that annoying flash counter, one could do lots of cool frankenstein swfl experiments with the 1:1 swfl:dME maps of various f8x cars.

Ok it's out, fresh out of the oven S55 DME Memory Map !

[aboulfad]

The more I dig into the diagnostics of this car, the more it amazes and scares this shit out of me ! I've always known about secondary faults, but didn't realize how nasty they are. They are faults that we can't query in ISTA, dont show up in ISTA, are stored in a central fault memory (diagnosis master), and are collected in FASTA. The good news, we can do as we please with any of these faults, we can eradicate them using BMW toolset jobs to oblivion, well not sure, the only way is to do it and see if any of the frequency/healing counters change or not, and if they survive a flash or not...

I havent figured out all the conditions, but when a primary fault exists, ISTA basic vehicle test will query the secondary faults, and in some cases I've seen some ECUs that had secondary faults collected without primary faults.

Look what the nasty ZGW had stored, oh yeah the car is smart enough to know some ECUs are on a different software version...

-------------------------------------------------------------
0x100001 VcmResultSvtCheck - Identitätskontrolle: Es sind Unterschiede zwischen der SVT-Ist und SVT-Soll erkannt worden.

Testbedingungen erfüllt
Fehler gespeichert
Fehler würde kein Aufleuchten einer Warnlampe verursachen
This is no event DTC. This ecu IS RESPONSIBLE for this error entry.
Error code: 10 00 01 4C
-------------------------------------------------------------

[aboulfad]

small update, given i flashed one of EGS4 swfl (38C2_000_048_002) with GTS DCT, i checked before and after the stats, and they are still there. Most likely need to flash the bootloader and software to get rid of the counters/stats but wont know until i do it.

[BuLoOoSki]

Originally Posted by aboulfad

small update, given i flashed one of EGS4 swfl (38C2_000_048_002) with GTS DCT, i checked before and after the stats, and they are still there. Most likely need to flash the bootloader and software to get rid of the counters/stats but wont know until i do it.

What do you mean by flash the software?

[Jaymax85]

Originally Posted by BuLoOoSki

Like it says in my post quoted in the OPs first post, I don't know. But I think so. There is an option on the BM3 that says Full Restore, haven't tried it.

The answer to this is no. The car must be benchflashed back to stock. Friend of mine went back to stock and the obd2 flash was a failure. He had to bench flash his car.

[aboulfad]

Originally Posted by BuLoOoSki

What do you mean by flash the software?

I should have been more precise, it's all software in the end! For EGS, there is a BTLD and two swfl (software application: one common and a variant). I only flashed the variant one with GTS DCT, my guess is that either flashing BTLD and/or the common swfl may probably erase the stats.

[aboulfad]

Originally Posted by HELLOimJ

The answer to this is no. The car must be benchflashed back to stock. Friend of mine went back to stock and the obd2 flash was a failure. He had to bench flash his car.

Although this thread is about counters/stats and flashing, what you say is intriguing. So a friend of yours previously had BM3 and had to bench flash back to stock, I.e. He had to yank back his DME??? That defeats the purpose of map switching that BM3 offers...

[BuLoOoSki]

Originally Posted by aboulfad

Although this thread is about counters/stats and flashing, what you say is intriguing. So a friend of yours previously had BM3 and had to bench flash back to stock, I.e. He had to yank back his DME??? That defeats the purpose of map switching that BM3 offers...

I'm not sure if his friend has BM3 or something else. But with the BM3 you can definitely flash back to stock, I've done it myself. However, if your question is can you flash back to stock and restore the DME to it's locked state that I can't say if its possible to do via the OBD. The app does have the feature, but I haven't tried it.

[aboulfad]

Originally Posted by BuLoOoSki

... The app does have the feature, but I haven't tried it.

OT: can you describe what feature you are referring to? So with bm3 you can switch maps, and switch back to the original unmodified stock DME file(s), the one that was read out on the bench, or even flash the original DME file modified with tamper delete code, right?

Is there another feature to "virginize" the DME stock software(s) ?

[Jaymax85]

Originally Posted by BuLoOoSki

I'm not sure if his friend has BM3 or something else. But with the BM3 you can definitely flash back to stock, I've done it myself. However, if your question is can you flash back to stock and restore the DME to it's locked state that I can't say if its possible to do via the OBD. The app does have the feature, but I haven't tried it.

Yah had bm3, the bm3 stock map is a modified stock file with the tamper code suppressed. If you are going in for a warranty repair and BMW examines ecu data or the dealer has to update your ecu firmware (tamper code will reactivate), the ecu alteration will be obvious. You cannot go back to your totally stock firmware with lock in place unless u bench flash.


TBH by flashing your ecu u pretty much forfeit any powertrain warranty you have as once BMW central looks at your ecu there is a high probability they will know what is going on.. unless u benchflash back to stock.

[Jaymax85]

Originally Posted by aboulfad

OT: can you describe what feature you are referring to? So with bm3 you can switch maps, and switch back to the original unmodified stock DME file(s), the one that was read out on the bench, or even flash the original DME file modified with tamper delete code, right?

Is there another feature to "virginize" the DME stock software(s) ?

The answer is no, the lock can only be reapplied with bench flash, at this point there is no bm3 app feature for this.

[aboulfad]

Originally Posted by HELLOimJ

The answer is no, the lock can only be reapplied with bench flash, at this point there is no bm3 app feature for this.

hmmm, this is interesting ! I need to read more about Infineon Tprot and other tools. BTW, when you bm3'folks flash back stock (or tamperless stock), are you writing only the 4Mb file?

[Jaymax85]

Originally Posted by aboulfad

hmmm, this is interesting ! I need to read more about Infineon Tprot and other tools. BTW, when you bm3'folks flash back stock (or tamperless stock), are you writing only the 4Mb file?

Well, to summarize what happened: car was the first f8x to be unlocked by one of the bootmod3 affiliates. This affiliate was using 4 different tools to extract data along with the help of his partner (they were part of a huge umbrella company). When The car went back to the said tuner for relocking and stock flashing, the tuner wasn't sure how to do it, tried obd2 first with dealer tools and a tamper code came on.

In the while since the initial unlock, the partners in the company had fallen out and the initially extracted stock fully compiled file went missing. The tuner then had recompile the 4 fragments which were all different formats into one entire file. Took them a few days, along with the help of ptf. That particular vehicle was the first one they did successfully. From what I hear it was a huge fiasco and really shows that flashing is in its infancy for the f8x. I know the tuner charged him a pretty penny to recompile the stock file, even though they lost it in the first place. Gotta pay to play I guess.

So to answer ur question, they flashed the entire file back. But there be an easier way to do this.

[aboulfad]

HELLOimJ , interesting story, and even that I set my thread OT: maybe those guys werent aware of su_root work:http://f80.bimmerpost.com/forums/sho....php?t=1264155

It makes it quite manageable to read the DME and do other stuff... Is your information up to date re flashing DME back to stock. i.e. is it still the case now, months or years post that initial attempt ? Maybe why PTF in one of their posts, mentionned a bench flash is the best to bring back to stock.

Anyways, all this is cool, I am trying to figure out what information lies where and what gets erased when ECUs get flashed... Tamper code was one example, stats and counters are the more generic case:
http://f80.bimmerpost.com/forums/sho....php?t=1381667
http://f80.bimmerpost.com/forums/sho....php?t=1376258

[BuLoOoSki]

Originally Posted by HELLOimJ

Yah had bm3, the bm3 stock map is a modified stock file with the tamper code suppressed. If you are going in for a warranty repair and BMW examines ecu data or the dealer has to update your ecu firmware (tamper code will reactivate), the ecu alteration will be obvious. You cannot go back to your totally stock firmware with lock in place unless u bench flash.


TBH by flashing your ecu u pretty much forfeit any powertrain warranty you have as once BMW central looks at your ecu there is a high probability they will know what is going on.. unless u benchflash back to stock.

But we all know that getting ourselves into it? Why is it shocking to you or your friend? You want to modify, you can't expect to maintain your warranty. Even with bench flashing back to stock, the dealer can still physically inspect your DME to see if it has been tampered with if you went in with a major drivetrain problem (crank hub for instance). Sorry but I really don't see your point.

[BuLoOoSki]

Originally Posted by aboulfad

OT: can you describe what feature you are referring to? So with bm3 you can switch maps, and switch back to the original unmodified stock DME file(s), the one that was read out on the bench, or even flash the original DME file modified with tamper delete code, right?

Is there another feature to "virginize" the DME stock software(s) ?

Originally Posted by HELLOimJ

The answer is no, the lock can only be reapplied with bench flash, at this point there is no bm3 app feature for this.

Yes, with the BM3 you can switch between maps, you can flash to your stock map with tamper code removed, and you can switch to your unmodified map that will still throw a DME tamper code. However, to relock the DME and get rid of the DME tamper code with the stock map I assume you need to flash the original bootloader. I'm not sure if it can be done via OBDII. But like you mentioned aboulfad, PTF recommend to bench flash it. I would assume it's because once you flash that stock bootloader you lose the ability to flash via OBD. So if something goes wrong throughout the process you might be stuck without being able to do anything about it given that you are no longer able to flash via OBD.

Here are some snapshots of the different flashing functions in the BM3, maybe proTUNING Freaks can chime in to explain the differences between them and what can actually be done.

Diagnostics tab (See last two DME functions):



Flashing page (I've only used the first one, "Flash"):

[aboulfad]

Originally Posted by BuLoOoSki

... However, to relock the DME and get rid of the DME tamper code with the stock map I assume you need to flash the original bootloader. I'm not sure if it can be done via OBDII. But like you mentioned aboulfad, PTF recommend to bench flash it. I would assume it's because once you flash that stock bootloader you lose the ability to flash via OBD. So if something goes wrong throughout the process you might be stuck without being able to do anything about it given that you are no longer able to flash via OBD.
...

Interesting too, so I can flash btld, swfl, ibad,... all the different types of firmware files using Esys/Enet. Your above assumption may have to do with the bm3 app, not a general restriction/limitation. So let's say I become a future tuned customer (same likelyhood I win the 649), then what stops me from flashing my DME with its original BTLD using Esys/Enet ? the reason is nor important.

PS: a small request, let's not talk about warranty, ... this is purely technical tryin to understand stuff. For general rant, there are more than enough posts under Engine subforum Thank you All

[Jaymax85]

Originally Posted by BuLoOoSki

But we all know that getting ourselves into it? Why is it shocking to you or your friend? You want to modify, you can't expect to maintain your warranty. Even with bench flashing back to stock, the dealer can still physically inspect your DME to see if it has been tampered with if you went in with a major drivetrain problem (crank hub for instance). Sorry but I really don't see your point.

I'm not sure what the point of your post is, I'm pretty much agreeing with what you are saying.

[Jaymax85]

Originally Posted by aboulfad

HELLOimJ , interesting story, and even that I set my thread OT: maybe those guys werent aware of su_root work:http://f80.bimmerpost.com/forums/sho....php?t=1264155

It makes it quite manageable to read the DME and do other stuff... Is your information up to date re flashing DME back to stock. i.e. is it still the case now, months or years post that initial attempt ? Maybe why PTF in one of their posts, mentionned a bench flash is the best to bring back to stock.

Anyways, all this is cool, I am trying to figure out what information lies where and what gets erased when ECUs get flashed... Tamper code was one example, stats and counters are the more generic case:
http://f80.bimmerpost.com/forums/sho....php?t=1381667
http://f80.bimmerpost.com/forums/sho....php?t=1376258

This happened within last 6 months

[BuLoOoSki]

Originally Posted by aboulfad

Interesting too, so I can flash btld, swfl, ibad,... all the different types of firmware files using Esys/Enet. Your above assumption may have to do with the bm3 app, not a general restriction/limitation. So let's say I become a future tuned customer (same likelyhood I win the 649), then what stops me from flashing my DME with its original BTLD using Esys/Enet ? the reason is nor important.

PS: a small request, let's not talk about warranty, ... this is purely technical tryin to understand stuff. For general rant, there are more than enough posts under Engine subforum Thank you All

Nothing stops you from doing that. My guess you'll just lose the ability to flash via OBD.

My assumptions of what I'm claiming are based on what I've been informed and offered to be done to my car back when I was flashed by a German tuner more than a year ago.

Upon sending my DME to be bench flashed, he asked if I wanted OBDII flashing unlocked with the tuned flash (because at the time no tuner knew a way of having the tamper code suppressed while keeping the OBDII unlocked, so some customers used to ask him to do that so the dealer don't see that they're tuned). This suggests that its possible to have tuned DME with the stock bootloader which won't throw a DME tampered code, but you wont have the ability to ever change/update your map via OBDII since it will be LOCKED.

I went with the UNLOCKED bootloader and had the tamper code. But after a short period of time I was having many issues with the tune and even after trying multiple maps it still didn't work out for me. Mind you flashing wasn't easy to do because no company offered OBDII flashing with simple tools at the time, it had to be done with Flashtec CMD or something similar and no one in my area at the time (Nashville TN) had those tools so their distributor in the US would ship me their laptop and tools and he would remotely flash the car. So after many failed attempts I asked to flash back to stock and part ways. He agreed to refund my money and flash my car back to stock. I asked if I'll still have the OBDII unlocked, and he said NO. He would flash the whole car back to stock including the bootloader, and that was all going to be done via CMD and NOT BENCH FLASHED. So back to your claim HELLOimJ, the DME can be locked and taken back to stock form via OBDII. Now whether that can be done via BM3 and a simple ethernet cable or you'll need a more sophisticated OBDII tool like CMD I'm not sure of.

In my case I reached a middle ground with him and he agreed to only flash me back to stock but keep my DME unlocked. Although that didn't help me when I came to get the BM3 as he never had a full readout of the DME (he had a partial readout that I mentioned to you in your other thread aboulfad ) which is needed to activate BM3. So I still had to pull out my DME out when I got the BM3

[aboulfad]

Sorry for your past troubles BuloOoski, it's been very interesting to read all those bits and parts. I've re-read the few pages on Tprot, and the Infineon chip has some very sophisticated security measures and I think I need to stay away from DME...

The reason I chose to discuss and learn about DME, is because it is a documented chip, the Infineon TC1797, and is a very interesting ECU with tons of bells and whistles (permanent code like tamper code,...)

I think I need to focus on a dummer simpler ECU, trigger some faults and store stats, and flash away to understand what I began: counters and stats, where are they (located in ECU flash, central fault main memory,...), do they get erased upon full flash (BTLD and all swfl), partial flash (swfl only)... or are they eternally placed in a locked flash region? ... all but questions...

[FSociety]

I'm pretty sure there's a way to overwrite or update the Bootloader via OBD2