ZCP DME flash Semi-Successful on Non-ZCP F8X

[aboulfad]

Originally Posted by thisisdave

..grand///Ma mode..

[packetpilot]

Originally Posted by thisisdave

Perhaps I should try to swap the swfl files in the leanest way possible (no coding mode, no programming mode, no updates to MSM/VCM) and see whether my programming counter increments for the DME.

swDeploy sans MSM/VCM updates and without coding/programming mode incremented the counter. Had to re-inject CAFD after-the-fact and that too might've incremented it, but I failed to poll the counter again after coding the DME.

So the donor car is at at least 33, maybe 34 out of 60.

[packetpilot]

Dealership told me that sales of AppID 265 are "not available yet" and there are no part numbers associated, but will check once a week to see if they are. (Same status for GTS taillights as well, fwiw.)

[stealth70mde]

Reading through this I can just say that you guys are awesome!

Steel Cahunas award definitely goes to thisisdave

[packetpilot]

Originally Posted by stealth70mde

Reading through this I can just say that you guys are awesome!

Steel Cahunas award definitely goes to thisisdave

Hah, thanks. Now taking donations to fund a new MEVD172G.

[aboulfad]

Originally Posted by thisisdave

Hah, thanks. Now taking donations to fund a new MEVD172G.

if you were TM, i'd gladly donate, A for effort, but we need a cryptographer

[packetpilot]

Originally Posted by aboulfad

if you were TM, i'd gladly donate, A for effort, but we need a cryptographer

Ah, the call for donations was tongue-in-cheek. I'll most likely be buying one (sans donations of course) just to sate some of my curiosity; I mean, I do work at a vehicle company plenty of talented software & electrical engineers, and I've piqued the interests of several.

Found a used "new" (barely) used one from a MY15 that's bilaterally exchangeable, only has a few miles on it, so I have a feeling I'll be playing with that soon.

[te37]

Where do i send the donation, that DME wasn't cheap lol

[packetpilot]

Originally Posted by te37

Where do i send the donation, that DME wasn't cheap lol

At about half of what it would've cost new, I'd say it was a good find! :-) ...especially having been pulled at 10mi. Hopefully the 10hr mark hasn't been met yet.

[ferrarif1]

Originally Posted by thisisdave

At about half of what it would've cost new, I'd say it was a good find! :-) ...especially having been pulled at 10mi. Hopefully the 10hr mark hasn't been met yet.

Glad you got that one. I was negotiating with the seller as well as a sandbox to experiment. I do wish the DME was not such an involved operation to remove (from a purely mechanical perspective).

[aboulfad]

Originally Posted by ferrarif1

... I do wish the DME was not such an involved operation to remove (from a purely mechanical perspective).

According to this, it's much easier than what is listed in ISTA/D , but maybe that is too much for most people if they are not mechanically inclined! And everyone says everything is easy until you do it yourself and go I just tried recently to remove the front side bulb, and you have to wrestle with the stupid wheel well cover!

[packetpilot]

For my reference,

// ----------------------------------------------------------------------------
// CRC tester v1.3 written on 4th of February 2003 by Sven Reifegerste (zorc/reflex)
// This is the complete compilable C program, consisting only of this .c file.
// No guarantee for any mistakes.
//
// changes to CRC tester v1.2:
//
// - remove unneccessary (!(polynom&1)) test for invalid polynoms
//   (now also XMODEM parameters 0x8408 work in c-code as they should)
//
// changes to CRC tester v1.1:
//
// - include an crc&0crcmask after converting non-direct to direct initial
//   value to avoid overflow
//
// changes to CRC tester v1.0:
//
// - most int's were replaced by unsigned long's to allow longer input strings
//   and avoid overflows and unnecessary type-casting's
// ----------------------------------------------------------------------------

// includes:

#include <string.h>
#include <stdio.h>


// CRC parameters (default values are for CRC-32):

const int order = 32;
const unsigned long polynom = 0x4c11db7;
const int direct = 1;
const unsigned long crcinit = 0xffffffff;
const unsigned long crcxor = 0xffffffff;
const int refin = 1;
const int refout = 1;

// 'order' [1..32] is the CRC polynom order, counted without the leading '1' bit
// 'polynom' is the CRC polynom without leading '1' bit
// 'direct' [0,1] specifies the kind of algorithm: 1=direct, no augmented zero bits
// 'crcinit' is the initial CRC value belonging to that algorithm
// 'crcxor' is the final XOR value
// 'refin' [0,1] specifies if a data byte is reflected before processing (UART) or not
// 'refout' [0,1] specifies if the CRC will be reflected before XOR


// Data character string

const unsigned char string[] = {"123456789"};

// internal global values:

unsigned long crcmask;
unsigned long crchighbit;
unsigned long crcinit_direct;
unsigned long crcinit_nondirect;
unsigned long crctab[256];


// subroutines

unsigned long reflect (unsigned long crc, int bitnum) {

	// reflects the lower 'bitnum' bits of 'crc'

	unsigned long i, j=1, crcout=0;

	for (i=(unsigned long)1<<(bitnum-1); i; i>>=1) {
		if (crc & i) crcout|=j;
		j<<= 1;
	}
	return (crcout);
}



void generate_crc_table() {

	// make CRC lookup table used by table algorithms

	int i, j;
	unsigned long bit, crc;

	for (i=0; i<256; i++) {

		crc=(unsigned long)i;
		if (refin) crc=reflect(crc, 8);
		crc<<= order-8;

		for (j=0; j<8; j++) {

			bit = crc & crchighbit;
			crc<<= 1;
			if (bit) crc^= polynom;
		}			

		if (refin) crc = reflect(crc, order);
		crc&= crcmask;
		crctab[i]= crc;
	}
}


		
unsigned long crctablefast (unsigned char* p, unsigned long len) {

	// fast lookup table algorithm without augmented zero bytes, e.g. used in pkzip.
	// only usable with polynom orders of 8, 16, 24 or 32.

	unsigned long crc = crcinit_direct;

	if (refin) crc = reflect(crc, order);

	if (!refin) while (len--) crc = (crc << 8) ^ crctab[ ((crc >> (order-8)) & 0xff) ^ *p++];
	else while (len--) crc = (crc >> 8) ^ crctab[ (crc & 0xff) ^ *p++];

	if (refout^refin) crc = reflect(crc, order);
	crc^= crcxor;
	crc&= crcmask;

	return(crc);
}



unsigned long crctable (unsigned char* p, unsigned long len) {

	// normal lookup table algorithm with augmented zero bytes.
	// only usable with polynom orders of 8, 16, 24 or 32.

	unsigned long crc = crcinit_nondirect;

	if (refin) crc = reflect(crc, order);

	if (!refin) while (len--) crc = ((crc << 8) | *p++) ^ crctab[ (crc >> (order-8))  & 0xff];
	else while (len--) crc = ((crc >> 8) | (*p++ << (order-8))) ^ crctab[ crc & 0xff];

	if (!refin) while (++len < order/8) crc = (crc << 8) ^ crctab[ (crc >> (order-8))  & 0xff];
	else while (++len < order/8) crc = (crc >> 8) ^ crctab[crc & 0xff];

	if (refout^refin) crc = reflect(crc, order);
	crc^= crcxor;
	crc&= crcmask;

	return(crc);
}



unsigned long crcbitbybit(unsigned char* p, unsigned long len) {

	// bit by bit algorithm with augmented zero bytes.
	// does not use lookup table, suited for polynom orders between 1...32.

	unsigned long i, j, c, bit;
	unsigned long crc = crcinit_nondirect;

	for (i=0; i<len; i++) {

		c = (unsigned long)*p++;
		if (refin) c = reflect(c, 8);

		for (j=0x80; j; j>>=1) {

			bit = crc & crchighbit;
			crc<<= 1;
			if (c & j) crc|= 1;
			if (bit) crc^= polynom;
		}
	}	

	for (i=0; i<order; i++) {

		bit = crc & crchighbit;
		crc<<= 1;
		if (bit) crc^= polynom;
	}

	if (refout) crc=reflect(crc, order);
	crc^= crcxor;
	crc&= crcmask;

	return(crc);
}



unsigned long crcbitbybitfast(unsigned char* p, unsigned long len) {

	// fast bit by bit algorithm without augmented zero bytes.
	// does not use lookup table, suited for polynom orders between 1...32.

	unsigned long i, j, c, bit;
	unsigned long crc = crcinit_direct;

	for (i=0; i<len; i++) {

		c = (unsigned long)*p++;
		if (refin) c = reflect(c, 8);

		for (j=0x80; j; j>>=1) {

			bit = crc & crchighbit;
			crc<<= 1;
			if (c & j) bit^= crchighbit;
			if (bit) crc^= polynom;
		}
	}	

	if (refout) crc=reflect(crc, order);
	crc^= crcxor;
	crc&= crcmask;

	return(crc);
}



int main() {

	// test program for checking four different CRC computing types that are:
	// crcbit(), crcbitfast(), crctable() and crctablefast(), see above.
	// parameters are at the top of this program.
	// Result will be printed on the console.

	int i;
	unsigned long bit, crc;


	// at first, compute constant bit masks for whole CRC and CRC high bit

	crcmask = ((((unsigned long)1<<(order-1))-1)<<1)|1;
	crchighbit = (unsigned long)1<<(order-1);


	// check parameters

	if (order < 1 || order > 32) {
		printf("ERROR, invalid order, it must be between 1..32.\n");
		return(0);
	}

	if (polynom != (polynom & crcmask)) {
		printf("ERROR, invalid polynom.\n");
		return(0);
	}

	if (crcinit != (crcinit & crcmask)) {
		printf("ERROR, invalid crcinit.\n");
		return(0);
	}

	if (crcxor != (crcxor & crcmask)) {
		printf("ERROR, invalid crcxor.\n");
		return(0);
	}

	
	// generate lookup table

	generate_crc_table();


	// compute missing initial CRC value

	if (!direct) {

		crcinit_nondirect = crcinit;
		crc = crcinit;
		for (i=0; i<order; i++) {

			bit = crc & crchighbit;
			crc<<= 1;
			if (bit) crc^= polynom;
		}
		crc&= crcmask;
		crcinit_direct = crc;
	}

	else {

		crcinit_direct = crcinit;
		crc = crcinit;
		for (i=0; i<order; i++) {

			bit = crc & 1;
			if (bit) crc^= polynom;
			crc >>= 1;
			if (bit) crc|= crchighbit;
		}	
		crcinit_nondirect = crc;
	}
	

	// call CRC algorithms using the CRC parameters above and print result to the console

	printf("\n");
	printf("CRC tester v1.1 written on 13/01/2003 by Sven Reifegerste (zorc/reflex)\n");
	printf("-----------------------------------------------------------------------\n");
	printf("\n");
	printf("Parameters:\n");
	printf("\n");
	printf(" polynom             :  0x%x\n", polynom);
	printf(" order               :  %d\n", order);
	printf(" crcinit             :  0x%x direct, 0x%x nondirect\n", crcinit_direct, crcinit_nondirect);
	printf(" crcxor              :  0x%x\n", crcxor);
	printf(" refin               :  %d\n", refin);
	printf(" refout              :  %d\n", refout);
	printf("\n");
	printf(" data string         :  '%s' (%d bytes)\n", string, strlen(string));
	printf("\n");
	printf("Results:\n");
	printf("\n");

	printf(" crc bit by bit      :  0x%x\n", crcbitbybit((unsigned char *)string, strlen(string)));
	printf(" crc bit by bit fast :  0x%x\n", crcbitbybitfast((unsigned char *)string, strlen(string)));
	if (!(order&7)) printf(" crc table           :  0x%x\n", crctable((unsigned char *)string, strlen(string)));
	if (!(order&7)) printf(" crc table fast      :  0x%x\n", crctablefast((unsigned char *)string, strlen(string)));

	return(0);
}

from http://www.zorc.breitbandkatze.de/crc.html
via http://srecord.sourceforge.net/crc16-ccitt.html

...as shared with me from someone who has worked on the software engineering of automotive ECUs.

[packetpilot]

I was able to switch back to the ZCP map without incrementing the programming counter.
[EDIT: I take that back! This was not reproducible!]

This was achieved by editing the SVT-soll per the screenshot; the values for Flash and Coding were changed to "false".
[EDIT: I take that back! This was not reproducible!]

I can confirm that setting SWT to "false" does not produce the eureka moment I was hoping for.

I can also confirm that adding 7ME (M Driver's Package) to the FA, which I believe to be a prerequisite for successful VMAX alteration, was also unsuccessful, but that may simply be due to the 10hr counter.

[ferrarif1]

Originally Posted by thisisdave

I was able to switch back to the ZCP map without incrementing the programming counter.

This was achieved by editing the SVT-soll per the screenshot; the values for Flash and Coding were changed to "false".

I can confirm that setting SWT to "false" does not produce the eureka moment I was hoping for.

I can also confirm that adding 7ME (M Driver's Package) to the FA, which I believe to be a prerequisite for successful VMAX alteration, was also unsuccessful, but that may simply be due to the 10hr counter.

Did you add 7ME to the FA or as a conversion through ISTA/P?

[packetpilot]

Originally Posted by ferrarif1

Did you add 7ME to the FA or as a conversion through ISTA/P?

I added it to the FA via E-SYS and wrote FA FP back to the car. (It successfully shows up when reading the FA.)

[ferrarif1]

Originally Posted by thisisdave

I added it to the FA via E-SYS and wrote FA FP back to the car. (It successfully shows up when reading the FA.)

What makes you say it was unsuccessful? Did you get an error?

[packetpilot]

Originally Posted by ferrarif1

What makes you say it was unsuccessful? Did you get an error?

Reading SVT actual still shows the old VMAX value, if that's what you're referring to.

If it's the ZCP map running in general, then it's because the drivetrain error persists.

[packetpilot]

E-sys, with a fresh TAL generation from SVT-ist with ZCP map currently flashed, is also calculating a hardware uninstall.

If ISTA/P and E-Sys are both recommending this, I wonder if the DMEs are not interchangeable between the two. Perhaps I'll pop into ASAP and see if there's any info there about this.

[packetpilot]

Upon closer inspection of the TAL I'd been using in the past to switch to ZCP, it seems as if it wants to change the diagnostic address of DME2 from 12 to 18. Is a diagaddr change normal, ever?

[packetpilot]

Previous ZCP flashing attempts had been made only flashing the 38ac map (a single swfl operation).

I've just carried out a test that with a revised TAL inclusive of bootloader and both swfl writes to DME, in case there were a prerequisites.

This has been unsuccessful.

[lemetier]

This seems rather risky and complicated for an almost imperceptible gain...that is if this had a chance of working.

Some unsolicited advice that I haven't seen mentioned...

The MEVD172G DME for the S55 is unique. All Engine Electronics are controlled through it directly and the E-Box has been eliminated. MEVD172G DME's for other engines are not interchangeable.

DME replacement is extremely risky. A new unit can only be sourced from BMW using the correct VIN and this will Flag the car in the system without a doubt. DME, CAS, and EWS require a matching encrypted code and the only place this information exists is on a non-networked server in Munich, with the exception of certain vehicles modified, retrofitted, or upgraded by Individual Manufaktur (xxxx "by ZS" in the HO/K/E-Worts).

Attempting to install a used DME will trigger the immobilizer and this cannot be undone. New DME, CAS, ZGW, and more won't be an option. It will be required and the chances of having a warranty intact are slim. If it's a leased car through BMWFS, there's a good chance they will cancel the contract and seek damages.

To each their own, but this is honestly one of the worst projects I've seen taking place in the Bimmer community. There's far too much access to the tools by people who have little to no real understanding of how to use them correctly. This is something that can really fuck up the ability to continue coding.

[packetpilot]

Originally Posted by miamiten

...To each their own, but this is honestly one of the worst projects I've seen taking place in the Bimmer community. There's far too much access to the tools by people who have little to no real understanding of how to use them correctly. This is something that can really fuck up the ability to continue coding.

Your advice is appreciated.