[DWR]

Originally Posted by _TB_

Soo.. Bosch magically added another memory section with optimized parameters?

We have the full readout - there are not double sections..

I call bollocks..

Double sections? Are we getting confused between the ECU and TCU? I'm talking about the ECU. I don't pretend to know what is in the internal flash, but it is called out in the EDC17CP09 Damos/AL2.

[shnaggs]

Originally Posted by DWR

If you have sent an email to ******* at HP Tuners, requesting support for the ZF6HP in US BMW 335ds, can you please leave a short post to that effect.

Would like to see what kind of interest there is ... and who I have to give personal invitations to, lol.

DWR, check.

I just emailed *****. Hope to get him on board!

[TheBoar]

Emailed! Just stated that I wanted to show support for a remap for the transmission.

[rspring]

Email sent to Eric

[rjahl]

Originally Posted by _TB_

Do tell more..

Just a reminder, I'm driving a gasoline powered Z4 with an automatic.

The MSV70 used in my car has a parameter that activates the torque reduction during a gearshift through CAN request. I simply changed the value from 3 to 2.

I managed to log the gear shifts this morning and it does work. The change did not affect the gear shift in the transmission only the engine keeps pulling all the way through.

I can log the reduction request and it's now gone.

[808AWD325xi]

Originally Posted by RayBan81

I played with this switch already and it had no effect on my stock cal. That means, I didn't get an error code, or any other effect. So I doubt that it would have any with the 5series cal. But we should give it a try anyway. I can't do it in the next days, so mabye someone else...

Nevertheless I worked a lot on the ips/prg/Winkfp files the last 2 weeks, but there were no major breakthroughs to report so I kept silent. What I can confirm 100% by now, is that's it's not possible to let the ECU "skip" the signature check from outside, or set it to a running state without the check whithin the scope of the ips/prg files. Unfortunately there's no useful information retrievable from these files. I also started to decompile WinkFP.exe and already found the part where the signature check is handled. I don't have a thorough understanding of the procedure at the moment but honestly I don't expect to find any useful information in there either.

As far as I made an understanding the TCU does the check fully on it's own and just returns OK or NOK. So no way to interfere from outside. After completing the flash procedure the TCU switches to state "0x05" (Program) or "0x06" (Data) which means that they are fully flashed, but not yet checked. The sig check then has to be called from outside and afterwards the TCU switches to state 0x01 (running), which WinkFP readsout and confirms a successful flash.

I also found the signature block on both the *.opa and the *.oda files. It's a 128 byte block each (=1024 Bit). The oda starts right with the signature, the opa ends with the signature. As the opa file is much bigger, than the readout with BMW Scanner i guess there's a good chance the signature routine is included in the code of the opa file. But I'm not aware of any available program, which disassembles the Motorola code.....? (IDA does, but costs a fortune)

That's my state at the moment....

Wow, that's a lot of great information. Unfortunately, I don't have the time or knowledge to completely digest it at the moment.

In terms of a disassembler, you can give ODA a shot:
https://www.onlinedisassembler.com/odaweb/

I took a snippet of your hex dump and manually entered it, it appears to work. But, I have no idea if the disassembly is correct. I used the following settings: Arch:m68k, Base Address:0x50090, Endian:BIG.

Raw input:

FF 30 34 37 39 53 39 30 54 36 34 31 5A 31 55 45 31 32 30 34 37 39 53 39 30 54 36 34 31 5A 31 55 45 31 32 30 34 37 39 53 39 30 54 36 34 31 5A 31 55 45 31 32 00 00 00 00 00 00 00 00 01 00 05 00

Output (Hex):

.data:00050090  ff 30 34 37 39 53 39 30  54 36 34 31 5a 31 55 45  .0479S90T641Z1UE
.data:000500a0  31 32 30 34 37 39 53 39  30 54 36 34 31 5a 31 55  120479S90T641Z1U
.data:000500b0  45 31 32 30 34 37 39 53  39 30 54 36 34 31 5a 31  E120479S90T641Z1
.data:000500c0  55 45 31 32 00 00 00 00  00 00 00 00 01 00 05 00  UE12............

Output (Disassembly):

.data:00050090 ff 30                            .short 0xff30
.data:00050092 34 37 39 53 39 30 54 36          movew %sp@(0000000000000000)@(0000000039305436),%d2
.data:0005009a 34 31 5a 31                      movew %a1@(0000000000000031,%d5:l:2),%d2
.data:0005009e 55 45                            subqw #2,%d5
.data:000500a0 31 32 30 34                      movew %a2@(0000000000000034,%d3:w),%a0@-
.data:000500a4 37 39 53 39 30 54                movew 0x53393054,%a3@-
.data:000500aa 36 34 31 5a 31 55                movew %a4@(0000000000000000)@(0000000000003155),%d3
.data:000500b0 45 31 32 30                      chkl %a1@(0000000000000030,%d3:w:2),%d2
.data:000500b4 34 37 39 53 39 30 54 36          movew %sp@(0000000000000000)@(0000000039305436),%d2
.data:000500bc 34 31 5a 31                      movew %a1@(0000000000000031,%d5:l:2),%d2
.data:000500c0 55 45                            subqw #2,%d5
.data:000500c2 31 32 00 00                      movew %a2@(0000000000000000,%d0:w),%a0@-
.data:000500c6 00 00 00 00                      orib #0,%d0
.data:000500ca 00 00 01 00                      orib #0,%d0
.data:000500ce 05 00                            btst %d2,%d0

[Mik325tds]

Originally Posted by DWR

Would like to see what kind of interest there is ... and who I have to give personal invitations to, lol.

DWR, check.

mik325tds, check.

[9mmkungfu]

I also emailed Eric.

[iaknown]

Just emailed him as well. And we will be hearing from him very soon!

[Hoooper]

Originally Posted by iaknown

Just emailed him as well. And we will be hearing from him very soon!

He replied to you im assuming?

[Hoooper]

I emailed and also let him know that I already have the tuner and would be willing to guinea pig a bit.

[iaknown]

Originally Posted by Hoooper

He replied to you im assuming?

Yea, and he's waiting on the administrators to approve him.

[DWR]

Thanks to everyone that contacted Eric Brooks and let our voices be heard. That effort just gave us the opportunity we needed.

[808AWD325xi]

For what it's worth, I verified today that my gs19.11 TCU uses symmetric authentication and has a random number generator.

It appears to align with the Medium EVITA HSM variant defined in this paper:
SECURE AUTOMOTIVE ON-BOARD ELECTRONICS NETWORK ARCHITECTURE

[RBT-Tuning]

Originally Posted by 808AWD325xi

For what it's worth, I verified today that my gs19.11 TCU uses symmetric authentication and has a random number generator.

It appears to align with the Medium EVITA HSM variant defined in this paper:
SECURE AUTOMOTIVE ON-BOARD ELECTRONICS NETWORK ARCHITECTURE

Wow, you are definitely the google search pro in this thread!

I didn't read the paper yet, but how did you verify??

[Vortechys]

Not sure if this will help, but I ran across a guy on the metro Detroit Craigslist that claims he can flash transmissions.
This was the information he provided...
I can flash your transmission to Alpina B3 Transmission Flash N54 & N55 2007-2013 335i E90, E92

Faster shifts, better rev matching. Just amazing!

-Faster shifts
-Almost no loss of power in between shifts
-Almost no torque limiter
-Faster launches
-Faster paddle response times
-Center cluster will now show D1,D2,D3,D4,D5,D6 rather then just D

[Works]

Originally Posted by Vortechys

Not sure if this will help, but I ran across a guy on the metro Detroit Craigslist that claims he can flash transmissions.
This was the information he provided...
I can flash your transmission to Alpina B3 Transmission Flash N54 & N55 2007-2013 335i E90, E92

Yep, this has been known for ages. The problem here is that N54+N55 are petrol engines with higher rev limits. And totally different power delivery and smoothness (petrol vs. diesel).

We are looking for a solution to the trans that has been hooked up to M57 or N57 (US 335d/EU330d-335d).

[Hoooper]

Originally Posted by Vortechys

Not sure if this will help, but I ran across a guy on the metro Detroit Craigslist that claims he can flash transmissions.
This was the information he provided...
I can flash your transmission to Alpina B3 Transmission Flash N54 & N55 2007-2013 335i E90, E92

Faster shifts, better rev matching. Just amazing!

-Faster shifts
-Almost no loss of power in between shifts
-Almost no torque limiter
-Faster launches
-Faster paddle response times
-Center cluster will now show D1,D2,D3,D4,D5,D6 rather then just D

Completely different transmission and flash, that one is easy to do since the transmissions match and the tune already exists

[Speed-D]

I bought my E90 LCI 335d last April and have been lurking around here a bit. I signed up to say I emailed to show support as well and I'm looking forward to attempting to contribute to the community

[Eric@HPTuners]

Hi everyone,

Several people have emailed me in regards to this TCM project you all are working on.

I would first ask if an administrator can remove my email address, just so I don't pickup any unwanted spam. Emailing me directly generally slows down my work in progress.

Requests such as this is best posted directly on our forum - http://www.hptuners.com/forum. All of our engineers and the owners of HP Tuners are actively monitoring it.

We are pretty comfortable with these controllers, but we need to take a closer look to see if it is something feasible for us to add support for.

[808AWD325xi]

Originally Posted by 808AWD325xi

For what it's worth, I verified today that my gs19.11 TCU uses symmetric authentication and has a random number generator.

It appears to align with the Medium EVITA HSM variant defined in this paper:
SECURE AUTOMOTIVE ON-BOARD ELECTRONICS NETWORK ARCHITECTURE

Originally Posted by RayBan81

Wow, you are definitely the google search pro in this thread!

I didn't read the paper yet, but how did you verify??

Thanks!

I used an early build SGBD to run the authentisierung_zufallszahl_lesen job, it returns the authentication random number and authentication type.

Satz : 1
  JOB_STATUS                      = OKAY
  ZUFALLSZAHL                     = 8 Bytes
    0000 : DC CB 00 00 5F DA FC FD                            ÜË.._Úüý  
  AUTHENTISIERUNG                 = Symetrisch
  _TEL_AUFTRAG                    = 10 Bytes
    0000 : 87 18 F1 31 07 03 00 00   00 00                    ?.ñ1....  ..
  _TEL_ANTWORT                    = 14 Bytes
    0000 : 8A F1 18 71 07 DC CB 00   00 5F DA FC FD E4        ?ñ.q.ÜË.  ._Úüýä

I reran the job today using the SGBD from the SP Daten and it returns an Asymmetric authentication type. Which means that the TCU more closely aligns with the Full EVITA HSM variant.

[Mik325tds]

Originally Posted by Eric@HPTuners

Hi everyone,

Several people have emailed me in regards to this TCM project you all are working on.

I would first ask if an administrator can remove my email address, just so I don't pickup any unwanted spam. Emailing me directly generally slows down my work in progress.

Requests such as this is best posted directly on our forum - http://www.hptuners.com/forum. All of our engineers and the owners of HP Tuners are actively monitoring it.

We are pretty comfortable with these controllers, but we need to take a closer look to see if it is something feasible for us to add support for.

Welcome, Eric!
Thanks for joining and apologies again for spamming your email account. Sometimes our desperation gets the best of us.
All posts and quotes of your email address have been removed, so you should not receive any more emails.
Please let us know if there is anything we an do to support your efforts.