[Chief Orman]

Originally Posted by Mik325tds

3lli0t - you're awesome!
It works!
I changed this line from
:1001300000000000000000000000000000000000BF
to
:10013000000000000000000FF000000000000000BF
Old checksum was
$CHECKSUMME 571E U

Used NCS dummy to read the file. It said that the checksum doesn't match and if I'd like to update it. YESSSS!!!
:10013000000000000000000FF000000000000000C0
$CHECKSUMME B1C8 X
How much more convenient can it be?

We are now ready to flash updated cal files to our EGS!

Well done!

[DWR]

Originally Posted by Mik325tds

In a desperate attempt to try something we haven't confirmed yet, I substituted the Cal A7610591.0da with the Alpina file A7615836.0da from the GKE215 folder. The HW numbers are just one number apart 7591971A.0pa vs 7591972A.0pa and differ marginally.
It flashed ok and didn't complain about checksums or signatures...
... but it didn't shift out of Park either. And it had this awful message about transmission failure on the CIC.

At least we have confirmation now. Alpina B3 does not work for the 335d.

OK, so not the results we had hoped, but I still this is awesome work you are doing!

[_TB_]

What about the Alpina D3 file on a 325d? It uses the same gearbox as the 320d/alpina D3.

Does anybody have the Alpina D3 file?

3lliot?

[briansjacobs]

I did not make it past the first two post of this thread, I will stick to selling houses, you guys find things for me to throw money at.

[DWR]

Originally Posted by briansjacobs

I did not make it past the first two post of this thread, I will stick to selling houses, you guys find things for me to throw money at.

Ha, PM me. I'll give you an account you can direct deposit to!

[DWR]

Seriously, just an update. Mik325tds and I are on a break due to other priorities. In addition, we decided to wait when a forum member with the reflash started to get concerned with shifting in his trans.

[_TB_]

Originally Posted by DWR

Seriously, just an update. Mik325tds and I are on a break due to other priorities. In addition, we decided to wait when a forum member with the reflash started to get concerned with shifting in his trans.

Do you have the Alpina D3 binary?

among other things I'm working as a remapper - I'm pretty used to find maps in binary files. Both in WinOLS and my own developed programs.

I'm not afraid of challenges.

[DWR]

Originally Posted by _TB_

Do you have the Alpina D3 binary?

among other things I'm working as a remapper - I'm pretty used to find maps in binary files. Both in WinOLS and my own developed programs.

I'm not afraid of challenges.

That really isn't the issue. The issue is getting the remap into the TCU. We originally thought there would be minimal protections - well, that turned out to be incorrect. Mik325tds and a few others have been able to flash existing BWM maps from other vehicles into the 335d, but nothing modified. So our challenge at this time is getting past the security gates. At least one other interested party is chipping away at this. If you would like to participate in that part of the effort, please PM Mik325tds, as he knows the specifics better than I.

Thanks for the offer of help.

[deepocean]

guys can just anyone explain to me straight forward what you r talking about is it something tune for transmission?

[DWR]

Originally Posted by deepocean

guys can just anyone explain to me straight forward what you r talking about is it something tune for transmission?

DIY transmission tuning.

[Chief Orman]

Originally Posted by deepocean

guys can just anyone explain to me straight forward what you r talking about is it something tune for transmission?

Quote:


Originally Posted by Chief Orman View Post

At the risk of asking a stupid question, where is all this leading? I assume that by dissecting the software files the intent is to create our own transmission software flash. Correct? To the technologically sophisticated folks who have dedicated countless hours to the noble endeavor how far away are we from the end goal (assuming I have summed it up correctly)?

There are no stupid questions. You got it almost right Chief. The SW for this transmission comes in two parts. One is the software which includes the allgorithms on which valves have to close/open in order to achieve gears. That we are not intending to change. The second part is the so called calibration. That's a different file and can be flashed with the same base SW. The cal file contains a whole bunch of maps which for instance tell the SW when to shift from 2>3 based on throttle input and output shaft speed. That is something we are trying to change and are very close to trying out the first changes.

We are also trying to change the lock up behavior of the clutch especially in first and second gear in order to get rid of the slushy behavior. That is a little further out since we haven't found the maps yet and don't quite understand yet how they work.

[deepocean]

highly appreciated ur reply and explination..

[Chief Orman]

Originally Posted by deepocean

highly appreciated ur reply and explination..

The useful part of the quote above is from MIK325tds

[rjahl]

Originally Posted by DWR

That really isn't the issue. The issue is getting the remap into the TCU. We originally thought there would be minimal protections - well, that turned out to be incorrect. Mik325tds and a few others have been able to flash existing BWM maps from other vehicles into the 335d, but nothing modified. So our challenge at this time is getting past the security gates. At least one other interested party is chipping away at this. If you would like to participate in that part of the effort, please PM Mik325tds, as he knows the specifics better than I.

Thanks for the offer of help.

Great work going on here, I've been reading this and it reminds me of when I tried to flash Z4 3.0SI software into my 3.0I. I got passed all of the ODA checksums using Revtors program and corrected the file checksum using other software. Never worked.

I managed to flash the 3.0SI code using a BDM and I'm very happy with the car but I'm starting to look at the transmission as a week link, that's what led me to this forum. It seems like the 6HP19 had two torque converters A121 and B121 and I can't find any documentation about them. I would love to flash the 3.0SI software into my transmission but I worried about the torque converter locking up before it's stall speed and burning up.

Did you know the CNV Code in the ODA file happens to be the Software checksum? Look at the end and you will see a line like

$CARB_MODE_9_CVN 0000B7C4 C

The B7C4 will be the checksum. Hint hint.

This still does not get you past the File signature. I think the public key is in the SGIDD.AS2 or SGIDC.AS2 files in the Gdaten folder.

[DWR]

Thanks for the hint.

[Hoooper]

Originally Posted by rjahl

I worried about the torque converter locking up before it's stall speed and burning up.

Not sure why that would be a problem. Stall speed is a power dependent variable, most transmissions will lock up the torque converter before hitting stall speed. For instance, the stall speed of the converter in the 6hp26 in the 335d is about 2000 RPM (closer to 2500 RPM in mine with minor mods, probably close to 3000 in the heavier modded cars), the torque converter will lock up while accelerating as low as about 1000 RPM with stock map. The only thing that should contribute to burning up the converter clutch is overpowering it or trying to apply it slowly.

[Mik325tds]

Originally Posted by rjahl

Great work going on here, I've been reading this and it reminds me of when I tried to flash Z4 3.0SI software into my 3.0I. I got passed all of the ODA checksums using Revtors program and corrected the file checksum using other software. Never worked.

I managed to flash the 3.0SI code using a BDM and I'm very happy with the car but I'm starting to look at the transmission as a week link, that's what led me to this forum. It seems like the 6HP19 had two torque converters A121 and B121 and I can't find any documentation about them. I would love to flash the 3.0SI software into my transmission but I worried about the torque converter locking up before it's stall speed and burning up.

Did you know the CNV Code in the ODA file happens to be the Software checksum? Look at the end and you will see a line like

$CARB_MODE_9_CVN 0000B7C4 C

The B7C4 will be the checksum. Hint hint.

This still does not get you past the File signature. I think the public key is in the SGIDD.AS2 or SGIDC.AS2 files in the Gdaten folder.

Thanks for the insight. I'm not quite getting your hint though. The line
;$CARB_MODE_9_CVN 00000DDC W
is commented out in our .oda file and I believe the checksum is in the line
$CHECKSUMME 571E U
At least that's the line that NCSdummy corrected after modification.

What is a BDM though? And how does it get around the digital signature?
Edit: Ah, yes. Bench programmer. Read out bootloader, deactivate signature check and reprogram. The only thing is, I don't feel like draining the oil again and opening the mechatronic unit to get to the micro.

[rjahl]

Originally Posted by Mik325tds

Thanks for the insight. I'm not quite getting your hint though. The line
;$CARB_MODE_9_CVN 00000DDC W
is commented out in our .oda file and I believe the checksum is in the line
$CHECKSUMME 571E U
At least that's the line that NCSdummy corrected after modification.

What is a BDM though? And how does it get around the digital signature?

You are facing several different layers of protection;

1. ODA file integrity.
last two byes of each line are a checksum for that line
$CHECKSUMME Is a total file checksum

2. Ram based checksum
This is the data used by the processor to insure nothing is wrong with the ram, This is the 0DDC in your file.

3. File signature
This is the system used by BMW to insure no one gets creative and makes there own "tunes" and flashes them with ODB protocols.

BDM stands for Boot Diagnostics Mode. Many microprocessors systems can be accessed directly through a BDM port on the board. This allows you to manipulate the programs with direct control. I used this port to "clone" my MSV70 and install a custom file bypassing the ODB program that checks the File signature.


http://www.e90post.com/forums/showthread.php?t=1035058

[rjahl]

Originally Posted by Hoooper

Not sure why that would be a problem. Stall speed is a power dependent variable, most transmissions will lock up the torque converter before hitting stall speed. For instance, the stall speed of the converter in the 6hp26 in the 335d is about 2000 RPM (closer to 2500 RPM in mine with minor mods, probably close to 3000 in the heavier modded cars), the torque converter will lock up while accelerating as low as about 1000 RPM with stock map. The only thing that should contribute to burning up the converter clutch is overpowering it or trying to apply it slowly.

"overpower" is my worry, my car started life as a Z4 3.0I essentially a 325 setup and I've installed a three stage manifold and the Z4.3.0SI tune. This upgrades the original 215HP into 258HP and I'm sure I can dig out another 10HP or so. No custom exhaust or intakes.

Through data logging, I've noticed horribly slow shifts with long Can bus torque reduction requests and my low RPM torque figures seem off, possibly from more reduction request, I'm not sure. I'd like to try the 3.0SI transmission file but need to learn more about the repercussions.

[Mik325tds]

Originally Posted by rjahl

You are facing several different layers of protection;

1. ODA file integrity.
last two byes of each line are a checksum for that line
$CHECKSUMME Is a total file checksum

2. Ram based checksum
This is the data used by the processor to insure nothing is wrong with the ram, This is the 0DDC in your file.

3. File signature
This is the system used by BMW to insure no one gets creative and makes there own "tunes" and flashes them with ODB protocols.

BDM stands for Boot Diagnostics Mode. Many microprocessors systems can be accessed directly through a BDM port on the board. This allows you to manipulate the programs with direct control. I used this port to "clone" my MSV70 and install a custom file bypassing the ODB program that checks the File signature.


http://www.e90post.com/forums/showthread.php?t=1035058

Thanks for the link. Interesting read.
Anyway, we'll need the TCU out of the tranny for that.
I wasn't aware of the RAM checksum. Which tool can calculate that one?

[rjahl]

Originally Posted by Mik325tds

Thanks for the link. Interesting read.
Anyway, we'll need the TCU out of the tranny for that.
I wasn't aware of the RAM checksum. Which tool can calculate that one?

Sorry, I can't help you with the RAM checksum. I don't know of anyone trying to crack the TCU. If it's like the DMEs, the checksum will be something like a standard CRC16 but the data range it covers will be hard to discover.

With the MSV70 the data range was recorded just in front of the Checksum but I don't know of anyone that's fully cracked that one. It covers several areas and the algorithm is still a mystery to me.

We all used the Checksum Calculators in our BDM software or WinOls plug-in's. I don't know of any software that will do what you need.

The TCU files are fairly small and I'm guessing they are easier then the DME files so you might find a way.

[Hoooper]

Originally Posted by rjahl

"overpower" is my worry, my car started life as a Z4 3.0I essentially a 325 setup and I've installed a three stage manifold and the Z4.3.0SI tune. This upgrades the original 215HP into 258HP and I'm sure I can dig out another 10HP or so. No custom exhaust or intakes.

Through data logging, I've noticed horribly slow shifts with long Can bus torque reduction requests and my low RPM torque figures seem off, possibly from more reduction request, I'm not sure. I'd like to try the 3.0SI transmission file but need to learn more about the repercussions.

Well, FWIW its unlikely that the tune for the 3.0si has the converter locking up any lower than the 3.0i tune does or that the small difference in torque would have any influence on the torque converter clutch (the stock 335d clutch is holding as much as 225 lb ft more than a stock tune) unless the 3.0si uses a completely different transmission, in which case swapping the tunes would probably not even work. Have you checked whether there is even a difference between the torque converters for those two models?