[Mik325tds]

Originally Posted by 808AWD325xi

Rather than messing with B3 bits meant for a different HW-NR (7591971), have you considered trying the B5 S transmission flash (ZB 7592154)?

The HW-NR (7591972) is the same as your 335d. Even if the program file doesn't work, perhaps the data file will...just a thought.

I wasn't even aware of the B5 S. Thanks for the hint! Where is it located? I can't seem to find it in my daten collection.

[808AWD325xi]

Originally Posted by Mik325tds

I wasn't even aware of the B5 S. Thanks for the hint! Where is it located? I can't seem to find it in my daten collection.

You're welcome, it's in the E60 > data > GKE195 folder.

[Mik325tds]

Originally Posted by RayBan81

Mik325tds
Concerning the flash procedure: I always use the supply when flashing the CIC or an ECU where I don't know how long it will take. From experience i can tell that it's quite safe to flash EGS & DME without the supply. (via CAN & ICOM and if your batterys in good condition) Power drain isn't that high and it's done in ~ 1 minute. I did that for sure 200 times until now and never had problems. But i will try it today with the supply connected, just to be bullet proof. Also i never experienced more than 25amps during flashing. My supply is rated at 50A, but never came even close to that with stable 13,8V.

Looks like you know what you're doing and are aware of the battery status during your flashing sessions. But we have to keep mentioning it so others don't go blindly into flashing.
I find myself trying this and that and before I know I have ignition on for 30 min. That's when things get dangerous.

Originally Posted by RayBan81

Maybe there's a way to change the project numbers with tool32..did you investigate that already? I'm going to try the B5 data now...the adress records match, so that should be safe too. Please keep your fingers crossed.

Yes, I have looked if there is a job to change the HW number or ZIF field but unfortunately there are read jobs only.
I wonder though if the $ REFERENZ is part of the RSA signature?
Fingers crossed my friend!

[rjahl]

Originally Posted by Mik325tds

Looks like you know what you're doing and are aware of the battery status during your flashing sessions. But we have to keep mentioning it so others don't go blindly into flashing.
I find myself trying this and that and before I know I have ignition on for 30 min. That's when things get dangerous.

Yes, I have looked if there is a job to change the HW number or ZIF field but unfortunately there are read jobs only.
I wonder though if the $ REFERENZ is part of the RSA signature?
Fingers crossed my friend!

With the OPA and ODA files any line starting with a $ is data used by winfkp only.

[RBT-Tuning]

So, again no luck with the B5 data. Flashing went fine, TCU is visible on CAN afterwards, but there are 3 constant errors, which are linked to the electronic park lock on the E60 platform, which the E89 platform does not have. I didn't try to start the car, because then i remembered that I did try this already a few months ago. The lever won't move out of P.

I also did some research on how to change the HW_REFERENZ, but I couldn't find any job for that too.

I'm pretty sure the reference# is also part of the RSA sig, because its stored inside the data block of the *.oda file.

I'm running out of ideas at the moment...

[Mik325tds]

Originally Posted by RayBan81

So, again no luck with the B5 data. Flashing went fine, TCU is visible on CAN afterwards, but there are 3 constant errors, which are linked to the electronic park lock on the E60 platform, which the E89 platform does not have. I didn't try to start the car, because then i remembered that I did try this already a few months ago. The lever won't move out of P.

I also did some research on how to change the HW_REFERENZ, but I couldn't find any job for that too.

I'm pretty sure the reference# is also part of the RSA sig, because its stored inside the data block of the *.oda file.

I'm running out of ideas at the moment...

Darn. I just tried changing the Referenz line and was surprised that it wasn't part of the checksum. But then I read your post and saw that it is also encoded again in the data block which of course is part of the checksum and RSA signature.

So it seems the only option is to get a hand on the bootloader of the EGS and disable the check for RSA signature.

[DWR]

Thanks for all the daring work this weekend, gentlemen.
Mik325tds, glad you were able to resolve last night's issue. In spite of not being able to flash Alpina software, it looks we have learned alot.

[RBT-Tuning]

Maybe there's one last chance....theres a generic "FlashSchreibenAdresse" job in tool32. Looks like this job enables one to write data directly at a given adress space...maybe that's a way to change the project# after flashing!?

[RBT-Tuning]

Mik325tds Have you ever tried this switch in WinKFP?

[rjahl]

Originally Posted by RayBan81

Mik325tds Have you ever tried this switch in WinKFP?

From other threads, I've read that this only disables the winfkp check on the total ODA / OPA checksum. The TCU will still check the flash during boot up. I recall reading this in the Winfkp manual as well.

[rjahl]

Originally Posted by RayBan81

Maybe there's one last chance....theres a generic "FlashSchreibenAdresse" job in tool32. Looks like this job enables one to write data directly at a given adress space...maybe that's a way to change the project# after flashing!?

Check the file or block size allowed. I think you are limited to 512 bytes. I expect you will also find another security measure as well. Some processors do not allow this at all. Might be one of those Netodata calls from ncsexpert.

Not trying to throw wet blankets. I'm hoping you find a way through.

I wish I could be more help.

[Mik325tds]

Originally Posted by DWR

Thanks for all the daring work this weekend, gentlemen.
Mik325tds, glad you were able to resolve last night's issue. In spite of not being able to flash Alpina software, it looks we have learned alot.

Thanks for your mental support. Much appreciated!

[Mik325tds]

Originally Posted by rjahl

From other threads, I've read that this only disables the winfkp check on the total ODA / OPA checksum. The TCU will still check the flash during boot up. I recall reading this in the Winfkp manual as well.

Jup. That's what I recollect as well. Just the file checksum at the end.

[Mik325tds]

Originally Posted by RayBan81

Maybe there's one last chance....theres a generic "FlashSchreibenAdresse" job in tool32. Looks like this job enables one to write data directly at a given adress space...maybe that's a way to change the project# after flashing!?

I was wondering about that as well. Probably have to go through seed key authorization first. I have never done that manually before. Do you know how that works?

[Yozh]

I check this thread everyday and cross my fingers...

[iaknown]

Originally Posted by Yozh

I check this thread everyday and cross my fingers...

Ditto....I have no clue what you guys are doing on the coding end lol but hat's off to you. Thanks for being so dedicated and continuing to look for a way to make something happen.

[RBT-Tuning]

Originally Posted by Mik325tds

I was wondering about that as well. Probably have to go through seed key authorization first. I have never done that manually before. Do you know how that works?

Nope, never tried before and personally I'd only try that at the bench. Why thing always have to be that complicated

[RBT-Tuning]

Found an interesting thread, how the same issue we have here is solved with M3 E46 non-CSL/CSL ECUs: http://www.m3forum.net/m3forum/showt...=469123&page=6

That of course does not work for us, but gives a direction, that the HW reference is included in the bootloader file and can only be changed through a direct BDM write.

[ChrizLoud]

So its an pan off work were talking about here.

[808AWD325xi]

Originally Posted by Mik325tds

I was wondering about that as well. Probably have to go through seed key authorization first. I have never done that manually before. Do you know how that works?

The E89\DATA\GDATEN\SGIDC.AS2 file contains authentication codes for various ECUs, including the TCU. I'm not sure how these are used by WinKFP...

I found some interesting information in a bankruptcy court filing:
http://bankrupt.com/misc/04878.pdf

Embedded within is documentation related to the GM6 transmission project. On page 113 of the PDF, in section 5.2.5, titled, "End of line and field Programming (Flash-Programming)", it states:

• Protection against service failures or misuse such as incorrect or unwanted programming (applies equally to the factories). The SW must implement BMW recommendations for authentication and signature (test authentication + signature verification) according to LH.

At first I thought that perhaps LH was another supplier, but I believe that in this context LH is short for LastenHeft (SPECIFICATIONS.)

Page 118 lists the LH docs for authentication, etc...any friends at GM by chance?

[gavronm]

Seriously guys - the quality of investigative work, research, experimentation, and collaboration going on in this thread is absolutely mind blowing. Kudos to everyone that continues trying to run this down.

In the meantime...

[Whitbread]

Originally Posted by iaknown

Ditto....I have no clue what you guys are doing on the coding end lol but hat's off to you. Thanks for being so dedicated and continuing to look for a way to make something happen.

I'm with him ^ LOL. Sad to hear the flash this weekend didn't work Mike.

Something Mike and I discussed at lunch the other day is ford used this 6hp26 trans in quite a few different applications. The two that stand out to me for tuning resources is the aussie falcon platform and the american jag xk/xk8/xkr models. This company advertises tcu tuning for the falcons.