[shnaggs]

+1 for donations

[rjahl]

Originally Posted by 808AWD325xi

That's all I could find as well. This is an older version from 2000...burst buffer description begins on page 179:
http://class.ece.iastate.edu/arun/Cp...UserManual.pdf

Without the ability to decrypt the 3DES encrypted key for the GKE215, I'm stuck. I tried to authenticate using test keys, but it appears that I'm not performing the correct sequence as ECU conditions are not met.

Are we still making progress with this project or did you hit an impenetrable wall? Anything we can help look for?

[808AWD325xi]

Originally Posted by rjahl

Are we still making progress with this project or did you hit an impenetrable wall? Anything we can help look for?

Ironically, I was laid off over the holidays by the company that owns RSA. That being said, my efforts have ceased.

[rjahl]

Originally Posted by 808AWD325xi

Ironically, I was laid off over the holidays by the company that owns RSA. That being said, my efforts have ceased.

Sorry to hear about your situation. I hope if all turns out for the best.

[RBT-Tuning]

I've been on holidays the last 2 weeks, so nothing new from my side. My rental car had 75hp, so I'm more then pleased with my Coupe at the moment, no matter how shitty the trans is.

Do we have any other promising ways besides the work from Dave? dave205t Did any of the documents posted help out?

[DWR]

Originally Posted by 808AWD325xi

Ironically, I was laid off over the holidays by the company that owns RSA. That being said, my efforts have ceased.

Thanks for all the help you provided on this thread. Hope you get an even better opportunity in the near future. Good Luck.

[DWR]

Originally Posted by RayBan81

Do we have any other promising ways besides the work from Dave? dave205t Did any of the documents posted help out?

It seems that the more we learn, the further away we get from a solution.
My only hope, at this time, is either a sustitute controller (one exists for small OEs) or a CAN interceptor/translator.

[ChrizLoud]

Sold my 535d with SAT transmission now.
I really missing the shifts while driving my 335D

[CvilleBill]

Maybe that's the answer to our problem. Both cars have the same trans, could it be as easy as the trans controller?

[ChrizLoud]

E60 LCI got the electrical gear selector and the e90 has the manual gear selector so loading up the E60 software into the E90 would probably not even let u engage "D"

But this actually gave me an idea...
What would happen if you manually disable the p-lock in the E90? Will it run on the E60 SAT software without going into failsafe?

[Mik325tds]

Good to see people are still thinking out of the box here . But a few pages back we tried flashing E60 files into our trans. It did take the flash but locked up because it was missing some valves from the other mechatronic. Even if you somehow disable the locking mech, the trans would probably still be in a limp home mode and give you all kinds of nasty messages on the cluster.
Anyway, how would you go about disabling the P-lock?

[ddillenger]

Can you guys repack a raw binary into something your cables can flash if I correct the binary checksums?

[Maniac0908]

If you guys figure this out, can you fix d mode in the alpina flash?

[dave205t]

Hi Guys,

Unfortunately no updates from my side, put the project on a side track (i'm a bit overloaded at work). Thanks for the group search on the documents!

To proceed we either need:

1) program to decrypt the classes based compressed section of code.
2) debugger with simulator that will allow loading and simulating the total binary (or subsection of it) and does on the fly decompression
3) a development board with mpc562 that could also be used to run the compressed bin.

In that order of preference. Any ideas ?

Best regards, Dave

[dave205t]

Originally Posted by ddillenger

Can you guys repack a raw binary into something your cables can flash if I correct the binary checksums?

Hello Ddillenger,

If you can make a before bin (stock), than make a few tiny changes and make a checksum corrected bin (mod), that should at least pin down the some checksum/rsa related locations, Thanks!

Best regards, Dave

[Mik325tds]

Originally Posted by dave205t

Hello Ddillenger,

If you can make a before bin (stock), than make a few tiny changes and make a checksum corrected bin (mod), that should at least pin down the some checksum/rsa related locations, Thanks!

Best regards, Dave

Hi Dave, good to see you're still on board. Don't worry about putting this on a side track. We are all very patient here.
I did try a very small modification to an original .bin file before (see attached .zip). I corrected the binary checksums with NCSdummy. It flashed ok but came back with a signature error:

[RBT-Tuning]

Originally Posted by ddillenger

Can you guys repack a raw binary into something your cables can flash if I correct the binary checksums?

That should be doable, yes!

Maybe i'm thinking to simple, but the Alpina file should run if we change just a few bytes to trick the ECU with the project#. Afterwards the file gets flashed but the signature check fails of course. Then someone with an appropriate tool has to read the binary, you correct the chks/RSA and then we should be able to "copy" those changes directly into the .0da file.

[dave205t]

Originally Posted by Mik325tds

Hi Dave, good to see you're still on board. Don't worry about putting this on a side track. We are all very patient here.
I did try a very small modification to an original .bin file before (see attached .zip). I corrected the binary checksums with NCSdummy. It flashed ok but came back with a signature error:

Hello Mik,

Yes correcting the end of line checksum and file checksum in the 0pa/0da will not correct the actual data checksums/RSA for the binary itself, just allow winfpk to flash it. Thats why i asked Daz to make a before/mod of the binary (using checksum module for that ecu family).

Best regards, Dave

[Mik325tds]

Originally Posted by dave205t

Hello Mik,

Yes correcting the end of line checksum and file checksum in the 0pa/0da will not correct the actual data checksums/RSA for the binary itself, just allow winfpk to flash it. Thats why i asked Daz to make a before/mod of the binary (using checksum module for that ecu family).

Best regards, Dave

Sorry, I misunderstood.

[ddillenger]

Can someone extract/convert to binary some 0pa/da files and email them to me? Ideally, as closely related to the alpina flash as possible. I have the Bosch EGS plugin, and can easily mod the alpina file to do most anything you guys want, however the bmw units are not covered by the same checksum correction software. I need more bmw binaries.

ddillenger84 (at) gmail

Also, what's wrong with the D mode in the alpina flash?

[ddillenger]

I took a quick look at the 6hp files I do have, and did notice that checksum monitoring is at least partially disabled in the pre-production files. This is usually done to facilitate easier/faster changes during the calibration process.

[DWR]

I can't believe everytime I think this thing is dead, someone comes out of the woodwork with something to contribute. Welcome aboard ddillenger!