Transmission remap - Let's do it ourselves

rjahl · 03-11-2016, 07:45 AM

Quote:

Originally Posted by DWR

Quote:

Originally Posted by ddillenger

I can post the shift maps if someone has a binary in mind.

Obviously, a binary that we are interested will not be here for awhile.
Could you pick any binary and show us the shift maps. I think it would be instructive. Thanks.

He can use the one I posted a few pages back.

dave205t · 03-11-2016, 09:55 AM

Hi Guys,

Has anyone already posted a before (stock) full readout and after (small changes with checksums and rsa's corrected using proprietary tool) ? So i can inspect and deduct some logic without unpacking the compressed code ?

Best regards, Dave

rjahl · 03-11-2016, 10:27 AM

Quote:

Originally Posted by dave205t

Hi Guys,

Has anyone already posted a before (stock) full readout and after (small changes with checksums and rsa's corrected using proprietary tool) ? So i can inspect and deduct some logic without unpacking the compressed code ?

Best regards, Dave

I don't know anyone who knows how to correct the RSA signatures on a modified file. That's the biggest problem we have. Crack the RSA and this thread would have died months ago.

RBT-Tuning · 03-11-2016, 12:27 PM

Quote:

Originally Posted by dave205t

Hi Guys,

Has anyone already posted a before (stock) full readout and after (small changes with checksums and rsa's corrected using proprietary tool) ? So i can inspect and deduct some logic without unpacking the compressed code ?

Best regards, Dave

Hi Dave,

what about the 2 files I posted a few weeks ago? They are not far apart.

btw: What i want is simple. Get rid of this fucking TC slip below 30 km/h...everything else is fine for me.

Mik325tds · 03-11-2016, 12:33 PM

^^^ Same here.

Mik325tds · 03-11-2016, 12:37 PM

Quote:

Originally Posted by ddillenger

Does BMW Scanner still work on these? I know it does on the slightly older models, and can read raw data

That's my hope. I tried the BMW Scanner on my E53 X5 with the same transmission. It read out fine.
However, the BMW Scanner uses K-Line protocol to do the direct access memory read. The E90 has only CAN diagnostics. That's why I'm trying to populate the K-Line connector at the transmission so I can use BMW scanner to download the binaries for you.

passuff · 03-13-2016, 12:13 PM

Quote:

Originally Posted by Mik325tds

That's my hope. I tried the BMW Scanner on my E53 X5 with the same transmission. It read out fine.
However, the BMW Scanner uses K-Line protocol to do the direct access memory read. The E90 has only CAN diagnostics. That's why I'm trying to populate the K-Line connector at the transmission so I can use BMW scanner to download the binaries for you.

Hey, just stepped into this interesting discussion. I think for K-Line CAN Gateway you can use this tool:
http://cartools.lv/Robin/page8.html
I own it but not yet used it...
Someone here ever found a2l, hex or any detailed logic about ZF/BMW TCU software functionalities?

locolobo · 03-13-2016, 03:52 PM

Mine does that too - At least I am glad to know I'm not the only one suffering. Apparently this is a design defect.

Quote:

Originally Posted by RayBan81

Hi Dave,

btw: What i want is simple. Get rid of this fucking TC slip below 30 km/h...everything else is fine for me.

Mik325tds · 03-13-2016, 06:15 PM

Quote:

Originally Posted by passuff

Hey, just stepped into this interesting discussion. I think for K-Line CAN Gateway you can use this tool:
http://cartools.lv/Robin/page8.html
I own it but not yet used it...
Someone here ever found a2l, hex or any detailed logic about ZF/BMW TCU software functionalities?

Welcome passuff!
Thanks for the link, but the issue is that our TCM doesn't allow memory reads through CAN. We have to use K-Line to do that. However, the K-Line is not populated on the connector to the transmission.

Mik325tds · 03-13-2016, 06:17 PM

Quote:

Originally Posted by locolobo

Mine does that too - At least I am glad to know I'm not the only one suffering. Apparently this is a design defect.

I don't think it is a design fault rather than a conservative design decision to protect the transmission from very high torque and torque impulses in 1st and 2nd gear.

RBT-Tuning · 03-13-2016, 07:00 PM

Quote:

Originally Posted by Mik325tds

Quote:

Originally Posted by locolobo

Mine does that too - At least I am glad to know I'm not the only one suffering. Apparently this is a design defect.

I don't think it is a design fault rather than a conservative design decision to protect the transmission from very high torque and torque impulses in 1st and 2nd gear.

I had the pleasure to talk to the N57 project leader in Steyr/Austria a few months ago. He told me that it was due to NVH issues for the rear passengers under high loads in 1st and 2nd gear.

RBT-Tuning · 03-13-2016, 07:01 PM

Quote:

Originally Posted by Mik325tds

Quote:

Originally Posted by locolobo

Mine does that too - At least I am glad to know I'm not the only one suffering. Apparently this is a design defect.

I don't think it is a design fault rather than a conservative design decision to protect the transmission from very high torque and torque impulses in 1st and 2nd gear.

I had the pleasure to talk to the N57 project leader in Steyr/Austria a few months ago. He told me that it was due to NVH issues for the rear passengers under high loads in 1st and 2nd gear.

locolobo · 03-13-2016, 08:28 PM

Very interesting to learn the reason, and that it's intentional! If anyone rides in my rear seat, it's the kids who won't appreciate the engineering.

dave205t · 03-14-2016, 04:56 AM

Quote:

Originally Posted by RayBan81

Hi Dave,
what about the 2 files I posted a few weeks ago? They are not far apart.

The 2 0pa files you posted are indeed quite close, but 0da have a lot of differences.
I did some more analysis on the only complete binary readout i have which is "EGS_00000-FFFFF-00 first.bin" posted by Rjahl in the post i quoted below

Quote:

Originally Posted by rjahl

DMW scanner dump and matching ODA / OPA file in one place.

ZB#7571102
HN#7574645
SW#7571103

https://www.dropbox.com/sh/md77cus3t...9t3QsBAfa?dl=0

Daz if you have time, could you make crc/rsa correction on this bin, first on the readout as is to verify if it is indeed a complete good readout and if so, on the bin with a few small changes in calibration area and program area (two separate files) so i can see what is affected by each mod ?

I wrote an initial checksum/rsa correction tool for this bin (inspired by the framework from me7sum), but am still missing some info to make i completely working

So work is being done to move you guys forward, but still missing essential pieces of the puzzle

To move forward, i would need more known good full bin readouts and the before after mod files requested above

Best regards, Dave

rjahl · 03-14-2016, 12:37 PM

The best I can do would be to "build" another Bin by slicing a different but matching calibration file into this read out. Ie. Splice a 3.0SI file into this 3.0I file with matching hardware numbers.

This method works pretty well with the DMEs providing you don't step on any country, variant or power class codes.

I believe all of the the E85 Automatics (6HP19a) used just two variants of the calibration file, low output and high output. Both used the same program and frankly, I can't find anything but the current program file. So I don't see any hidden problems with variant matching.

In any case, I thought the RSA signature and checksums for the program and calibration sections were separate?

DWR · 03-16-2016, 12:33 AM

Quote:

Originally Posted by dave205t

To move forward, i would need more known good full bin readouts and the before after mod files requested above.

Mod files? Please be more specific what that means. Does 1 value change in a map suffice?

dave205t · 03-16-2016, 04:34 AM

Quote:

Originally Posted by DWR

Mod files? Please be more specific what that means. Does 1 value change in a map suffice?

Yes a one value change in either program or calibration area would suffice (if that area is covered by the checksum/rsa area's; Take care it only helps me if the files are correctly checksum/rsa corrected after making the change using some other tool that already does it.

Best regards, Dave

dave205t · 03-16-2016, 04:49 AM

Quote:

Originally Posted by rjahl

The best I can do would be to "build" another Bin by slicing a different but matching calibration file into this read out. Ie. Splice a 3.0SI file into this 3.0I file with matching hardware numbers.

This method works pretty well with the DMEs providing you don't step on any country, variant or power class codes.

I believe all of the the E85 Automatics (6HP19a) used just two variants of the calibration file, low output and high output. Both used the same program and frankly, I can't find anything but the current program file. So I don't see any hidden problems with variant matching.

If someone can make a pack for each transmission variant, containing matching 0pa/0da (so a separate subdir within pack dir for each program (0pa) / cal (0da) combination; That would also help, i can convert those into bins as well.

Quote:

Originally Posted by rjahl

In any case, I thought the RSA signature and checksums for the program and calibration sections were separate?

Yes the rsa signature for program and calibration are store in seperate locations withing the appropriate sections, but to check or recalculate them you need the complete bin.

Best regards, Dave

Mik325tds · 03-16-2016, 08:57 AM

Quote:

Originally Posted by dave205t

If someone can make a pack for each transmission variant, containing matching 0pa/0da (so a separate subdir within pack dir for each program (0pa) / cal (0da) combination; That would also help, i can convert those into bins as well.

I created two folders (GKE195, GKE215). All of the .0da will work with the one .0da of the respective sub-directory.
We are most interested in the A7606274.0da which is the original 335d cal and the A7615836.0da which is the Alpina B3 cal.
The password is your username:
https://www.dropbox.com/s/08jaw6flf1...5_215.zip?dl=0

Thank you for your hard work!

DWR · 03-16-2016, 09:05 AM

Quote:

Originally Posted by dave205t

If someone can make a pack for each transmission variant, containing matching 0pa/0da (so a separate subdir within pack dir for each program (0pa) / cal (0da) combination; That would also help, i can convert those into bins as well.

That is fantastic. Then those bins can be passed onto ddillenger. Thank you.

ddillenger · 03-18-2016, 02:05 PM

I have all the alpina files converted to binary already, so no need to play with those :P

I can post them if anyone would like?

335dsleeper · 03-18-2016, 02:25 PM

Alpina for the D?

03-11-2016, 09:55 AM	#706
dave205t Private First Class 218 Rep 109 Posts Drives: BMW e90 Join Date: Jan 2016 Location: Netherlands iTrader: (0)	Hi Guys, Has anyone already posted a before (stock) full readout and after (small changes with checksums and rsa's corrected using proprietary tool) ? So i can inspect and deduct some logic without unpacking the compressed code ? Best regards, Dave
	Appreciate 0 Quote

03-11-2016, 12:33 PM	#709
Mik325tds Major 808 Rep 1,192 Posts Drives: 335d M-Sport Join Date: Jul 2014 Location: Greater Detroit iTrader: (0)	^^^ Same here.
	Appreciate 0 Quote

03-13-2016, 08:28 PM	#717
locolobo Oil Burner 22 Rep 119 Posts Drives: 2009 335d Barbera Red Metallic Join Date: May 2013 Location: Columbus, Ohio iTrader: (1) Garage List 2013 Volkswagen Pas ... [0.00] 2004 Honda Pilot [0.00] 2009 335d [0.00]	Very interesting to learn the reason, and that it's intentional! If anyone rides in my rear seat, it's the kids who won't appreciate the engineering. __________________ 2009 335d Barbera Red Metallic; Mods: BPC tuned, Bohl Diesel Performance, Laser Veil, BelTronics Pro 500
	Appreciate 0 Quote

03-14-2016, 12:37 PM	#719
rjahl Colonel 1002 Rep 2,287 Posts Drives: Z4 35is Join Date: Jun 2011 Location: Tampa iTrader: (0) Garage List 2012 Z4 35is [0.00]	The best I can do would be to "build" another Bin by slicing a different but matching calibration file into this read out. Ie. Splice a 3.0SI file into this 3.0I file with matching hardware numbers. This method works pretty well with the DMEs providing you don't step on any country, variant or power class codes. I believe all of the the E85 Automatics (6HP19a) used just two variants of the calibration file, low output and high output. Both used the same program and frankly, I can't find anything but the current program file. So I don't see any hidden problems with variant matching. In any case, I thought the RSA signature and checksums for the program and calibration sections were separate?
	Appreciate 1 Quote

03-18-2016, 02:05 PM	#725
ddillenger New Member 23 Rep 22 Posts Drives: Range Rover SC Join Date: Feb 2016 Location: USA iTrader: (0)	I have all the alpina files converted to binary already, so no need to play with those :P I can post them if anyone would like?
	Appreciate 0 Quote

03-18-2016, 02:25 PM	#726
335dsleeper Banned 390 Rep 1,622 Posts Drives: 09' 335d 10'35D Join Date: Dec 2015 Location: Suffolk, va iTrader: (0)	Alpina for the D?
	Appreciate 0 Quote