[Kgolf31]

Originally Posted by hassmaschine

ok, that makes sense. In that case the simplest way is to just get the Mishimoto thermostat. I don't know if it's any good though, I don't know anyone who has used it, but it's advertised for the N52.

If you have the means to flash yourself (OFT is the only way to DIY flash over OBD currently), then it's a simple matter of changing the 4 temp thresholds for the thermostat to 80c.

this is your 128i or your Z4M?

FWIW, I can do the same stuff with the Z4M that I can do with MSV70. They share about 98% of their code. I don't know if the Z4M has the mapped thermostat though?

This is for the 128i. The Z4M is just a fun daily driver/weekend car in the summer. I'm pretty sure it's a typical thermostat.

OFT meaning open flash tune? If so, can you do this within conjunction of another tune (like currently I have AA as a tune).

We might have to talk further, I'd like to look into the programming more and see limiting factors of the car (like what was discovered with brake controls and nannies that prevented brake consistency)

[hassmaschine]

yes I believe you can read the AA tune and modify it from there. I don't encourage stealing other people's work of course, but I don't see a problem with modifying it for your own personal use.

[Kgolf31]

Originally Posted by hassmaschine

yes I believe you can read the AA tune and modify it from there. I don't encourage stealing other people's work of course, but I don't see a problem with modifying it for your own personal use.

Okay. I'd rather not effect the tune as it's running pretty well. But if I can use OFT and change parameters outside of the engine control that is in place...that would be nice.

I'll shoot you some PMs later to discuss so I don't derail

[Taskmaster]

Originally Posted by hassmaschine

yes I believe you can read the AA tune and modify it from there. I don't encourage stealing other people's work of course, but I don't see a problem with modifying it for your own personal use.

Careful Hass, he'll come back months later denying that you helped him and claiming that you're clueless.

[rjahl]

Originally Posted by Kgolf31

Okay. I'd rather not effect the tune as it's running pretty well. But if I can use OFT and change parameters outside of the engine control that is in place...that would be nice.

I'll shoot you some PMs later to discuss so I don't derail

I'd be really surprised if AA did not modify the program section to disable memory read-outs through ODB.

[Taskmaster]

Originally Posted by rjahl

I'd be really surprised if AA did not modify the program section to disable memory read-outs through ODB.

If what I heard is true, try encrypted the file so it can't be read of modified. I could be wrong obviously, but that was my take on how they protected their IP.

[rjahl]

Originally Posted by TheAxiom

If what I heard is true, try encrypted the file so it can't be read of modified. I could be wrong obviously, but that was my take on how they protected their IP.

They might encrypt the file for transporting through email and flashing but the actual code withing the DME can not be encrypted. All they can do, is lockout some of the ODB based commands within the flash/program to keep out the simple hackers.

Thee freescale processor in the MSV70 does not support encrypted code, not 100% sure about the MSV80.

Some ECUs support encrypted code and decode on the fly. The ZF TCUs have such processors.

[hassmaschine]

Originally Posted by TheAxiom

If what I heard is true, try encrypted the file so it can't be read of modified. I could be wrong obviously, but that was my take on how they protected their IP.

the file they email to customers is encrypted. But you can still read it out over OBD.

AFAIK, there is no way for them to modify the boot sector to encrypt the file on the DME. Not unless they have BMW's private 1024bit RSA key for the boot sector and know how to factor it.

[Terraphantm]

Originally Posted by hassmaschine

the file they email to customers is encrypted. But you can still read it out over OBD.

AFAIK, there is no way for them to modify the boot sector to encrypt the file on the DME. Not unless they have BMW's private 1024bit RSA key for the boot sector and know how to factor it.

If AA can flash the MSV70 over OBDII, then they either have the key or a valid signature.

[hassmaschine]

Ah, yes, but not for the boot sector and program space necessarily. A buddy of mine found out the hard way when he ponied up $3500 for Kess V2 that it can only do parameter space writes because they don't have the other keys.

It's not like AA or anyone writes their own flash routines - they are using a product made and supported by somebody else.

[rjahl]

Originally Posted by hassmaschine

hey cool. If he can directly log RAM locations, I can list or find any of the ones we might be interested in.

Just did a quick test. You can log MSV 70 memory addresses with the latest version of Testo. Still stuck with the 254 byte limit with each request but you can make 20 plus requests at one time.

[hassmaschine]

For the most part you probably don't want a huge swath of ram anyway. You might have an area with 3-4 bytes that are interesting and the rest you'd probably never care about.

Let me know if there are any specific variables you're looking for and I'll see if I can find the addresses for them.

[Terraphantm]

Originally Posted by hassmaschine

Ah, yes, but not for the boot sector and program space necessarily. A buddy of mine found out the hard way when he ponied up $3500 for Kess V2 that it can only do parameter space writes because they don't have the other keys.

It's not like AA or anyone writes their own flash routines - they are using a product made and supported by somebody else.

From what I can tell the program sector uses the same keys, not sure about boot sector. Just have to generate a valid signature and change the pointers if necessary.

I agree, they're not modifying the DME to encrypt anything. That's a lot of effort, and if the hardware was capable of it without slowing down excessively, BMW/Siemens probably would have done it themselves rather than using signatures.

[hassmaschine]

I don't know, I know for sure Kess V2 will fail if you change anything in the boot or program space. It does a full write to everything either way (which is stupid), but I presume it fails because the RSA signature is wrong.

Support told him to use BDM.

[Terraphantm]

Originally Posted by hassmaschine

I don't know, I know for sure Kess V2 will fail if you change anything in the boot or program space. It does a full write to everything either way (which is stupid), but I presume it fails because the RSA signature is wrong.

Support told him to use BDM.

I mean the program signature and pointers are definitely passed to the same routine that does the parameter check.

I'd be tempted to try changing the pointers and signature in the program to match the same signature and addresses in the parameter and see what happens.

[rjahl]

Originally Posted by Terraphantm

I mean the program signature and pointers are definitely passed to the same routine that does the parameter check.

I'd be tempted to try changing the pointers and signature in the program to match the same signature and addresses in the parameter and see what happens.

Have you seen any of the partial flash files from my ODB Galletto? I've shared them with Hassmachine in the past.

[rjahl]

Originally Posted by hassmaschine

For the most part you probably don't want a huge swath of ram anyway. You might have an area with 3-4 bytes that are interesting and the rest you'd probably never care about.

Let me know if there are any specific variables you're looking for and I'll see if I can find the addresses for them.

I'm only looking to see the stored values for knock or octane adaption. I'm interested to compare those values against the tune.

[CobraMarty]

rjahl-
Can you make a 3D map for fuel and timing? like this one you did here for valve lift.

[hassmaschine]

The fuel map is actually 2D (wot). The part throttle map is flat - lambda 1.0.

Wot ignition is a "map" but is also close to 2D.

[CobraMarty]

Does it ever go richer than lamda 1.0?

So a plot of rpm vs load for fuel and ignition is not 3D?

Do you have those fuel and ignition 2D values?

[hassmaschine]

the maps are 3D. but the part load fuel is all lambda 1.0. There's no reason at all to mess with this map.

I'm sure I posted the ignition maps and full load fuel before in this thread. But it's going to look different depending on what tune you have - 325 vs 328 vs 330i.

[rjahl]

Originally Posted by hassmaschine

the maps are 3D. but the part load fuel is all lambda 1.0. There's no reason at all to mess with this map.

I'm sure I posted the ignition maps and full load fuel before in this thread. But it's going to look different depending on what tune you have - 325 vs 328 vs 330i.

You posted the lambda maps on page 5.