[DWR]

Originally Posted by Mik325tds

Has anyone ever asked if Bob@BPC can do a bootloader replacement on the EGS?

I just did. Should have a answer in a day, Bob is very responsive.

[RBT-Tuning]

Originally Posted by Mik325tds

Hm. Maybe that is a quirk of the A7610591.0da cal that I'm driving now. I can't remember noticing it as much with the original cal.
What is so bad about the E90 manuals? I have not driven one so far, but I guess many here think "any" manual must be better than our automatic.

I had a 120d, 123d and 335i before and none of them had a pleasant manual. They all were inprecise, and required a lot of force at the lever. The 335i (Touring) had aditional "problems" at lift-off because of the very soft "mounting" of the whole drivetrain. Felt like an old Mercedes Diesel cab. )

The only enjoyable manual fom BMW i ever had was in my Z4 Coupe.

And the best of them all are found in Porsches. Pure pleasure.

In general i see a "trend" nowadays to build shitty manuals, because everyone goes for Auto's anyway...

[dave205t]

Hi Guys,

Had a few cycles to work on this project, extended TCU_flash so it can now fully program (not only read) calibration and program.

So far i have been unable to rewrite the program area in 0x2000-0x2ffff, if anyone has some ideas, that would be very welcome.

Best regards, Dave

[_TB_]

Originally Posted by dave205t

Hi Guys,

Had a few cycles to work on this project, extended TCU_flash so it can now fully program (not only read) calibration and program.

So far i have been unable to rewrite the program area in 0x2000-0x2ffff, if anyone has some ideas, that would be very welcome.

Best regards, Dave

Is there a need for rewring the program area? If we just want to alter the "calibrations" eg. shiftpoints, lockups, line pressure.

When remapping the ECU you normally do not touch the program area. (unless you make changes to the program like launchcontrol switched by the cruise control button, double programs etc.)

[dave205t]

Originally Posted by _TB_

Is there a need for rewring the program area? If we just want to alter the "calibrations" eg. shiftpoints, lockups, line pressure.

When remapping the ECU you normally do not touch the program area. (unless you make changes to the program like launchcontrol switched by the cruise control button, double programs etc.)

Well we still need to defeat the RSA right ?

[DWR]

Originally Posted by dave205t

Well we still need to defeat the RSA right ?

Right
My immediate thought is about procurring a non RSA TCU. Maybe something that is the same vinatage as 330d EDC16. Just guessing protections came into TCUs around the same time as ECUs.

Mik325tds probably has some words of wisdom.

BTW, welcome back.

[_TB_]

Originally Posted by dave205t

Well we still need to defeat the RSA right ?

The RSA checks is in the bootloader right?

[dave205t]

Originally Posted by _TB_

The RSA checks is in the bootloader right?

Yes correct

[Mik325tds]

Do we know which section the bootloader is in? Please don't tell me 0x2000.

[dave205t]

Originally Posted by Mik325tds

Do we know which section the bootloader is in? Please don't tell me 0x2000.

Haha, sorry to disappoint you there, but indeed its in 0x20000-0x2ffff.

I have already devised a few ways to bypass it, all i need todo is to write to either this 0x20000-0x2ffff section or to CALRAM (0x3f8000-0x3f8fff), but surprise both are prohibited.
Prohibited at least in auth level 3, auth level 5 (internally in TCU) might allow some wider access, but i do not have the access key for those on the TCU; luckily i know which RSA public key matches this level 5 access so i might be able to brute force it.

Was anyone able to get some more insight (or info) on writing to TCU protected areas from alternate sources (e.g. Bob or alike) ?

Best regards, Dave

[DWR]

Originally Posted by dave205t

Was anyone able to get some more insight (or info) on writing to TCU protected areas from alternate sources (e.g. Bob or alike) ?

Unfortunately, I was sworn to secrecy. Can you do that? Tell someone something and then say they can't repeat it. I mean is that binding without a pinky swear?
OK, I'll be good.

What that means is tools are there, but competency is somewhat behind.
The tools I'm referring to are, unfortunately, commercial products ($). So, the secret sauce would still be a secret. Not that communications cannot be intercepted, but I don't see the logistics coming together on that.

[kydiesel35]

Originally Posted by DWR

Unfortunately, I was sworn to secrecy. Can you do that? Tell someone something and then say they can't repeat it. I mean is that binding without a pinky swear?
OK, I'll be good.

Shh!

[DWR]

LOL, I like that.

I should explain. A couple of folks have told me that certain forum posts can generate a ton of phone calls about stuff that is not ready for prime time. Answering the phone all day just means progress gets slowed down. A trans tune is one of those things that folks get excited about. Just so I'm clear, no trans tune (that I am aware of) is even close for the 335d, yet.

[dave205t]

Originally Posted by DWR

What that means is tools are there, but competency is somewhat behind.
The tools I'm referring to are, unfortunately, commercial products ($). So, the secret sauce would still be a secret. Not that communications cannot be intercepted, but I don't see the logistics coming together on that.

Interesting, well if the tools are already there, just buy those; always faster than reinventing the wheel. If there is any info that can be shared one way or the other, its very welcome. It feels a bit like im the only one pulling the wagon here ...

Best regards, Dave

[Mik325tds]

Originally Posted by dave205t

Interesting, well if the tools are already there, just buy those; always faster than reinventing the wheel. If there is any info that can be shared one way or the other, its very welcome. It feels a bit like im the only one pulling the wagon here ...

Best regards, Dave

Well, I guess that's true. But only because no one else has anything to contribute.

[DWR]

Originally Posted by dave205t

Interesting, well if the tools are already there, just buy those; always faster than reinventing the wheel. If there is any info that can be shared one way or the other, its very welcome. It feels a bit like im the only one pulling the wagon here ...

Best regards, Dave

Right now, sorry to say, you are pulling the wagon. Simply, you have the greatest competency at this stage of the game. But that doesn't mean we are all sitting on the wagon. I'm walking with you and have no intention of adding any burden. I'll get in back and push the wagon, tell us how we can help.

Also, please consider that I am just relaying a message. Whether the source of the message has it right remains to be seen. I'm rather skeptical by nature, and would bet that the "tool" cannot not do what we would like. I have no way determine that, at this time.

You can give a man a hammer, but if he doesn't know where to drive the nails, it isn't much good.

Finally, let it not be said that your efforts have not been much appreciated. If you walked away from this today, you would still command my admiration.

[Mik325tds]

Originally Posted by DWR

Right now, sorry to say, you are pulling the wagon. Simply, you have the greatest competency at this stage of the game. But that doesn't mean we are all sitting on the wagon. I'm walking with you and have no intention of adding any burden. I'll get in back and push the wagon, tell us how we can help.

Also, please consider that I am just relaying a message. Whether the source of the message has it right remains to be seen. I'm rather skeptical by nature, and would bet that the "tool" cannot not do what we would like. I have no way determine that, at this time.

You can give a man a hammer, but if he doesn't know where to drive the nails, it isn't much good.

Finally, let it not be said that your efforts have not been much appreciated. If you walked away from this today, you would still command my admiration.

Well said my friend. +1

[dave205t]

Originally Posted by DWR

Right now, sorry to say, you are pulling the wagon. Simply, you have the greatest competency at this stage of the game. But that doesn't mean we are all sitting on the wagon. I'm walking with you and have no intention of adding any burden. I'll get in back and push the wagon, tell us how we can help.

Great analogy, very much appreciated.
Some more news from my side; The procedure for obtaining the other access keys is progressing nicely.

Best regards, Dave

[335inDe]

I have been told by a very popular company that they in fact have a TCU remap and are trying to find a way to encrypt it so someone can't just read the tcu file and copy it.. so if anyone has the know how for protecting their work that's the key at this point.

[DWR]

Originally Posted by 335inDe

I have been told by a very popular company that they in fact have a TCU remap and are trying to find a way to encrypt it so someone can't just read the tcu file and copy it.. so if anyone has the know how for protecting their work that's the key at this point.

Sorry, but I find this post funny. We can't figure out how to get passed the security that is native and now the key to the problem is figuring out an encryption method.

Let's make a deal. They give us RSA cracking and we will show how to protect the remap. The answers are interelated, IMO.

[335inDe]

Well maybe they will chime in. They frequent the boards quite often.

[dave205t]

Originally Posted by 335inDe

Well maybe they will chime in. They frequent the boards quite often.

Any additional input is welcome, they might have some fresh ideas. Invite them over