How to disassemble MSS52 DME dump? help needed please

[HybridNz]

Hi Katvis,

I stumbled across your thread while looking for WDS PDF files for a S62B50 into e46 M3 conversion Im working on at the moment.

A friend and myself have successfully transplanted a s50b32 into an e30 thought we will give the e46 m3 a go

I have been working on a few projects which are starting to get down into the protocol and MCU layers and all I can say keep it up!

The same friend of mine who I worked with on the s50/e30 conversion has his own project. And has been working on his Mitsi EVO3 and disassembling his ECU/MCU to add features such as antilag and flat shifting. He successfully reprogrammed the MCU to do this using modified pins from the ECU and creating a new clutch switch into the ECU and writting code to deal with this.
I learnt a lot of what hes done and have been looking at ways to apply it to MSS5X ECUs .. Obviously understanding that the MSS5X ECU class uses more than one CPU which helps complicate things a little.

Im keen to get up and running and maybe assist you in your battle with a colabrative effort.

Ultimately it would be nice to create a Nice XDF file for tuner pro with easy to use scalers etc to add some motorsport features to our ECU's like the JDM market enjoys.

keep it up

Cheers
Josh

[Katvis]

Some more info for those interested:
Checksums, the quick and dirty way..

For boot loader, there is an address just after the start of the code
at 200h which show where the BOOT section end, this address is in word
format. Highlight the BOOT section up to the word address, calculate
the CRC16 and you will see it match the checksum directly at the end
of that section.

For the CODE section you do as follows, go to address 3DBEh, here you
will find a address in the start of the CODE section, goes to this
address and again here you will find the END OF CODE address,
highlight the code from 10000h up to this address and calculate the
CRC16 and you will see the check sum match directly after the code end
word.


I have not successfully decode the DATA section, for some or other reason this does not work for the data, any ideas?

[Meat-Head]

Sorry, *WHY* are you doing this.

Apart from the cool test rig, why?

[HybridNz]

Sorry, *WHY* are you doing this.

Apart from the cool test rig, why?

When you disassemble an ECU you can do more than just fiddling with the maps. You can work out the true inner workings of HOW and WHY the ECU does what it does.

EG you can replace a pin funtion on the ECU to install a clutch switch and program in flatshifting or other motorsport style functions.

Effectively turning your stock ECU into same capability as a an aftermarket ECU but you get to retain all of the great stateful functionality such as warm up programs etc.
You can also use spare ROM space to store higher resolution maps that stock, which benefit boosted applications.

It would be awesome to get it to a state where a XDF overlay can be made for each BIN and people can work their own cars with out having to disassemble and edit raw data.

the other reason is its a bloody cool hack if nothing else.

[malva]

WOW,

Sounds like you could build a spaceship mate, why not do something really awesome like hack into Barclays and transfer ?1,000,000 to me!

[0to60Motorsports]

Wow loads of info here. Most of it is beyond me but great work guys

[paffy]

Any progress on this ?

I just started on MSS54 and the software seems pretty much the same.

P.

[SliM3]

This is an extremely resourceful thread. I am working on a pretty LARGE (translated) xdf with maps, curves, and scalars (actually more than what is needed for tuning). Hardest thing is guesstimating what the hell some of these functions control.

My next step is to learn what you are doing here. GREAT WORK!! And we also have a lot of great info over at Comprehensive MSS54/MSS54HP DME Information - BMW M3 Forum.com (E30 M3 | E36 M3 | E46 M3 | E92 M3 | F80/X) M3Forum.

[thehsm]

Could they be PowerPC processors?

[Katvis]

Some more info for those interested:
Checksums, the quick and dirty way..

For boot loader, there is an address just after the start of the code
at 200h which show where the BOOT section end, this address is in word
format. Highlight the BOOT section up to the word address, calculate
the CRC16 and you will see it match the checksum directly at the end
of that section.

For the CODE section you do as follows, go to address 3DBEh, here you
will find a address in the start of the CODE section, goes to this
address and again here you will find the END OF CODE address,
highlight the code from 10000h up to this address and calculate the
CRC16 and you will see the check sum match directly after the code end
word.


I have not successfully decode the DATA section, for some or other reason this does not work for the data, any ideas?

I am very glad the guys on the BMW M3 forum figured out how to calculate the DATA section check sums, have to test it sometime on my data...

It is well worth while to read and join the BMW M3 forum if you need more information on the MSS52 MSS54 DME

[bmwMcrzy]

Katvis, how many of the MSS52's maps do you have defined?
Are you using winOLS ?

[Katvis]

Katvis, how many of the MSS52's maps do you have defined?
Are you using winOLS ?

I have not defined a lot of MAPS or CURVES as it was never my goal to tune the DME. If you send me a private message with your email address I can forward the excel spreadsheet that I have and this should give you a good idea which MAPS/CURVES/CONSTANTS are available.

I would strongly suggest to join the conversation on the M3Forum because to do this work on your own is a very hard route to go

[tap46]

tap here crossing over from M3Forum.

Trying to learn more about the MSS52/4!

I should be able to supply a more complete list of maps and curves to support the disassembly if needed!

[SKYTON]

I have the complete dump of the code, my problem is that if I use IDA to disassemble I need to chose the Processor type.

For the Bosch motronics it is easy as Andy Whitaker made nice tutorial videos that explain exactly how to disassemble the code.

I am looking for similar help to disassemble the MSS52 code.

Cheers
C

can you shre link to tuto Andy Whitaker

[Katvis]

can you shre link to tuto Andy Whitaker

Good day
I have tried to find the post but cannot see it now, which ECu are you working on?

Cheers
K