CAS3+ X6 Urgent help Needed!!

[snatchme]

Hello,

Can somebody help me with correct Flash file from CAS3+?

Customer wants to kill me if i have his car not running by Friday. (No Joke.)

It's a CAS3+ from 11/2010 with 0L15Y (512) inside.
See also Pic. for SW info.

And can somebody check the eeprom data from the 0L15Y in the attachment if it is corrupted or not?
i checked myself with : R260,R270, Abritus,Tango,Hitag2 V3.11. no errors found.

What happend: wanted to program new key, had added new key to the original file with Tango, wrote data back and with desoldering i had a short now i cannot acces the eep and Flash memory anymore.

Now i had taken other CAS3 ( No +).
Wrote the only data i had back, EEP file.
installed CAS back into the car but now i get the message from the engine ECU "EWS manipulation protection active".
I think that this error is active because i have the wrong Flash file on the 0L15Y.
Because the Remote from the new key works, and the car goes on ignition just the starter will not crank.

many many thanks for your help with this problem..

Greetz Snatchme

[PremierD]

Hello,

Can somebody help me with correct Flash file from CAS3+?

Customer wants to kill me if i have his car not running by Friday. (No Joke.)

It's a CAS3+ from 11/2010 with 0L15Y (512) inside.
See also Pic. for SW info.

And can somebody check the eeprom data from the 0L15Y in the attachment if it is corrupted or not?
i checked myself with : R260,R270, Abritus,Tango,Hitag2 V3.11. no errors found.

What happend: wanted to program new key, had added new key to the original file with Tango, wrote data back and with desoldering i had a short now i cannot acces the eep and Flash memory anymore.

Now i had taken other CAS3 ( No +).
Wrote the only data i had back, EEP file.
installed CAS back into the car but now i get the message from the engine ECU "EWS manipulation protection active".
I think that this error is active because i have the wrong Flash file on the 0L15Y.
Because the Remote from the new key works, and the car goes on ignition just the starter will not crank.

many many thanks for your help with this problem..

Greetz Snatchme

Check this out mate .. may help

[markony79]

use GT1 and just to -synchronoise- Ecu with EWS(Cas)

its hapend to Bmw with Diesel engine when the Ecu stay out more then 20min with out batery

[3in1san]

Hi
Markony have right

Rolle code has change, this is normal
you must sycnchronize with gt1, inpa etc

[snatchme]

Hello,

Ok will have a try if i can synchronize with abritus.

PremierD: sorry thanks for the effort, but you added the Eep file of the flash mcu.. needed the Flash file of the Flash mcu.

thanks anyway..

[dimitar]

You can align with GT1 if car cranks but dont start, if it doesnt crank it means that the key is not recognised either the fixed code or the variable code,

[mihaiservice]

Hi
Rolle code has change becouse ISN and date was different in Cas now
you must sycnchronize with gt1 or ops.
in Function will see dme-cas sycnchronization but with 2 choice:
1.new ecu...
2.old ecu ...use this one

[snatchme]

Hello All,

To let you know problem has been solved and i am still alive..:bounce:

As i tought there was the wrong Flash file on the CAS MCU.
Had flash file with ELV ( Electronic steering lock) but car had no ELV.

And CAS eep was corrupted, managed to correct it with normal Hex editor.
this was also why i got the EWS manipulation error.

Synchronization CAS-DDE was not possible.
my CAS3+ was in EWS4 mode.

Synchronization is possible on CAS3 in EWS3 Mode
but if the CAS3 or 3+ is in EWS4 mode this is not needed or possible anymore.

but anyway thanks for the support and thinking with me..

Greetz

[cartech]

that's great:trytofly:, car was started

[dilick]

Did you start car or changed ECU too?

[snatchme]

Hello all,

i did not changed the ECU just corrected the CAS file.

Just compare the 2 file out of the attachment and you will see what i have done.

First 2 bytes (00 00) is for automatic gear box sync code the 2 bytes behind it is your DME code (A5 37) the next byte is your checksum (DC)( Ubyte- 8bit)
you can also read the DME code from your key with Tango, just do read key info, you will see the VIN but also the DME code.

each time the CAS is disconnected / connected from the car you get an extra set of EGS/DME coding that has been crypted.
in this case 00 00 AF 04 (B3)
just change the crypted parts back with the original and you will be o.k.

it took me 3 weeks to see the mistake but the sollution is that easy to correct. So easy that i did not see it for 3 weeks.

Greetz from the Dutch side of life.

[labusas]

So are you saying this "corruption" will happen every time you just disconnect and connect cas? Or did the short did it?
What if battery is disconnected all the time while cas is out?

[ajayrao]

Hello
Thank you snatchme for this valuable post ,if u have working key u can extract dme from key ,but in absence of working key how did u read dme /dde code ? by diagnostics?
best regards
Ajay

[labusas]

If I understand it correctly it is in the cas dump in the top line:
"First 2 bytes (00 00) is for automatic gear box sync code the 2 bytes behind it is your DME code (A5 37)"
Look at his dump and you'll see where "A5 37" is, the DME code.

[snatchme]

Hello
Thank you snatchme for this valuable post ,if u have working key u can extract dme from key ,but in absence of working key how did u read dme /dde code ? by diagnostics?
best regards
Ajay

you can also see in the original file, the correct code is the only one that did not change. 1 time correct code, many times incorrect code.

[snatchme]

If I understand it correctly it is in the cas dump in the top line:
"First 2 bytes (00 00) is for automatic gear box sync code the 2 bytes behind it is your DME code (A5 37)"
Look at his dump and you'll see where "A5 37" is, the DME code.

Disconnecting battery would be the same as removing CAS.
changes will take place.

and yes you are understanding correctly DME code is "A5 37".

[ajayrao]

hello
can you please tell for manual what it is ,as you said for automatic is first 2 bytes
best regards
ajay

[snatchme]

hello
can you please tell for manual what it is ,as you said for automatic is first 2 bytes
best regards
ajay

For Manual the 2 first bytes are "00 00".

[3abas27]

For Manual the 2 first bytes are "00 00".
THANKS FOR THIS HELPFUL RXPLANATION

[radiodecoder23]

For Manual the 2 first bytes are "00 00".

Hello snatchme ;

please help....

http://www.digital-kaos.co.uk/forums/f178/bmw-x5-dme-cas3-tampering-324076/

[andreic]

Hello snatchme,

Do you know if the checksum also includes the two bytes for EGS or just the DME? If it includes both, can you please give me an algo for calculating it(or a hint if possible)?
Thanks

BR,
Andrei


Hello all,

i did not changed the ECU just corrected the CAS file.

Just compare the 2 file out of the attachment and you will see what i have done.

First 2 bytes (00 00) is for automatic gear box sync code the 2 bytes behind it is your DME code (A5 37) the next byte is your checksum (DC)( Ubyte- 8bit)
you can also read the DME code from your key with Tango, just do read key info, you will see the VIN but also the DME code.

each time the CAS is disconnected / connected from the car you get an extra set of EGS/DME coding that has been crypted.
in this case 00 00 AF 04 (B3)
just change the crypted parts back with the original and you will be o.k.

it took me 3 weeks to see the mistake but the sollution is that easy to correct. So easy that i did not see it for 3 weeks.

Greetz from the Dutch side of life.