Need Advice - EWS2 on 1995 BMWs

[zilog357]

Hello guys. I know this is old stuff (OBD-I) but, does anyone know a way of deleting EWS2 from the EPROM file (27C512) instead of the EWS box EEPROM?

I know there are some guys that have done so, but no way I can get the idea from them.

For example, below I attached both EWS and Non-EWS original files of the same car. The EWS is a late 1995 E36 325i, and the Non-EWS is a late 1994 (sold as a 1995 model) not using the EWS system.

Both are from a 0 261 200 413 Bosch ECU.

I will appreciate any advice.

Thanks.

[cjawahir]

company in USA that does this only for bosch .

there is a lot of info on that chip , to tune the car map settings

the non ews bin have more info on it than the one with ews .


cj

[zilog357]

Thank you very much for replying.

Yes, there is a lot of info, but I only know fuel and ignition maps (WOT and Part Throttle), rpm limiter, checksum, maf correction, etc. There is an information block table near the end with some data too, but I do not know how to stop the ecu from expecting the EWS data form the EWS module and stopping the engine if it does not receive that data.

I am thinking in comparing the files and try to do an analysis of both, but I am not very skilled on disassembly, specially if the best disassembler (IDA PRO v5.5) does not seems to do the job right for that specific MCU (some version of the Intel 8096).

Please, if someone know how to delete EWS from the engine EPROM I will appreciate to shed some light on it.

Thanks.

Rick

[cjawahir]

or your can buy this >>>SMOK (http://www.smok.com.pl/index.php?lang=en&id=oferta&kategoria=2&produkt=30)

[zilog357]

or your can buy this >>>SMOK (http://www.smok.com.pl/index.php?lang=en&id=oferta&kategoria=2&produkt=30)

Thanks. That gadget would be nice for emergencies, but what I am trying to do is to prepare a chip that can run on EWS ecus, without needing to cut wire number 66 on the ecu (coming from the EWS box).

Well, I guess it would be a good project to start with. By the way, impressive how many immobilizer hacking tools come from Poland. Looks like this one generate a specific signal to fool the ecu into thinking that the correct key is inserted...

[ecuconnection]

I'm also looking for im*o off software for ews or a better understanding of the code that must be edited :)

Kind regards

[xbyte]

Your ews key is 5545 ascii stored at 0xFE7B to 0xFE7F

[zilog357]

Your ews key is 5545 ascii stored at 0xFE7B to 0xFE7F


Thank ypu for that X-Byte.

The more info I learn about it, the less difficult it will be to solve it.

[mikeslocks]

When you flash with a non ews dump you have to cut the green wire going to the ecu its has grey stripes might look white after all these years. Off the back off my head its number 66 but might be 46. You will see that wire it is a shit thicker than the rest green stripped wires you put the old flash in from a red lable 04,or a 04 used ecu altogether thats how the boasters did it back in the day. They cut the wire/trace inside the ecu for the not so bright could just swap. I work part time for insurance companies except all state ( I was in a mva (got hit in a suv rolled seven time) and they had a million dollar rider and I landed in debt. When Im against them for a theift for defense I pull out all my secrets to get get the car started with out key. Stab the dash on some that have immo info in it that lets the car still run and pry the focus front off the ignition to watch the sidebar pop off. Got them on a early 2000 escalade they had mrd ignitions not transponders showed how to pop off the black ring off the ignition and you can use a peice of steel of a windshield wiper insert at the 740 position to hold pressure at the side bar and use almost any key thats worn to to turn the ignition over and be out in less than 30 seconds. One of the mods said they do not want immo no more Im thinking about my own web site with immo and help locksmiths. Really a lock smith site with immo only to special people. Thanks.

[zilog357]

Thank you for the info mikeslocks.

Yes it is known that you may use a red-label 413 file on a silver-label one and it will run if wire #66 on the ecu is cut.

The thing is that many local customers have asked for a method of disabling the EWS-II on those cars as you mention, but when we say the method they either say that they wouldn't any wire cut from their car or say that it is "too crafty" if it is to be done by their selves.

That is why I am looking for a way to disable it from the chip as Jim Conforti has done with his chips. It will be very handy for selling ecms no matter what version they have.

Regards,

Rick

[xbyte]

Seems like all the ECU needs it the 4 digit ISN(idividual serial number) key from the ews box, me and my friend tried to patch out those routines comparing that eprom ISN with the ISN from the ews box, but it still did`nt fire up, we tried for days with different ways to patch it without any luck yet.

We also wrote c code of the routine that reads the ISN from the eprom wraps it around and writing it to sram chip for compare.

http://hackintosh.no/filedump/ews_del/ews2_reverse.txt


ISNasciikey 5754 encodes to XRAM_272 = 05 , XRAM_273 = 7A
There must be something checking if the ews box is present before running the ISN check, and we have not found that stuff yet.

I did take a chip from another type of ecu and tested just for fun, and the car started without any ews box, but runned very poorly, so it shuld be possible to patch this ews 2 stuff away from the eprom.

here is a good doc i found explaining the ews
http://www.europeantransmissions.com/Bulletin/DTC.BMW/understandthe%20EWS%20BMW.pdf

[C16XE]

Thank you for the info mikeslocks.

Yes it is known that you may use a red-label 413 file on a silver-label one and it will run if wire #66 on the ecu is cut.

The thing is that many local customers have asked for a method of disabling the EWS-II on those cars as you mention, but when we say the method they either say that they wouldn't any wire cut from their car or say that it is "too crafty" if it is to be done by their selves.

That is why I am looking for a way to disable it from the chip as Jim Conforti has done with his chips. It will be very handy for selling ecms no matter what version they have.

Regards,

Rick

I had the same problems.. i only can run EWS II cuting the green wire of pin 7 in the X20 conector (that goes to pin 66 of ECU like said).

Byt the way, if you send the tutorial of cutting wire of pin 7, usually, they can accept more easier.. if you just say "cut this", will be much more difficult..


Regards,