Cas3++ downgrade please help!

[binary420]

Hello, I have a 2008 E92 M3 with Comfort Access

Can anyone please help me with downgrade to unencrypted version CAS3 ?

All 10 key slots were used, so I attempted a downgrade via obd which failed, so I removed the cas from vehicle and connected it on bench.
I backed up the ISN, EEPROM, and FLASH

If someone can please help supply me a new EEPROM and FLASH to write back to the module I'll love you forever and would be willing to pay you just pm me if u wanna go that route

Thank you so much

Cas ID: C41000
ISN: 898547F82201B448449984413A907801

910991

[Muhammad Kassam]

Hi mate, give this a go:

[binary420]

Hi mate, give this a go:
thank you for the reply.
So I have never done this before.

Do i just flash that file to eeprom and then im good? will i just need to add a new key then or what exactly do i need to do to get it working?
and does my flash.bin file look good?

i've learned if i just start pushing button, this bmw does a good job punishing me for it, so i want to be as thorough as possible



thanks

[Muhammad Kassam]

Sorry I didn't read your thread properly, so your CAS failed the downgrade, there is some tools out there and that I have that can restore the CAS by OBD itself, the flash gets corrupt, not eeprom usually, in other cases both need to be redone, either by OBD or dump, but in most cases only flash needs to be done, post the 7 digit CAS label so I can see if I have a flash file for you, cheers
P.S: Don't flash my eeprom - even though it is ISTAP/encrypted, and the ISN you posted doesn't decrypt the dump but my edited dump for the eeprom accepts your ISN, so I highly doubt your EEPROM is good either

[binary420]

Sorry I didn't read your thread properly, so your CAS failed the downgrade, there is some tools out there and that I have that can restore the CAS by OBD itself, the flash gets corrupt, not eeprom usually, in other cases both need to be redone, either by OBD or dump, but in most cases only flash needs to be done, post the 7 digit CAS label so I can see if I have a flash file for you, cheers
P.S: Don't flash my eeprom - even though it is ISTAP/encrypted, and the ISN you posted doesn't decrypt the dump so I highly doubt your EEPROM is good either

9147217

61.35- "9147217" -01
2080853072
c4-18.6-08-06A0

[binary420]

it failed via OBD but now i have it wired up on bench, and backed up the flash and eeprom on bench

i have the ability to write back to the cas a new flash/eeprom but beyond that i have no knowledge is this area

[Muhammad Kassam]

What tool did you read CAS dump with ?

[binary420]

What tool did you read CAS dump with ?
LAUNCH X-PROG3

[Muhammad Kassam]

Here is working good flash and eeprom for your CAS.

[binary420]

Here is working good flash and eeprom for your CAS.
THANK YOU VERY MUCH.
Does it matter which one I write first?
flash and then eeprom? or other way around

[Muhammad Kassam]

The eeprom is not matched for your ECU/system though, so the ISN you have posted is from DME right ? If so, I will edit this eeprom I have posted with the ISN you've provided if it is the legit DME ISN, also, you'll need to add key by dump, hopefully x431 can do so

[binary420]

I'm not sure whether it's from the dme.

If the dme has a different isn than the cas has, then ya im not sure.

I read it before I removed cas from the car but I think it was within the immobilizer area of the programmer when I read it so I'm assuming it's ISN from cas idk for sure

[Muhammad Kassam]

Well, without DME ISN, not much can do

[binary420]

Okay, I will reconnect cas to vehicle and read isn from dme

Thanks

[binary420]

I will return shortly with yhe ISN of DME
Thank you again for your assistance on this so far I really do appreciate it greatly.

I have 2 questions about the procedure to program a new key once this is repaired.

Q1 For the option of key type, for comfort access key, (5wk49147) do you select:
-chip key
-remote key
or
-smart key
(I would assume its smart key right?)

Q2 on the option for key learning, do you select:
-write key by ignition switch
Or
-write key by programmer?

And what is the difference between the 2?

[Muhammad Kassam]

If programming the key, do it by dump and not OBD this time, chip is transponder type pcf79xx, remote is chip+remote PCB without keyless/comfort access, and smart is with comfort access/keyless, for programming such keys, you need a unlocked key if you're not aware, if you're doing it by dump, it is by programmer, ignition switch is by OBD . . .

[binary420]

If programming the key, do it by dump and not OBD this time, chip is transponder type pcf79xx, remote is chip+remote PCB without keyless/comfort access, and smart is with comfort access/keyless, for programming such keys, you need a unlocked key if you're not aware, if you're doing it by dump, it is by programmer, ignition switch is by OBD . . .

okay, very useful info, thank you
regarding the DME ISN, i have tried to locate where to read that from, but i'm not seeing anything called ISN in the DME module
unless this is it?
7848125
7841978
0569QT0Z240EEKUV0
WBSWD93558PY42760
01.07.2008

i think that 0569QT0Z240EEKUV0 was labeled hardware ID or something like that.
if that isnt the right code, please let me know how to read the DME ISN
sorry it is hot as my wifes tits outside so i can barely handle sitting out there without the AC
Global Warming is real ppl!

Actually I just discovered why I can't read it.
It's cause I had a tune on the car.
It's flashed back to stock currently but apparently even that has encryption cause mss6x flasher isn't able to locate the ISN

I've contacted Alex @ Alpine to see if he can give it to me, otherwise if I were to do a full binary read using MSS6X Flasher would that contain the ISN in a readable form?

[Muhammad Kassam]

ISN is not something printed or visibly obtained by looking at ECU, the ISN is like a immobilizer/sync code present in both the DME and CAS and is internal to the ECU in the ECU's CPU/software, and when all keys are lost or need to replace CAS or DME, this ISN is needed to decrypt the encrypted CAS unit, and in your case it is a MSS60 DME - I have not worked with the MSS60 but I do know there are tools that can read ISN by OBD and by BENCH like the MSS6X flasher that utilises the EdiabasLib firmware that can be flashed on most K+D CAN cable, you need a tool(s) that will be able to read the DME's ISN - don't know if your launch is able to, if not, what other tools you got ?. . .

[binary420]

ISN is not something printed or visibly obtained by looking at ECU, the ISN is like a immobilizer/sync code present in both the DME and CAS and is internal to the ECU in the ECU's CPU/software, and when all keys are lost or need to replace CAS or DME, this ISN is needed to decrypt the encrypted CAS unit, and in your case it is a MSS60 DME - I have not worked with the MSS60 but I do know there are tools that can read ISN by OBD and by BENCH like the MSS6X flasher that utilises the EdiabasLib firmware that can be flashed on most K+D CAN cable, you need a tool(s) that will be able to read the DME's ISN - don't know if your launch is able to, if not, what other tools you got ?. . .

Right ya I got that figured out.
It looks like I'm being restricted from reading it due to the tune file I flashed which is scrambled or encrypted or something.

It's a .mod file which I guess is done by the tuner to protect their tune but I've emailed him requesting the ISN so hopefully he'll get back to me shortly

[binary420]

ISN is not something printed or visibly obtained by looking at ECU, the ISN is like a immobilizer/sync code present in both the DME and CAS and is internal to the ECU in the ECU's CPU/software, and when all keys are lost or need to replace CAS or DME, this ISN is needed to decrypt the encrypted CAS unit, and in your case it is a MSS60 DME - I have not worked with the MSS60 but I do know there are tools that can read ISN by OBD and by BENCH like the MSS6X flasher that utilises the EdiabasLib firmware that can be flashed on most K+D CAN cable, you need a tool(s) that will be able to read the DME's ISN - don't know if your launch is able to, if not, what other tools you got ?. . .


okay sorry for the delay.

he finally got back to me, and he said DME ISN is the same as CAS ISN


898547F82201B448449984413A907801

[Muhammad Kassam]

Okay then write the eeprom where I changed ISN for you (EEPROM _NEW) and make key by dump, if doesn't work after doing so, write flash from my other/next post, but don't write the eeprom from there, only flash from there

[binary420]

Okay then write the eeprom where I changed ISN for you (EEPROM _NEW) and make key by dump, if doesn't work after doing so, write flash from my other/next post, but don't write the eeprom from there, only flash from there

okay, my bench tool doesnt have an option to add a key via dump, would it be possible to write key into the eeprom and give me that eeprom file to write?

it'd be key #5 in this key file
911636

[Muhammad Kassam]

No, these are crypto keys, I don't really think it is possible

[binary420]

okay, so i used a new virgin key and programmed it to the car with the launch xprog3 tool.

the key write was successful, the ignition turns on etc, but when i try to start the engine, it just cranks, and wont start.

I don't know where to go from here other than when i read the CAS ISN, the number is completely different from what it was originally, is that normal?

as in is the CAS ISN a rolling code that changes all the time, or why would that have gotten changed?

any other ideas?

[Muhammad Kassam]

Right, at least now ignition comes on, have you scanned fault codes ? Any immo related faults ?

I'd also suspect the CAS flash since eeprom got messed up, but first see the fault codes.

ISN is not a rolling code, meaning it doesn't dynamically change, can only be changed by modifying CAS/DME dump and ISN in CAS and DME/DDE should be the same for vehicl to start, so the ISN that is in DME did not decrypt your CAS eeprom, hence I changed ISN (EEPROM_NEW) in CAS for you, did xprog ask for valid key or ISN before it programmed the virgin key ?

[binary420]

Right, at least now ignition comes on, have you scanned fault codes ? Any immo related faults ?

I'd also suspect the CAS flash since eeprom got messed up, but first see the fault codes.

ISN is not a rolling code, meaning it doesn't dynamically change, can only be changed by modifying CAS/DME dump and ISN in CAS and DME/DDE should be the same for vehicl to start, so the ISN that is in DME did not decrypt your CAS eeprom, hence I changed ISN (EEPROM_NEW) in CAS for you, did xprog ask for valid key or ISN before it programmed the virgin key ?

no it has the option to add key when all keys lost.
when u go to key learning is asks are all keys lost? do not select if all keys are not lost?

but i hit yes, and it successfully added the key. ignition comes on and engine cranks, but no start.

there was a whole bunch of faults, but the battery had died since the time I last started engine,so i figured alot of them weren't relevant, so i cleared them.

so what would next step be to get engine started? i tried to do cas/dme align but it fails. so does ELV reset fails
Ill check the diag history on my scanner and see what immo faults there were,
but
so far no codes have come back, although i think thats normal since the engine hasnt started..

[binary420]

i am assuming the reason the e engine doesnt start, is cause its not seeing a matching isn between dme and cas, but im not understanding why u gave the eeprom new with different isn?

please dont misunderstand me, i very much appreciate your help more than u know, but please help me to understand why we changed the ISN of the CAS if they are required to be matching,
since the DME ISN isnt able to be changed, only read. so the CAS i would think should have kept the same ISN no?

[Muhammad Kassam]

The fact it doesn't ask for ISN since all keys are lost is funny, this is a crypted/ISTAP CAS, hence a working key or valid ISN is required to add a key, that could be the issue - xprog isn't adding the key properly

[Muhammad Kassam]

i am assuming the reason the e engine doesnt start, is cause its not seeing a matching isn between dme and cas, but im not understanding why u gave the eeprom new with different isn?

please dont misunderstand me, i very much appreciate your help more than u know, but please help me to understand why we changed the ISN of the CAS if they are required to be matching,
since the DME ISN isnt able to be changed, only read. so the CAS i would think should have kept the same ISN no?

The CAS eeprom you posted along with DME ISN, the DME ISN does not decrypt the CAS, which means it's not a valid ISN for this CAS or got corrupt, which is why I changed the ISN to the one you posted, so now the ISNs are matching . . . And when you try to add key or do all keys lost procedure, it SHOULD ask for ISN . . .

[binary420]

The fact it doesn't ask for ISN since all keys are lost is funny, this is a crypted/ISTAP CAS, hence a working key or valid ISN is required to add a key, that could be the issue - xprog isn't adding the key properly
but it is capable of reading the ISN which i think is referred to as "SK" ISN (32 digit)

and with that, it can determine the DME ISN which is identical, or partially matching but smaller length, im not sure exactly

but ya basically it has the option "read ISN" and 898547F82201B448449984413A907801 was the number originally but now its a total different #

[binary420]

so what do i do next? i have to write the dme to match this changed cas isn? or what im really not understanding if its already been said i apologize this is all very new to me

[Muhammad Kassam]

so what do i do next? i have to write the dme to match this changed cas isn? or what im really not understanding if its already been said i apologize this is all very new to me

Don't play with DME - nothing to do with DME unless you have modified ISN on it. My concern is that launch is not asking for ISN or a way to decrypt the CAS - meaning it is likely not adding key properly how other programmers do - like CGDI, VVDI2, or TANGO e.t.c do, you could try adding key to the original eeprom you have posted and write that to CAS and see if it starts.

Check below how other programmers do it:

https://mega.nz/folder/Bzo2wLhJ#cvzR55ce1bVLr2plq8cS2g

[Silva1337]

When you be tired to play message me ill fix it

[binary420]

Don't play with DME - nothing to do with DME unless you have modified ISN on it. My concern is that launch is not asking for ISN or a way to decrypt the CAS - meaning it is likely not adding key properly how other programmers do - like CGDI, VVDI2, or TANGO e.t.c do, you could try adding key to the original eeprom you have posted and write that to CAS and see if it starts.

Check below how other programmers do it:

https://mega.nz/folder/Bzo2wLhJ#cvzR55ce1bVLr2plq8cS2g


Is CAS ISN # saved into the CAS EEPROM, or on the CAS FLASH?

and does it matter which get written back to the cas first? Eeprom vs flash?

[binary420]

ok, i reflashed my DME Module back to stock using WinKFP

After doing so I re-attempted to read ISN from DME using MSS6X Flasher, and I was able to read the DME ISN (EW$4 Secret Key) successfully.

Secret Key (SK): 99-19-FB-E8-8E-BD-A4-E4-F8-89-28-FD-2A-3C-C7-11

with that key, I now just need to write that into the CAS module correct?

can you assist me from this point now that I have this DME Secret Key? Does that provide you the ability to decrypt the cas now or downgrade it or whatever?

thank you.. I realize I dont know what I'm doing but I am trying. Any help will be greatly appreciated

[binary420]

Don't play with DME - nothing to do with DME unless you have modified ISN on it. My concern is that launch is not asking for ISN or a way to decrypt the CAS - meaning it is likely not adding key properly how other programmers do - like CGDI, VVDI2, or TANGO e.t.c do, you could try adding key to the original eeprom you have posted and write that to CAS and see if it starts.

Check below how other programmers do it:

https://mega.nz/folder/Bzo2wLhJ#cvzR55ce1bVLr2plq8cS2g


ok, i flashed the 241E ECU update to DME Module which wiped all traces of the Engine Tune which was preventing me from reading DME

After doing so I re-attempted to read ISN from DME using MSS6X Flasher, and I was able to read the DME ISN (EW$4 Secret Key) successfully.

Secret Key (SK): 99-19-FB-E8-8E-BD-A4-E4-F8-89-28-FD-2A-3C-C7-11

with that key, I now just need to write that into the CAS module correct?

can you assist me from this point now that I have this DME Secret Key? Does that provide you the ability to decrypt the cas now or downgrade it or whatever?

thank you.. I realize I dont know what I'm doing but I am trying. Any help will be greatly appreciated

[Muhammad Kassam]

Yes, this IS the correct DME ISN - write the following flash to your CAS by dump, and the eeprom also by dump but before writing this eeprom make a key to it and then write to CAS by dump - and she should start.

[binary420]

Yes, this IS the correct DME ISN - write the following flash to your CAS by dump, and the eeprom also by dump but before writing this eeprom make a key to it and then write to CAS by dump - and she should start.

awesome man, so when u say that's the correct DME ISN, are you determining that because the CAS is being decrypted now (or whatever the terminology is) as you were expected before?

That is great news! This shit has had me stressed for too long. You are such a giant help, you don't even know!

Just one more thing and then I will go pull the cas back out and write back to it one last time!

My xPROG3 device isnt capable of writing a key via dump file (as far as I am aware) is there any way you can add this key?

the Key 5 which is:
ImmoData_Key5:004B001E98869DF5875F626121C8DF677DDD
RemoteData_Key5:142AF5875F62612177A278B7030002

if you can please add that key to it ill greatly appreciate it. I'm in disbelief this is all gonna be over soon!

[dijo]

Guys, you need to know the basics of BMW key programming!

1. To start engine, SK " SecreteKey must match between DDE and Cas
2. After Cas3+ SK is encrypted in CAS eeprom dump ( to work with this dump you need to decrypt it )
3. 2 ways to decrypt 1º using working key or 2º using DDE´s SK
4. Only by matching Cas dump with DDE dump in decrypted situation and encrypted it back after program new key
it is possible to start the engine.

[Muhammad Kassam]

Guys, you need to know the basics of BMW key programming!

1. To start engine, SK " SecreteKey must match between DDE and Cas
2. After Cas3+ SK is encrypted in CAS eeprom dump ( to work with this dump you need to decrypt it )
3. 2 ways to decrypt 1º using working key or 2º using DDE´s SK
4. Only by matching Cas dump with DDE dump in decrypted situation and encrypted it back after program new key
it is possible to start the engine.

Yes ��

But OP doesn't have the right tool to make the key, ISN in DME and CAS is matching, but he can't generate the key using the tools he has, generation of key is where there's a hiccup, his tool doesn't ask for ISN or working key to decrypt the dump, whereas it should as this is a ISTAP/encrypted version . . .

[binary420]

Guys, you need to know the basics of BMW key programming!

1. To start engine, SK " SecreteKey must match between DDE and Cas
2. After Cas3+ SK is encrypted in CAS eeprom dump ( to work with this dump you need to decrypt it )
3. 2 ways to decrypt 1º using working key or 2º using DDE´s SK
4. Only by matching Cas dump with DDE dump in decrypted situation and encrypted it back after program new key
it is possible to start the engine.


Thank you for your input, but I'm not sure what your point is?

Muhammad has been trying to help me for like a week at this point,

And my incompetence and inexperience has been the only hindrance on progress.

AKA. I dont know what the F i'm doing, but if I can't figure it out, I'll be taking the bus, cause I don't currently have the money to have it repaired

But so initially, I made a key, using all keys lost option. It started the engine when inserted, but remote and CA did not function.

So then without knowing any better, I saw the cas downgrade option on my scan tool, and attempted it, without having a charger connected or anything.

It failed, which I'm assuming that left my CAS in disrepair / scrambled firmware.

So I started looking online and saw I need EEPROM and FLASH backups from CAS.

I pulled the backups, uploaded here, along with what I thought was the DME ISN.

I again, was wrong, it was not the DME ISN, and when I tried to read DME ISN, it failed every time,
I finally discovered that was being caused by the engine tune which was scrambled or encrypted or whatever, restricted it from being read properly.

So I updated the DME software using the factory technician tool called WinKFP (it was already on 241E, but I re-flashed 241E again) this wiped the engine tune off and
I re-attempted to read DME ISN and it was successful no problem whatsoever now.

FINALLY, as of last night, I FINALLY got the proper DME SK, which as I understand it, this number is a fixed number. Doesn't change. (right?)

And I uploaded the CAS backups from the beginning.

According to you, in order to start engine, DDE and CAS SK must match.
I have CAS3+ which requires decryption to add key to it.
To add key you can use DDE SK which you have now.

But so I'm really confused by your comment. "you guys need to know the basics of bmw programming" ??

Obviously I do not, but like I said many times throughout this post, I am making every attempt to get this shit working, and Muhammad has been extremely patienct throughout, so
did you actually read through the whole thread, or are you just throwing words out there without even understanding what the ~~~~ the situation is??
If so, ~~~~ off dude cause now you're just throwing doubt into the mix.

what point were you trying to accomplish with your comment???
Cause unless I'm mistaken, thats what we're doing

[binary420]

okay, well i wrote the most recent eeprom, and then the flash you supplied and sadly as soon as I plugged in the cas to the car, the car appeared to completely die. like all the interior light shut, it didnt detect any key. not even as an invalid key. just totally dead. not even the lock / unlock button on the dashboard worked at all.

However, the car was not "dead" because the hazard light still worked, and interior lights worked if i pressed the overhead button.

I first tried to scan the car with my scan tool, but it couldnt detect the vin even, and when i manually put the vin, it said can not communicate with vehicle. so ya, I'm not sure why but it did not like those files.. so then i paniced and pulled it back out, put it back on bench, re-wrote the previous files back to it, plugged it back into car, and thank god everything is where it was a few days prior

[Muhammad Kassam]

okay, well i wrote the most recent eeprom, and then the flash you supplied and sadly as soon as I plugged in the cas to the car, the car appeared to completely die. like all the interior light shut, it didnt detect any key. not even as an invalid key. just totally dead. not even the lock / unlock button on the dashboard worked at all.

However, the car was not "dead" because the hazard light still worked, and interior lights worked if i pressed the overhead button.

I first tried to scan the car with my scan tool, but it couldnt detect the vin even, and when i manually put the vin, it said can not communicate with vehicle. so ya, I'm not sure why but it did not like those files.. so then i paniced and pulled it back out, put it back on bench, re-wrote the previous files back to it, plugged it back into car, and thank god everything is where it was a few days prior

Right yes, this happened because the flash I've sent is likely incompatible with your CAS or the tool you're using to read/write by dump is doing it differently/different reading/writing formats from the tool I read the flash with, not a big issue, your flash is likely intact.

You need to get someone to add key to dump with a proper tool, where it will ask for DME ISN since you don't have a working key and as this is an encrypted CAS, DME ISN you now have and can take it from there . . .

[binary420]

okay do you not have the right tool? cant you add it with the files i supplied? please?

[Muhammad Kassam]

No, as I mentioned earlier, these are crypto keys, written to CAS dump and also to key - you'll need someone to physically do it for you with the right tool. . .

[binary420]

No, as I mentioned earlier, these are crypto keys, written to CAS dump and also to key - you'll need someone to physically do it for you with the right tool. . .

gotcha, ok well i have 2 virgin keys coming today. i'll try again using 1 of those and hope for the best.
(now that DME is able to be read out, maybe that will allow my tool to work properly)

i noticed something else just browsing around in the tool.
the EGS module shows VIN: and then nothing. the field is blank.

could the EGS module possibly prevent the engine from starting? it cranks strong but no start

[binary420]

Figured I should provide a final conclusion to this saga for future reference

I ended up giving up after discovering an immo off for my mss60 s65 engine

Simply take the original full bin using mss6x flasher
Search for the relevant field based on your specific engine below, and simply change the value and write the modified bin back to dme
Cas will still only allow starting and unlocking with programmed key, but engine and cas will no longer require a matching ISN / secret key in order to start engine.

If someone were to break into your car, they still couldn't start engine without their own cas3 module and a matching key.
Although that would be the only requirement and they could theoretically unplug your cas, plug In their own cas, and driveway.
Or if u leave your car unlocked, they could do all keys lost and program new key and drive off but they could do that anyway... only if your car is already unlocked though unless I'm mistaken

Mss60 241E
change byte 0x65387 from 03 to 01
(Confirmed)

Mss65 160E
change address 0x60FBC from 40 82 to 48 00 (confirmed)

MSS65 520E
change address 0x62DA8 from 40 82 to 48 00 (confirmed)

Thank you for your assistance Muhammad Kassam I learned alot but in the end this car is simply above my skill level and/or my available toolset