Close

Page 3 of 3 FirstFirst 123
Results 51 to 61 of 61

Thread: DME Swap

  1. #51
    Join Date
    Mar 2010
    Location
    AZ
    Posts
    2,729
    Rep Points
    2,484.0
    Mentioned
    40 Post(s)
    Rep Power
    25



    Reputation: Yes | No
    Personally, anything is possible. But sometimes futile. There is generally not a software way to prevent someone from writing something if it is possible to write it again unless we are speaking of high levels of encryption/signing or true ROMs. The time/money to figure this out likely offsets the cost of just buying a new DME. But it would be great if someone figured this out. Out of my league.
    Click here to enlarge
    Join the largest N5X Enthusiasts Group! 1200+ Members Strong!
    https://www.facebook.com/groups/n5xenthusiasts/

  2. #52
    Join Date
    Mar 2013
    Posts
    7
    Rep Points
    26.4
    Mentioned
    1 Post(s)
    Rep Power
    0


    Reputation: Yes | No
    Click here to enlarge Originally Posted by lorddrinkalot Click here to enlarge
    I think we are talking about 2 different things.

    VIN is not the secrete key.

    The VIN in the DME is maybe changable but the secrete key to decode the messages sent from CAS to DME is not changeable according to this document you posted.

    So even if the VIN change is possible you wouldnt be able to start the car and drive if the DME you are using is from another car with another secrete key.

    I know from experience you can move CAS/DME/KEYS from one car to another without a problem. Interaction with the other ECU's is not an issue with exception to the cluster and ABG module. The ABG will throw airbag and DTC errors and the cluster will show a tamper dot, as the VIN doesn't match that of the CAS module. The cluster of course, is no big deal. I don't exactly know about the airbag related issues though as they didn't affect my ability to start and drive the car. All that mattered was that ISN *must* match between the DME and CAS. VIN does not matter.

    I have started my car in fact, with different VIN written to each ECU (DME, CAS & KOMBI) while the rest of the modules retained the originally programmed VIN.

    The immobilizer/EWS-4 system is completely based on the ISN exchange between the DME/CAS modules.

    I know my zero post count lends nothing to my credibility, but I stand by what I have stated as the truth. I am hopeful that my insight can save someone the trouble and time I paid for my education.. Looking back, it would have made more sense to pay the stealership ransom and be done with it all.. Instead I got schooled .. lol

    Kind regards,

    db

  3. #53
    Join Date
    Mar 2013
    Posts
    7
    Rep Points
    26.4
    Mentioned
    1 Post(s)
    Rep Power
    0


    1 out of 1 members liked this post. Reputation: Yes | No
    Click here to enlarge Originally Posted by klipseracer Click here to enlarge
    What basis do you have for this information? I realize things change between platforms, but the E46 for example, you can recode the VIN. I don't see why you couldn't do it with the E90 MSD8X with the right tools and or software or approach. Will a dealer recode a VIN on an E46? If they refuse to which I bet they do, then just proves at least on that platform that they are refusing to do so even though it can be done. Probably for good reason, theftwise.
    Re-writing the VIN is easy with the bimmerboost flash. Once the bin file is read from the DME, a hex editor with checksum calculation is all that is needed. Simply edit VIN in hex and and calculate checksum and save file before writing. I used the editor that comes with m-prog, device programmer desktop; software that came with the programmer I have. CAS dumps are modified in the same way. I wish though I knew what bytes in the CAS to edit the ISN. DME is out of the question (for me anyway) to edit the ISN as it requires BDM frame equipment to access the boot loader of the DME, allowing full dump from tricore MCU. <<<-- That is what I have accepted, but do not know as fact. I would love to hear some other speculation though or even better, empirical data on the subject.

    The CAS dump isn't such an issue to access. You only need access to the PCB and a programmer capable of reading out the flash and EEPROM data from the MC9S12Xxx. Edit in the same way, followed by calculation of the checksum and VIN write/change is no issue.

    unfortunately, we still have to start with matched key?DME/CAS.. unless the ISN is can be found and edited from the donor DME.

    db

  4. #54
    Join Date
    Dec 2013
    Posts
    5
    Rep Points
    6.0
    Mentioned
    0 Post(s)
    Rep Power
    0


    1 out of 1 members liked this post. Reputation: Yes | No
    Click here to enlarge Originally Posted by db2761 Click here to enlarge
    db
    Some good information here, and some that is not completely correct. VIN in the DME can be changed in a few different ways, but that doesnt really matter. ISN after 2008 is 16 byte encryption code stored in the DME and CAS (yes, that is the same 128 bit encryption that is used for bank web sites, etc Click here to enlarge). The biggest problem is that the location of the ISN in the dumps is changing with every integration level. And in the newer versions it is encrypted in the CAS using some codes stored in the keys.
    Changing a complete set of CAS, keys, DME opens another can of worms, as the VIN mismatch between the DSC, steering angle sensor, instrument cluster and CAS will trigger many warning lights.
    I have equipment that can read the ISN from DME and write it in the CAS, even if it is the newest integration level (i.e. even if your car was programmed yesterday from the dealer. If someone needs to change DME I can do that even if i have the parts on the bench. I dont need the complete car to change the ISN.
    BTW, the MSD80,81 is read via CAN, BDM is for the previous generation ECUs with Motorola MPC processor inside.

  5. #55
    Join Date
    Jan 2010
    Location
    SoCal
    Posts
    117,797
    Rep Points
    31,559.9
    Mentioned
    2064 Post(s)
    Rep Power
    316


    Reputation: Yes | No
    Click here to enlarge Originally Posted by bawareca Click here to enlarge
    VIN in the DME can be changed in a few different ways, but that doesnt really matter
    I'm curious as to what the ways are.

  6. #56
    Join Date
    Mar 2010
    Location
    AZ
    Posts
    2,729
    Rep Points
    2,484.0
    Mentioned
    40 Post(s)
    Rep Power
    25



    Reputation: Yes | No
    Click here to enlarge Originally Posted by bawareca Click here to enlarge
    Some good information here, and some that is not completely correct. VIN in the DME can be changed in a few different ways, but that doesnt really matter. ISN after 2008 is 16 byte encryption code stored in the DME and CAS (yes, that is the same 128 bit encryption that is used for bank web sites, etc Click here to enlarge). The biggest problem is that the location of the ISN in the dumps is changing with every integration level. And in the newer versions it is encrypted in the CAS using some codes stored in the keys.
    Changing a complete set of CAS, keys, DME opens another can of worms, as the VIN mismatch between the DSC, steering angle sensor, instrument cluster and CAS will trigger many warning lights.
    I have equipment that can read the ISN from DME and write it in the CAS, even if it is the newest integration level (i.e. even if your car was programmed yesterday from the dealer. If someone needs to change DME I can do that even if i have the parts on the bench. I dont need the complete car to change the ISN.
    BTW, the MSD80,81 is read via CAN, BDM is for the previous generation ECUs with Motorola MPC processor inside.
    I know someone right now who has a bad msd80 and needs a replacement msd80. You are saying you have this equipment to do a PROPER dme swap?
    Click here to enlarge
    Join the largest N5X Enthusiasts Group! 1200+ Members Strong!
    https://www.facebook.com/groups/n5xenthusiasts/

  7. #57
    Join Date
    Dec 2013
    Posts
    5
    Rep Points
    6.0
    Mentioned
    0 Post(s)
    Rep Power
    0


    1 out of 1 members liked this post. Reputation: Yes | No
    Click here to enlarge Originally Posted by Sticky Click here to enlarge
    I'm curious as to what the ways are.
    Some aftermarket tools, WINKFP are 2 of them.

  8. #58
    Join Date
    Dec 2013
    Posts
    5
    Rep Points
    6.0
    Mentioned
    0 Post(s)
    Rep Power
    0


    Reputation: Yes | No
    Click here to enlarge Originally Posted by klipseracer Click here to enlarge
    I know someone right now who has a bad msd80 and needs a replacement msd80. You are saying you have this equipment to do a PROPER dme swap?
    Just did a swap of an 08 535i last week. The original DME was throwing crank sensor code randomly, 1-2 times a day. After 2 sensors and torough investigation of the wiring we figured it was the DME. It runs trouble free now with used DME.
    So, briefly, yes, I can do that.

  9. #59
    Join Date
    Jan 2014
    Posts
    1
    Rep Points
    2.1
    Mentioned
    0 Post(s)
    Rep Power
    0


    1 out of 1 members liked this post. Reputation: Yes | No
    Click here to enlarge Originally Posted by bawareca Click here to enlarge
    Just did a swap of an 08 535i last week. The original DME was throwing crank sensor code randomly, 1-2 times a day. After 2 sensors and torough investigation of the wiring we figured it was the DME. It runs trouble free now with used DME.
    So, briefly, yes, I can do that.
    Hi bawareca,


    just read your statement that you are able to clone N54 DMUs. What would you need for re-programming a msd8x unit so that it would run in my 1M coupe?

  10. #60
    Join Date
    Jan 2016
    Posts
    3
    Rep Points
    4.3
    Mentioned
    0 Post(s)
    Rep Power
    0


    1 out of 1 members liked this post. Reputation: Yes | No
    I recently had a problem with MSV80, where I had too replace the MSV80 DME. I found 2 companies that do that.
    One of them was rmsonlinestore (RPM Motorsport) another one sells services on eBay (don't remember the name, just search MSV80 cloning). The one on eBay charges half what RPM Motorsport and you have eBay guarantee. I used the eBay one, no issues so far. Saved over $1000 vs dealer Click here to enlarge .

  11. #61
    Join Date
    Jan 2010
    Location
    SoCal
    Posts
    117,797
    Rep Points
    31,559.9
    Mentioned
    2064 Post(s)
    Rep Power
    316


    Reputation: Yes | No
    Click here to enlarge Originally Posted by roth Click here to enlarge
    I recently had a problem with MSV80, where I had too replace the MSV80 DME. I found 2 companies that do that.
    One of them was rmsonlinestore (RPM Motorsport) another one sells services on eBay (don't remember the name, just search MSV80 cloning). The one on eBay charges half what RPM Motorsport and you have eBay guarantee. I used the eBay one, no issues so far. Saved over $1000 vs dealer Click here to enlarge .
    I'm surprised the Ebay source did the trick. Usually you get cheap crap.

Page 3 of 3 FirstFirst 123

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may post replies
  • You may not post attachments
  • You may not edit your posts
  •