Close

Page 1 of 2 12 LastLast
Results 1 to 25 of 31
  1. #1
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3


    Yes Reputation No

    Cracking the DCT BINs

    Going on from conversation started here https://www.bimmerboost.com/showthre...eally-is/page2

    The hardware identification of the DCT gearbox is GS40
    The zb thatís most commonly used for flashing the 135/335 DCT is zb 8606072 this is used because itís one of if not the latest ZB for the box that sets launch control RPM to 3500rpm
    There are others however lets start with just this one

    PABD for the GS40 is 06DKG436.ipo and the P-SGBD is 10FLASH.prg

    I understand that the first step too cracking these files is creating a BIN file @trevorlee02 @Rahl

    What do i need to do next ?

  2. #2
    Join Date
    Mar 2014
    Posts
    805
    Rep Points
    1,199.5
    Mentioned
    37 Post(s)
    Rep Power
    12


    Yes Reputation No
    I'll try and build one from the 0pa and 0da files later then u gotta get on all the dodgy looking forums, often in foreign languages, to try and get a damos for it.

  3. #3
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3



    Yes Reputation No
    Thanks Brad. That’d be tops ! I’d really like to also fish for myself - Is there a specific post somewhere i can read that outlines how to do this ? Reason being i want multiple files to compare against each other and i dont want to bother you all the time. You probably dont mind but id like to learn in any case.

    I tried to read through the XHP development thread and I got so tired after 1 page i gave up.

    As for dodgy foreign forums... None scare me. My wife is Russian and she’s always asking if she can help somehow. Knows a bit of German and Im from the former Yugoslavia - what could go wrong eh ?

  4. #4
    Join Date
    Jan 2010
    Location
    SoCal
    Posts
    132,092
    Rep Points
    38,358.8
    Mentioned
    2366 Post(s)
    Rep Power
    384


    Yes Reputation No
    Click here to enlarge Originally Posted by Aus335iGuy Click here to enlarge
    I tried to read through the XHP development thread and I got so tired after 1 page i gave up.
    I don't know if that necessarily will help you with the DCT but let me know what I can do to help you guys.

    I have Winols and am more than happy to host whatever files you need.

  5. #5
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3



    1 out of 1 members liked this post. Yes Reputation No
    My ambition for this is pretty big. Assemble all the DCT BINs and find someone to crack the RSA encryption. Then compare one file against the other to figure out which tables do what the way others like @bradsm87 and @Jayamona have done for the auto and dmeí respectively.

    the same TCU is used on 135,335,z4,m3,m4,and M5 each of them have different ZBs that change shifting characteristics, launch control RPMs etc

    Once we figure out what all the tables are we can figure a way to flash it to the TCU safely we will then start to see the DCT box being used more widely.

    The guys on the M5 forum are using a very similar box with upgraded clutches to launch 1000hp,100ftlb M5s fairly reliably. The fact that we cant launch a 135is is woeful and needs to be addressed. Many hands make light work but its a MASSIVE task. Anyone that wants to lend a hand is welcome. Thanks for the offer to host the files @Sticky. Also One thing that would help is a Damos map pack for these files... dunno if you came across one in your travels?

  6. #6
    Join Date
    Jan 2010
    Location
    SoCal
    Posts
    132,092
    Rep Points
    38,358.8
    Mentioned
    2366 Post(s)
    Rep Power
    384


    Yes Reputation No
    Click here to enlarge Originally Posted by Aus335iGuy Click here to enlarge
    Thanks for the offer to host the files @Sticky. Also One thing that would help is a Damos map pack for these files... dunno if you came across one in your travels?
    @bradsm87 would be the man for finding the Damos map packs.

    I'll contribute if necessary to acquire them.

  7. #7
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3



    Yes Reputation No
    That’s mighty generous man! Im curious, how come you never went down this path for your M3 ?

  8. #8
    Join Date
    Mar 2014
    Posts
    805
    Rep Points
    1,199.5
    Mentioned
    37 Post(s)
    Rep Power
    12


    Yes Reputation No
    Creating a BIN with the "BMWFileCreator" tool found on a random forum from 0pa and 0da files didn't work. This happens a lot with that tool. Only some stuff works. Click here to enlarge

  9. #9
    Join Date
    Mar 2014
    Posts
    805
    Rep Points
    1,199.5
    Mentioned
    37 Post(s)
    Rep Power
    12


    Yes Reputation No
    The full firmware version string is:

    0549QB0F980G

    Short versions could be something like:
    F980G
    9QBF98

    That's just based on some people referring to for example IJE0S or 4CCIJE when the full string is 0044CC0IJE0S.

    Nothing out there that I can see in terms of DAMOS files.

  10. #10
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3



    Yes Reputation No
    Damn thanks for trying Brad. How did the auto guys do this ? I need to read more...
    Is there any way to read the file directly from the car? Perhaps flash, read, save rinse repeat ?

  11. #11
    Join Date
    Jan 2010
    Location
    SoCal
    Posts
    132,092
    Rep Points
    38,358.8
    Mentioned
    2366 Post(s)
    Rep Power
    384


    Yes Reputation No
    Click here to enlarge Originally Posted by Aus335iGuy Click here to enlarge
    That’s mighty generous man! Im curious, how come you never went down this path for your M3 ?
    The DCT was never a problem for me. I can adjust my launch from 4500-6500 rpm or whatever the window is.

    Why do you think the M3 does so well comparatively on the strip? Better DCT software is definitely an important part.

  12. #12
    Join Date
    Mar 2014
    Posts
    805
    Rep Points
    1,199.5
    Mentioned
    37 Post(s)
    Rep Power
    12


    Yes Reputation No
    Click here to enlarge Originally Posted by Aus335iGuy Click here to enlarge
    How did the auto guys do this ?
    Some guys mostly in the diesel crowd made a Windows tool to read out the rom. Not long after, they completely closed up development/public discussion and went commercial with it.

  13. #13
    Join Date
    Jan 2015
    Posts
    16
    Rep Points
    50.2
    Mentioned
    7 Post(s)
    Rep Power
    0


    2 out of 2 members liked this post. Yes Reputation No
    You can pull the 0da file into winols and start to look for maps yourself, Slow and tedious but it will give you an idea. There are 8,000 maps and constants in the ZF 6HP.

    You can use tool32 to pull out the "scalors" from one of the related *.prg files for the TCU. This will help you find the conversions used. For instance the ZF hp uses Rom x 32 for engine RPM when the data was 8bit or Rom x 6 -204 for torque.

    The maps I found did not have the typical markers preceding them so nothing like a 00 04 00 08 to mark out a 4 x 8 map.

    I can tell you that the key maps will probably have Engine RPM, Engine Torque, Turbine RPM/Input and output shaft. speed.

    I'll see if I can did up or write a tool to read out the TCU. I tried the DR Gini program a few nights back and it would not read out my TCU or DME. Managed the Kombi just fine.

    I'll try to contribute but my personal time is really limited right now.

  14. #14
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3



    Yes Reputation No
    Thanks Rahl!

    Ill have a crack with the trial Winols i have

    8000 maps eh? I might make a cup of tea i might be here a bit...

  15. #15
    Join Date
    Jan 2015
    Posts
    16
    Rep Points
    50.2
    Mentioned
    7 Post(s)
    Rep Power
    0


    Yes Reputation No
    Have you looked at the DCT bin downloaded in the N54 files section?

  16. #16
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3



    Yes Reputation No
    No I looked in those files and never saw it ?

  17. #17
    Join Date
    Jan 2010
    Location
    SoCal
    Posts
    132,092
    Rep Points
    38,358.8
    Mentioned
    2366 Post(s)
    Rep Power
    384


    Yes Reputation No
    Click here to enlarge Originally Posted by Rahl Click here to enlarge
    Have you looked at the DCT bin downloaded in the N54 files section?
    Link him please @Rahl

  18. #18
    Join Date
    Jan 2015
    Posts
    16
    Rep Points
    50.2
    Mentioned
    7 Post(s)
    Rep Power
    0


    Yes Reputation No
    As you requested.

    https://www.bimmerboost.com/g2.php?do=download&file=107


    I looked at this file and could not get it to match my 0pa or 0da, not even close. Nothing aligned at all.

  19. #19
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3



    1 out of 1 members liked this post. Yes Reputation No
    Mate Im not surprised as that’s a DME bin. Im loooking for a DCT TCU Bin.

  20. #20
    Join Date
    Jan 2015
    Posts
    16
    Rep Points
    50.2
    Mentioned
    7 Post(s)
    Rep Power
    0


    Yes Reputation No
    That explains a lot. LOL

    Do you know the name of the *.PRG file that would be used by INPA for the DCT?

  21. #21
    Join Date
    Jan 2015
    Location
    UK
    Posts
    1,027
    Rep Points
    1,445.4
    Mentioned
    30 Post(s)
    Rep Power
    15


    1 out of 1 members liked this post. Yes Reputation No
    Great thread.
    Amazes me this info doesn't leak from BMW or someone who works on it isn't paid to leak it.
    Best:11.79@119mph on stock turbos.
    11.74@129 on GCs.
    FBO+Meth Port injection, GC Turbos, custom bucketless stage2, JB4, Trebila flash.

  22. #22
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3



    Yes Reputation No
    TPABD for the GS40 is 06DKG436.ipo and the P-SGBD is 10FLASH.prg

  23. #23
    Join Date
    Jan 2015
    Posts
    16
    Rep Points
    50.2
    Mentioned
    7 Post(s)
    Rep Power
    0


    Yes Reputation No
    Actually I was looking for DSK90.prg. This is the file that you would use for logging or general Tool32 work. If you extract the tables from DSK90.prg you can look at the parameters and conversion factors used in the TCU maps.

    For example, Vehicle speed is probably the RAM value/40 and transmission input speed is Ram / 16

    I tried posting the file but, it seems like I can't upload files. After I get the file type and size warning, the system just ignores the uploaded attachment?
    Attached Images Attached Images    
    Attached Files Attached Files

  24. #24
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3



    Yes Reputation No
    @Sticky a little help ?

  25. #25
    Join Date
    Feb 2017
    Posts
    229
    Rep Points
    279.9
    Mentioned
    2 Post(s)
    Rep Power
    3



    Yes Reputation No
    Im not familiar with Tool32 @Rahl can you point me at some reading material that will help me ?

Page 1 of 2 12 LastLast

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may post replies
  • You may not post attachments
  • You may not edit your posts
  •