E46 BMW Social Directory E46 FAQ 3-Series Discussion Forums BMW Photo Gallery BMW 3-Series Technical Information E46 Fanatics - The Ultimate BMW Resource BMW Vendors General E46 Forum The Tire Rack's Tire Wheel Forum Forced Induction Forum The Off-Topic The E46 BMW Showroom For Sale, For Trade or Wanting to Buy

Welcome to the E46Fanatics forums. E46Fanatics is the premiere website for BMW 3 series owners around the world with interactive forums, a geographical enthusiast directory, photo galleries, and technical information for BMW enthusiasts.

You are currently viewing our boards as a guest which gives you limited access to view most discussions and access our other features. By joining our free community you will have access to post topics, communicate privately with other members (PM), respond to polls, upload content and access many other special features. Registration is fast, simple and absolutely free so please, join our community today!

If you have any problems with the registration process or your account login, please contact contact us.

Go Back   E46Fanatics > Tuning & Tech > Driveline, Engine & DME Tuning

Driveline, Engine & DME Tuning
Talk about driveline improvements, NA tuning and DME tuning your E46 BMW here. This includes diffs, intakes, exhausts, chips, software and OBD tuning.

Reply
 
Thread Tools Search this Thread Rating: Thread Rating: 9 votes, 5.00 average. Display Modes
Old 11-25-2013, 10:47 AM   #81
daniel_f.
Registered User
 
Join Date: Jul 2011
Location: Germany
Posts: 821
My Ride: 330iCA
I can compare with winols or else i have a obd interface which can calculate the checksum.

i have several ms4300** files, but some are from german tuners.

im asking Rene to chime in, as i think he found the checksums at ms43 already.
__________________
kind regards
Daniel

daniel_f. is offline   Reply With Quote
Old 11-25-2013, 11:22 AM   #82
p0lar
Registered User
 
Join Date: Jul 2012
Location: Midwest
Posts: 32
My Ride: E46 ///M3
Quote:
Originally Posted by daniel_f. View Post
I can compare with winols or else i have a obd interface which can calculate the checksum.

i have several ms4300** files, but some are from german tuners.

im asking Rene to chime in, as i think he found the checksums at ms43 already.
I have reason to believe that there is only ONE checksum, despite what was previously posted.

When I create a file full of FF's and send it out to have it corrected by WinOLS, it returns with a 2-byte change at exactly 0x3FE0.

Last edited by p0lar; 11-25-2013 at 12:19 PM.
p0lar is offline   Reply With Quote
Old 11-25-2013, 02:24 PM   #83
p0lar
Registered User
 
Join Date: Jul 2012
Location: Midwest
Posts: 32
My Ride: E46 ///M3
One more bit I discovered, that the 30-byte region after the checksum, but before the first 16kb boundary (from 0x3FE2 -> 0x3FFF), seems not to be factored into the checksum calculation.

I filled the entire region from 0x3FE2 -> 0x3FFF with '00' and had the checksum recalculated. It remained unchanged.

I know that many people don't feel the checksum is of great importance, but it really is a fundamental pillar that supports open development of the platform. Without an understanding of the calculation procedure and a free, or minimal-cost tool to validate changes to the DME parameters, we are institutionally locked to commercial software that is both expensive and (relatively) proprietary. Many people are comfortable pirating this software, but this only serves to degenerate a legitimate effort to produce software that everyone can use without legal ramification.

I tried automating a routine that modified how the checksum is mathematically calculated - a complete and total brute-force approach - but that hasn't yielded success yet, and it's horribly slow. Perhaps I've missed information that someone else has posted?

Last edited by p0lar; 11-25-2013 at 03:05 PM.
p0lar is offline   Reply With Quote
Old 11-25-2013, 08:35 PM   #84
HakenTT
OEM ///Member
 
Join Date: Aug 2009
Location: gross deutsches reich USA
Posts: 666
My Ride: 323i with S54
Polar, here is what I can say about MS43 partial read (64kb)

It appears that checksum is only calculated for partial read file (64kb)

Checksum algorithm is located starting at hex address 0008 and ends at 004F

The checksum is located at 3FE0 and the string that follows has something to do with how the checksum is calculated

Checksum is very important for MS42/MS43/MS45 because the DME will not even boot without proper checksum
HakenTT is offline   Reply With Quote
Old 11-26-2013, 12:12 AM   #85
p0lar
Registered User
 
Join Date: Jul 2012
Location: Midwest
Posts: 32
My Ride: E46 ///M3
Quote:
Originally Posted by HakenTT View Post
Polar, here is what I can say about MS43 partial read (64kb)
Affirmative.

Quote:
It appears that checksum is only calculated for partial read file (64kb)
Confirmed.

Quote:
Checksum algorithm is located starting at hex address 0008 and ends at 004F
The algorithm is the following? How does the following data constitute a checksum algorithm?
Code:
34 33 30 30 36 36 30 31 31 31 31 34 33 30 30 30 
36 36 30 31 30 30 30 30 31 31 31 34 33 30 30 30 
36 36 30 31 30 30 30 30 31 31 31 34 33 30 30 30 
36 36 30 31 30 30 30 30 63 61 34 33 30 30 36 36 
2E 44 41 54 FF FF FF FF
This seems more like versioning information, as follows by a basic breakout according to what seems like more common convention:
Code:
c566750k
430066
01
1114300066010000
1114300066010000
1114300066010000
ca430066.DAT
Quote:
The checksum is located at 3FE0 and the string that follows has something to do with how the checksum is calculated
Didn't you just state that this was from 0x8 -> 0x4F? Now the part that isn't factored into the checksum calculation is now relevant as to how it's permuted? Ok, let's see from the original binary what's there...
Code:
      02 00 00 00 07 00 FF 2F 07 00 00 40 07 00 
17 EE 07 00 FF FF FF FF FF FF FF FF FF FF 00 00
How does this bit correlate to what was previously posted from the start of the binary?

Quote:
Checksum is very important for MS42/MS43/MS45 because the DME will not even boot without proper checksum
Pretty much like almost every other DME, correct.
p0lar is offline   Reply With Quote
Old 11-26-2013, 03:56 AM   #86
HakenTT
OEM ///Member
 
Join Date: Aug 2009
Location: gross deutsches reich USA
Posts: 666
My Ride: 323i with S54
Quote:
How does this bit correlate to what was previously posted from the start of the binary?


Pretty much like almost every other DME, correct.
[/QUOTE]

The first one is algorithm if you change one byte the winols would not be able to make checksum correction. MS41 and MSS52/54 do not need proper checksum to run the engine.
HakenTT is offline   Reply With Quote
Old 11-26-2013, 05:29 AM   #87
GrafSpee
Registered User
 
Join Date: Oct 2012
Location: Deutschland
Posts: 19
My Ride: e46 330xi
WinOLS shows the change in checksum not.
You have to use an external editor to see the change.

The Checksumm would also be equal to the same operating system.
The checksum is present twice.
Once in the boot sector and once Eprom of the maps.
These are matched at the start.
It is important that both checksums are equal.
GrafSpee is offline   Reply With Quote
Old 11-26-2013, 07:04 PM   #88
p0lar
Registered User
 
Join Date: Jul 2012
Location: Midwest
Posts: 32
My Ride: E46 ///M3
Quote:
Originally Posted by HakenTT View Post

The first one is algorithm if you change one byte the winols would not be able to make checksum correction. MS41 and MSS52/54 do not need proper checksum to run the engine.
The first one, meaning the first string of bytes at the beginning of the file that looks like versioning information?

So how was WinOLS able to make a checksum correction with a file full of 'FF's? It didn't cough or sputter on that at all.

My MSS52 and MSS54HP will NOT run with incorrect checksums - I tried both.

Last edited by p0lar; 11-26-2013 at 07:07 PM.
p0lar is offline   Reply With Quote
Old 11-26-2013, 07:07 PM   #89
p0lar
Registered User
 
Join Date: Jul 2012
Location: Midwest
Posts: 32
My Ride: E46 ///M3
Quote:
Originally Posted by GrafSpee View Post
WinOLS shows the change in checksum not.
You have to use an external editor to see the change.
I'm aware of this, I use a separate binary editor to see what the differences are. WinOLS is vastly inferior software in regards to raw binary editing.

Quote:
The Checksumm would also be equal to the same operating system.
What does this mean? It equals the operating system?

Quote:
The checksum is present twice.
Once in the boot sector and once Eprom of the maps.
You mean in the 16kb boot sector, for only the boot sector, and for the 64kb of the parameter space at 0x3FE0?

Quote:
These are matched at the start.
It is important that both checksums are equal.
So if you modify one byte in either the boot sector, OR parameter space, you must correct both?

I was only able to pull the 64kb parameter space using my Galletto 1260 cable, how do you pull and push the full 512kb?

The information [sic] provided in this thread is vague and very poorly worded.
p0lar is offline   Reply With Quote
Old 11-26-2013, 07:10 PM   #90
smooth1
Registered User
 
Join Date: Nov 2005
Location: Phoenix
Posts: 269
My Ride: BMW FTW
You don't need to correct both. Just the parameter space.
smooth1 is offline   Reply With Quote
Old 11-26-2013, 07:28 PM   #91
p0lar
Registered User
 
Join Date: Jul 2012
Location: Midwest
Posts: 32
My Ride: E46 ///M3
Quote:
Originally Posted by smooth1 View Post
You don't need to correct both. Just the parameter space.
Good information, thank you. Can you confirm the single 2-byte checksum at 0x3FE0 as well?

I'll continue to test how the checksums are calculated, but it seems not to be something as simple as what the MSS5x DMEs are, or not at first glance.
p0lar is offline   Reply With Quote
Old 11-27-2013, 09:31 PM   #92
TerraPhantm
Registered User
 
Join Date: Feb 2008
Location: Mountain Top
Posts: 5,983
My Ride: 2005 M3 Coupe
Quote:
Originally Posted by p0lar View Post
Ok, so no matter what changes seem to be made to the MS43 binary, only one location changes otherwise for me, 2 bytes at 0x3FE0. I don't believe the next 30 bytes are factored, but that doesn't help in the way the data is ordered when calculated, nor if there is a prefix much like the MSS52 and MSS54.

So, let's say the parameter space is chunked into exactly 16kb boundaries as follows:
segment 1 = 0x0000 -> 0x3FE0
segment 2 = 0x4000 -> 0x7FFF
segment 3 = 0x8000 -> 0xBFFF
segment 4 = 0xC000 -> 0xFFFF

I've tried running the same CRC16 used on the MSS5x DMEs in the following orders:
2,1,4,3
4,3,2,1
1,2,3,4
1,2,4,3
2,1,3,4

Plus, adding a prefix from 0x0000 -> 0xFFFF in advance of each run.

Thus far, I've hit on one match accidentally, but I believe that was a CRC16 collision as it didn't hold for any other instance. I know this is a brute force approach, but without a hint as to where to start, I'm not sure what else to try just yet.
I think it'd be best to create a program that calculates a checksum with any arbitrary start value. Basically something like

Code:
int findChecksumStart (byte[] ROM, int CSIndex)
{
    for (int i = 0; i < CSIndex; ++i)
    {
        if (crc16(ROM, i, CSIndex) == ROM[CSIndex-1]*16+ROM[CSIndex])
            return i;
    }
        return -1;
}
If that doesn't work for any of the possible orders, then either there's a prefix we don't know, it's not a CRC16, or the polynomial is non-standard. Might be worth writing a function that goes in the other direction too (start is always 0, last checked byte is at some point before the checksum)
__________________

Last edited by TerraPhantm; 11-27-2013 at 09:33 PM.
TerraPhantm is offline   Reply With Quote
Old 11-28-2013, 09:44 AM   #93
p0lar
Registered User
 
Join Date: Jul 2012
Location: Midwest
Posts: 32
My Ride: E46 ///M3
Quote:
Originally Posted by TerraPhantm View Post
I think it'd be best to create a program that calculates a checksum with any arbitrary start value. Basically something like

Code:
int findChecksumStart (byte[] ROM, int CSIndex)
{
    for (int i = 0; i < CSIndex; ++i)
    {
        if (crc16(ROM, i, CSIndex) == ROM[CSIndex-1]*16+ROM[CSIndex])
            return i;
    }
        return -1;
}
If that doesn't work for any of the possible orders, then either there's a prefix we don't know, it's not a CRC16, or the polynomial is non-standard. Might be worth writing a function that goes in the other direction too (start is always 0, last checked byte is at some point before the checksum)
That's more or less what I tried, albeit when testing with a sea of 'FF's rather than actual data, I could just vary the length of the data rather than concerning over its contents or the segment order therein. I also wrote in a separate layer that would try various CRC polynomials, without success (yet). I'll work on it more after the holidays, but I'm sure it will become apparent with more study.
p0lar is offline   Reply With Quote
Old 12-09-2013, 10:07 PM   #94
jony787
Registered User
 
Join Date: Nov 2012
Location: North Carolina
Posts: 85
My Ride: 318ti M52tu SWAP
Comprehensive MS43 DME Information

EWS DELETE IS POSSIBLE. Im able to delete or virginize any ms42, or MS43. Pm for details.


Sent from BimmerApp mobile app
jony787 is offline   Reply With Quote
Old 12-10-2013, 03:00 AM   #95
krzychulbl
Registered User
 
Join Date: Dec 2013
Location: europe
Posts: 5
My Ride: e36
hello, I need euro EU2 catless file in normal open *.bin format... Can you help me?
krzychulbl is offline   Reply With Quote
Old 12-10-2013, 07:27 AM   #96
jony787
Registered User
 
Join Date: Nov 2012
Location: North Carolina
Posts: 85
My Ride: 318ti M52tu SWAP
Comprehensive MS43 DME Information

Quote:
Originally Posted by krzychulbl View Post
hello, I need euro EU2 catless file in normal open *.bin format... Can you help me?
What version do you have?????


Sent from BimmerApp mobile app
jony787 is offline   Reply With Quote
Old 12-10-2013, 09:25 AM   #97
krzychulbl
Registered User
 
Join Date: Dec 2013
Location: europe
Posts: 5
My Ride: e36
7509942 ms43 m54b30
I need normal bin format for flashing not winkfp

Last edited by krzychulbl; 12-10-2013 at 09:26 AM.
krzychulbl is offline   Reply With Quote
Old 12-10-2013, 03:27 PM   #98
daniel_f.
Registered User
 
Join Date: Jul 2011
Location: Germany
Posts: 821
My Ride: 330iCA
i can provide you some files, but just 64kb. the 512kb files include complete VIN and im just to lazy to manually delete them.
__________________
kind regards
Daniel

daniel_f. is offline   Reply With Quote
Old 12-11-2013, 03:56 AM   #99
new//M3fan
Registered User
 
Join Date: Aug 2010
Location: Reston, VA
Posts: 2,663
My Ride: 77' 924 87' E30
Quote:
Originally Posted by krzychulbl View Post
7509942 ms43 m54b30
I need normal bin format for flashing not winkfp
Just update your ecu to the latest, and follow the guide below to run a cat-less tune.

http://forum.e46fanatics.com/showthr...137&highlight=

Then turn on EOBD (address has been identified) and have someone tune it to your motor or I can send you the one I am running.
__________________
<-- Mango *F-BOMBS IN SIGS*
Bilstein HD's | E30 M3 FCAB's | H&R OE Sports | F+R strut bars | Self tuned 027 93 octane chip | KoseiK1's on R888's | + crazy OCD maintenance
new//M3fan is offline   Reply With Quote
Old 12-11-2013, 03:59 AM   #100
krzychulbl
Registered User
 
Join Date: Dec 2013
Location: europe
Posts: 5
My Ride: e36
Quote:
Originally Posted by daniel_f. View Post
i can provide you some files, but just 64kb. the 512kb files include complete VIN and im just to lazy to manually delete them.
64kb is ok
krzychulbl is offline   Reply With Quote
Reply

Thread Tools Search this Thread
Search this Thread:

Advanced Search
Display Modes Rate This Thread
Rate This Thread:

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Censor is OFF





All times are GMT -5. The time now is 01:03 PM.


Powered by vBulletin® Version 3.8.7
Copyright ©2000 - 2014, vBulletin Solutions, Inc.
(c) 1999 - 2011 performanceIX Inc - privacy policy - terms of use