BMW Forums : BimmerForums banner

1 - 13 of 13 Posts

·
Registered
Joined
·
7 Posts
Discussion Starter #1
Ok probably need flamesuit but here goes..........

I am new to the BMW scene, so just to give you a bit of background so you can see where I am coming from.

I had an 02 STi UK impreza which I kept for 3 and a half years, and had 2 imprezas before that.

I had been tuning that car for 3 years quite happily and am no newbie to tuning that car, including developing a mafless system, launch control enabled, and mild anti lag systems to boot, similar to the group n roms that are available for the jap versions of the cars from p'drive.

Really enjoyed it, learnt alot, keen to continue!

So, I had to get rid recently as my job has changed and need to do more miles.

Invested in a low mileage 320d (150bhp) late 2004 BMW (e46). Now I would like to have a look at the maps and extend my knowledge over to my own 320d. But, I am drawing a blank as to which cable and software to use. I am not entirely sure what actually works with that model, nor am I sure which ecu it has.

Can anyone point me in the right direction? Which cable will do it? (KWP2000+, Galleto or another?), software? (i used to use ecuflash romraider amongst others).

I dont plan on doing any one elses and always refused to on subaru's, basically I will take the risk for myself, but not extend that to other peoples motors!

Any help/advice greatly appreciated.

PS I know I could get it done for me, but thats not the point, I want to learn even more by exploring my map and seeing where the improvements can be done.

Cheers:D
 

·
Registered
Joined
·
7 Posts
Discussion Starter #2
E46 320d 150bhp 2004

Sorry forgot to list make model etc in thread title.

Noted!

and will do in future :thumbsup :duh
 

·
Registered
Joined
·
8,981 Posts
Your ECU will be a DDE5, also known by everyone else as EDC16.

The cloned Gallettos only cover up to EDC15, 1250 and 1260 are in fact the same, 1260 just includes Vista drivers, and a serial number in the lead has been changed.
KWP2000 is the same, only covering up to the DDE4 EDC15 ecus.

Real Gallettos will have been updated since, and i assume will cover the ECU.
The only problem is one of these interfaces will cost in the region of 3-4k

Subaru had the handy OpenECU resource, but there isn't anything similar for BMW.

BMW have an RSA encrypted key for communication which was designed to keep people out of the OBD port, so there is never going to be an easy way.
 

·
Registered
Joined
·
7 Posts
Discussion Starter #4
Cheers for the response,

So is this why people are talking of opening the ecu, so they can bypass the key?

therefore flashing the rom directly.

And if that is the case ('scuse the bad pun!) what do I need to be looking at. I have seen a bloke here where I work using an optican on a hdi ecu from a peugeot (was thinking of asking for a lend lol), although I fear that is too much money, although I am willing to throw some money into this, openecu tactrix cables are not cheap once bought from USA and imported, though not the price of pro kit.

I was thinking of maybe writing a def file for romraider (done that before form hex!), if I can download my rom..........

It has been managed for beemer minis.........
 

·
Registered
Joined
·
640 Posts
Ok probably need flamesuit but here goes..........

I am new to the BMW scene, so just to give you a bit of background so you can see where I am coming from.

I had an 02 STi UK impreza which I kept for 3 and a half years, and had 2 imprezas before that.

I had been tuning that car for 3 years quite happily and am no newbie to tuning that car, including developing a mafless system, launch control enabled, and mild anti lag systems to boot, similar to the group n roms that are available for the jap versions of the cars from p'drive.

Really enjoyed it, learnt alot, keen to continue!

So, I had to get rid recently as my job has changed and need to do more miles.

Invested in a low mileage 320d (150bhp) late 2004 BMW (e46). Now I would like to have a look at the maps and extend my knowledge over to my own 320d. But, I am drawing a blank as to which cable and software to use. I am not entirely sure what actually works with that model, nor am I sure which ecu it has.

Can anyone point me in the right direction? Which cable will do it? (KWP2000+, Galleto or another?), software? (i used to use ecuflash romraider amongst others).

I dont plan on doing any one elses and always refused to on subaru's, basically I will take the risk for myself, but not extend that to other peoples motors!

Any help/advice greatly appreciated.

PS I know I could get it done for me, but thats not the point, I want to learn even more by exploring my map and seeing where the improvements can be done.

Cheers:D
PM'd :D
 

·
Registered
Joined
·
8,981 Posts
When open, you can read the complete ECU via BDM.

BDM is a debugging port where the main base of the ECU is programmed in the factory, then shifted out to BMW.
Once BMW fit them, they finish off the coding through the diagnostic port.

It's this internal port where you can read all of the ECU data, the main flash, Eeprom, (which tends to hold fault codes, chassis data, individual coding etc) and the internal processor memory.

Through the OBD port, you can only read the flash memory, and often, only a section is read.

BDM is pretty fast, faster than OBD flashing, but you do need to be opening the ECU every time you want to make a change.
 

·
Registered
Joined
·
7 Posts
Discussion Starter #7
So cheers for the info, I think I am going to go down the BDM100 route and see where I end up, I am not really looking for big end power, if i wanted that I should have kept the STi, lol.

But I have found the power to be quite high up in the rev range, and am looking at tuning the car to be more responsive and less sluggish lower down, at cruising revs.

So......... EDC16 with RSA encrypted key (is the key individual to each ECU?, or just BMW. Thinking of PKI compliance here, with Public read and Private write keys), which renders the cheap cables useless as they do not include the private write key, which the pro kit does.

Am I right in thinking that byteshooter, expensive galletos and cmdflash etc, ie all the pro kits, are capable of writing directly to the ECU without the need to access the BDM port directly on the motherboard and therefore work via the OBD port?

If that is the case do these cables contain the RSA key needed, and if that is again true then the key is BMW, not ECU derived (sorry thinking out loud now.....)

Ok, so what is the extra BMW specific port for? What does that do that the OBD connector can not?

Sorry to go on............

Cheers

Jonny
 

·
Registered
Joined
·
8,981 Posts
The BDM 100, and others,
infact i have a feeling any Motorola MPC5xx type BDM is able to read out the ECU, will bypass the OBD Read/write RSA protection.

The current full genuine tools can read and write the ECUs, but they usually require a live internet connection.
What happens at the far end of this connection is anyone's guess, as the RSA keys are the property of BMW, so other won't have them, but it all comes back OK.
Reading and writing is then enabled.

Inside the ECU is the 3 main memory zones, the main flash chip, where the maps will be stored, the eeprom where immobiliser, chassis numbers, coding info etc is stored, (not always the case, sometime it will be in other chips, but generally true) and the processor memory.

The processor memory is best left alone unless you plan to write a complete program to run the car, the eeprom, aka e2, or e2prom is also left alone unless you need to do ECU repairs, or swap an ECU completely, so you just concentrate on the flash memory which holds all the main map files.

As space isn't at a premium with these ecus, and they have 16bit data values, most of the info is in "Human", ie boost values will be in mbar, injection quantities will be in mg, as there is 65,000 steps in 16 bit, compared to the cramped 256 in 8 bit.

Generally, BDM avoids having to get through the OBD security.
 

·
Registered
Joined
·
7 Posts
Discussion Starter #9
Again thank you, The end, this is wetting my appetite.........

So BDM is the only way I could continue without shelling out a fortune and a internet connection to 'negotiate' the pki write key to 'unencrypt' the OBD flash protocol. Think I get it....

So to the BDM100, I assume the ones on eBay are clones? should these be avoided? are there any reputable dealers, where I know I can buy something without manufactured dry joints built in?

Also which software do people use to view the maps or is it pure hex translation and address spotting.

Just as a bit of a thought, has anyone played with the logic in the processor mem? Just a wonder as I have worked on ECU logic before.......... result was anti-lag, maffless and launch control ( 2 stage rev limiting). Not saying I want any of this, just being nosey...

Jonny
 

·
Registered
Joined
·
8,981 Posts
Well, there is stumbling block number 2.
For the editing, you can use a simple hex editor, but you then have the numerous checksums, these cover the various areas and watch for changes.
If anything changed is noted, the ECU shuts down, fearing a corrupt program.
That means any changes made get detected, and the ECU won't run unless the checksums are correct.

Many of the obd flashing tools correct the checksum whilst they are being passed around to the manufacturer's site, otherwise, you need an editor which can correct them, which again, will start to cost in the region of 1k plus, and usually subscription charges on top each year.


Processor memory - i don't think anyone goes into that. There is more program code in the flash too, easier to describe the processor as running XP, and the flash has MS excel installed, and also the databases it uses.
 

·
Registered
Joined
·
7 Posts
Discussion Starter #11
Ah yes the checksums, which is where the software comes in.........

openecu tools does all this for us, in that lucky world, so what do we use on BMW maps, ie what (if any) is the BMW equivalent of romraider?

PLUS,

Is the BMW socket a re wired clone of the OBD port, and therefore does nothing different?

I will stop bugging you soon honest....

Cheers
 

·
Registered
Joined
·
8,981 Posts
There used to be programs about which did some 8 bit stuff, and you usually had to do your own checksum or buy a full package, but i don't think they ever made it to the market, and have been consigned to the history books.

The BDM port has pins that talk directly to the processor. OBD had relatively few, in fact less than half of the 16 pins are usually used, just a power and ground, K line which is a general communication line, sometimes a secondary K line to talk to different modules, ie, one K line will communicate with the ECU, the other will go to body modules and ABS.
A L line which is rarely used, which was usually a wake up signal to the ECU to prepare it for communication, and now, the current popular one is 2 CAN lines, which is the CAN bus where pretty much every important sensor and module all share info, and any device can just tune in like a radio and pick up or broadcast what it needs.

The BDM port is either a JTAG port, or at least very similar, if maybe sidestepping a few of the JTAG rules.

http://en.wikipedia.org/wiki/Joint_Test_Action_Group

For an ECU, the BDM port has 10 -12 pins, not all of them will be used, and this generally taps into the complete ECU databus so can read every chip on the board.

http://www.shop.drs-systems.com/index.php?main_page=index&cPath=2

That's a quick look at some of the bits used, including the evil looking spikey probes that make the contact.
 

·
Registered
Joined
·
1 Posts
I am really grateful for this post! Spent days spending time faffing about with an ODB cable bought cheap; stripped it re-soldered connections reprogrammed the chip in it to match Galleto 1260; read 3 cars downloaded approximately (Unknown) Trojans, XP Programs, 7Zip files Zip files its been a blast from 2010!!! Its crazy how far some things get you to look....
I was starting to get to the manual bench power supply hard wiring boot modes and JTAG outputs etc... then I read this just as I started to have (mutated) faith in ODB + Galleto (falsely reading) ECU whilst being unconnected...

If you guys are still about would you mind updating me on the approach you ended taking if any? :)

I will be sure to follow along with my experience on this post...
 
1 - 13 of 13 Posts
Top