NefMoto

Technical => Tuning => Topic started by: adriancl on December 15, 2015, 01:02:09 AM



Title: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 15, 2015, 01:02:09 AM
Hi all,
I searched for a long time a Damos file for Siemens EMS2000 ECU, but nothing.
After some work, and it was not easy, have made a  mappack for R50 and R53,on csv file can see only a short version.Tested on over ten tuned cars,with very good results.


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 15, 2015, 01:19:58 PM
Upload your ori?


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: ddillenger on December 15, 2015, 04:54:33 PM
This is some sort of humble brag I guess. Just a list of stuff he's found I guess. I don't even know why he posted it.


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 16, 2015, 07:59:11 AM
This is some sort of humble brag I guess. Just a list of stuff he's found I guess. I don't even know why he posted it.
not at all, simply want to help members who have questions about these maps, factor and offset, units, which ones need to be modified for tuning, what maps must to touch if you use bigger injectors, reduced pulleys, larger throttles and so on.I'm ready to share ,wait for the questions,that's all mate!


Title: Re:
Post by: n0ble on December 16, 2015, 09:23:52 AM
Well share it then.


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 16, 2015, 11:20:55 AM
This is some sort of humble brag I guess. Just a list of stuff he's found I guess. I don't even know why he posted it.

odd!


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 16, 2015, 11:25:59 AM
EMS 2000 ECU Overview



Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 16, 2015, 12:21:08 PM
Here you are first doc,regarding main Ignition maps.Of course, any help from other more skilled members,improvement, addition are welcome.
I modified the attach from odt in word file


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 16, 2015, 07:52:58 PM
Open office file which I ain't got a reader for but funny in the context of the thread

Did you post you ori?  Curious to dissembe it


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 16, 2015, 07:54:54 PM
I think you should change the thread title bit misleading unless you are wanting pms


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: ddillenger on December 16, 2015, 08:29:08 PM
Here's one of my oris.



Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 16, 2015, 11:27:50 PM
Open office file which I ain't got a reader for but funny in the context of the thread

Did you post you ori?  Curious to dissembe it

It disassembles so beautiful :) Let me take a look if i can deactivate EWS for you guys.

Disassembly is somewhat similar to MS43 :D

Checksum handling found, we could turn off checksum for calibration.


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 17, 2015, 02:27:07 AM
It disassembles so beautiful :) Let me take a look if i can deactivate EWS for you guys.

Disassembly is somewhat similar to MS43 :D

Checksum handling found, we could turn off checksum for calibration.

Need full flash read 29F400 to deactivate EWS,OBD read is useless.


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 17, 2015, 03:29:19 AM
Need full flash read 29F400 to deactivate EWS,OBD read is useless.

512kb is full flash file ;)


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: aef on December 17, 2015, 03:41:34 AM
just out of interest:
which cheap tools will read this ecu


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 17, 2015, 04:20:23 AM
just out of interest:
which cheap tools will read this ecu
MPPS, Galletto 1260,FGTech, the fastest is MPPS,read in 2 minutes, write in 75 sec.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 17, 2015, 04:27:34 AM
just out of interest:
which cheap tools will read this ecu
MPPS, Galletto 1260,FGTech, the fastest is MPPS,read in 2 minutes, write in 75 sec.


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 17, 2015, 04:44:02 AM
512kb is full flash file ;)


This is full flash read , and look at address 4000 to 4800 on file posted by ddillinger and this file, of course are from diff.  cars, ddillinger file is from Cooper S,2004,manual gearbox, my file is from Cooper 2003, automatic gearbox.


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 17, 2015, 07:46:42 AM
This is full flash read , and look at address 4000 to 4800 on file posted by ddillinger and this file, of course are from diff.  cars, ddillinger file is from Cooper S,2004,manual gearbox, my file is from Cooper 2003, automatic gearbox.

4000-4800 is most probably measured values ;) So it depends on how one reads the flash, there will be entries or simply FF. Nothing to worry about.

AIF storage found, ISN found. AIF has some good amount of offset to MS43, but ISN is pretty similar.

Anti-bounce counter section found, axis description section found, too. I just have a hard time finding the linearization for main load measurement. Do these cars use a MAF sensor?


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 17, 2015, 08:22:40 AM
Very interesting to me this, are you guys referring to an FR?



Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 17, 2015, 08:27:47 AM
Very interesting to me this, are you guys referring to an FR?

Me? No. I´m just referring to my MS42/43 disassembly and it look so much similar :)


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 17, 2015, 08:31:16 AM
It disassembles so beautiful :) Let me take a look if i can deactivate EWS for you guys.

Disassembly is somewhat similar to MS43 :D

Checksum handling found, we could turn off checksum for calibration.

Could you post your settings is it a C167?


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 17, 2015, 08:50:17 AM
DPP1 = 0x1C?


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 17, 2015, 08:59:54 AM
DPP2 =0x1D?


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 17, 2015, 09:04:48 AM
DPP3 = 3 RAM?


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 17, 2015, 09:05:28 AM
Code:
0000:00000000             ; Format      : Binary file
0000:00000000             ; Base Address: 0000h Range: 0000h - 80000h Loaded length: 80000h
0000:00000000
0000:00000000             ; Processor       : c166 [C167CR-LM_MS43]
0000:00000000             ; Target assembler: Keil A166 Assembler
0000:00000000             ; Byte sex        : Little endian
0000:00000000             $MOD167
0000:00000000             $CASE
0000:00000000             $NOMACRO
0000:00000000
0000:00000000
0000:00000000             ; ===========================================================================
0000:00000000
0000:00000000             ; Segment type: Pure code
0000:00000000             MEM_EXT_0       section CODE word public
0000:00000000             procMEM_EXT_0 proc
0000:00000000                             ; assume dpp0: 1Ch (page 0x70000)
0000:00000000                             ; assume dpp1: 3Bh (page 0xEC000)
0000:00000000                             ; assume dpp2: 10h (page 0x40000)
0000:00000000                             ; assume dpp3: 3 (page 0xC000)



Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 17, 2015, 09:32:39 AM
I make it:

0 = 0x1c
1= 0x24
2 = 0x1D
3 = 3

 ??? ???

Ext ram range? 0x300000?? or does it just use internal xram


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 17, 2015, 09:56:50 AM
Anyone knows the position of partial checksum?

It should be located at 0x77FE0/1


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 18, 2015, 12:32:18 AM
I make it:

0 = 0x1c
1= 0x24
2 = 0x1D
3 = 3

 ??? ???

Ext ram range? 0x300000?? or does it just use internal xram

Seems you´re right, even though i have no idea why :)


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: AG on December 18, 2015, 12:47:05 AM
Need full flash read 29F400 to deactivate EWS,OBD read is useless.

You don't need to read 29F400 or read C167 in BootMode to get fullflash.
But you have to upload your disabled-EWS-rom in BootMode because the record "EWS signal to start" is in write-protected area and it can't be changed online. (There is opportunity to do it online, but has not been studied yet)

Ext ram range? 0x300000?? or does it just use internal xram

As I can found there is no Ext RAM on the circuit board.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 18, 2015, 03:35:06 AM
Found it.
Galletto can read full flash by OBD.
Immo off can be done only in flash, and made a shortcut at start relay outputs.That is solution 100% tested and work perfect.
For automatic gearbox must do after immo off  adaptation,according to BMW  procedures.No need diag tool, only follow the indicated steps.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 18, 2015, 03:56:40 AM
Found it.
Galletto can read full flash by OBD.
Immo off can be done only in flash, and made a shortcut at start relay outputs.That is solution 100% tested and work perfect.
For automatic gearbox must do after immo off  adaptation,according to BMW  procedures.No need diag tool, only follow the indicated steps.

So there is already a free ews delete solution? Then i don´t need to investigate further.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: ddillenger on December 18, 2015, 04:21:51 AM
So there is already a free ews delete solution? Then i don´t need to investigate further.

He said it exists, it hasn't been posted, nor word of it being free. It'd be awesome to see regardless.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: AG on December 18, 2015, 04:33:07 AM
There is a solution previously known. Only needed to be uploaded in offline (in Bootmode).

But if you start disassembling you can make a good job.
As you know KWP2000 protocol have security access and you need to authorize to get access to read/write functions.
Is it possible to find the mechanism of forming the hash of seed-key? (if you understand me :))

I can explain what to look for.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 18, 2015, 05:29:36 AM
There is a solution previously known. Only needed to be uploaded in offline (in Bootmode).

But if you start disassembling you can make a good job.
As you know KWP2000 protocol have security access and you need to authorize to get access to read/write functions.
Is it possible to find the mechanism of forming the hash of seed-key? (if you understand me :))

I can explain what to look for.

I have no idea ;) I would just try the same approach as used at MS43/42. i don´t think its to much hassle to work with bootmode, but if you are aware of a different solution, i´d definately be interested in this. Everything that makes it easier for others would be awesome for the community  :)


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: AG on December 18, 2015, 05:42:36 AM
It is not too hassle to work in boot mode but it is interresting to try change readonly areas online.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: AG on December 18, 2015, 05:51:47 AM
About IMMO disabling just put FF into 3ee7 and upload in bootmode


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 18, 2015, 06:56:57 AM
About IMMO disabling just put FF into 3ee7 and upload in bootmode

Looking very interesting  ;)



Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 18, 2015, 10:23:44 AM
I´ve seen there is a Launch-Control solution for the stock ecu from bytetronik?! Anyone having info on that?


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: AG on December 18, 2015, 12:19:35 PM
You have to put rev limiter for Gear 0.
When you will satart moving ECU will determine 1st gear and jump to new limiter.
In my case it is not very intetesting because after I release clutch revs jumps to max sliping front wheels.
I have to regulate throttle to have good start. I think it will be better to have torque based gear limiter.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 18, 2015, 02:05:00 PM
Do you know the actual approach bytetronik did? Did they modify the code like ME7.* folks or is it simpler solution like neutral gear rev limit?


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: AG on December 18, 2015, 02:10:58 PM
Neutral gear limit. Have it. And what is modify like ME7?


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 19, 2015, 12:04:26 AM
ME7 folks modify the code to get some more realistic launch control and no-lift shift. Thats why i´m really interested in the EMS2000 solution, as MS43 (which i´m mostly interested in) is pretty similar.

We also have the gear dependant rev limiter, i just haven´t found someone to test it. Regarding your ecu and the rev limiter stoping to work to early: I guess there is a similar constant at EMS2000... maybe this could help?

c_vs_min_gear_1 "3km/h"


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 19, 2015, 01:31:45 AM
Seems you´re right, even though i have no idea why :)

It's in ze code ;)


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 19, 2015, 01:34:09 AM
You don't need to read 29F400 or read C167 in BootMode to get fullflash.
But you have to upload your disabled-EWS-rom in BootMode because the record "EWS signal to start" is in write-protected area and it can't be changed online. (There is opportunity to do it online, but has not been studied yet)

As I can found there is no Ext RAM on the circuit board.

I assume you use a bootloader, just needs modified..


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 19, 2015, 04:40:31 PM
Code:
0000:00000000             ; Format      : Binary file
0000:00000000             ; Base Address: 0000h Range: 0000h - 80000h Loaded length: 80000h
0000:00000000
0000:00000000             ; Processor       : c166 [C167CR-LM_MS43]
0000:00000000             ; Target assembler: Keil A166 Assembler
0000:00000000             ; Byte sex        : Little endian
0000:00000000             $MOD167
0000:00000000             $CASE
0000:00000000             $NOMACRO
0000:00000000
0000:00000000
0000:00000000             ; ===========================================================================
0000:00000000
0000:00000000             ; Segment type: Pure code
0000:00000000             MEM_EXT_0       section CODE word public
0000:00000000             procMEM_EXT_0 proc
0000:00000000                             ; assume dpp0: 1Ch (page 0x70000)
0000:00000000                             ; assume dpp1: 3Bh (page 0xEC000)
0000:00000000                             ; assume dpp2: 10h (page 0x40000)
0000:00000000                             ; assume dpp3: 3 (page 0xC000)



I just  looked at your drive files and those are correct DPP's for the MS43's files.  That's where the confusions came from assumption! :)

Nice logger BTW :)


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: AG on December 20, 2015, 12:24:53 AM

AIF storage found, ISN found. AIF has some good amount of offset to MS43, but ISN is pretty similar.

Anti-bounce counter section found, axis description section found, too. I just have a hard time finding the linearization for main load measurement. Do these cars use a MAF sensor?

Very interresting could you find more details?
R50-R53 use MAP sensor


Title: Re: Map pack for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 20, 2015, 12:51:37 PM
Very interresting could you find more detaiis.
R50-R53 use MAP sensor

Haven´t looked tooooo deep into code, but i tend to think MAP sensor linearization is done at 0x7BF18 in the file from ddillenger. I need to take a look where its located in the code.

Crosscomparing to other siemens ecus like MS43 and MS42 should give a good hint whats going on and what map does what.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 20, 2015, 01:25:46 PM
Happy to chip in just lmk


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 20, 2015, 01:28:04 PM
x


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 20, 2015, 02:13:30 PM
winols map for Intake manifold MAP sensor.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: ddillenger on December 20, 2015, 02:30:58 PM
Any chance you can post a JCW R53 file? I'd love to compare it to the non JCW...


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 20, 2015, 02:57:18 PM
yes of course,


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 21, 2015, 04:50:10 AM
Do we have a specific softwareversion we should be working on? In my experience its much easier if all work on the same version as in every iteration there´s offset and new maps/constants.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 21, 2015, 04:59:23 AM
Do we have a specific softwareversion we should be working on? In my experience its much easier if all work on the same version as in every iteration there´s offset and new maps/constants.

I think this is how I got confused, and also the calibration section layout.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: OKCZ on December 21, 2015, 05:01:40 AM
I think the best is to use latest software versions. Select one for EMS2K (pre-facelift models) and one for MS5150 (facelift models).


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 21, 2015, 05:04:37 AM
I think the best is to use latest software versions. Select one for EMS2K (pre-facelift models) and one for MS5150 (facelift models).

Agreed, which EMS2000 file then and I'll crank IDA, a OLS would be helpful in defining a few functions, I'm assuming an A2L doesn't exist lol.  Didn't stop me on Volvo but I had something to go with, I figured out he diag routine with rkams help, then I blagged info from Volvo, that was a major breakthrough.  Fairly easy to find the map function if you identify the VAR lol.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: OKCZ on December 21, 2015, 05:07:40 AM
Here, both latest sw versions from facelift and pre-facelift models.

EMS2K and MS5150 are in practical same units.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 21, 2015, 05:19:44 AM
Here, both latest sw versions from facelift and pre-facelift models.

EMS2K and MS5150 are in practical same units.

EMS2000:
dpp0: 0x1Ch (page 0x70000)
dpp1: 0x24h (page 0x90000)
dpp2: 0x1D (page 0x74000)
dpp3: 0x3 (assumed as it points to 0xc000 in the older file, haven't seen the instruction yet, this is RAM inside the PROC)


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 21, 2015, 05:32:59 AM
Here, both latest sw versions from facelift and pre-facelift models.

EMS2K and MS5150 are in practical same units.

Do you have different stock tunes with that softwareversion to compare for config switches and antibounce counter? Mainly EMS2k interested ;)


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: OKCZ on December 21, 2015, 05:39:25 AM
Here is Cooper S latest sw version EMS2K


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: NolanD on December 21, 2015, 06:10:38 AM
may be this was made later for ems .. (USDM Man)


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: OKCZ on December 21, 2015, 06:23:06 AM
may be this was made later for ems .. (USDM Man)
Correct, BUT this version was made only for small amount of cars because they didn't had MS5150 finished yet, so they prepared little new "facelift" version for EMS2K.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: NolanD on December 21, 2015, 06:28:58 AM
yes.. this soft is with native offthrottle "popping" for EMS   :)  rare thing


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: OKCZ on December 21, 2015, 06:29:56 AM
Popping was in every sw


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: NolanD on December 21, 2015, 06:42:31 AM
ok, but in facelift sw  off throttle ignition advance  dips became more synchronous, thus popping is clearly hearing there


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 21, 2015, 08:49:06 AM
Still working on the softwareversion ddillenger has posted, so far this should be the position from antibounce counter. Its part of the diagnostic. Either 5A12h or 0D65Ah is refference to DTC Mask which can be used to turn off dtc handling.

0x70127 is the beginning of antibounce counter, at MS43 its called C_ABC_INC_*** and its the value the antibounce counter gets counted up until it reaches the max allowed value (40 in this case) C_ABC_MAX_***. 0x7015C also is the beginning of C_ABC_MAX_*** section.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Cloudforce on December 22, 2015, 12:13:10 AM
Comparison of position of checksum calculation between MS43 (left) and EMS2k (right). Someone tell me they have nothing in common ;)


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 24, 2015, 07:21:56 AM
Comparison of position of checksum calculation between MS43 (left) and EMS2k (right). Someone tell me they have nothing in common ;)


Lol cut and paste/port


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: AG on December 24, 2015, 07:59:32 AM
Is it possible to reverse it like ms43?


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: dream3R on December 24, 2015, 10:44:05 AM
Yes


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: ported2flow on February 20, 2017, 11:38:04 AM
anyone could share some info on how to get rid of the cat so that there is no error?


thanks


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on February 26, 2017, 12:46:18 AM
anyone could share some info on how to get rid of the cat so that there is no error?


thanks
Hi mate,
 Can use NCSExpert and disable second Lambda sensor or you can made DTC P0420 off in flash.If you need to close DTC , I'll do the job for you, just send me your file.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 22, 2018, 03:18:18 PM
Sorry to rattle this old topic up. You guys really know your bussines. 
I recently bought a Bytetronik loaded ECU. They advertise that it can be uninstalled, but apparently only they can.

Now i want to change the software to a Immo off solution, but they changed the seed code or something. It cant be read with any tools i have, except bytetronik, and that file is encrypted.

Any way to get that "cracked" so i can use this ECU?
It looks like the Bytetronik reads the UIF data to see if it is licensed. Maybe i can copy this UIF to my immo off ecu and load the bytetronik software again?

Any info would greatly be appreciated.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on August 22, 2018, 08:33:39 PM
Hi mate
Open ECU and read flash in boot mode.Will get full flash read.Can use a cheap Galetto FGTech or KTAG.In boot mode ,can write in boot mode any file you want ,mean an immo off file ,easy job.Immo data are stored in flash.Hope i understand well your question.If you need i can provide you more info.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 22, 2018, 10:19:21 PM
I can read 29f400 flashes without issues.  Trouble is that this one has a flexible print instead of a solid board.  Don't want to risk it unless there is no other way. 
And if im not mistaken,  the mini has 1 or 2 data lines different so that my flash data needs to be adjusted to the obd read format. But I never had to do that myself.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on August 23, 2018, 12:13:40 AM
I can read 29f400 flashes without issues.  Trouble is that this one has a flexible print instead of a solid board.  Don't want to risk it unless there is no other way. 
And if im not mistaken,  the mini has 1 or 2 data lines different so that my flash data needs to be adjusted to the obd read format. But I never had to do that myself.

No risk , flexible print is  a good quality one, can solder  the boot  cable without issues, made that many times.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 23, 2018, 01:18:29 AM
I didn't know it had boot mode.

Will try it in a minute with ktag


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 23, 2018, 02:03:37 AM
What protocol do you use with Ktag? Cant seem to find the EMS2k in the list.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on August 23, 2018, 02:42:03 AM
What protocol do you use with Ktag? Cant seem to find the EMS2k in the list.

Use Sirius protocol.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 23, 2018, 03:16:09 AM
Trying it now with a non bytetronik. First read was only 192kb while i should read 512.. Working on it. As soon as it works, i will post the bytetronik read out as well.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 24, 2018, 04:54:52 AM
It will keep giving me a 192 kb file.

Will try to repair my FGtech this weekend and pull the bytetronik flash.
Maybe we can see what they are hiding :P


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: n14 on August 25, 2018, 02:04:56 AM
I can confirm those ECU's works fine with Galletto v54 in Bootmode. Don't worry about soldiering on the PCB


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 25, 2018, 02:25:23 PM
I can tell you guys that I've fixed my fgtech. I also have to inform you that I forgot the 15 pins cable at work.  I might solder it directly tomorrow.. but first I will read and save the aif info from the ecu to make a copy just in case.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on August 27, 2018, 05:06:29 AM
It worked.

This is the read out of the Bytetronik ecu.

Lets see what i can do with it :P

Read is OK, have NOREAD tag inside.
Car VIN Nr.WMWRE32050TC73442.File is moded for around 200HP in case you have reduced pulley on Supercharger.With stock injectors 320cc can't get more power.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 27, 2018, 07:22:57 AM
Edited

Do you also know where the No-read tag is located so i can change that?

Thanks
Also uploaded the ECU i want to adjust as a test mule(my own r50)


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 27, 2018, 11:32:57 AM
I was mistaken by thinking the uif data was in the flash as I don't see an eeprom anywhere.
But after I transferred the whole flash, bytetronik wil still see the vin number. Need to see how I can alter this data.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on August 27, 2018, 11:51:06 AM
Hi mate,
NOREAD tag address  77EE0 and 77FA0.
File named R50 Michel Original is bad read,although it seems to be original .I can restaure for you the R53 file to original, even from this file missing sw number.
If you want to transfer R53 file on R50 ECU , you must do immo off on R53 file ,if want to start the car with R50 ECU.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 28, 2018, 04:05:54 AM
Hi there,

An original R53 file would be great. Trying to figure out if i have a software/interface package that will copy the UIF data from one to another in order to switch the license. If so, i might be able to get bytetronik far enough to work with my own software version.

I will read out the R50 again on the bench(kinda unintentionally messed up EWS-DME sync with FVDI yesterday) en see if i can make it immo off.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 28, 2018, 04:08:08 AM
one other thing i noticed, is that the Vin in the UIF from the Bytetronik ECU is not the original ecu. So that would indicate that they write a new UIF record to the ECU, and dont specificly look at the first record right?
jus throwing ideas out here :p


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: prj on August 28, 2018, 05:55:22 AM
Posting commercial tunes on this forum is against the rules.
What you are doing here is against the very core ideas of this forum. Get out of here and stop posting material that you do not have permission to post.

We are here to help people learn to DIY, not to rip off and copy work of commercial tuners.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 28, 2018, 06:47:40 AM
Sorry you feel this way.  I bought the bytetronik second hand with the idea to transfer it to my own car as they advertise that you can uninstall it.  What they don't tell you is that it will cost you 300 euro.
So I then asked to sell me a immo off solution le they advertise,  been 3 weeks since I heard from them.
I eventually send them a message to sell me another license.. want to guess what happened?  Exactly.. no desolve whatsoever. So this leaves me no choice then to take matters in my own hands and try to transfer the license myself.  The software I posted are original files my my own cars. No software or tunes from commercial companies are shared.

So sorry if it seems that I'm trying to steal any shit from bytetronik,  I'm not  im trying to get it to work on my own as they have 0 support.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Mclain on August 30, 2018, 05:19:39 AM
Hey All.

Was able to transfer the neccessary block to let it run on my own ECU. Now i can use it on my car without the need to exchange ews, keys, locks ets

Would it be possible to make the R53 bytetronik file original again? That way i can flash this back into that ecu and make it stock again and sell it with the keys, ews and bcm.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: prj on August 30, 2018, 08:52:34 AM
Sorry you feel this way.
I don't have any feelings towards you.

Posting commercial tunes is against the rules, I don't care what your excuse is.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Dufek125 on November 08, 2018, 10:02:00 AM
Hoping to revive this a bit. Was there a solution worked out for boot mode and checksum correction to allow for easy flashing? Coming from the ms43 community as well and I see alot of similarities


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on December 03, 2018, 08:47:38 AM
Hoping to revive this a bit. Was there a solution worked out for boot mode and checksum correction to allow for easy flashing? Coming from the ms43 community as well and I see alot of similarities
Full read can be done with any cheap tool, in this case MPPS clone.
Boot mode is useful for immo of.Immo data are stored in flash,  but in a protected area of memory, so immo of file can be written only in boot mode.VIN Nr. address is 8000.To decode the VIN Nr. need BMW VIN to Hex sw.Both type of ECU, mean EMS2000 and MS5150 can be made immo off.MPPS original tool can do checksum.Also Kess, and maybe  other tools.ECM  from AlienTech can do it also.
Bootpin for MS5150 in attach.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: blax123 on December 29, 2018, 03:12:50 PM
Full read can be done with any cheap tool, in this case MPPS clone.
Boot mode is useful for immo of.Immo data are stored in flash,  but in a protected area of memory, so immo of file can be written only in boot mode.VIN Nr. address is 8000.To decode the VIN Nr. need BMW VIN to Hex sw.Both type of ECU, mean EMS2000 and MS5150 can be made immo off.MPPS original tool can do checksum.Also Kess, and maybe  other tools.ECM  from AlienTech can do it also.
Bootpin for MS5150 in attach.
Read in Bootmode with MPPS clone can be done also?
And do I need to calc checksum if I just want to FF the ISN to be able to sync immobilizer with BMW tools again?

I'm asking because I want to change the EMS2K from a preLCI Cooper S to a MS5150 from LCI to be able to flash the GP1 Soft with Winkfp

Edit:
Found out that SMOK UHDS is able to read and write Eprom and Flash via OBD. Still the question, do i need to correct the checksum if i just edit the ISN? Will Ultimo do this job? Last time i loaded a MS5150 Full Flash into it said no checksum correction needed

Edit2:
At which adress is the ISN located and how much bytes?


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: adriancl on January 05, 2019, 04:20:24 AM
Have pm mate.


Title: Re: Maps study for Mini Cooper R50 and R53 Siemens EMS2000
Post by: Dufek125 on February 05, 2019, 11:54:27 AM
So they ecu does not need to have the immo off to flash a modified file?