ECU Explorer Review (Modifying VMax and other locked DME parameters) [In Progress]

cryptocar · 11-20-2015, 03:17 PM

Hi, as many coders are already aware, the F series BMWs have time locks built into the DME, prohibiting reading and writing of certain parameters such as ISN (secret key), VMax (electronically limited top speed) and KAT (delete the painfully annoying CEL and fault due to sport or catless downpipes). ECU Explorer is a tool designed specifically to read and write the internal eeprom of the DMEs used in many current BMW models. The eeprom is where the hour counter is located, using this tool should allow you to reset your hour counter therefore unlocking time locked parameters such as VMax.
So far I have successfully removed my DME from my car (with some awesome help from dd1981 , opened the case, shorted the required pin and connected to my computer, unfortunately by the time I got there I ran into software problems and decided to hold off until I had more time.
Since, I have gotten my car back together and running perfectly with no faults, and also figured out the next step in the software. The hard part is out of the way, I've successfully done the required physical hacking of the board, all that's left is for me to find time to remove my DME again and finish the process with ECU Explorer.

Will post back with an update.

If any other users have experience with this tool please post or PM me. I have yet to find anyone to has also used this tool.

tboooe · 11-20-2015, 03:26 PM

subscribed!!!! I've hacked lots of things but never my car because frankly I am too scared. Very interested to learn what hacking a DIY'er can do.

cryptocar · 11-20-2015, 03:56 PM

Hacking your car is always a scary prospect but I've spent a few months researching this, priced the risks and feel confident I can do it successfully on my car. I've already done the hard part, shorting the pin on the board and reinstall it into my car working without faults. Last step is just a few clicks through ECU Explorer.

mike@x-ph.com · 11-20-2015, 04:28 PM

Good luck

ronanz · 11-20-2015, 05:23 PM

.

... .

.

G30 B58 · 11-20-2015, 05:32 PM

Like I said, BIG BALLS.

Don't be scared, be the pioneer.

Jadar · 11-21-2015, 07:57 AM

Quote:

Originally Posted by cryptocar

Hacking your car is always a scary prospect but I've spent a few months researching this, priced the risks and feel confident I can do it successfully on my car. I've already done the hard part, shorting the pin on the board and reinstall it into my car working without faults. Last step is just a few clicks through ECU Explorer.

Quote:

Originally Posted by mike@x-ph.com

Good luck

Hes got this

The leg work and charting the territory was already done...just had software issues that prevented this from being complete.

Taking out the DME I think I got this down to 1/2 hour now...

mookie45 · 11-21-2015, 07:57 AM

Very interesting! Good luck!

franzzz · 11-23-2015, 02:37 AM

for me, Another way is decrypt the CAFD files in order to edit and upload new DME config via ESYS.....

cryptocar · 11-23-2015, 11:01 AM

Quote:

Originally Posted by franzzz

for me, Another way is decrypt the CAFD files in order to edit and upload new DME config via ESYS.....

And you've had success with this method?

Polo08816 · 11-23-2015, 11:13 AM

Quote:

Originally Posted by cryptocar

And you've had success with this method?

It's just 'ones' and 'zeroes' man. No big deal. I actually have a two button keyboard just for programming in binary.

In all seriousness, this is good work.

Jadar · 11-25-2015, 10:26 AM

Quote:

Originally Posted by Polo08816

Quote:

Originally Posted by cryptocar

And you've had success with this method?

It's just 'ones' and 'zeroes' man. No big deal. I actually have a two button keyboard just for programming in binary.

In all seriousness, this is good work.

Do share, so we don't have to take out the ECU again

obriennathaniel · 11-27-2015, 09:09 PM

this is interesting!

undermine · 11-29-2015, 08:36 PM

Time to chime in, first off I don't mind pulling out my DME or even buying another one to test on.

I was looking up BootMode on Flashtec, and a method for direct connection.

http://flashtec.ch/boot-tricore#tricorecarlist

E-Sys sounds great but no one has been able to reset the time lock with E-Sys like you could with Tool32, either way we have work to do.

Does any one have a working copy of ECU Explorer that they could share, please PM me!

Quote:

Originally Posted by franzzz

for me, Another way is decrypt the CAFD files in order to edit and upload new DME config via ESYS.....

cryptocar · 11-30-2015, 02:11 AM

Quote:

Originally Posted by undermine

Time to chime in, first off I don't mind pulling out my DME or even buying another one to test on.

I was looking up BootMode on Flashtec, and a method for direct connection.

http://flashtec.ch/boot-tricore#tricorecarlist

E-Sys sounds great but no one has been able to reset the time lock with E-Sys like you could with Tool32, either way we have work to do.

Does any one have a working copy of ECU Explorer that they could share, please PM me!

Quote:

Originally Posted by franzzz

for me, Another way is decrypt the CAFD files in order to edit and upload new DME config via ESYS.....

ECU Explorer is pretty tightly controlled. Need a a physical USB key open the software and have a license.

undermine · 11-30-2015, 05:38 PM

Got it, I don't know of any other alternative and if it really is the best and only option then I will look into the details. I am sure there are a few of you far more familiar with ECU Explorer, feel free to chime in with some feedback, I would like to invest some time into this.

Piggy back hasn't been too bad but I would rather have the ability to flash.

Quote:

Originally Posted by cryptocar

ECU Explorer is pretty tightly controlled. Need a a physical USB key open the software and have a license.

cryptocar · 11-30-2015, 07:40 PM

Quote:

Originally Posted by undermine

Got it, I don't know of any other alternative and if it really is the best and only option then I will look into the details. I am sure there are a few of you far more familiar with ECU Explorer, feel free to chime in with some feedback, I would like to invest some time into this.

Piggy back hasn't been too bad but I would rather have the ability to flash.

I'll keep posted on ECU Explorer no other users have posted about actual use so I'm trying to help, my harness used to connect directly to the DME is even cleaner than the one in those pics you shared.

undermine · 12-01-2015, 05:24 PM

Quote:

Originally Posted by cryptocar

I'll keep posted on ECU Explorer no other users have posted about actual use so I'm trying to help, my harness used to connect directly to the DME is even cleaner than the one in those pics you shared.

That was someone else's photo, do share, pm.

cryptocar · 12-01-2015, 05:45 PM

Quote:

Originally Posted by undermine

Quote:

Originally Posted by cryptocar

I'll keep posted on ECU Explorer no other users have posted about actual use so I'm trying to help, my harness used to connect directly to the DME is even cleaner than the one in those pics you shared.

That was someone else's photo, do share, pm.

I'll take a pic of it and post it tomorrow don't have it with me. It's actually quite similar but my harness has a camlock plug just like the OEM cables. It converts to a OBD CANBUS powered by an external 12v power supply which is then converted to USB.
Also that's a very different DME than mine. Mine has the circuits on the bottom the the board and the connections on the top.
This is the best photo I have right now of what one of the N55 F series DME looks like.

cryptocar · 12-02-2015, 09:02 PM

Here's a photo of the harness.

ronanz · 12-02-2015, 09:22 PM

WOW!!! THAT'S impressive!! Soooo clean...

.

cryptocar · 12-02-2015, 10:17 PM

Sorry, my previous post with the DME image, didn't have the image attached, app was bugging out on me that day.

As I stated earlier, the board looks pretty burned up and melty for this type of high quality electronics.

11-20-2015, 03:17 PM	#1
cryptocar Captain 497 Rep 902 Posts Drives: 13' F30 385xi VNV Speed Custom Join Date: Jul 2015 Location: Chicago, IL iTrader: (3) Garage List 2013 Mercedes SL63 ... [0.00] 2010 VW Tiguan 2.0 ... [0.00] 2015 Tesla P85D [0.00] 2014 Mercedes S63 AMG [0.00] 2007 Mercedes GL450 [0.00] 1967 Ford Mustang [0.00] 2013 BMW F30 335xi [0.00]	ECU Explorer Review (Modifying VMax and other locked DME parameters) [In Progress] Hi, as many coders are already aware, the F series BMWs have time locks built into the DME, prohibiting reading and writing of certain parameters such as ISN (secret key), VMax (electronically limited top speed) and KAT (delete the painfully annoying CEL and fault due to sport or catless downpipes). ECU Explorer is a tool designed specifically to read and write the internal eeprom of the DMEs used in many current BMW models. The eeprom is where the hour counter is located, using this tool should allow you to reset your hour counter therefore unlocking time locked parameters such as VMax. So far I have successfully removed my DME from my car (with some awesome help from dd1981 , opened the case, shorted the required pin and connected to my computer, unfortunately by the time I got there I ran into software problems and decided to hold off until I had more time. Since, I have gotten my car back together and running perfectly with no faults, and also figured out the next step in the software. The hard part is out of the way, I've successfully done the required physical hacking of the board, all that's left is for me to find time to remove my DME again and finish the process with ECU Explorer. Will post back with an update. If any other users have experience with this tool please post or PM me. I have yet to find anyone to has also used this tool. __________________ 13' 335xi, ACF Tuned, ACF Stage 3 Turbo Kit (67mm),PDU PI, ACF Stage 4 LPFP, M-Perf Brakes, AEM CM10 Meth/Nitro, CG DR-1 + VS-1 3.5" Turboback, AFe S2 CAI+Ram Scoop, ER Chargepipe, Wagner EVOII Comp. FMIC, Stop-Tech SS Brake Lines, BMS Sport Oil Cooler Valve+Spacers F10mm R15mm, 19" Bridgestone Potenzas, KW EDC Coilovers, CF Seibon Hood + CSL trunk. Track:Pagid Race Pads, Stop-Tech Custom Pads Front+Rear Racing Tow Hooks Last edited by cryptocar; 12-02-2015 at 11:55 PM..
	Appreciate 6 Tweet Quote

11-20-2015, 03:26 PM	#2
tboooe Brigadier General 925 Rep 3,089 Posts Drives: F36 428i GC, E36 M3 - gone :( Join Date: Dec 2014 Location: The OC! iTrader: (1)	subscribed!!!! I've hacked lots of things but never my car because frankly I am too scared. Very interested to learn what hacking a DIY'er can do. __________________ My build thread 2015 428i GC - Alpine White - Coral Red - M Sport
	Appreciate 0 Quote

11-20-2015, 03:56 PM	#3
cryptocar Captain 497 Rep 902 Posts Drives: 13' F30 385xi VNV Speed Custom Join Date: Jul 2015 Location: Chicago, IL iTrader: (3) Garage List 2013 Mercedes SL63 ... [0.00] 2010 VW Tiguan 2.0 ... [0.00] 2015 Tesla P85D [0.00] 2014 Mercedes S63 AMG [0.00] 2007 Mercedes GL450 [0.00] 1967 Ford Mustang [0.00] 2013 BMW F30 335xi [0.00]	Hacking your car is always a scary prospect but I've spent a few months researching this, priced the risks and feel confident I can do it successfully on my car. I've already done the hard part, shorting the pin on the board and reinstall it into my car working without faults. Last step is just a few clicks through ECU Explorer. __________________ 13' 335xi, ACF Tuned, ACF Stage 3 Turbo Kit (67mm),PDU PI, ACF Stage 4 LPFP, M-Perf Brakes, AEM CM10 Meth/Nitro, CG DR-1 + VS-1 3.5" Turboback, AFe S2 CAI+Ram Scoop, ER Chargepipe, Wagner EVOII Comp. FMIC, Stop-Tech SS Brake Lines, BMS Sport Oil Cooler Valve+Spacers F10mm R15mm, 19" Bridgestone Potenzas, KW EDC Coilovers, CF Seibon Hood + CSL trunk. Track:Pagid Race Pads, Stop-Tech Custom Pads Front+Rear Racing Tow Hooks
	Appreciate 0 Quote

11-20-2015, 04:28 PM	#4
mike@x-ph.com BimmerPost Supporting Vendor 24182 Rep 190,777 Posts Drives: 07-335/12-328/18-M4/21-M4CP Join Date: Sep 2013 Location: Las Vegas iTrader: (23)	Good luck __________________ Check out our current sale by clicking on this link! https://x-ph.com/sale/ Phone number 702-494-9435
	Appreciate 0 Quote

11-20-2015, 05:23 PM	#5
ronanz Gettin It Figured Out 1820 Rep 2,669 Posts Drives: 435i FBO PS2 bm3 w/ options Join Date: Jul 2014 Location: Southwest Region iTrader: (3)	. ... . . __________________ . My Build Thread can be found HERE
	Appreciate 0 Quote

11-20-2015, 05:32 PM	#6
G30 B58 Pace Car Driver 1548 Rep 3,164 Posts Drives: '22 AW G30 B58 M-Sport Join Date: May 2014 Location: my garage in PA iTrader: (0)	Like I said, BIG BALLS. Don't be scared, be the pioneer.
	Appreciate 1 Quote

11-21-2015, 07:57 AM	#8
mookie45 Major 770 Rep 1,270 Posts Drives: 2017 AW 340i M-Sport Join Date: Aug 2011 Location: Brickell iTrader: (4)	Very interesting! Good luck! __________________
	Appreciate 0 Quote

11-23-2015, 02:37 AM	#9
franzzz Captain 142 Rep 931 Posts Drives: BMW M4 Join Date: Feb 2010 Location: ITALY iTrader: (0)	for me, Another way is decrypt the CAFD files in order to edit and upload new DME config via ESYS..... __________________ BMW F82 M4 Black MHD CS Map - GTS DKG - Navi -Performance Brake RSL1 Pads - USB - DivX-DVD - Bluetooth - VoiceControl - Connect - Apps - Online - H&K - TrafficInfo - SpLimInfo - WhiteMerino- PDC - Cam - Adaptive Led - Antitheft - CP Steering- Performance ST - Adaptive CP Setup - GarageDoorOpen - Pipercross - Stock Exhaust - Mdrivers Pack - 437M Wheels
	Appreciate 0 Quote

11-27-2015, 09:09 PM	#13
obriennathaniel @obriennathaniel_f30 on Instagram 515 Rep 1,063 Posts Drives: 582whp/596wtq '13 335i Join Date: Jan 2014 Location: Houston,Tx ig:obriennathaniel_f30 iTrader: (0)	this is interesting! __________________ CG Precision VS-1 Exhaust\DR-1 DownPipe \| PS2 Turbo\Inlet \| PDU PI w/Fuel-it platinum kit & E sensor \| GFB DV+ Diverter Valve \| BM3 w/AIC2-V\|Tune CaryTheLabelGuy \| Full E85 \| ATM FMIC \| ER Chargepipe Inlet/Outlet \| AFE Intake \| BC Coilovers \| PSS 255/40-275/35 Velos Designwerks S3 two piece 19x9/19x10 \| Osram Xenarc \| LED retro \| AWRON digital AC gauge\|
	Appreciate 3 Quote

12-02-2015, 09:02 PM	#20
cryptocar Captain 497 Rep 902 Posts Drives: 13' F30 385xi VNV Speed Custom Join Date: Jul 2015 Location: Chicago, IL iTrader: (3) Garage List 2013 Mercedes SL63 ... [0.00] 2010 VW Tiguan 2.0 ... [0.00] 2015 Tesla P85D [0.00] 2014 Mercedes S63 AMG [0.00] 2007 Mercedes GL450 [0.00] 1967 Ford Mustang [0.00] 2013 BMW F30 335xi [0.00]	Here's a photo of the harness. Attached Images __________________ 13' 335xi, ACF Tuned, ACF Stage 3 Turbo Kit (67mm),PDU PI, ACF Stage 4 LPFP, M-Perf Brakes, AEM CM10 Meth/Nitro, CG DR-1 + VS-1 3.5" Turboback, AFe S2 CAI+Ram Scoop, ER Chargepipe, Wagner EVOII Comp. FMIC, Stop-Tech SS Brake Lines, BMS Sport Oil Cooler Valve+Spacers F10mm R15mm, 19" Bridgestone Potenzas, KW EDC Coilovers, CF Seibon Hood + CSL trunk. Track:Pagid Race Pads, Stop-Tech Custom Pads Front+Rear Racing Tow Hooks
	Appreciate 1 Quote

12-02-2015, 09:22 PM	#21
ronanz Gettin It Figured Out 1820 Rep 2,669 Posts Drives: 435i FBO PS2 bm3 w/ options Join Date: Jul 2014 Location: Southwest Region iTrader: (3)	WOW!!! THAT'S impressive!! Soooo clean... . __________________ . My Build Thread can be found HERE
	Appreciate 1 Quote

12-02-2015, 10:17 PM	#22
cryptocar Captain 497 Rep 902 Posts Drives: 13' F30 385xi VNV Speed Custom Join Date: Jul 2015 Location: Chicago, IL iTrader: (3) Garage List 2013 Mercedes SL63 ... [0.00] 2010 VW Tiguan 2.0 ... [0.00] 2015 Tesla P85D [0.00] 2014 Mercedes S63 AMG [0.00] 2007 Mercedes GL450 [0.00] 1967 Ford Mustang [0.00] 2013 BMW F30 335xi [0.00]	Sorry, my previous post with the DME image, didn't have the image attached, app was bugging out on me that day. As I stated earlier, the board looks pretty burned up and melty for this type of high quality electronics. Attached Images __________________ 13' 335xi, ACF Tuned, ACF Stage 3 Turbo Kit (67mm),PDU PI, ACF Stage 4 LPFP, M-Perf Brakes, AEM CM10 Meth/Nitro, CG DR-1 + VS-1 3.5" Turboback, AFe S2 CAI+Ram Scoop, ER Chargepipe, Wagner EVOII Comp. FMIC, Stop-Tech SS Brake Lines, BMS Sport Oil Cooler Valve+Spacers F10mm R15mm, 19" Bridgestone Potenzas, KW EDC Coilovers, CF Seibon Hood + CSL trunk. Track:Pagid Race Pads, Stop-Tech Custom Pads Front+Rear Racing Tow Hooks Last edited by cryptocar; 12-02-2015 at 10:27 PM.. Reason: add info
	Appreciate 3 xxxjecxxx2153.00 Quote