[Tpeterson]

My response: I'm glad I don't live in SoCal to be tempted by all these ECU tunes. On the other hand I'd like to be there to check all these tuning and mod possibilities not available here in the hinterlands. ie. A moth to the flame!

[chuckles01]

+1, Thanks Matt.

Originally Posted by 2msport

In response to Matt..

Exactly. Great job guys.

[Pparana]

Originally Posted by BarryJI

Fair enough but I feel compelled to point out something my tuner told me, which is that it is all but impossible to crack a modern BMW ECU and all efforts to do so are, to a greater or lesser extent, extremely speculative. This is why the much-maligned piggyback tune exists and why it's a good idea to go with a supplier that stands behind its product with a warranty and keeps on the right side of BMW. Different standards might apply to race tunes in dedicated track cars but for the street, why entrust a $45,000 car to hackers, even when their intentions are good?

yup, I hate to be the bearer of bad news, but most, if not all ecu "Flashes" are not possible.

BMW uses

Hersteller
Initiative
Software



Which simplified is AES 128 bit encryption with about 10 general crypto keys and 5 specific crypto keys with secure boot after every flash to verify.

Even with a supercomputer, it would take 1 billion billion years to crack the 128-bit AES key using brute force attack. This is more than the age of the universe (13.75 billion years)

Your not getting into the ecu, about as likely as the justice department getting into apples phones.

[MissionPerformance]

Originally Posted by Pparana

yup, I hate to be the bearer of bad news, but most, if not all ecu "Flashes" are just piggybacks on the ecu via the dme.

Your not getting into the ecu, about as likely as the justice department getting into apples phones.

Actually that is not completely correct. Getting into actual ECU/DME is actually do-able and has been like this for a while. That is the "easy part". Second task is to get the understanding the function of the ecu binary. That is much harder, and this is what differentiates a proper reflash compared to a "piggy back" style reflash. After a full disassembly of the TC1797 processor used in the current ECUs, you start seeing how the computer controls hardware, to put it simply. This is the part where we built a custom reflash specific for the hardware. Now time comes to uploading the modified file to ecu, and this is where the issue is. MEVD17 uses a 1024 RSA key security to check if the file is authorized and was created by bosch/bmw. If the key/signature provided in the modified file doesn't match the properly generated test key in the processor memory, then flash fails and computer soft-bricks. At this moment, there is no way to properly sign the file, and thus a modified file can not be flashed over OBD. Crwcking the 1024bit key is out of the question, so this is where we are at now. The only other way to flash the modified file is using the alternate boot mode (developer access) that requires opening the computer Every time to flash. This is the way most current tuners use to flash the computers.

After a very lengthy disassembly, we created a custom bootloader (part of software code that controls the signature check) that disables the signature check. What that means is that after initial developer mode flash, we can flash the ecu unlimited amount of times over OBD and do so remotelly.

So, whoever said that ecu is not cracked, they are very wrong. What is not cracked is the private key that is used to properly sign the key. We are close to being able to OBD flash without ever opening the computer, but that is still work in progress as at this point we only bypassed part of the signature verification routine and can flash exactly 50% of the ecu over OBD without ever opening it. Hopefully within next few month, it will be 100%.

[Pparana]

Clever solution, I stand corrected, Much like a jailbreaking your phone. but in the end your still not 100 percent there. How often is bmw flashing the ecu, I would think never. Or will this get wiped on a simple software update from dealer every time you go in for service.

This seems like a lot of work, is there really a big enough market for this? How many developmental ecus did you guys brick before getting this figured out? seems like a big job without a large community to support the development. Do not get me wrong, I think anyone should be able to modify something they buy, computer, car or software. However I am in the minority on this.

[Info@EnzoPerformance]

We have been developing tunes for F series models for 2 years now. Once we unlock the ECU we can fully tune via OBD. With the right equipment and experience, tuning these vehicles is totally possible. The tuning experience is what is essential here. We do not just focus on BMW but offer tunes and packages for McLaren, AMG, Porsche, Ferrari etc.

[MissionPerformance]

Originally Posted by Pparana

Clever solution, I stand corrected, Much like a jailbreaking your phone. but in the end your still not 100 percent there. How often is bmw flashing the ecu, I would think never. Or will this get wiped on a simple software update from dealer every time you go in for service.

This seems like a lot of work, is there really a big enough market for this? How many developmental ecus did you guys brick before getting this figured out? seems like a big job without a large community to support the development. Do not get me wrong, I think anyone should be able to modify something they buy, computer, car or software. However I am in the minority on this.

Actually BMW flashes/updates the computers very, very often. It seems that N20 and N55 have some type of update every time new I-level comes out. The issue with a plain OBD patch is the fact that every time dealer does the update, they wipe the tune and the patch, so the customer has to send the ecu in again for flashing. The beautiful part of our bootloader is the fact that we modified it to tell the BMW dealership that no update is necessary at all times, thus not having issues with being over written. We also rebuild our tunes for every update that BMW release and can flash those updates tunes remotely for customers.

[Pparana]

Originally Posted by MissionPerformance

Actually BMW flashes/updates the computers very, very often. It seems that N20 and N55 have some type of update every time new I-level comes out. The issue with a plain OBD patch is the fact that every time dealer does the update, they wipe the tune and the patch, so the customer has to send the ecu in again for flashing. The beautiful part of our bootloader is the fact that we modified it to tell the BMW dealership that no update is necessary at all times, thus not having issues with being over written. We also rebuild our tunes for every update that BMW release and can flash those updates tunes remotely for customers.

so is this type of flash available to the 2r? can you use with jb4 as well?

[MissionPerformance]

Originally Posted by Pparana

so is this type of flash available to the 2r? can you use with jb4 as well?

Yes, we have full support for 2 series and JB4 can be used at your own discretion tho we do not recommend it. If you need a backend tune built for you to run in combination with JB4, that is something we can do as well.

PM or email us if you have any questions regarding this, we are always happy to help out.

[FSociety]

Would be REAL to see what a
N20/N26 car does on same Dyno, same day, and 1/4 mile

JB4 car
GSR car
MP car
Dinan car

Where are all you Californians lol

[BarryJI]

Originally Posted by ROBNYC

Would be REAL to see what a
N20/N26 car does on same Dyno, same day, and 1/4 mile

JB4 car
GSR car
MP car
Dinan car

Where are all you Californians lol

Imagine the butthurt if the Dinan car won!! Don't worry, chaps, I know it's unlikely!