Siemens MS41.1 Hacking

[LinearX]

I have been interested in manipulating the ECU through the round proprietary BMW connector in the OBDII E36 engine bay. I can find pages in non-English languages regarding serial programming tools compatible with the MS41.x but I have also seen some posts on message boards referencing people who made their own RS232 adapter. Does anyone have information on adapters, whether commercial or homebrew, and how to acquire/construct them? What about the protocol used for reading codes/EEPROM dumping/EEPROM programming?

[Whatup1049]

I am also very interested in this! What do they use for custom tuning? And why can't we emulate it in a computer program?

[LinearX]

I can write the software if I know the serial parameters and protocol. I've made some rudimentary stuff like RS232 -> TI calculator adapters. I bet the official tools are like $10,000 or some ridiculous price.

[somethingaboutM]

Sorry to be a pain but what would you gain by doing this? I mean yes i know better performance but specifically, the actual gains you would get by doing this. Just curious. thanks

[LinearX]

Software is regularly available, but I like to play. I want to see if it is possible to code a freeware OBDII BMW scan/reset/programming software app/design a DIY (or cheap) programming tool. The newer cars use the OBDII connector which I won't concern myself with, I want to get into the BMW diagnostic plug. There are lots of German sites where it seems amateurs are doing their own OBDII programming on the MS41.x but I cannot understand the language, and translators don't have many of the technical terms in their dictionaries.

If it is much like other serial adapters, it's a matter of finding the Tx/Rx/Ground and knocking them down to the expected voltage using series resistors, and looping the RTS/CTS into itself. The baud rate I saw on some pages is 9600, 1 stop bit, no parity. Handshake packets and such are going to be cryptic, which might mean having to vampire onto an existing BMW tool (if I can locate one) and snooping the serial data. Obviously, my preference is to find a table of values that someone has already reverse-engineered.

[dtmlyfestyle]

Originally posted by LinearX
Software is regularly available, but I like to play. I want to see if it is possible to code a freeware OBDII BMW scan/reset/programming software app/design a DIY (or cheap) programming tool. The newer cars use the OBDII connector which I won't concern myself with, I want to get into the BMW diagnostic plug. There are lots of German sites where it seems amateurs are doing their own OBDII programming on the MS41.x but I cannot understand the language, and translators don't have many of the technical terms in their dictionaries.

If it is much like other serial adapters, it's a matter of finding the Tx/Rx/Ground and knocking them down to the expected voltage using series resistors, and looping the RTS/CTS into itself. The baud rate I saw on some pages is 9600, 1 stop bit, no parity. Handshake packets and such are going to be cryptic, which might mean having to vampire onto an existing BMW tool (if I can locate one) and snooping the serial data. Obviously, my preference is to find a table of values that someone has already reverse-engineered.

...lol no need to decrypt what u previously typed...just trying to make some wiseass humor...

lol....for those readers that are not computer/electronically saavy in terms of the mechanics of computers and its languages, i bet this info you just shared with us,went through their eyes and came out their ass, like it just did to me

[kai]

Originally posted by LinearX
I can find pages in non-English languages regarding serial programming tools compatible with the MS41.x but I have also seen some posts on message boards referencing people who made their own RS232 adapter.
----------------------------------
There are lots of German sites where it seems amateurs are doing their own OBDII programming on the MS41.x

links?

[smackbelly]

Hello friends! I too am searching for a way to dick around with the ECU (read and log data from the servers; poor mans dyno)... I have some really goods leads on freeware applications that allow screwing with the ECU, check out the link in my other thread

http://forums.bimmerforums.com/forum...hreadid=172804

...a good place to get some really great support on this issue is eng-tips.com (Automotive Electronics section)... the responses here at bfc tend to be a more of "Why do you wanna do that" and "you'll shoot your out"... and most (not all) lack the insight to make a declaration about the difficulties of the design...

...I think you'll recieve the biggest resistance here is because of a) commericial interests and b)noone wants to feel paying like they paid WAY too much for something I can make in an hour...

How about this for an example.
You know the VS paddle shifters right?
http://home.comcast.net/~paddle.shif...rofit_main.htm
Check out the price they charge and then read the faq justifying the price, they know they are hosing you on the product. If they are no microprocessors or microcontrollers involved then its a simple circuit for $400! I believe in fair payment for the concept and implementation, but come on... Thats bad business, if they sold it for $80 every slushbox-jockey here would have them...

btw... the BMW ECU communicates by ISO Standard (others are VPW and PCM)... I think one would need a RS-232 transciever (maxim makes them) because I think the OBD2 is TTL(5V) and your serial (RS-232) is a whole lot more than that...

this would do the trick http://www.dontronics.com/rlc1.html...

btw LinearX ... I think in 96+ BMW the diagnostic port provides the same access to the ECU that the OBD2 port does...

...also I think baud is something like 5. Yes 5... ...I'll post the link when I find it...

[LinearX]

smackbelly I know on the later E46s it does, but I am pretty sure that before BMW went to the OBD-II port alone, serial programming and ROM dumping could only be done via the round connector in the engine bay. Of course, if somebody knows better, please let me know.

Thanks for the link to the connector, that's a good deal and cleaner than a DIY. Will probably order it after I check out some details on the other sites you described. Then I can begin working on a software tool.

[smackbelly]

LinearX, check this out its a freeware OBD2 reader app, http://www.obd-2.com/ ...

[KyleAwesome]

So did anything ever come from this? I see quite a bit of home brew OBD-I tuning, nothing for OBD-II.
If what little research I have done is true, it is just assembly code that should be disectable.

[tsweers89]

+1 intrested in what happended

[KyleAwesome]

anything?

[LinearX]

I didn't ever get enough information to do it. It's in a few people's heads out there but they have no economic motivation to share.

The inspiration came from projects like OpenEEG. Also, such tools and information are available for some other OBDII cars.

Programs stored on chips (ie, OBD1) are fairly straightforward. Did one for an Espirit a while back. You can write a program that graphcs out the binary dump as bytes, words, dwords, singles, etc.. until you see within the seemingly random data a graph that resembles fuel curve data. Adjusting toggles is much harder to guess, sometimes impossible. Sometimes the fuel curve is embedded as a function and cannot be changed, rather than being a static array.

[tsweers89]

[quote=LinearX;1863951]smackbelly I know on the later E46s it does, but I am pretty sure that before BMW went to the OBD-II port alone, serial programming and ROM dumping could only be done via the round connector in the engine bay. Of course, if somebody knows better, please let me know.

thats true