Siemens ms41 ews delete patcher

[xbyte]

Deleted becouse it was an old version

[furnata]

Don't start - give error - not valid win32 application

[unar]

no work at win xp

[xbyte]

File updated: shuld run on xp now too if net framework 4.0.3019 is installed.

Please report :)

[MarkPRP]

Top work, tried today!

[xbyte]

I know checksum is not needed on these ms41`s, but i want to practice my coding skills as i just started with the coding stuff a few weeks ago, and therefore i need new challenges, does anyone have information about the checksum used in siemens ecu`s ?

Im currently working on an updated version for ms41,ms42,ms43,mss52,mss54(i have alle the needed ews delete data)
the full version vil probalby not be public as i spent alot of money and time on finding these solutions, but i will release the public version for ms41 with obd read/write.

the new version will connect trought the diagnostic port with any ftdi based obd cable, like the cheap vag-kkl with ft323rl chip.

It bitbangs the initial wakeup 0x33 at 5 baud and and then do the rest for retrieving only the block needed for ews delete,add the ews delete stuff,correcting the checksum and write it back.

I also hardware modded an vag-kkl cable to "spy" on the obd port protocols by lifting the k-line pullup resistor, this way it can be run in parallell with any other cables and log the data used by any other tools that communicate with the ecu.

I had to write my own software for this diagnostic spying, since there where notting to be found, this way i found the data needed to comminicate with the dme for reading and writing the data.

All i need now is the checksum protocols.

http://bildr.no/thumb/1396757.jpeg (http://bildr.no/view/1396757)

[Sir Pommes]

Hi,

i?ve tested you tool with MPPS OBD-flasher and 2 MS41 ecus on my desk, not in a car yet. The error memory of both ecus show a "ecu self test error" after modifying and writing back the dump.
Whats the reason for that? Checksum?

Beside that it seems to work. No error message concerning the missing EWS.


regards

SP

[mtey]

Hi,

i?ve tested you tool with MPPS OBD-flasher and 2 MS41 ecus on my desk, not in a car yet. The error memory of both ecus show a "ecu self test error" after modifying and writing back the dump.
Whats the reason for that? Checksum?

Beside that it seems to work. No error message concerning the missing EWS.


regards

SP


No " self test error" - You must calculate checksum.

Greetings, mtey

[Sir Pommes]

No " self test error" - You must calculate checksum.

Greetings, mtey

Hi,

i?m not very familiar with maps, checksum calculation and so on. Can somebody explain how to calculate the checksum for a MS41 and where it is stored in the flash?
Or is there a simple tool for that?


SP

[alfons37]

Use winols for calculate checksum...

[xbyte]

1. Load orginal readout into winols:
2. Import new version (the version with ews delete)
3. export this new version just loaded after checksum is corrected.

but this is not needed for the engine to start on ms41, you can just flash the file without the checksum corrected.

[Boeing747]

Hy to everybody,

@xbyte - can you please help me with immo of on Bmw with MS41 , I have partial read from TMS28F200AZ .

Thanks in advance.

[Sir Pommes]

1. Load orginal readout into winols:
2. Import new version (the version with ews delete)
3. export this new version just loaded after checksum is corrected.

but this is not needed for the engine to start on ms41, you can just flash the file without the checksum corrected.

Hi,


okay i?ll try it. Do i need a special WinOLS version?

Did you get my message concering MS42?


regards

SP

[Morette]

The checksums are in blocks in MS41, I think there are about 8 blocks inside the part read, each with a 2 byte checksum at the end.

[woodoo]

If I still get error message "signal from EWS missing" after used this solution, does it means car won't start? Car is located far away from me, so I can't test it on car. Is this solution working for EWS3?

[xbyte]

Car will still start, and the ews error message will sometimes still be there, ms41 systems only use ews2, even the ews3 boxes are still in ews2 mode.

[woodoo]

Thanks for reply, so the only way to find out is to try on car. Will do that next weekend and will let you know how it worked out. Thanks again!

[xbyte]

Tested and works for me on

ms41:

1432401
1429861
1429373

i have not found any ms41 this is not working on yet.

[furnata]

What about MS41 with 32pin plcc 87pc110 inside? You test this one??

This is oldest MS41 with NO flash

[xbyte]

I have not tested the one with plcc chip.

[woodoo]

Tested and works for me on

ms41:

1432401
1429861
1429373

i have not found any ms41 this is not working on yet.

Mine is 1429861. I can see you have tested same ECU, so it should work. Thanks for great solution, as I said, will test it next week and will let you know how it worked out.

[xbyte]

New version that does both: partial and full read.
I improved some stuff:

Saves the patched file with immOFF extention and keeps the orginal intact
Does both 256kb full read and 24kb partial read

I still need the checksum algo to add, if i increase/decrease a byte by one then all the 4 digits in the checksum changes.

[woodoo]

Thanks xbyte! Your solution really works on 1429861. Tested last weekend, Ecu still gives fault codes about EWS, but car starts with no problems. :top:

[BimmerGT1]

New version that does both: partial and full read.
I improved some stuff:

Saves the patched file with immOFF extention and keeps the orginal intact
Does both 256kb full read and 24kb partial read



I still need the checksum algo to add, if i increase/decrease a byte by one then all the 4 digits in the checksum changes.



Will this work on mask 2d47j , please let me know and wich pins do I need to bridge on a e39 97. Thank you

[xbyte]

This is not for the ews box, its for the ecu/dme readout.

[jhec23]

New version that does both: partial and full read.
I improved some stuff:

Saves the patched file with immOFF extention and keeps the orginal intact
Does both 256kb full read and 24kb partial read

I still need the checksum algo to add, if i increase/decrease a byte by one then all the 4 digits in the checksum changes.

Will try this. Thanks!

[profex86]

I just wrote a little tool for patching ews in siemens ms41 partial reads.
With this 2 byte solution AC shuld still work.

Please report if there are any MS41 partial reads that this solution are not working on, i testet it on many different dumps with success.

update: shuld run on xp now too, if net framework 4.0.3019 is installed

http://bildr.no/thumb/1391703.jpeg (http://bildr.no/view/1391703)


thx for this

[verik]

hi i have a 5wk9 0322 328i ecu, would it work on it? Thanks!

[mrs2vv]

is this works on bmw e39 1977 witn ms.41?

[stefan123]

Hi,
Anybody knows how to delete speed signal?

[chipsminor]

Thanks... i will try...

[Juelz323is]

Will not download for me please help

[Stijnvdw]

Thanks mate

[Speedbrothers]

So this should work on every late ms41 with flash instead of rom based memory?

[teepee75]

Hope this solves my start issue

Thanks

[mardon]

This looks awesome. I can't wait to try it on my S52 E30 swap;)

[jonhudd]

Tried this tonight and the upload appeared to have loaded correctly but now the ECU is just clicking and I cannot read it anymore...

Any idea's?

[andrewd]

Awesome! Thank you! Excited to try it!

[DeNelson]

Thanks to all the good people on this forum.
You give me hope.
Thus will be my next route.

[suckatall]

Thanks Bro for the file !!!