e9x bench setup

RTA

Lurker
Jun 17, 2020
10
5
0
So a very generous person gave me this(thank you sir !)
It’s an IPO decompiler
With this we can potentially take apart how BMW flashes modules and change whatever we want.
No idea how/ if it works or how to use it. I can’t vouch for its safety either, use at your own risk!
I'm getting trojan warnings by two Anti-vir programs, I would not open it outside a temporary VM without a network connection. On the other hand: https://github.com/microsoft/vcpkg/issues/13864
 

RSL

Lieutenant
Aug 11, 2017
714
387
0
Mine passed it both in and out of zip. I've run it without complaint from the antivirus or anything picked up on subsequent scans, so those might've been false positives.

As always though, use caution with anything from unknown sources.
 

RSL

Lieutenant
Aug 11, 2017
714
387
0
For real lol It's stuck in some way I can't get anything to connect to it to recover. MSD81.

Recommendations of firsthand experiences with any businesses that can reset a DME are equally welcome.
 

jockyw2001

Lurker
Aug 4, 2020
21
5
0
So a very generous person gave me this(thank you sir !)
It’s an IPO decompiler
With this we can potentially take apart how BMW flashes modules and change whatever we want.
No idea how/ if it works or how to use it. I can’t vouch for its safety either, use at your own risk!
Turns out this tool is IDA Pro 7.2
Does anyone know how an .IPO file can be decompiled with IDA Pro?
 

klugscheisser

New Member
Dec 18, 2020
3
1
0
Not sure if this is the right place for this but, I was inspired by the OP's bench setup so I'm building my own. I'm attempting to build setup for an E60 which doesn't have the JBBR but has a KGM instead. All my components are from a 2010 E60.

However, I'm a bit confused by the wiring diagram in ISTA. Specifically for the KGM, I just want the MINIMUM connections to power on the KGM on so that it can do the translations with the other BUS networks, however there seem to be alot of power feeds to the box which control alot of the down stream features that I don't need on the bench like the door locks, window motors, outside mirrors., etc. These are all pretty thick wires, 2.5 mm, which is like 14 AWG, I don't want to hook up power feeds that I have no need for.
Can someone enlighten me as to what pins are the ones that I need to power JUST to have the KGM module power up and provide the gateway services for PT-CAN, CAN, etc. ?

Based on the supply diagram below, I'm led to believe that Pin 1, on X16759 would be required, but then the pin out table says that pin is "Signal, load cutout"

In the schematic, what do the things about the metric wire gauge size mean (30<18, 30<KGM, 30<10, 30<12, 30<29) I take it that 30 refers to terminal 30, and the 2nd number references the fuse number, but what does 30<KGM mean then? It's a pretty thick wire, so it seems it does have to SUPPLY a decent amount of current, but what does "Signal, load cutout" mean?

For Pin #27 on X16760, it is described as "Wake-up signal, terminal 15". Shall I assume that this means that it is sn INPUT signal when +12V is applied to this that turns this module on? OR is it that this wire is the OUTPUT signal, when the car is at terminal 15?

1611589816569.png




<!---->A16760 Body-gateway module
Plug connector overview


NumberX-pin, colourDescription
X1675951-pin, blackComponent connector Body-gateway module
X1676051-pin, blackComponent connector Body-gateway module

Pin assignments at plug connector X16759

PinTypeDescription /Signal typeConnection /Measuring notes
1ASignal, load cutoutFuse holder, front
2ESupply, terminal 30Fuse F18
3--Not used
4--Not used
5--Not used
6--Not used
7--Not used
8--Not used
9--Not used
10ASignal, exit lightExit light, driver's door
11Awithout active steering Signal, Servotronic solenoid valveServotronic valve
12Awithout active steering Signal, Servotronic solenoid valveServotronic valve
13--Not used
14ASupply, Hall sensorDriver's window motor
15ESignal, Hall sensorSystem lock, driver's door
16--Not used
17--Signal, Hall sensorDriver's window motor
18--Diagnosis signal TXDConnector X183
19AUnlock motor signalSystem lock, driver's door
20--Not used
21--ASP_LOW GroundOutside mirror, driver's side
22E/ATouring Signal, LIN busRoller cover controller
23E/ASignal, LIN busConnector, LIN bus
24--Not used
25--Not used
26--Not used
27--Not used
28ESignal, Hall sensorSystem lock, driver's door
29EDoor contact signalSystem lock, driver's door
30MSensor groundDriver's window motor
31--Not used
32ASignal, lock motorSystem lock, driver's door
33ESupply, terminal 30Fuse F10
34MGroundGround point
35AActivation Driver's window motorDriver's window motor
36AActivation Driver's window motorDriver's window motor
37--Not used
38--Not used
39--Not used
40AASP_LOW Voltage supply, horizontal mirror adjustmentOutside mirror, driver's side
41AASP_LOW Voltage supply, vertical mirror adjustmentOutside mirror, driver's side
42AASP_LOW Voltage supply, outside mirror heatingOutside mirror, driver's side
43--Not used
44--Not used
45--Not used
46--Not used
47--Not used
48ASensor groundSystem lock, driver's door
49MSignal, Hall sensorDriver's window motor
50--Not used
51ASignal, central arrest motorSystem lock, driver's door


Pin assignments at plug connector X16760

PinTypeDescription /Signal typeConnection /Measuring notes
1--Not used
2--Not used
3AActivation Passenger's window motorPassenger's window motor
4AActivation Passenger's window motorPassenger's window motor
5--Not used
6--Not used
7--Not used
8E/ACAN bus lowK-CAN-system bus
9E/ACAN bus highK-CAN-system bus
10--Not used
11MSensor groundPassenger's window motor
12--Not used
13--Not used
14E/AASP_HIGH Signal, LIN busOutside mirror, passenger's side
15--Not used
16--Not used
17--Not used
18--Not used
19ASignal, central arrest motorSystem lock, passenger's door
20--Not used
21--Not used
22--Not used
23MGround System lock, passenger's doorSystem lock, passenger's door
24ESignal, Hall sensorPassenger's window motor
25AASP_LOW Voltage supply, outside mirror heatingOutside mirror, passenger's side
26--Not used
27EWake-up signal, terminal 15Connector, terminal 15 wake-up
28--Not used
29E/ASignal PT-CAN highPowertrain CAN-bus
30E/ASignal PT-CAN lowPowertrain CAN-bus
31--Not used
32AUnlock motor signalSystem lock, passenger's door
33ESupply, terminal 30Fuse F12
34MGroundGround point
35--Not used
36--Not used
37MGroundGround point
38ESupply, terminal 30Fuse F29
39--Not used
40--Not used
41--Not used
42EDoor contact signalSystem lock, passenger's door
43ESignal, Hall sensorPassenger's window motor
44--Not used
45AASP_LOW GroundOutside mirror, passenger's side
46AASP_LOW Voltage supply, horizontal mirror adjustmentOutside mirror, passenger's side
47AASP_LOW Voltage supply, vertical mirror adjustmentOutside mirror, passenger's side
48ASignal, exit lightExit light, passenger's door
49--Not used
50ASupply, Hall sensorPassenger's window motor
51ASignal, lock motorSystem lock, passenger's door
 

aus335iguy

Colonel
Nov 18, 2017
2,090
718
0
Down under
Ride
335i DCT 2009
I’m guessing here and others will hopefully correct my mistakes before you do any damage

what I can see it receives battery current on the pins labeled supply that go to a fuse
That seems to be pin 38 and 33 on connector x161670 and pin 33 and pin 2 on x16759??
 

klugscheisser

New Member
Dec 18, 2020
3
1
0
Thanks for the reply. I can hook all of them up to my power supply and I don't see that doing any damage, since it should be the same as if it were hooked in the car. However, I need to create extensions to my power supply and hook all of them up which probably equates to a 4 AWG cable, but again I don't want to hook all this up when there are no loads that I will draw down on from the KGM.

Pins 33 (30 amp fuse) and 38 (10 amp fuse) on x16760 seem to be fused 12V+ feeds to power the accessories, not exactly sure which ones exactly, but they would be power windows, door locks, and mirrors.

Similarly, Pin 33 (30 amp fuse) and pin 2 (30 amp fuse) on x16759 seem like they are also feeding some of those same circuits.

On a different practical note, I bought the pigtail connects for x16760 and x16759 on fleabay and I think they came from an E9x, they are the same connector shells as used on the FRM. Therefore, the wire colors and pin outs are different, which is no issue, other than for the bigger pins (like these 30 amp terminals) the E60 KGM has a few more that are populated vs the E9x FRM so IF I NEED them I have to buy separate terminals to get hooked up. However, I don't think I really need all of them and want to avoid wasting time an money on terminals I don't need.

Does anyone know where you can find in ISTA the map/table of all the fuse numbers and their circuit description? When I click on the F18, F10, F12, F29, they all hyperlink to a diagram of the installation location, which is the front fuse box in the glove box, which is kinda unhelpful.

The only reason why I am doing all of this is so I have run other modules off the bench like the OP, who inspired me . I want to have my DME, CAS, KOMBI, CIC, CID, iDrive on the bench. I may also then hook up the other audio/video stuff on the MOST network like the Logic7 and SiriusXM, then do some coding to add HUD and Night Vision, these are all E6X options, that I don't have on my car which is also CCC.

For the KGM, it can't be that the microprocessors that translate all the messages consume more than a few amps, let alone 10 amps. The DME (MSS65) has a far more powerful processor and those seem to be hooked up on a regular basis for bench flashing using 1-2 AMP power supplies.
 

Hotter

Private
Jan 23, 2021
36
1
0
Hi, I have bench setup also of these modules:
JBBF
KOMBI,
RAD2,
TCU,
KLIMA.

Also I just bought CAS module for my bench setup which came without key, key slot, start button. Is it possible to somehow fake ignition/terminal power so that it would light up KOMBI and other modules? Does Pin8->12V do that?

Is my only option to intercept CAS can bus messages and modify ignition message so that other devices on can bus would think that key is inserted and system good to go?
 
Last edited:

ccfj1

Private
Jul 26, 2018
45
41
0
UK
Ride
bmw e92 n55 335i Sport manual
With out the oem key and cas then canbus shield with emulated ignition would be the only way.

When I started building my bench setup, CAS with key was the basis, everything else comes from that, (and is easy to add on top).
 

Hotter

Private
Jan 23, 2021
36
1
0
With out the oem key and cas then canbus shield with emulated ignition would be the only way.

Yes, I was able to communicate with CAS and emulate ignition to other modules. I was able to use NCSExper to read code from modules. But when I choose SG_CODIEREN I get error:

Code:
[20:54:45.023] [2021-03-24] [SERIE]   2063   PABD/CABD  A_PL2KMB.IPS            Fgnr   265
[20:54:45.023] [2021-03-24] [SERIE]      Fehler beim Codierdaten vergleichen/verifizieren  SG bereits auf andere FG-Nummer codiert, Codierung abgebrochen

[20:54:45.142] [2021-03-24] [SERIE]   2063       Error    COAPI2.CPP    coapiRunCabd     6
[20:54:45.142] [2021-03-24] [SERIE]      Fehler beim Codierdaten vergleichen/verifizieren  SG_CODIEREN

Any ideas what this error mean?
I guess the issue is thas CAS is from E90 and KOMBI which I try to code is from E92 with different VIN? Their VIN must match? Is it possible to change CAS VIN?
 
Last edited:

ccfj1

Private
Jul 26, 2018
45
41
0
UK
Ride
bmw e92 n55 335i Sport manual
They dont have to match for the bench to work, but if you want to code the kombi then use the onne_vin option, SG_CODIEREN wont work.

you can only change the VIn in either the cas or the kombi via a chip reader (r270), no standard tool can do it.

I have dumped my kombi chip and modded it so that the cas and kombi have the same VIn and coding wise it all works as normal.

the cas should be codable using SG_CODIEREN as normal, only the kombi will have the problem.
 

NoQuarter

Major
Nov 24, 2017
1,605
1,003
0
Indiana, USA
Ride
Z4 35is, 535xi, X5 35i
I had to remove the chip from the board to change the VIN and Miles. Couldn't get it to work while in circuit.
 

Hotter

Private
Jan 23, 2021
36
1
0
So bench setup is kinda useless if you cant code? Or its only KOMBI/CAS/DME which are restricted with VIN? other modules should be able to code?
 

aus335iguy

Colonel
Nov 18, 2017
2,090
718
0
Down under
Ride
335i DCT 2009
So bench setup is kinda useless if you cant code? Or its only KOMBI/CAS/DME which are restricted with VIN? other modules should be able to code?
Pretty sure only the KOMBI eeprom is special as it can’t be done via standard tools and this causes issues in circuit and only then for some people. and the rest can be done via can/OBD/ICOM
 

ccfj1

Private
Jul 26, 2018
45
41
0
UK
Ride
bmw e92 n55 335i Sport manual
So bench setup is kinda useless if you cant code? Or its only KOMBI/CAS/DME which are restricted with VIN? other modules should be able to code?
You can code the cas, dme and kombi, the kombi just needs coding with the onne_vin option if the vins does not match that of the CAS.

with a bench setup as long as the wiring is good you can code all modules that are plugged in.

I have bench flashed and coded, JBBR, TV, CIC, CID, ZBE, Combox, MULF, TCU, CAS, Kombi, DME, EDC, HVAC, PDC, Rear camera module, DCS/ABS, Logic7 and Indi Amps.
 

ccfj1

Private
Jul 26, 2018
45
41
0
UK
Ride
bmw e92 n55 335i Sport manual
Pretty sure only the KOMBI eeprom is special as it can’t be done via standard tools and this causes issues in circuit and only then for some people. and the rest can be done via can/OBD/ICOM
Correct, you need a programmer. (like the r270)
 

sangria

New Member
Mar 12, 2020
2
0
0
Hey guys. While ago i was talking with a fellow in Germany who was asking me questions about one of my retrofits on my e93 m3 and i mentioned him that i would like to have E and F series bench setup in my house since i own both. He told me that he got Arduino Nano with MCP2515 Canbus module + JBBF and can do anything without CAS,Key,Ignition,KOMBI etc. So i told him i will order them if you can help me out. He first said okay. Then i got the units and he said well i worked so hard to make this happen and no one helped me so i cant help you with the setup.

Well i now have the parts but not the knowledge to activate this unit. Arduino world is totally strange to me even tho i know how to write HTML coding and stuff. And i have no cluse how to create CAS + key emulator by using this SW.

I saw that someone mentions something like that :

const byte Stay_alive[8] PROGMEM = {0x00, 0x00, 0x8A, 0xDD, 0xF1, 0x15, 0x30, 0x02}; // 0x130, Wake up network

const byte Ignition_1[8] PROGMEM = {0x00, 0x40, 0x7F, 0x50, 0xFF, 0xFF, 0xFF, 0xFF}; // 0x26E, Ignition stage 1
const byte Ignition_2[8] PROGMEM = {0x40, 0x40, 0x3F, 0x50, 0xFF, 0xFF, 0xFF, 0xFF}; // 0x26E, Ignition stage 2

Seems like the Arduino works with this type of commands.

If anyone knows how can i do this i will pay for the service to accomplish a decent setup with the Arduino. I always shared my experiences and knowledge with anyone without a cost on many platform. My nick is SaNGRia in any bmw platform.
 
Last edited: