Technical Mini ACDP Review/ DIY MSD80/81 Clone Swap Upgrade

AzNdevil

Lieutenant
Staff member
Nov 4, 2016
566
269
0
Hong Kong
Moving this review out of my build thread.... and so more people can see it...

TLDR;
Summary of what Mini ACDP can do with a MSD81 as of 20220831
  • Without Delidding/Through DME CANBUS Pins
    • Read ISN and boot password (Read ISN/PSW)
    • Read/Write "calibration" sector (Backup/Restore FLASH)
    • Flash different versions of software like WinKFP (Update program)
    • (Modify VIN) <-- I think this updates the UIF on the DME but i am not 100% sure
  • With Delidding the MSD81
    • Read/Write ISN and last 7 digits of your VIN in the SBOOT (Read/Write ISN)
    • Read/Write Part of the SBOOT (Read/Write EEPROM)

After almost a full week of head banging and troubleshooting with Mini ACDP Support on WhatsApp, I finally managed to get everything to work the way i wanted it to.

Special thanks to @levane for providing a working 95640 eeprom dump and @carabuser for identifying the files i dumped

Heres are some Screenshots of the Main Menu from their PC App
I will post the inner workings of the app in the later posts

1661768434687-png.png



Through OBD/Canbus Menu
1661768443980-png.png



1661768453235-png.png



1661768465063-png.png



Delid Menu
1661768494388-png.png



1661768502119-png.png


1661768508275-png.png
 
Last edited:
  • Like
Reactions: jayntguru

AzNdevil

Lieutenant
Staff member
Nov 4, 2016
566
269
0
Hong Kong
Mini ACDP Review Part 1

I am not an expert in anything. I just like to tinker with things and I know enough to be dangerous.
I only went down the road to figure out how to swap DMEs because I can't seem to ever get things to work without doing it myself.
This is not sponsored in any way and I paid the full retail price on this.
1659539639704-png.72210

Since I haven't found any information (reviews/videos/etc) thats not made by the manufacturer themselves so I think this can be used as a reference to anyone that is interested in tinkering.

This is not meant to be a professional review but only to document the frustration and head banging I have encountered throughout my journey.

My car is throwing BSD bus communications error and my water pump is constantly running. I did some initial troubleshooting by unplugging everything on the BSD bus (Waterpump, Alternator, Oil Level Sensor, I don't have IBS). I don't own an oscillioscope or have acess to one so I can't check the BSD pin to see what's actually happening either so time to throw another DME at it to see if it fixes the issue (FYI, No it didn't fix anything).

Unboxing
Package came pretty quick from China to Hong Kong. It was nicely packged in a box with bubble wrap and stuff.
All the electronics and interface boards are nicely packaged into their seperate plastic boxes.
It definitely feels a lot better than the cheap crap I buy off TaoBao/AliExpress.
The supplied three prong UK-Styled Power Adapter was a nice touch.
Normally Chinese electornics ships with two prong flat blade power adapters and I need to use a converter on it.

pxl_20220806_190229921-jpg.jpg


The Modules I bought were CAS, ISN and the MSD80/81 Interface Board
pxl_20220806_190335368-jpg.jpg


The thing in the plastic bag is the Mini ACDP Main Controller, BAV-Key is used for coding/decoding/registering keys when working with a CAS module. OBP+ICP is used for programming the DME/CAS modules.
pxl_20220806_190345040-jpg.jpg


Initial Setup
The Mini ACDP Controller works through WIFI and has to be connected to an Access Point or Hotspot (from a phone).
The PC/Android/iPhone also requires Internet Access for anything to work.

Pairing the Mini ACDP Controller to my notebook/phone is where the head banging started.
Initial configuration (telling which Access Point/HotSpot the controller sholud connect to) has to be done through bluetooth of your PC or phone. This supposingly could be done with any device that has bluetooth be it a PC or phone but for some reason, I couldn't get anything to pair with the Mini ACDP Controller. I have tested 5-6 devices and they all have relatively recent bluetooth controller/chipsets.

Eventually, I dug out an old phone that I had laying around because the buttons are sometimes stuck down and it paired successfully.
Just the initial configuration took me 4-5 hours in total. If you were to order a Mini ACDP, make sure to buy their bluetooth module as well so you don't have to waste your time.

One thing to note, the Mini ACDP Controller requires your AP or Hotspot to be working in 2.4Ghz otherwise it won't connect at all.
This took another 30 minutes to figure out. Make sure the device you are planning on using is connected to the same AP/hotspot or it won't work. I ended up pairing the controller to my primary phone's hotspot so I can take it to my car as well.

Mini ACDP Controller paired to my old phone. You can see the serial number at the top right hand corner of the screen when it's paired.
pxl_20220808_184023224-jpg.jpg


Since I wanted to use this on my notebook instead of my phone, I had to release the "lock" my phone has on the controller.
If the lock is not released, you will not be able to pair the controller on another device. This can be done in the Setting Menu inside PC Bound to Mini ACDP device.

1661771535736-png.png


Go in, select the device and choose Untie.
1661771567063-png.png


Now I can see the controller on my notebook that's connected through WIFI to the 2.4GHz Hotspot. Click it and it will pair.
pxl_20220808_185419061-jpg.jpg


Controller Paired with my Notebook
pxl_20220808_185451055-jpg.jpg


After pairing the device, I had to register the modules I have purchased to my controller.
This requires Internet Connectivity on the device you are worrking with.
You can see there are green stickers covering the "authorization card" code for each module I have purchased in the unboxing section.
Rip it off, type the code into the screen and...... watch it fail.

pxl_20220808_191420678-jpg.jpg


Luckily I was playing with this during the day so I was able to reach Mini ACDP Support and they fixed the issue within 15 minutes.
I am in the same timezone as them so if you are not from Asia you will need to leave them a message or something.

Eventually I was able to register all the "modules" to my Mini ACDP Controller and now the fun begins.
[Placeholder for a screen cap of all the modules registered]
 

AzNdevil

Lieutenant
Staff member
Nov 4, 2016
566
269
0
Hong Kong
Mini ACDP Review Part 2

Since I only want to do a DME swap, I don't want to write anything to my CAS unless I have to (Which I did eventually...again you will see why later). I don't want to delid my old DME. I am fine with delidding the donor DME to write the ISN and VIN. I want to be able to use both DMEs in the car without writing the ISN to my CAS everytime I switch over.

Plan sounds simple...right? I suppose it could be done with just a few clicks so I can continue to get abused by my car but of course...I am playing life on HARD mode and I like making things hard for myself.

Reading ISN and Boot Password from my donor DME was relatively straightforward and worked without a hitch.
Everything is plug and play. I just need to select the correct options and I got the ISN and Boot Password to my donor DME.

Donor DME hooked up to the Mini ACDP controller through the MSD80/81 Interface Board
pxl_20220823_155654117-jpg.jpg



Select OBD/CAN Mode Read/Write ISN
pxl_20220823_155703299-jpg.jpg



Select Read/Write MSD81/MSD812 DME ISN
pxl_20220823_155711921-jpg.jpg



Select Read ISN/PSW
pxl_20220823_155918764-jpg.jpg



Watch it do its thing and read out the existing DME info
pxl_20220823_155939180-jpg.jpg



It will take a backup of the "FLASH" data. According to @carabuser this is actually the calibration sector.
pxl_20220823_155948424-jpg.jpg



Click OK. But it won't ask you where to save it................
pxl_20220823_160011129-jpg.jpg



Watch it upload the backup FLASH data to the Mini ACDP Factory's Server.
It will apply the exploit so you can dump the ISN/PSW from the DME.
pxl_20220823_160019109-jpg.jpg



Patching Done. Downloading...
pxl_20220823_160031311-jpg.jpg



Time to flash the exploit.
pxl_20220823_160205037-jpg.jpg



Wait....
pxl_20220823_160223116-jpg.jpg



Give it some time.
pxl_20220823_160619382-jpg.jpg



And viola! Heres our ISN/PSW.
pxl_20220823_160634289-jpg.jpg



After you click OK, it will write the previously backed up FLASH data back to the DME.
pxl_20220823_160747051-jpg.jpg



And this is how it should be when everything goes smoothly.
pxl_20220823_160825657-jpg.jpg



Since retrieving the ISN/PSW didn't require delidding, I proceed to do the same with my old DME. If only things go as planned.

Reading DME info went through fine.
pxl_20220824_023208363-jpg.jpg



Then it fails when it starts to read the FLASH.
pxl_20220824_023259033-jpg.jpg



I contacted Mini ACDP Support but they weren't sure why this happened. I sent them my logs and dumps so they can take a look at it.

Since I just wanted to get things to work, I delidded my old DME and found out the hard way that I needed the PSW (Boot Password) in order to read the ISN.

Here is the second interface board in action. No soldering required but you do have to remove a torx screw that holds the PCB into the DME casing so you can jerry rig the interface board in place. The interface board has some test points with spring loaded pins to poke into the test points on the DME PCB.
pxl_20220824_021831085-jpg.jpg



Choose the Open DME Option. Select Interface Board here so it knows you have delidded your DME
pxl_20220824_022019508-jpg.jpg



It will do some pin checks to make sure the interface board is hooked up correctly.
This is fiddly. I think i spent 5-10 minutes trying to get the stars align.
pxl_20220824_022031065-jpg.jpg



Why would the app tell me to click OK if I don't know the password? It doesn't even work without it!
pxl_20220824_022040143-jpg.jpg



It tries to read but of course....
pxl_20220824_022054008-jpg.jpg



It fails without the password.
pxl_20220824_022102091-jpg.jpg



This was all done during the same day (midnight actually). Mini ACDP Support didn't get back to me until the day after...
 

AzNdevil

Lieutenant
Staff member
Nov 4, 2016
566
269
0
Hong Kong
This part is unrelated but I knew the donor DME I bought has the wrong power class coding as it is from a N53 powered 325i.
Normally, things such as the speed governor, power class coding, coding protocol, oil service interval and some stuff to do with the ignition switch can be coded to the DME with NCSExpert but this requires the DME Power On Hours to be less than 10 hours.
ncsdummy_msd80-png.png



I know the speed governor and power class can be removed through through tuning but for the sake of tinkering, I removed the EEPROM from my DME and took a memory dump with a cheap CH341 EEPROM Programmer. (This actually caused me a huge headache later...)

1661782563308-png.png



pxl_20220824_175539227-jpg.jpg



Took two dumps and compared them to make sure they are identical. (This proved to be useless later....)
pxl_20220824_174805874-jpg.jpg



Since I still can't dump the ISN and Boot PSW from the DME, I put in back into my car. Started it up, let it idle for a few minutes and everythings good. Shut it back off, tried to start it again and....... it doesn't start. WTF? Tried to scan for codes and DME is totally unresponsive.

The DME was working intermittenly anyways so I guess it just decided to take a shit for good and its a lost cause. Removed the DME from my car and went home.
 

AzNdevil

Lieutenant
Staff member
Nov 4, 2016
566
269
0
Hong Kong
Mini ACDP Review Part 3

Now that my car isn't working at all, I was desperate to try and get my donor DME to be paired to my CAS.
As Mini ACDP Support is still working on the issue, why not just do what everyone does and overwrite the old ISN in the CAS with the donor ISN?

Remember when I said I didn't want to touch the CAS module? Well I did and kind of wished I didn't because the terminology used in the software just made things more complicated.

The Mini ACDP supports the standard CAS manipulation stuff (add/remove keys, mileage correction, change dme isn, etc) thats offered by more expensive tools out there.

Some screencaps of the CAS menu
1661786549987-png.png



1661786556512-png.png


OBD Mode, You can connect the Mini ADCP Controller to the OBD Port in your car and supposingly do everything.
However, in order for it to do anything over OBD, it will need to downgrade the software running in the CAS module to an older version.
I believe this relies on some exploit that lets you write stuff to the EEPROM without taking the CAS apart.
This takes ~15 minutes.

1661786565427-png.png



IMMO Menu, I believe this lets you play with keys and stuff.
1661786574999-png.png



Theres also a menu with a bunch of special functions.
1661786583627-png.png



However...
  • You can't trigger DME sync with CAS on EWS4 as far as I know.
  • ELV syncs with CAS everytime it boots up so I don't know why it's there?
  • Clear DTC and shadow... well it saves some time opening INPA or ISTA-D
  • Unlock Key, I think this removes your current key data from the CAS.
Mileage Correction
1661786599074-png.png



Read/Write CAS ISN through OBD
1661786613316-png.png


This might do what it says in the text but with one caveat, you need a new BLANK key.
I don't have one and I only found out when I was actually using it!

The Abnormal CAS repair option soft bricked my CAS module.
1661786625363-png.png



No Clue what it does
1661786631624-png.png



Supposingly, I should be able to change the ISN through OBD without removing the CAS module in the Read/Write CAS ISN menu.
I was working with Mini ACDP Support in real time already but only found out it needs a new blank key if you want to do it through this method! I don't mind buying a new key if I knew in advance but I certainly don't apreciate finding this out when I am stuck with a non working car. Besides, it will take me at least a week to get a new blank key from China even if I was to order it....

Also, I found out the hard way of what happens when technical terms don't match. Since I wasn't able to use the option "Replace DME of 32-bit ISN" without a new blank key, I started to poke around with the Read/Write DME-ISN option.

dme-isn-png.png



I only found out later that this DME-ISN is NOT the ISN used to sync with the DME. According to Mini ACDP Support, it only has something to do with key generation.

Anyways, I updated this DME-ISN to the one I retrieved from my donor DME, flashed my CAS through the OBD port and..............
it went totally unresponsive. My car wouldn't respond to the Start Stop Button at all but I could still connect through Mini ACDP so I used the Abnormal CAS repair option. It tried to flash my CAS and..............soft bricked the CAS module after 15 minutes. Car still wouldn't respond to the Start Stop Button. Couldn't Lock/Unlock my doors or trunk. Luckily there is a key slot in my trunk so I could still open it and grab the tools I need to remove the CAS Module.

CAS Module out of my car
pxl_20220812_183916457-jpg.jpg



It just takes prying 4 clips apart to remove the shell from the CAS3 Module
pxl_20220812_202207061-jpg.jpg



CAS Module Disassembled and hooked up through ICP Mode. If DME Open Shell was fiddly, this was just painful the first time.
I wasted at least 30 minutes trying to get everything to line up correctly.

pxl_20220812_194851536-jpg.jpg


PIN Checking
pxl_20220812_195552876-jpg.jpg



Decrypting the CAS Module Requires a Working Key unless you have the Password used for decryption
pxl_20220812_195848789-portrait-jpg.jpg



Here are some screenshots of the menu

My CAS Module is 0L15Y
1661783678281-png.png



IMMO and Mileage Correction is pretty much the same as OBD.
However, you save 30 minutes+ as you don't need to downgrade and upgrade the software version again.
1661783685073-png.png



Read/Write CAS Data, Pretty much self explanatory...
Before Editing Anything through OBD or ICP, make sure you Read EEPROM and FLASH and save a copy somewhere!

Luckily, before starting to do any of this, I have removed my CAS module and gone through the process of backing everything up.
Otherwise I would be stuck with a soft bricked CAS module with no way of recovering it.

1661783751399-png.png



In order to recover the module, I just used the option Write EEPROM and Write FLASH and chose the respective backup files.

Now my CAS is back in a responsive state. It also works in my car, or at least my cluster lights up when I press the Start Stop Button.
pxl_20220825_142047878-jpg.jpg



However, with the donor DME installed, it is still throwing EWS Manipulation Codes which is to be expected as the DME and CAS aren't synced.
Since changing the DME-ISN in the CAS didn't work, why not put the DME-ISN into the DME?

I took everything apart and did it sitting on the ground in my parking garage. And this didn't work either.....
img_20220825_165423-jpg.jpg



Dreaded EWS Manipulation Error Code. You can also see the 2FA4 Code Complaining about the wrong power class.
I haven't flashed my tune to my DME yet but my car should still be able to start at this point.
pxl_20220825_020904497-jpg.jpg



After ~6 hours of talking to Mini ACDP Support, now they tell me I should change the EWS4-ISN instead of the DME-ISN.....................................
Honestly why the fuck would anyone label something as DME-ISN when it's not even related to the DME?
Or better yet, why not label the fucking ISN retrieved from the DME as EWS4-ISN so a sane person would know what to expect?

I unplugged everything and went home.
 

AzNdevil

Lieutenant
Staff member
Nov 4, 2016
566
269
0
Hong Kong
Mini ACDP Review Part 4

Everything is in english, the ones you see in Chinese are the ones I am reusing from my previous screen captures.

How to update the EWS4-ISN in the CAS

Go into the CAS Menu, Select CAS 3, Select ICP Mode
1661787279980-png.png



My CAS Module is 0L15Y
1661787288009-png.png



Read the CAS EEPROM
1661787295820-png.png



Hook up the ICP Board to your CAS
pxl_20220825_141320139-jpg.jpg



Let it do its PIN CHecking
pxl_20220812_194917943-jpg.jpg



And Upload it to their server for some reason
pxl_20220812_195221072-jpg.jpg



Select Modify ISN
1661788275902-png.png



Select Replace 32-bit ISN DME
1661787379242-png.png



Select Your EEPROM
pxl_20220812_195715930-portrait-jpg.jpg



Here
pxl_20220812_195725007-portrait-jpg.jpg



Decode the EEPROM with your car key
pxl_20220812_195823166-portrait-jpg.jpg



Hook up the BAV-KEY Module to your Mini ACDP Controller
pxl_20220825_142042037-jpg.jpg



Click the middle button to modify the EWS4-ISN
pxl_20220812_200017183-portrait-jpg.jpg



Change this to your DME ISN (The actual ISN from the DME). Click Modify.
pxl_20220812_200028291-portrait-jpg.jpg



Select Write CAS EEPROM
1661788275902-png.png



Done.

Now that CAS is done, time to change the ISN in the DME.
Back into the Open Shell Menu. Read/Write ISN
1661788909118-png.png



Select Use Interface Board
pxl_20220824_022019508-jpg.jpg



Hook up the Interface Board to your DME. Let it do its pin checking
pxl_20220824_022031065-jpg.jpg



Enter the Boot Password Retrieved from OBD
pxl_20220824_022040143-jpg.jpg



Let it read...
pxl_20220824_022054008-jpg.jpg



You should see this screen if its successful. Note that this only changes the last 7 digits of your VIN.
Change it and click Write.
pxl_20220825_004825146-jpg.jpg



Then this happened. Look specifically at the VIN. The software only changed the last 7 digits of my VIN!
The first part of my VIN is incorrect and MHD doesn't recognize my license.
pxl_20220825_012449415-jpg.jpg



In order to fix this, you will need to manually edit the file dumped by the software here.
1661789560705-png.png



Select the Read/write EEPROM option here, Select your edited file and it should be fine.
1661788909118-png.png



Note: Mini ACDP Support said the edited EEPROM file should be checksum corrected. I didn't do anything to it but it still worked. YMMV

And with everything back in the car, its finally working again.
 

AzNdevil

Lieutenant
Staff member
Nov 4, 2016
566
269
0
Hong Kong
fwiw, i did get the working hours zeroed out but i dont have to time to write a post on it
i still need to test the dme in my car to see if i can actually code it with ncsexpert as well

For anyone that's interested, Mini ACDP Support just told me they released a module that allows full eeprom/flash cloning for the older DMEs including msd80/81 without delidding...and allows for read/write isn without delidding
http://www.acdpmaster.com/en/module-list/Module-EN27.html

this new module costs another 199USD, since i dont have a need for it now, i am just going to steal some screencaps from their site...

if anyone is considering buying the tool to do a dme swap/upgraede, you can get away with just buying the Mini ACDP Controller Master Module and this module... which only costs $400USD+shipping in total...

pryhey0e6fyj3dlvklz7-jpg.jpg



27_18-jpg.jpg
 
  • Informative
Reactions: TiAgAu

carabuser

Lieutenant
Oct 2, 2019
884
1
782
0
UK
Ride
Z4 35i & 335i
fwiw, i did get the working hours zeroed out but i dont have to time to write a post on it
i still need to test the dme in my car to see if i can actually code it with ncsexpert as well

For anyone that's interested, Mini ACDP Support just told me they released a module that allows full eeprom/flash cloning for the older DMEs including msd80/81 without delidding...and allows for read/write isn without delidding
http://www.acdpmaster.com/en/module-list/Module-EN27.html

this new module costs another 199USD, since i dont have a need for it now, i am just going to steal some screencaps from their site...

if anyone is considering buying the tool to do a dme swap/upgraede, you can get away with just buying the Mini ACDP Controller Master Module and this module... which only costs $400USD+shipping in total...

View attachment 73478


View attachment 73479
So with that new module it would be possible to read existing ISN from a CAS or DME then write that to a new DME all over OBD?

Also would you be able to reset working hours and write the correct VIN into the SBOOT area without needing to take the lid off?
 

That4chanhackerguy

Specialist
May 27, 2022
54
8
0
So a few things about this.... it's great that you can modify ISN however you won't be able to change the vin in UIF field 1 this is the vin that displays in MHD, also you have other things you need to make sure are correct like the OBD protocol since there are early N54 cars that run a different OBD protocol (JBBE vs JBBEII/III) along with powerclass and other coding however you are in the right area, also what is ready from MSD80 can not be cloned to a MSD81. There are other tools that do this better. But I only charge about $275.00 to do a msd80 to msd81 upgrade
 

carabuser

Lieutenant
Oct 2, 2019
884
1
782
0
UK
Ride
Z4 35i & 335i
So a few things about this.... it's great that you can modify ISN however you won't be able to change the vin in UIF field 1 this is the vin that displays in MHD, also you have other things you need to make sure are correct like the OBD protocol since there are early N54 cars that run a different OBD protocol (JBBE vs JBBEII/III) along with powerclass and other coding however you are in the right area, also what is ready from MSD80 can not be cloned to a MSD81. There are other tools that do this better. But I only charge about $275.00 to do a msd80 to msd81 upgrade
He changed VIN 1 that lives at 0x1A00. Not sure if de-lid is required for that or if this new module can do over OBD. He also managed a working hours reset too so powerclass can be changed.

I don't think procotol is an issue either. All MSD80 and MSD81 have the same ports available for comms. You can use PTCAN or local DCAN.

$400 seems like a pretty good deal if this can do ISN, working hours and VIN writing.
 

AzNdevil

Lieutenant
Staff member
Nov 4, 2016
566
269
0
Hong Kong
So with that new module it would be possible to read existing ISN from a CAS or DME then write that to a new DME all over OBD?

Also would you be able to reset working hours and write the correct VIN into the SBOOT area without needing to take the lid off?
He changed VIN 1 that lives at 0x1A00. Not sure if de-lid is required for that or if this new module can do over OBD. He also managed a working hours reset too so powerclass can be changed.

I don't think procotol is an issue either. All MSD80 and MSD81 have the same ports available for comms. You can use PTCAN or local DCAN.

$400 seems like a pretty good deal if this can do ISN, working hours and VIN writing.

Mini ACDP's "OBD" sometimes mean a bench setup and sometimes through the actual OBD port

supposingly with the new module 27 it should be possible to read and write ISN from DME
i don't have the module so i cant say for sure but Mini ACDP Support said yes at least :D

if you want to do anything with the CAS you need to buy the CAS module as well

reset working hours has to be done by desoldering 95640 EEPROM, the actual coding options are stored in the EEPROM as well.

to our previous discussion, you were correct about the DME auto learning some of the "coding options" and overwriting them in the 95640 EEPROM during its start up sequence.

i confirmed this when i flashed another 95640 EEPROM dump to my chip, hooked it up to my DME, power on, wait 30 seconds, dump the 95640 EEPROM again

both parts of the VIN are in SBOOT, supposingly this module can do it through OBD as well


So a few things about this.... it's great that you can modify ISN however you won't be able to change the vin in UIF field 1 this is the vin that displays in MHD, also you have other things you need to make sure are correct like the OBD protocol since there are early N54 cars that run a different OBD protocol (JBBE vs JBBEII/III) along with powerclass and other coding however you are in the right area, also what is ready from MSD80 can not be cloned to a MSD81. There are other tools that do this better. But I only charge about $275.00 to do a msd80 to msd81 upgrade

i mentioned how to do it for MHD near the end of my review part 4. and yes i agree there are other tools that are a lot less painful tbh...
but it costs relatively more and doesnt make sense for an individual like me to buy it and only do 1-2 DME swaps.

if you ask me $275 without the dme is a fair price, but i am not from the US/UK so i'd be stuck with a 2-4 weeks roundtrip shipping
and i cant drive my car in the meantime.

and of course i can go another route, buy a dme/cas/key set, send it to you/someone to change everything. but the costs already exceed the ~600USD + 265USD i paid...

if going to China doesn't require quarantine, i could have this done for 50 - 100$USD.
taobao/aliexpress DME sellers are willing to do it for free or 2-3$USD if you provide the ISN for them to program in...
a DME from them is 350-400 USD though

The issue is the tool doesn't understand the ROM on the MSD81 this tool is very dodgy.

the tool never promised to automate a msd80 to msd81 conversion... its just something that can be done if you know your way around this particular tool

this review is meant to show people that it could be done for 4~600USD if they are technical enough
there are other features like key coding into the CAS but i dont have time to play with it

besides...it supports other DMEs as well if you buy the proper modules.
i do believe it can do bench unlocks for newer DMEs (B48/B58) and stuff but i havent looked deep into it
 

That4chanhackerguy

Specialist
May 27, 2022
54
8
0
I know I'm just saying that it's pretty dodgy is all, there is a high risk of permanently bricking the dme with this tool i have seen it many times. They operate on a quantity model where they offer a lot of ecu options but that leads to a lot of errors and failures.
 

That4chanhackerguy

Specialist
May 27, 2022
54
8
0
There are certain sectors of the SBOOT or also called the PFlash that can not be written over OBD this includes UIF field 1 and the ISN, also the ext eeprom 95640 doesn't require you to desolder with a lot of tool to reset hours, it can be written to on the bench and without opening the dme i think even kess clones but dont take my word on that... but if you had to you can get a cheap 15.00 programmer desolder and them resolver back for that.
 

carabuser

Lieutenant
Oct 2, 2019
884
1
782
0
UK
Ride
Z4 35i & 335i
There are certain sectors of the SBOOT or also called the PFlash that can not be written over OBD this includes UIF field 1 and the ISN, also the ext eeprom 95640 doesn't require you to desolder with a lot of tool to reset hours, it can be written to on the bench and without opening the dme i think even kess clones but dont take my word on that... but if you had to you can get a cheap 15.00 programmer desolder and them resolver back for that.
Is ISN in SBOOT? Do you know the offset for it?

It's pretty easy to read the SBOOT from a DME with just BMW standard tools.
 

AzNdevil

Lieutenant
Staff member
Nov 4, 2016
566
269
0
Hong Kong
I know I'm just saying that it's pretty dodgy is all, there is a high risk of permanently bricking the dme with this tool i have seen it many times. They operate on a quantity model where they offer a lot of ecu options but that leads to a lot of errors and failures.

to be fair, at this lifecycle stage of the product, i do agree there is a high risk of screwing things up
in fact, when i bought it i dont even know if it will really work, and thats why i paid with paypal................
worst case scenario, i refund it through paypal, get my money back and absorb the costs of a bricked msd81

at the end of the day, tools only get better if more people use them and report issues they have encountered.
hey... i even mentioned and documented the issues/errors i encountered myself;)

but do note that i am able to communicate with them using chinese...and i am in the same timezone as them so my support experience wasn't all that bad

There are certain sectors of the SBOOT or also called the PFlash that can not be written over OBD this includes UIF field 1 and the ISN, also the ext eeprom 95640 doesn't require you to desolder with a lot of tool to reset hours, it can be written to on the bench and without opening the dme i think even kess clones but dont take my word on that... but if you had to you can get a cheap 15.00 programmer desolder and them resolver back for that.

fot the working hours thing, i spent some time researching but the only thing i found was from autohex.
they claimed that they are the only tool that can change working hours without delidding and this is only in the relatively recent software release notes

besides..personally i cant justify spending 5k+ EUR for autohex+hextag... unless i am doing this as a business/professional services.

1662050762282.png


and... i did end up buying a cheap ch341 programmer to read the 95640 eeprom... but i later found out the Mini ACDP Controller also supports reading and writing to 95640 EEPROMs as well (with an additional module...)... i think this came as part of the CAS module but i havent played with it myself
PXL_20220824_173102368.jpg


i checked with the chinese sellers and they confirmed kess/ktag clones cant do 95640 eeprom or isn...
however, they said it should be able to do a full read/write on the tricore side of things...
if i ever run out of things to do or find the need to deep dive into this, i will grab both and do a review specifically for msd81
especially when i can get both for under 100USD.........and i have an extra DME to play around with

kess clone
1662050890095.png


ktag clone
1662051007393.png
 

Attachments

  • 1662050947787.png
    1662050947787.png
    268.7 KB · Views: 37

TiAgAu

Corporal
Nov 18, 2018
139
56
0
Australia
Ride
08 335i
fwiw, i did get the working hours zeroed out but i dont have to time to write a post on it
i still need to test the dme in my car to see if i can actually code it with ncsexpert as well

For anyone that's interested, Mini ACDP Support just told me they released a module that allows full eeprom/flash cloning for the older DMEs including msd80/81 without delidding...and allows for read/write isn without delidding
http://www.acdpmaster.com/en/module-list/Module-EN27.html

this new module costs another 199USD, since i dont have a need for it now, i am just going to steal some screencaps from their site...

if anyone is considering buying the tool to do a dme swap/upgraede, you can get away with just buying the Mini ACDP Controller Master Module and this module... which only costs $400USD+shipping in total...

View attachment 73478


View attachment 73479

Thanks for the write up.
Looked into this a little, looks like you have to delid to write ISN. According to this anyway (pic below)
https://www.yanhuaacdp.com/wholesale/bmw-msd80-msd81-isn-interface-board.html

What is the Reset working hours? Is it basically zeroing out the DME's miles/km's? This tool can do it?
 

Attachments

  • 20112416062728433550.jpg
    20112416062728433550.jpg
    255.1 KB · Views: 25

AzNdevil

Lieutenant
Staff member
Nov 4, 2016
566
269
0
Hong Kong
Thanks for the write up.
Looked into this a little, looks like you have to delid to write ISN. According to this anyway (pic below)
https://www.yanhuaacdp.com/wholesale/bmw-msd80-msd81-isn-interface-board.html

What is the Reset working hours? Is it basically zeroing out the DME's miles/km's? This tool can do it?
iirc they came out with an update to write ISN without delid

reset working hours is for resetting the dme's working hours so you can change some coding stuff like vehicle power class or speed limiter
zeroing out the DME's mileage... its probably on the 95640 as well

this tool can read/write to a 95640 but it needs an extra module ($$) a ch341 programmer is like ~5USD from aliexpress
 
  • Like
Reactions: TiAgAu and jzx_andy