RomRaider

Does anyone have any information pertaining to communicating with MS45?

I have decompiled INPA files and the commands all appear to be virtually identical to MSS54, MS43, MS42, MS41.
However I get bad responses when attempting to communicate. Tried several different BAUD rates, etc. Nothing. I sniffed the communication when doing basic INPA functions and did not recognize anything. I have yet to sniff my KESS read/write communications.

Am I missing something?

My goal was to build a free MS45 read tool making it a little easier for people using WINKFP to flash and hopefully open some doors to the MS45 community.

Use the Editor > Tools > Test App to send the Init command. Do you get the exact same format and *length* as the older version DMEs?
Then try sending the general query command: 0B03
You will need to modify the logger def to match the results of this output. The response length has to be correct or you will not get any data to show in the logger display.

I have an x3 with ms45. What do you want me to try?

Same

I get nothing with init command which is why I started the thread (even though the INPA source files state init is the same)

Do you know if kess reads files similar to pasoft? I can grab a read using that and sniff that

The address of the dme is different on ms45 and newer. 83 vs 12 for ms41-43

Interesting. I’ll play around later. I wonder if my inpa source file is old or inaccurate for my ms45.1.


Sent from my iPhone using Tapatalk

Success. Checksum is the same. Now I need to find the right INPA source file to make this easier. I'll also sniff my kess read. Here's some adaptation clearing. Knock and lambda.

Write: B8 12 F1 04 18 02 FF FF 45
Read: B8 F1 12 20 58 0A 27 86 D1 27 87 D2 27 F7 52 27 F8 52 28 07 D8 27 B5 D4 27 BD D4 27 D7 D4 27 D6 D4 27 64 D4 4D

Write: B8 12 F1 05 31 30 04 00 00 5B
Read: B8 F1 12 05 71 30 04 00 00 1B


Unsure if packet length is built in here or not.

Edit: Don't waste your time sniffing kess

This is a different protocol from MS41/2/3. It's KWP2000 instead of DS2. The first three bytes are the header (83 = ??, 12 = DME, F1 = tester), then the length of the payload. The next byte is the SID (service ID AKA Mode) next is the Parameter ID (PID) and then whatever arguments are required. The response code for success is the SID + 0x40.

This is not proprietary to BMW, it's really similar to what a lot of other manufacturers use, and it's the same protocol that's used via K and CAN on newer cars (with some minor changes).

Awesome! This helps a ton. If I read that right, the 4th byte = packet length - 5? aka length of payload

Yep, exactly.

It's much the same as the protocol we use for Subaru (on K-line).
You may even be able to create your own Logger definition file to try it.
Change these as required but leave protocol ID as SSM and transport ID as ISO9141 and choose SSM on K-line as the protocol in the Logger settings rather than DS2:

Try a sniff and see if you get a response. Then you'd have to define all the logger parameters in this section of the def.
What will probably be different is the Init to determine the DME ID and supported parameters thereafter.

I have ms45.0 for experiments, if something need to be checked - PM.

so do I. if I can do any for community let me know

Haven't forgotten about this.

Did some sniffing today and was able to decipher this (just to get familiar with the packets)

TX: B8 12 F1 01 3E 64
RX: B8 F1 12 01 7E 24

TX: B8 12 F1 03 10 81 05 CC
RX: B8 F1 12 03 50 81 05 8C

E0 38 30 30 70 70 38 10 C0 70 0E 80 10 80 30 C0 0C 1C C0 10 70 30 18 C0 60 70 70 88 3A 60 38 10 80 38 0C 60 1C 70 80 70 30 18 60 70 18 70 E0 70 38 80 30 F8 F8 FF

TX: B8 12 F1 01 3E 64
RX: B8 F1 12 01 7E 24

TX: B8 12 F1 03 10 81 05 CC
RX: B8 F1 12 03 50 81 05 8C


I'm unable to identify the bold text. How many packets, which are the packet headers, checksums, etc. Does anyone else see anything there?