BMW ME7.2 Developement

zarboz · **Joined:** Sat Aug 11, 2018 12:42 am **Posts:** 47

I have a full working xdefinition for 3 different software versions but seeing as how the tuner software guy doesnt develop his software anymore and doesnt share source ive shuffled my projects over to romraider

I am currently porting xdefinition items over and then laying them out in 512kb and 64kb mappings for romraider

https://github.com/zarboz/Me72-XML

This is the romraider file that is a work in progress

https://github.com/zarboz/BMW-XDFs/tree ... %20V8/XDFS

this is the folder of my xdfs I am porting over

if anyone has input / suggestions / wants to help let me know

zarboz · **Joined:** Sat Aug 11, 2018 12:42 am **Posts:** 47

my 540i is dead for now and the 740i I just bought does not have an me7.2 it is the older model

So I might not be pushing as hard on this right now

zarboz · **Joined:** Sat Aug 11, 2018 12:42 am **Posts:** 47

I realized my github was private for some reason

exposed back to pubic and added the xdefinition and binary I am working off of

zarboz · **Joined:** Sat Aug 11, 2018 12:42 am **Posts:** 47

just a preview of where i am with 512kb reads

ba114 · **Joined:** Wed Oct 21, 2015 2:36 am **Posts:** 945

How are you managing the axis labels given they use a subtract method? RR doesn't seem to have the capability to display axis labels this way.

zarboz · **Joined:** Sat Aug 11, 2018 12:42 am **Posts:** 47

ba114 wrote:

How are you managing the axis labels given they use a subtract method? RR doesn't seem to have the capability to display axis labels this way.

not going to lie i am still fumbling around on RR learning as I go the X/Y axis are outlined as hex already in the binary same as MS41/42/43 DME strategy

I have FR and a half assed IDA project for this (I only took it apart far enough to figure out EWS delete)

Trying to port my work from the "other guys" software

I also have a working xdefinition I have produced after countless hours of A2L > KP > xdefinition translation

I know the Bosch Me7.2 decently well from all this I am just trying to bring over an XML

If you see any errors I made please feel free to open issue on github or make pull request with corrections

Thank you so much for being interested

ba114 · **Joined:** Wed Oct 21, 2015 2:36 am **Posts:** 945

Sent you a PM as i'm also working on M5.2.1 which is pretty similar

bernardo774 · **Joined:** Thu Aug 17, 2017 3:21 pm **Posts:** 24

nice work!!!

i am a basic tuner, work a lot in ms41, ms42 and ms43

but a need to tank your guys that make this XML!

7.2 and 5.2 will be wonderfull

zarboz · **Joined:** Sat Aug 11, 2018 12:42 am **Posts:** 47

I have figured out the EWS delete for the me7.2 if you care at all for the information

Search a 512kb dump for the following hex string:

Code:

E6 F5 00 FF F6 F5 32 80 DB 00

Following this is a string of hex 1A long

in my binary the hex string looked as such

Code:

C2F430B168412D07C2F450B168412D038A6C01C00D026F880D01

Replace this hex with an string also 1A in length containing the following characters

Code:

CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00

So my string went from

Code:

E6F500FFF6F53280DB00C2F430B168412D07C2F450B168412D038A6C01C00D026F880D01

changed over to

Code:

E6F500FFF6F53280DB00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00

Essentially what this does is replace the EWS check portion of the code with a Null Operation

I am sure there could be a more elegant way of doing this with a unconditional jump but I dont really care to figure that out since I dont own an me7 car anymore

should be noted that you should bridge the 2 ignition wires on the EWS box

markRR · **Joined:** Mon May 05, 2014 8:50 pm **Posts:** 6

So you figured it out yourself by dis-assembling the file?

lucasffer · **Joined:** Sun Mar 23, 2014 1:54 am **Posts:** 1

zarboz wrote:

I have figured out the EWS delete for the me7.2 if you care at all for the information

Search a 512kb dump for the following hex string:

Code:

E6 F5 00 FF F6 F5 32 80 DB 00

Following this is a string of hex 1A long

in my binary the hex string looked as such

Code:

C2F430B168412D07C2F450B168412D038A6C01C00D026F880D01

Replace this hex with an string also 1A in length containing the following characters

Code:

CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00

So my string went from

Code:

E6F500FFF6F53280DB00C2F430B168412D07C2F450B168412D038A6C01C00D026F880D01

changed over to

Code:

E6F500FFF6F53280DB00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00

Essentially what this does is replace the EWS check portion of the code with a Null Operation

I am sure there could be a more elegant way of doing this with a unconditional jump but I dont really care to figure that out since I dont own an me7 car anymore

should be noted that you should bridge the 2 ignition wires on the EWS box

I Have a Me7.2 X5 4.4, i had some issues getting the DME to go to Boot mode, i put a scope on the communication line with the INPA tool and i found there was some communication collision and drop of packets. i adjusted the Baud rate to 2048 and the latency to 8ms and i was able to get it to download the full 512KB file on the bench. once i did that i opened the BIN file with a HEX editor, performed the search and replace as per your instructions , then run a CRC correction on it (this DME has 4 CRC for the 512kB file) and re uploaded to DME.
Then i shorted the relay on the EWS, It started after 2-3 seconds of cranking. it does so reliably now.
Notes: EWS module needs to remain connected in the harness or it will not start, if you read the DME memory, the EWS-DME communication still shows up as an error but it does not stop car from starting.

THANK YOU FOR POSTING THIS!, Literally this was the difference between me scrapping the car vs keeping it.

Now i am going to tackle my e36 supercharger project :-)

zarboz · **Joined:** Sat Aug 11, 2018 12:42 am **Posts:** 47

lucasffer wrote:

zarboz wrote:

I have figured out the EWS delete for the me7.2 if you care at all for the information

Search a 512kb dump for the following hex string:

Code:

E6 F5 00 FF F6 F5 32 80 DB 00

Following this is a string of hex 1A long

in my binary the hex string looked as such

Code:

C2F430B168412D07C2F450B168412D038A6C01C00D026F880D01

Replace this hex with an string also 1A in length containing the following characters

Code:

CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00

So my string went from

Code:

E6F500FFF6F53280DB00C2F430B168412D07C2F450B168412D038A6C01C00D026F880D01

changed over to

Code:

E6F500FFF6F53280DB00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00CC00

Essentially what this does is replace the EWS check portion of the code with a Null Operation

I am sure there could be a more elegant way of doing this with a unconditional jump but I dont really care to figure that out since I dont own an me7 car anymore

should be noted that you should bridge the 2 ignition wires on the EWS box

I Have a Me7.2 X5 4.4, i had some issues getting the DME to go to Boot mode, i put a scope on the communication line with the INPA tool and i found there was some communication collision and drop of packets. i adjusted the Baud rate to 2048 and the latency to 8ms and i was able to get it to download the full 512KB file on the bench. once i did that i opened the BIN file with a HEX editor, performed the search and replace as per your instructions , then run a CRC correction on it (this DME has 4 CRC for the 512kB file) and re uploaded to DME.
Then i shorted the relay on the EWS, It started after 2-3 seconds of cranking. it does so reliably now.
Notes: EWS module needs to remain connected in the harness or it will not start, if you read the DME memory, the EWS-DME communication still shows up as an error but it does not stop car from starting.

THANK YOU FOR POSTING THIS!, Literally this was the difference between me scrapping the car vs keeping it.

Now i am going to tackle my e36 supercharger project :-)

curious how you did the full read just through INPA or using Galletto or through JMgarage tools?

zarboz · **Joined:** Sat Aug 11, 2018 12:42 am **Posts:** 47

I will add the IDA project to the repo as well and finish naming all the tables I found. Maybe we can get a better understanding of the DME

zarboz · **Joined:** Sat Aug 11, 2018 12:42 am **Posts:** 47

What it looks like with NOOP in place

going to figure out a unconditional jump method for this so its a simple byte flip

Fabio · **Posted:** Fri Mar 20, 2020 2:30 pm

zarboz wrote:

I have figured out the EWS delete for the me7.2 if you care at all for the information

Erm... You've had the file with it :wink:

I can analyze it with IDA for one byte jump If You want.

Also interested in vanos tuning, because currently changed to RON98 and increasing ignition timing.

RomRaider

BMW ME7.2 Developement

Who is online