MSS30/MSS32/MSS34/MSS34P ul?

uML ModlflcaLlon

1he purpose of Lhls documenL ls Lo gulde lLs reader Lhrough a successful
modlflcaLlon of Lhe MSS30 (L36 M3), MSS32 (L39 M3), MSS34 (L46 M3) or
MSS34P (L46 M3) ln a comprehenslve fashlon wlLhouL requlrlng Lhe
readers Lo overly burden Lhemselves wlLh a full undersLandlng of Lhe
Lechnlcal deLalls of Lhe processes lnvolved.


D|sc|a|mer 2
Nomenc|ature 3
Necessary 1oo|s 4
Necessary Software S
Caveats 6
kead|ng (dump|ng) the arameter Space 8
Ident|fy|ng the DML's nardware Var|ant and rogram Vers|on 9
Mod|fy|ng the arameter Space 11
Wr|t|ng (f|ash|ng) the Mod|f|ed arameter Space 14
I|na||z|ng the rocedure 1S
Irequent|y Asked uest|ons 16
Works C|ted|keferences 18
Cred|ts 18
kev|s|on n|story 18


2
D|sc|a|mer

lts o tettlble Jlssetvlce to tbe eotboslost commoolty tbot Jlsclolmets ote tepolteJ, ooJ wblle tbe
tbteot of lltlqotloo ooJ lloblllty ls evet locteosloq, lt sboolJ oot be oseJ os o Jetetteot to tbose
ptovlJloq lofotmotloo oo qtotls. 1bos, betelo lles o telotlvely ooo-comptebeoslve Jlsclolmet.

LkICkMANCL WAkkAN1 DISCLAIMLk - 8y lnsLalllng or aLLempLlng, by any means, any
lnformaLlon, sofLware, servlces, suggesLlons, Lune, or Lunlng ldea conLalned wlLhln Lhls
documenL, Lhe reader boLh undersLands and agrees, uncondlLlonally, LhaL any such alLered
performance producLs, lnformaLlon, sofLware, servlces, suggesLlons, Lunes, or ldeas may noL
perform as lnLended, or aL all. lndlvldual resulLs may vary dependlng on make, model, year, and
flLmenL for any parLlcular use ls noL guaranLeed. ln no way shall Lhe conLrlbuLors of Lhls
documenL, or slLe admlnlsLraLlon, slLe owners, or sponsors be held responslble and/or llable for
any resulLs based on lnformaLlon clalmed or unclalmed, LhaL may or may noL come from Lhe
dlrecL or lndlrecL use of lnformaLlon, sofLware, servlces, suggesLlons, Lunes or Lunlng ldeas
conLalned wlLhln. Ou Ak ON Ouk OwN. Any lnformaLlon, sofLware, servlces, suggesLlons,
Lune or Lunlng ldeas can and mosL wlll lnhlblL Lhe ablllLy of Lhe car Lo perform as lnLended by lLs
orlglnal manufacLurer. lL ls also enLlrely llkely LhaL Lhe lnformaLlon, sofLware, servlces,
suggesLlons, Lune or Lunlng ldeas conLalned wlLhln wlll lnLerfere wlLh Llme-LesLed CLM
funcLlonallLy, dlagnosLlcs and local emlsslons compllance. u5 A1 Ouk OwN kl5k.

LIA8ILI1 DISCLAIMLk - ln no way shall any conLrlbuLor hereby referred Lo as an
admlnlsLraLor, documenL owner, forum member or forum sponsor be llable for Lhe lnformaLlon,
sofLware, servlces, suggesLlons, Lune, or Lunlng ldea or oLher such nomenclaLure conLalned
wlLhln Lhls documenL, regardless of proper or lmproper uLlllzaLlon. 1hose who acLlvely choose Lo
follow any advlce, or seek Lhe counsel of any oLher person ln accordance wlLh Lhe lnformaLlon
volunLarlly submlLLed wlLhln Lhls documenL accepL Lhe consequences of Lhelr acLlons or
lnacLlons wlLhouL recourse. 1he user of Lhls lnformaLlon, sofLware, servlces, suggesLlons, Lune or
Lunlng ldea assumes all llablllLy and agrees Lo walve any and all remedles and llablllLles, clalms
for remuneraLlon, expressed or lmplled arlslng by law or oLherwlse, lncludlng wlLhouL obllgaLlon
by Lhose volunLeerlng any such lnformaLlon, sofLware, servlces, suggesLlons, Lune or Lunlng ldea
wlLh respecL Lo flLness or consequenLlal damage, elLher by negllgence or dlrecL consequence.
1he conLrlbuLors Lo Lhls documenL also walve any such llablllLy for personal ln[ury or damages
LhaL may arlse for any reason, noL wlLhsLandlng ln[ury or damage Lo oLher persons. 1he user
acknowledges LhaL he or she ls noL relylng on Lhe conLrlbuLors Lo Lhls documenL Lo have any
such sklll or [udgmenL Lo furnlsh correcL or proper lnformaLlon, sofLware, servlces, suggesLlons,
Lune, or Lunlng ldea sulLable for any parLlcular purpose and LhaL no llablllLles exlsL whaLsoever.
8y agreelng Lo Lhese Lerms, elLher acLlvely, passlvely or noL aL all, Lhe user of Lhe lnformaLlon,
sofLware, servlces, suggesLlons, Lune, or Lunlng ldea conLalned wlLhln agrees Lo lndemnlfy Lhe
conLrlbuLors Lo Lhls documenL and Lo hold any such conLrlbuLors harmless from any clalm(s)
relaLed Lo Lhe aforemenLloned lnformaLlon, sofLware, servlces, suggesLlons, Lune, or Lunlng ldea.
under nC clrcumsLance wlll any parLlclpanL of Lhls documenL be held llable for any damages or
expenses for any reason, especlally by use of Lhe lnformaLlon, sofLware, servlces, suggesLlons,
Lune, or Lunlng ldea. ConLrlbuLors Lo Lhls documenL assume zero llablllLy regardlng Lhe lmproper
lnsLallaLlon or mlsappllcaLlon of Lhe lnformaLlon, sofLware, servlces, suggesLlons, Lune or Lunlng
ldeas conLalned hereln. lL ls Lhe user's responslblllLy Lo make proper [udgmenL declslons when
maklng changes Lo Lhelr own vehlcle.
Nomenc|ature
8|nary - uslng or denoLlng a sysLem of numerlcal noLaLlon LhaL uLlllzes base 2
raLher Lhan base 10 or base 16
8|t - a unlL of lnformaLlon expressed as elLher a 0 or 1 ln blnary noLaLlon
8yte - a group of blnary dlglLs or blLs (usually 8) operaLed on as a unlL
Dec|ma| (dec) - relaLlng Lo or denoLlng a sysLem of numbers and arlLhmeLlc LhaL
uLlllzes base 10, LenLh parLs, or powers of 10
DML - ulglLal MoLor LlecLronlcs, conLrols all key aspecLs of Lhe englne's
operaLlon, ensurlng opLlmum rellablllLy, maxlmum performance and Lhe lowesL
posslble fuel consumpLlon and emlsslons
Dump - a compuLer flle whlch conLalns a copy of Lhe daLa conLenLs from a read-
only memory chlp
LkCM - Lrasable rogrammable 8ead Cnly Memory - a read-only memory
whose conLenLs are sLored regardless of power and can be erased and
reprogrammed
I|ash - elecLronlc non-volaLlle compuLer sLorage devlce LhaL can be elecLrlcally
erased and reprogrammed
nexadec|ma| (hex) - uslng or denoLlng a sysLem of numerlcal noLaLlon LhaL
uLlllzes base 16 raLher Lhan base 2 or base 10, ofLen preflxed by '0x' or '0h', or
alLernaLely, an 'h' sufflx
MSSS0 - varlanL of Lhe uML found ln Lhe L36 ///M3
MSSS2 - varlanL of Lhe uML found ln Lhe L39 ///M3 and L32 Z8
MSSS4 - earllesL varlanLs of Lhe uML found ln Lhe L46 ///M3 and L36 Z3M
MSSS4n - laLer varlanLs of Lhe uML found ln Lhe L46 ///M3 wlLh Lwlce as much
L8CM sLorage space as Lhe MSS34
Cffset - an lnLeger lndlcaLlng Lhe dlsLance from Lhe beglnnlng of Lhe ob[ecL up
unLll a glven elemenL or polnL, presumably wlLhln Lhe same ob[ecL
Word - a flxed slzed group of blLs LhaL are handled as a unlL by Lhe lnsLrucLlon
seL and/or hardware of Lhe processor (16 blLs for Lhe MoLorola 68k found ln Lhe
uML)
Necessary 1oo|s

Mod|f|ed I1DI-based (I1232kL) VAG Com C8DII to US8 cab|e
1he cable requlred for Lhls procedure ls a sLandard vAC Com cable modlfled for
use wlLh LulA8AS/lnA/nCSLxperL/Wlnkl/rogman/SSS/ulS. 1he procedure
Lo modlfy a cable ls noL covered by Lhls documenL, lL ls presumed LhaL Lhe cable
works rellably wlLh LulA8AS-based sofLware (lnA, nCSLxperL, Wlnkl) prlor Lo
Lhe lnlLlal flashlng procedures.
1o daLe, some problems have arlsen from l12328M chlpseLs. Cnly l12328L
chlpseLs are supporLed aL Lhe Llme of Lhls wrlLlng. 1he verslon of chlpseL can be
deLermlned uslng elLher of l1ul's uLlllLles, l1_rog or Mrog, boLh of whlch are
avallable onllne for free download.
10A 8attery Charger]1ender
1he uML ln Lhe L46 ///M3 consumes conslderable power, as such, leavlng Lhe
lgnlLlon ln a ready sLaLe wlll draln Lhe baLLery qulckly.
Successful wrlLe operaLlons depend heavlly on a healLhy power supply.
1yplcal parLlal uML reads and wrlLes can be performed ln less Lhan 2.3 mlnuLes,
however, full blnary reads may Lake as long as 40 mlnuLes.
uon'L Lake a chance here, as baLLery chargers are relaLlvely lnexpenslve, buL Lhe
MSS34 uML lsn'L.
Computer
ueskLop or LapLop wlLh aL leasL 1C8 8AM and 1.3 CPZ Cu, avallable uS8 porL
32-blL Wlndows for LulA8AS-based sofLware:
lnA/nCSLxperL/Wlnkl/rogman/SSS/ulS/1lS
Wlndows or Mac CS x for 8MWllash
Necessary Software

8MWI|ash (hLLp://www.blmmersofLware.com/bmwflash/)
1hls ls Lhe cornersLone sofLware of Lhe pro[ecL and ls used Lo obLaln boLh full and
parLlal blnary reads of Lhe daLa conLalned wlLhln Lhe uML.
8ead (aka dump) operaLlons are free.
WrlLe (aka flash) operaLlons are a one-Llme cosL of $19 (currenL as of Lhls wrlLlng)
and locked Lo Lhe vln of Lhe uML belng reflashed.
Avallable for boLh Wlndows and Apple plaLforms, Lhe llcenslng key ls noL
plaLform-speclflc.
LDIA8AS]INA (32-blL Wlndows x/vlsLa/7 ooly)
lnA ls used as a fasL means Lo read Lhe flash counLer and Lo reseL Lhe uML
adapLaLlons. lL can also be used Lo exLracL uML program verslon lnformaLlon.
1hls ls commonly avallable onllne so acqulslLlon and lnsLallaLlon wlll noL be
covered wlLhln Lhls documenL.
nex Ld|t|ng Software
lor a comparlson of hex edlLors, please reference Lhls Wlklpedla page
(hLLp://en.wlklpedla.org/wlkl/Comparlson_of_hex_edlLors) uue Lo a varled level
of user famlllarlLy wlLh dlfferenL programs, no furLher sofLware
recommendaLlons wlll be made wlLh respecL Lo whlch hex edlLor ls mosL opLlmal
for Lhls Lask.
I1DI Ut|||t|es
l1_rog (hLLp://www.fLdlchlp.com/SupporL/uLlllLles.hLm#l1_rog) ls used Lo
ldenLlfy and change Lhe behavlor of Lhe l12328L chlpseL-based vAC Com cable
and ls Lhe laLesL L8CM edlLlng sofLware provlded by l1ul, buL does requlre
.nL1 Lo be lnsLalled.
Mrog (hLLp://www.fLdlchlp.com/SupporL/uLlllLles.hLm#Mrog) ls used Lo
ldenLlfy and change Lhe operaLlon of Lhe l12328L chlpseL-based vAC Com cable,
buL ls Lhe deprecaLed L8CM edlLlng sofLware provlded by l1ul, does noL
requlre .nL1 lnsLallaLlon, and has been superseded by l1_rog.
1eamV|ewer (hLLp://www.Leamvlewer.com)
1eamvlewer ls a free (for prlvaLe use) remoLe deskLop sharlng sulLe LhaL allows
remoLe users Lo share and conLrol Lhe local user's screen, and also feaLures
lnLegraLed messaglng and flle Lransfer funcLlonallLy.
Caveats

Lmbedded wrlLe-llmlL pseudocounLer - Lhls ls a meLhod employed by Slemens Lo
arLlflclally llmlL Lhe number of Llmes Lhe uML can be flashed.

1he uML can be flashed exacLly 60 Llmes before lL refuses addlLlonal sofLware flashlng
requesLs, aL whlch polnL alLernaLe flashlng meLhods musL be employed Lo reseL Lhe
pseudocounLer (whlch ls unforLunaLely beyond Lhe scope of Lhls documenL). ln Lheory,
Lhe AM29l200 and AM29l400 chlps are capable of >100000 wrlLe cycles.

1he flrsL and subsequenL flashes from 8MW facLory lnsLallaLlon and sofLware updaLes
may consume several wrlLe sloLs. lf a prevlous owner has performed any sofLware
updaLes, Lhese wlll deLracL from Lhe number of avallable wrlLes.

1he fasLesL way Lo deLermlne exacLly how many wrlLes remaln ls Lo read Lhe flrsL 100
byLes aL locaLlon 0x800 uslng Lhe 8ead 8AM feaLure ln lnA. 1hls wlll show a sLrlng such
as 12 68 A0 00 00 00 00 followed by some deLermlnlsLlc number of '00's or
'll's LhereafLer. Cne '00 00' grouplng represenLs one wrlLe sloL LhaL has been used. A
'll ll' represenLs an avallable wrlLe sloL.

1o know exacLly how many flashes remaln requlres counLlng Lhe number of '00's,
dlvldlng LhaL number by Lwo, and subLracLlng from 60.

avallable wrlLes = 60 - ([n}/2) (epootloo 1)

1hus, lf you counL 20 '00's ln flqote 2:



I|gure 2: lNlA keoJ kAM scteeo sbot oseJ to Jetetmloe tbe flosb pseoJocoootet

And consequenLly subsLlLuLe 20 for [n} ln epootloo 1 as follows:

60 - (20/2) = S0 ava||ab|e f|ashes rema|n|ng (epootloo 1. somple colcolotloo)

1he pseudocounLer can also be examlned by exLracLlng a full uML read uslng
8MWllash. 1he locaLlon for Lhe byLes occupled by Lhe pseudocounLer ls aL 0x4800. A
full uML read can Lake as long as 40 mlnuLes, whlch ls mosL cerLaln Lo requlre an
exLernal power source. (see baLLery charger lnformaLlon above)
kead|ng (dump|ng) the arameter Space

ConnecL Lhe baLLery charger Lo Lhe car, Lhen connecL Lhe C8u ll cable beLween Lhe car
and compuLer, Lurn Lhe lgnlLlon Lo poslLlon 2 (buL do noL sLarL Lhe car), and sLarL Lhe
8MWllash sofLware.

Cllck on I||e ! kead DML

A prompL wlll Lhen ask 'Do you want to down|oad the ent|re kCM contents?'

Click No to take a partial read, consisting only of the
parameter space, or click Yes to Lake a full read, whlch wlll provlde a
full dump of boLh L8CMs chlps.

uo noL remove Lhe baLLery charger, cycle Lhe lgnlLlon or unplug any cables durlng Lhls
procedure - lL wlll Lake approxlmaLely 2.3 mlnuLes Lo exLracL Lhe parameLer space.

Cnce Lhe procedure has flnlshed, Lhe sofLware wlll ask Lo save Lhe flle. LnLer Lhe deslred
flle name and locaLlon. lt ls blqbly tecommeoJeJ to ose some kloJ of flle oome
vetslooloq system to Jlffeteotlote betweeo tbe otlqlool potometet spoce blooty ooJ tbe
moJlfleJ blooty.

lot exomple:
ayrton.senna_v0.1.0.bin = otlqlool potometet spoce Jomp
ayrton.senna_v0.2.0.bin = fltst mojot moJlflcotloo
ayrton.senna_v0.2.1.bin = fltst mloot moJlflcotloo oftet mojot
ayrton.senna_v1.0.0.bin = fltst te-collbtoteJ opetotloool oJjostmeot
ayrton.senna_v1.0.1.bin = fltst mloot moJlflcotloo oftet tecollbtotloo
Ident|fy|ng the DML's nardware Var|ant and rogram Vers|on

1here are over a dozen dlfferenL program verslons across boLh uML varlanLs. 1he
Lunlng parameLer space ls maLched Lo lLs correspondlng program verslon so Lhe
parameLer space from one uML moy oot be (ooJ vety llkely lsot) compotlble wltb
oootbet, unless Lhe program verslons are an exoct maLch. 1he locaLlons of maps, curves
and values are dlfferenL beLween program verslons, so Lhe uML's program verslon musL
be deLermlned before proceedlng Lo make modlflcaLlons Lo Lhe uML parameLer space!

Whlle Lhe MSS30, MSS32, MSS34 and MSS34P uMLs have Lwo L8CM chlps onboard,
Lhey are noL ldenLlcal ln slze or conflguraLlon. 1he MSS30, MSS32 and MSS34 have Lwo
236 k8 chlps (AM29l200) and Lhe MSS34P has Lwo 312 k8 chlps (AM29l400). 1he
exLracLed slzes of boLh parameLer space, program space, and a full uML read are
provlded ln 1oble 1.

1he flrsL sLep ls Lo ldenLlfy Lhe varlanL of Lhe uML by looklng aL Lhe parLlal read (aka
parameLer space or callbraLlon). 1he fasLesL way Lo ldenLlfy Lhe uML varlanL ls by
examlnlng Lhe resulLanL flle slze of Lhe parameLer space dump. lf lL ls a 32 k8 flle, lL ls
Lhe MSS30, MSS32 or MSS34 (non-P) varlanL. lf lL ls a 64 k8 flle, lL ls Lhe MSS34P
varlanL. 1he L46 ///M3 CSL uLlllzes a varlaLlon of Lhe MSS34P wlLh a mlnor hardware
augmenLaLlon, and ls also 64 k8.

1o daLe, Lhe mosL accuraLe way Lo deLermlne boLh Lhe uML varlanL and program
verslon ls by Lhe 16-byLe verslon sLrlng locaLed aL 0x7l88 on Lhe MSS34 and 0x8l88 on
Lhe MSS34P. 1hls wlll conLaln a serles of characLers such as '211323002701J469'.
8yLes 3-8 (2300) wlll denoLe Lhe uML varlanL, as lllusLraLed ln 1oble 1. 1he segmenL
locaLed ln byLes 9-12 (2701) wlll denoLe Lhe program verslon. 8yLes 13-16 (J469) wlll
denoLe a dlfference ln callbraLlon, buL wlLh equlvalenL parameLer offseLs Lo oLher
callbraLlons wlLhln Lhe same program verslon group.

1ab|e 1: uM votloot vetsloo sttloq lJeotlflcotloo lofotmotloo

DML Var|ant (p|atform) Vers|on ID arameter Space rogram Space Iu|| DML kead
MSSS0 (L36 M3) 1800
1801
32768 8 (32 k8)
32768 8 (32 k8)
236 k8
236 k8
312 k8
312 k8
MSSS2 (L39 MS) 2100 32768 8 (32 k8) 236 k8 312 k8
MSSS4 (L46 M3) 2200 32768 8 (32 k8) 236 k8 312 k8
MSSS4n (L46 M3) 2300 63336 8 (64 k8) 312 k8 1024 k8
MSSS4n (L46 M3 CSL) 2300 63336 8 (64 k8) 312 k8 1024 k8

1he verslon can also be somewhaL deLermlned by openlng Lhe parLlal read uslng a hex
edlLor and looklng aL Lhe Lwo byLes aL 0x2 represenLlng Lhe program number, Lhough
Lhere ls some mlnor varlance and overlap for program numbers 3.19, 3.22 and 1.12.
1be 16-byte vetsloo sttloq wlll setve os !"# %#&! metboJ fot occototely Jetetmloloq tbe
botJwote oombet.

1oble 2 wlll lllusLraLe Lhe cross reference Lo program verslon wlLh respecL Lo hardware
number, verslon sLrlng, program number, uML varlanL and flnally, flle slze.

1ab|e 2: notJwote oombet cottelotloo ooJ lJeotlflcotloo


nardware Number Vers|on Str|ng rogram Number DML Var|ant I||e S|ze
783181S 2200 0701 3.03 (01 l7) MSS34 32 k8
unknown 2200 0901 3.08 (01 lC) MSS34 32 k8
7833892 2200 1301 3.18 (02 06) MSS34 32 k8
7834910 2300 1601 1.04 (00 68) MSS34P 64 k8
783SS84 2200 1701 3.19 (02 07) MSS34 32 k8
783SS64 2300 1801 1.07 (00 68) MSS34P 64 k8
7837340 2300 0401 2.11 (00 u3) MSS34P (csl) 64 k8
783780S 2300 2001 1.08 (00 6C) MSS34P 64 k8
7837941 2200 2101 3.19 (02 07) MSS34 32 k8
7842SS9 2200 2601 3.22 (02 0A) MSS34 32 k8
7842S69 2300 2301 1.12 (00 70) MSS34P 64 k8
784297S 2200 2801 3.22 (02 0A) MSS34 32 k8
7842981 2300 2701 1.12 (00 70) MSS34P 64 k8
Mod|fy|ng the arameter Space

Several meLhods exlsL Lo modlfy Lhe blnary parameLer space dump exLracLed from Lhe
uML uslng 8MWllash. 1he leasL sophlsLlcaLed meLhod ls Lo use a Pex LdlLor, and wlll be
Lhe lnlLlal focus of Lhls secLlon. AlLernaLely, Lhe free sofLware 1unerro can also be used
wlLh an approprlaLely crafLed .xdf LemplaLe flle, or WlnCLS (non-free) also wlLh an
approprlaLely crafLed damos (.a2l) LemplaLe flle. 8ear ln mlnd LhaL each program
verslon wlll requlre a dlfferenL .xdf or .a2l, whlch are noL ready for publlc uLlllzaLlon aL
Lhe Llme of Lhls wrlLlng.

lL ls cruclal Lo have a fundamenLal undersLandlng of Lhe Lhree daLa Lypes, as well as Lhe
Lhree Lypes of characLerlsLlcs as Lhey are organlzed wlLhln Lhe parameLer space, before
maklng changes wlLhln Lhe parameLer space blnary.

uaLa 1ypes:
1. byte - range of 0 - 233 lf unslgned, and -128 Lo 127 lf slgned
2. wotJ - range of 0 - 63333 lf unslgned, and -32768 Lo 32767 lf slgned
3. looq - range of 0 - 4294967293 lf unslgned, and -2147483648 Lo 2147483647 lf
slgned

CharacLerlsLlcs:
1. Va|ue - conslsLs of a slngle byte, a wotJ (Lwo byLes ln Lhe case of Lhe MoLorola
68k Cu used on Lhe uML), or a looq (four byLes ln Lhe case of Lhe MoLorola
68k..) and may be slqoeJ or ooslqoeJ.
2. Curve - conslsLs of an lndex and a slngle x-Axls comprlsed of byte, wotJ or looq
values.
3. Map - conslsLs of an lndex and boLh x- and ?-Axes comprlsed of byte, wotJ or
looq values.

1he smallesL characLerlsLlcs, and consequenLly easlesL Lo modlfy, wlll be Lhose deflned
as voloes. 1he largesL characLerlsLlcs, and mosL dlfflculL Lo modlfy, wlll be Lhose deflned
as a mops.

8oLh curves and maps have a small wotJ precedlng Lhem, whlch wlll ald ln Lhe
ldenLlflcaLlon of Lhe curve or map. lor example:

0A 00: 10 (0x0A) polnLs on Lhe x-axls, 0 (0x00) polnLs on Lhe ?-Axls = cotve
0E 17: 14 (0x0L) polnLs on Lhe x-axls, 23 (0x17) polnLs on Lhe ?-Axls = mop

1he locaLlon of each voloe, cotve, or mop wlLhln Lhe parameLer space ls glven by an
offset. 1hese offseLs can vary heavlly based on Lhe program verslon and varlanL of Lhe

12
uML. 1he seL of Lables below wlll asslsL ln locaLlng some of Lhe more common/popular
characLerlsLlcs and are organlzed by uML varlanL, Lhen furLher by program number.

AnoLher conslderaLlon Lo bear ln mlnd ls LhaL noL all byLes, words, or longs wlll reflecL
Lhelr common unlLs. MosL wlll have a compuLaLlon applled. 1hls ls usually deflned ln an
accompanylng uAMCS (.A2L) flle, Lhough Lhese flles are noL known Lo exlsL for every
verslon, or noL freely avallable. MosL of whaL has been dlscovered and freely
dlsLrlbuLed ls due Lo Lhe dlllgence and hard work by forum members Lrawllng Lhrow an
old uAMCS flle Lo maLch values from a maLchlng program verslon Lo oLher verslons
lacklng uAMCS flles. unforLunaLely, aL Lhe Llme of Lhls wrlLlng, an explanaLlon of
compuLaLlon meLhods ls beyond Lhe scope of Lhls documenL.

1ab|e 3: commooly-moJlfleJ M5554 ptoqtom vetsloo fooctloool potometet locotloos

0701 1S01 1701 2101 2601 2801
6M1 Sh|ft L|ghts 0x28CB 0x1A7D 0x1AB3 0x1AB3 0x1AB3 0x1AB3
Sport 1hrott|e Sens|t|v|ty 0x4188 0x4174 0x4174 0x4174 0x4174 0x4174
Comfort 1hrott|e
Sens|t|v|ty
0x41B2 0x419E 0x419E 0x419E 0x419E 0x419E
Lng|ne kM ||m|ts 0x03B4 0x03AE 0x03AE 0x03AE 0x03AE 0x03AE
Speed L|m|ts]gear 0x6E70 0x6F00 0x6ED0 0x6ED0 0x6ED0 0x6ED0
Sport Mode Iunct|ona||ty 0x4024 0x4024 0x4024 0x4024 0x4024 0x4024
C|| 1emp Warm-Up L|ghts 0xAC74 0x5454 0x5370 0x5370 0x5370 0x5370

1ab|e 4: commooly-moJlfleJ M5554nl ptoqtom vetsloo fooctloool potometet locotloos

1601 1801 0401 2001 2S01 2701
6M1 Sh|ft L|ghts 0x28C9 0x29CB 0x28CB 0x29CB 0x29CB 0x29CB
Sport 1hrott|e Sens|t|v|ty 0x8228 0x8228 0x8228 0x8228 0x8228 0x8228
Comfort 1hrott|e Sens|t|v|ty 0x8252 0x8252 0x8252 0x8252 0x8252 0x8252
Lng|ne kM ||m|ts 0x03E2 0x040A 0x03E2 0x040A 0x040A 0x040A
Speed L|m|ts]gear 0x8F92 0x8F92 0x92AE 0x8F92 0x8F92 0x8F92
Sport Mode Iunct|ona||ty 0x8026 0x8026 0x8026 0x8026 0x8026 0x8026
C|| 1emp Warm-Up L|ghts 0xB076 0xB076 0xAC74 0xB076 0xB076 0xB076


1he sample below wlll lllusLraLe how Lo enable shlfL llghLs on a L46 M3 wlLh a manual
Lransmlsslon and a prevlously-deLermlned program verslon of 2300 2001" lndlcaLlng lL
ls a MSS34P (2300, see 1oble 1).

llrsL, reference Lhe approprlaLe offseL ln elLher 1oble J or 1oble 4 based on program
verslon. lor verslon 2001, Lhe offseL for shlfL llghL value ls 0x29CB.


13
WlLhln Lhe parameLer space blnary, uslng a hex edlLor, noLe Lhe locaLlon and observe
Lhe byLes aL LhaL locaLlon as lllusLraLed wlLhln llqote J.



I|gure 3: ltoqtom vetsloo 2001, sblft llqbts locotloo lo bex eJltot

ln Lhe case of shlfL llghLs, a value of '00' means dlsabled, '01' means enabled always,
and '02' means enabled wlLh sporL mode only. Change Lhls value Lo '01' Lo enable shlfL
llghLs regardless of sporL/comforL mode, save Lhe flle, and proceed Lo Lhe nexL
modlflcaLlon.

Cnce all modlflcaLlons have been performed Lo Lhe parameLer space blnary, proceed Lo
Lhe nexL sLep, wtltloq (flosbloq) tbe MoJlfleJ lotometet 5poce.
Wr|t|ng (f|ash|ng) the Mod|f|ed arameter Space

AfLer modlflcaLlons Lo Lhe parameLer space have been saved, verlfy LhaL Lhe flle ls sLlll
Lhe correcL slze accordlng Lo Lhe uML Lype wlLhln 1oble 1, and Lhen connecL a baLLery
charger Lo Lhe vehlcle.

ConnecL Lhe C8u ll cable beLween Lhe vehlcle's C8u ll porL and compuLer, Lurn Lhe
lgnlLlon Lo poslLlon 2 (buL do noL sLarL Lhe car), and sLarL Lhe 8MWllash sofLware. lf Lhe
cable ls properly deLecLed, Lhe screen wlll show a green square ln Lhe lower lefL corner
as lndlcaLed ln I|gure 4.



I|gure 4: 8Mwllosb. teoJy to opqtoJe

Cllck on I||e ! kef|ash DML.

A prompL wlll Lhen ask 'Are you sure you wanL Lo reflash your uML? lf noL powered
properly durlng Lhe reflash problems can occur.'



I|gure S: 8Mwllosb pte-opqtoJe wotoloq


13
upon cllcklng 'es', a dlalog wlll be presenLed asklng for Lhe locaLlon of Lhe modlfled
parameLer space blnary flle. LocaLe Lhe flle and press 'Cpen' and Lhe flashlng procedure
wlll commence.

uo oot temove tbe bottety cbotqet, cycle tbe lqoltloo ot ooploq ooy cobles Jotloq tbls
ptoceJote - lL wlll Lake approxlmaLely 2.3 mlnuLes.
I|na||z|ng the rocedure

1o flnallze Lhe modlfled parameLer space wrlLe Lo Lhe uML, Lhe lgnlLlon musL be Lurned
off for approxlmaLely 13-20 seconds, Lhen Lurned on agaln. lf any operaLlonal changes
Lo varlous englne parameLers have been modlfled, lL may be necessary Lo clear Lhe uML
adapLaLlons uslng lnA.
Irequent|y Asked uest|ons

: l have a CalleLLo 1260 and Lhe accompanylng sofLware, can l use Lhls Lool/sofLware
raLher Lhan a modlfled vAC Com cable and 8MWllash?
A: AbsoluLely, however, be advlsed LhaL Lhe CalleLLo sofLware flashlng rouLlnes wlll noL
correcL boLh C8C16 checksums locaLed wlLhln Lhe parameLer space. 1hese wlll need Lo
be manually correcLed prlor Lo flashlng or Lhe uML wlll refuse Lo sLarL.

: uo l have Lo correcL Lhe checksums before flashlng?
A: Cnly when uslng Lhe CalleLLo 1260 Lo wrlLe Lhe modlfled parameLer space.
8MWllash wlll correcL Lhe checksums lnllne on behalf of Lhe user.

: Where do l purchase a proper vAC Com cable, and whaL modlflcaLlons musL be
performed Lo make lL compaLlble?
A: 1hese can generally be purchased vla e8ay, buL conflrm wlLh Lhe seller LhaL lL lndeed
has Lhe l1ul l12328L chlpseL and oot Lhe l12328M chlpseL or problems may ensue. lns
7 & 8 musL be soldered LogeLher lnslde Lhe C8u ll 16-pln head of Lhe cable, Lhen lnverL
Lhe 8l and uS8 slgnals and seL C0 = 8xLLu#, C1 = 1xLLu#, C2 = W8Cn#, C3 = W8Cn#,
C4 = SLLL# uslng l1_rog or Mrog, Lhen save Lhe LemplaLe and flash Lhe cable. More
deLalled lnsLrucLlons are avallable for Lhls onllne.

: l'm sLlll confused, can someone please help me from remoLe?
A: Llkely! uownload and lnsLall 1eamvlewer
(hLLp://www.Leamvlewer.com/en/lndex.aspx) and posL a requesL ln any of Lhe varlous
supporL Lhreads locaLed ln Lhe forum. lL ls very llkely LhaL someone wlll be wllllng Lo
asslsL for free, or for a very nomlnal fee aL mosL.

: My car has been Luned by [xyz} Luner. Wlll Lhls affecL Lhe Lune?
A: no. 1he meLhods presenLed ln Lhls documenL wlll allow you Lo alLer Lhe parameLer
space where Lhe Lune ls locaLed, buL unless you overwrlLe Lhe maps/curves/values used
Lo speclflcally Lune Lhe vehlcle, noLhlng wlll change. AL Lhe very worsL, as long as Lhe
orlglnal blnary was approprlaLely saved, you wlll have a free backup of your Lune Lo
reverL Lo should someLhlng behave unexpecLedly.

: uo l really need a baLLery charger?
A: lL's noL recommended Lo wrlLe Lo Lhe uML wlLhouL one, buL Lhe wrlLe procedure ls
less Lhan 3 mlnuLes, so Lhe llkellhood of dralnlng Lhe vehlcle's baLLery ls very low unless
lL ls already ln poor condlLlon.

: 8MWllash can'L flnd my cable, whaL's wrong?

17
A: Check Lhe Lype of chlpseL uLlllzed wlLhln Lhe cable uslng Lhe l1ul uLlllLles l1_rog or
Mrog Lo ensure lL ls deflnlLely Lhe l12328L-based cable.

: Pow long does lL Lake Lo reglsLer 8MWllash?
A: 1hls depends. Cnce you send Lhe llcense flle Lo blmmersofLware.com, lL wlll be
processed along wlLh your $19 uSu paymenL and a key wlll be lssued LhaL ls locked
speclflcally Lo your vehlcle's vln. 1urnaround ls usually qulck, any addlLlonal quesLlons
regardlng llcenslng should be addressed dlrecLly Lo lnfo[blmmersofLware.com.

: WhaL hex edlLor do you recommend l use?
A: AlmosL any hex edlLor wlll work, Lhe reason no speclflc sofLware ls recommended ls
because Lhe lnLerfaces vary Lo a greaL degree. Some people wlll flnd parLlcular
lnLerfaces more comforLable Lhan oLhers so lL's lmposslble Lo Lell whaL someone wlll
feel mosL comforLable uslng, whlch ls very lmporLanL when maklng flne-gralned changes
LhaL affecL Lhe operaLlon of Lhe englne.

: ls Lhls procedure dangerous? Can l 'brlck' my uML?
A: noLhlng concernlng Lhe MSS30, MSS32, MSS34 and MSS34P uML ls Lrlvlal,
however, Lhe rouLlnes requlred Lo flash Lhe uML are noL conLalned wlLhln Lhe
parameLer space LhaL governs funcLlonal and operaLlonal englne characLerlsLlcs. As
such, Lhe llkellhood of 'brlcklng' Lhe uML ls exLremely sllm slnce Lhe booL secLor and
program space remaln unLouched. AL worsL, Lhe vehlcle slmply won'L sLarL and a reflash
wlll be requlred. Mlnd Lhe flash pseudocounLer flash and baLLery volLage level and mosL
problems wlll be avolded.

: Wlll Lhe sofLware work on Mac?
A: ?es, and no. 8MWllash ls complled for boLh Wlndows and Apple's CS x, however,
LulA8AS-based sofLware, lncludlng lnA, nCSLxperL and Wlnkl, as well as
rogman/SSS and ulS/1lS are excluslve Lo Lhe 32-blL Wlndows plaLform.

: 1he verslon lnformaLlon can'L be found, help!
A: uslng your hex edlLor, search for a LexL sLrlng sLarLlng wlLh '2113' and noLe Lhe 16-
byLe wlde sLrlng, speclflcally byLes 3 - 8 and 9 - 12.

: Pow do l know lf my vAC Com cable has Lhe correcL chlpseL?
A: 8efer Lo Lhe Mrog or l1_rog sofLware uLlllLles provlded by l1ul Lo make Lhe proper
deLermlnaLlon.

Works C|ted|keferences
W|k|ped|a: for cerLaln explanaLlons and dlcLlonary references
Goog|e: dlcLlonary references, general lnformaLlon and baslc search crlLerla
m3forum.net: where Lhe purlLy of Lhls movemenL really Look shape and form
and whose admlnlsLraLlon have gladly hosLed our efforLs wlLhouL lmpedlng
progress. 1he bulk of Lhe lnformaLlon shared on Lhe MSS34 and MSS34P uML
can be locaLed as a sLlcky aL Lhe Lop of Lhe L46 M3 secLlon of Lhls forum.
Cred|ts
1hese are Loo numerous Lo speclfy, as Lhere have been so many conLrlbuLors.
LvenLually, Lhls secLlon wlll be populaLed, for now, please be paLlenL as Lhose
who have donaLed Lhelr Llme and energy Lo Lhls pro[ecL wlll noL go unnamed and
are very well aware of who Lhey are. 1o each and every one of Lhem - 1book
yoo.
kev|s|on n|story
v0.0.1 (p0lar) - lnlLlal drafL release Lo proof/edlL/LesL
v0.0.2 (p0lar) - revlslon wlLh mlnor correcLlons, grammaLlcal modlflcLlons, more
clarlflcaLlons
v0.0.3 (p0lar) - revlslon wlLh more mlnor correcLlons, addlLlon of more daLa Lo
1able 1 (lncludlng MSS30 and MSS32 verslon lnformaLlon) as well as Lhe
beglnnlngs of MSS30 and MSS32 lncluslon ln Lhe process slnce Lhelr archlLecLures
are exLremely slmllar.