View Single Post
Old Sun, Jan-05-2014, 07:11:45 AM   #4263
Join Date: Dec 2010
Posts: 11,908
In the garage:
Reputation: 11 terraphantm is on a distinguished road
Location: Philadelphia

United States

Default Re: Comprehensive MSS54/MSS54HP DME Information

You've got it

On a completely unrelated note, I figured out how to turn off the checksum verification.

Set 0xF and 0x400F/800F to a value such that the 7th bit is not "1" (so from 0 to 7F). I set these bits, set the actual checksums to FFFF, drove around, and all is good. No error codes, no drivability issues, or anything.

Got the idea from that beta MSS52 DME that someone found earlier.

If you look at the data from the A2L, you'll see these definitions for those first few bytes

CharacteristicOffsetSize (bytes)Optional Definitions
Motor Type0x7101=S40,04=S53,0C=S54,20=S62B36,30=S62B50
Canstand0x9110=CAN 10H,11=CAN11H,27=CAN27H
Region0xA101=Europe,02=United States,04=Gulf States
KR0xB100=KR Inactive,40=KR HIP,80=KR DSP
DME Type0x101{unrestricted}
Operational Mode0x11100=Fz-Betrieb,01=Pruefstand,02=Rolle
(table ripped off from p0lar)

It seems the A-Muster, B-Muster, C-Muster designations are for internal purposes only. The actual code only checks that last bit. The beta code that was found earlier was "C-muster" fwiw.

I think "muster" is a German industry thing. Basically alpha, beta, release candidate -> final (serienstand). Makes sense that they don't really need to bother with the checksums for non-final code.

I'm not very good with disassembly, but to me it looked like only the checksum checks are bypassed. I'm not sure if there are other routines that would be bypassed in what is basically beta code. Maybe some protections are also disabled? I'm also not sure if it's just the data checksum, or everything.

Last edited by terraphantm; Sun, Jan-05-2014 at 07:29:56 AM.
Jump to top terraphantm is offline   Reply With Quote