Tuning the MS45.1

[rkneeshaw]

I felt this was worth sharing as it may help out other members.

The MS45.1 tuning "community" if you will call it that is a highly political and volatile space. I've spent the better part of 2 years trying to peel back the curtains and make sense of the landscape. What I explain here is my perception and story, and of course if there are any tuners out there that want to point out corrections I will gladly make them.

When I first installed my ESS Twin Screw Stage 2 (TS2) kit back in 2015 I was never happy with the tuning. I started with trying to work with ESS, naturally, but after constant back and forth I never really got anywhere. Eventually, growing frustrated with the apparent lack of either knowledge or support for the MS45.1 tune, I started looking elsewhere, even considering trying to tune the car myself.

It was at this stage it became apparent that the tuning world for the MS45.1 is a very murky cloudy place. There's no clear answer for who knows everything about this DME and who is the best choice to tune the car. Around the internet you will find people recommending Nick G, Frank Smith (at TTFS), Karl at Activ Autowerk, George Gelashvili, Market motorwerk in Atlanta (not sure who specifically they use as a tuner), Kassel performance (not sure who specifically they use as a tuner), TRM tuning (not sure who specifically they use as a tuner), and while nobody has recommended him specifically to me Jim Conforti is a tuner as well, best known for his product called the Shark Injector. At some point someone somewhere has labeled some of these a wizard and very good, and then at the same time there are almost just as many people I’ve talked to that will say the opposite, that “so and so” makes terrible tunes or don’t know what they are doing and “you should talk to so-and-so instead”.

And to be fair, please don’t take everything I say here about this group of tuners as applying to every name I mentioned above. Some of these guys are willing to talk about what they do and share information and are a pleasure to deal with, and others are the opposite, highly protective of anything they do, and others are in between. Which is which will depend on who you talk to and you will receive mixed reviews, which yes, is frustrating too.

I’ve also heard stories from some of these tuners about each other as well. Some have claimed they share maps and information with other tuners in a "scratch my back and I'll scratch yours" type fashion. Some seem to only share maps with only 2 or 3 others who are "like minded". Others claim not to know of the others existence, which I highly doubt. Some of them have figured out certain maps, sold it to other tuners, and then when those tuners became successful threatened litigation against them complete with attorney's and everything (which apparently never went anywhere?).

To be honest, there is so much secrecy and politics at play that I truly do not know what to believe among the tuners that tune the MS45.1 anymore. It's a nasty cut throat environment. It would not even surprise me if I’ve been fed misinformation as some of these guys try to hold on to their “secret sauce” for these 15 year old cars as long as they can.

Among these tuners it has been explained to me that typically they will use software such as WinOLS or RomRaider to tune a car and with it they have typically paid for a package of maps that identify where in the binary code you can change values for different parameters. And I can understand that if I’m a tuner and paid a few thousand bucks for these maps that I wouldn’t be thrilled about it eventually becoming public domain knowledge, but, they paid for an advantage and they got it. They bought these maps when they weren’t available publicly and it allowed them to provide a service that nobody else could at the time. They would be foolish to think that advantage would last forever though. It's a mistake for the tuners of the MS45.1 to consider their package of known maps a permanent trade secret.

Aside from simply buying the pack of maps for the MS45, a few of these tuners legitimately know how to disassemble the binary back into machine code and thus have an advantage. Well, at least it is an advantage during the period of time that the availability of defined maps is not commonly available or very well developed. At this point I’m only aware of a guy named Ruben, Jim Conforti and to some extent Nick G that do this commercially, but there are others too.

Beyond the “commercially available” tuners, I am aware of a couple hobbyists that are interested in deconstructing the MS45.1 DME so that they and others can themselves tune a car with this DME. There are at least three that I’m aware of, and to my knowledge they do not work together and seem to have started in different places. They do this for fun in their spare time. They are working to disassemble the MS45 and create maps that we could use for tuning. One of them I’ve talked to seems very sharp and has been able to disassemble the binary to machine code and found advanced capabilities such as enabling the OEM sport mode, for example, as well as recreate the RSA encryption keys and checksums.

Politics and philosophy aside, to tune the MS45 you need software to edit a tune file (e.g. WinOLS, RomRaider, TunerPro, etc), a set of maps that define where in the binary file you can change values (Damos, A2L, XDF, etc), and then you need to have a way to read/write that tune (which is a binary file) to the car. These components aren’t always included in the same package. For example, WinOLS and RomRaider and bimmereditor and probably tunerpro can take a binary file and tune it, but you still need a package of maps and you also will need a way to get the tune onto the car. With the MS45 there is RSA encryption that has to be dealt with to do that over the OBDII port so only a few (and probably expensive) pieces of software can do it. Or you can remove the DME from your car every time you want to do a read/write operation.

I am only aware of the following means to read/write from the MS45.1:

1. BDM (remove DME from car, done on a bench)
2. PASoft (can at least read the DME over OBDII but is VERY slow, took me 2 hours to get a full dump of the DME)
3. PowerGate 3 (can read/write over OBDII)
4. Alientech Kess (can read/write over OBDII)
5. Frieling-Racing has software they sell to tuners that can read-write over OBDII, and the stuff I’ve used as a consumer works great but I don’t know if they sell to just anyone or if you have to be a tuner, nor do I know how expensive it is.

If there are others, please let me know and I can update this list.

I’ve just learned too that Jim Conforti owns a patent on reading from a car over OBDII and writing back a configuration change (http://pat2pdf.org/pat2pdf/foo.pl?number=8458689). This may only apply to the shark injector, but, this is something to consider and should be known.

This has been such an exhausting and frustrating experience I’ve considered trying to learn powerpc machine code used by the Siemens MS45.1 DME and try to deconstruct it myself. If I would have started that two years ago I might be somewhere by now. While I have a limited programming background I haven’t dug into the machine code layer so that would be a lot of work for me. My car is something I’m very passionate about and this has been such an irritation for so long I still consider this as an option at some point.

But currently I’m working with someone who I think can get this right. And if they do, I’ll let you know who it was that was able finally get my tune running the way I think it should: OEM like drivability with smooth and linear throttle response and as much reliable and safe power as possible. Its why I chose the supercharger kit I did to start with and I truly believe it’s possible, and I intend to prove it, somehow, someday.

For those interested in some of the technical details, here are some good threads with some tidbits of info in them:
https://forum.e46fanatics.com/showthread.php?t=1058092
https://forum.e46fanatics.com/showthread.php?t=1162921
https://forum.e46fanatics.com/showthread.php?t=1169529

[danewilson77]

Thanks for sharing

Sent from my S8+

[nextelbuddy]

wonderful information. great detective work you did there. so ahrd to believe how old the software is but how secret and hard it is as well still.

it amazes me how much easier MSS54 tuning is over MSS45.1 at least in the terms of publicly available software to allow end users to flash and update their DMEs over OBDII.

[rkneeshaw]

And MS43 is blown wide open. The barrier that has held up MS45.1 development (or at least publicly available info) is because BMW started using RSA encryption with the MS45.1 DME, which means someone has to crack that before they can read/write over BDM and save updated checksums after changing tune values.

But these cars are like 15 years old now, so its a shame there isn't more openly shared info on them.

Now I think thats going to change because there are a few more hobbyists that have cracked the RSA encryption, and someone just posted some Damos/A2L files for the MS45.1 the other day, so we may finally see this thing split wide open soon.

[BMWCurves]

And MS43 is blown wide open. The barrier that has held up MS45.1 development (or at least publicly available info) is because BMW started using RSA encryption with the MS45.1 DME, which means someone has to crack that before they can read/write over BDM and save updated checksums after changing tune values.

But these cars are like 15 years old now, so its a shame there isn't more openly shared info on them.

Now I think thats going to change because there are a few more hobbyists that have cracked the RSA encryption, and someone just posted some Damos/A2L files for the MS45.1 the other day, so we may finally see this thing split wide open soon.