How to Clone Siemens MSDxx ECUs for BMW SSM vehicles

May 24, 2019 by wp-admin

How to: clone Siemens MSDxx (MSD80, MSD81, MSD85, MSD87, MSD85.4) ECUs for BMW SSM vehicles using original KTAG ECU Programmer.

To use this protocol of communication you have to remove and open the ECU. It is a risky operation, to be done with great care and caution to avoid damaging the ECU beyond repair.g
After opening the ECU and before proceeding with reading and/or programming, you are strongly advised to reconnect the unit to the vehicle and start the engine, to make sure it still works.
To use this protocol you also need to connect to the ECU connector through a cable, and solder one or more wires to the programming pads.
Incorrect or poorly made connections and solderings may damage the Car ECU Programmer, often beyond repair.
Under no circumstances we shall be liable for any damage caused to the ECU during the opening, due to connections and soldering that do not comply with the instructions provided in this manual. If you are using KTAG, you are at your risk.

Notice

When writing the modified file, the checksum of the data may last several minutes, depending on the performances of your computer.

The first time you work on the ECU, before opening the ECU, you need to retrieve the protection password. Follow the instructions provided for each model to connect to the connector.

Retrieve Password

1.Remove the ECU from the vehicle;
2. Connect to the ECU connector to retrieve the password, according to the pinout provided for each model connection instructions:

* Plug-in 986: SIEMENS MSD80 IROM TC1796

Material needed:

* Cable 14P600KT02

a.Connect the cable 14P600KT02 to the ECU connector according to the pinout below:

ktag-siemens-msd80-2Pin Color Description
Pin 1,1    Red       +12V
Pin 4      Noir       Ground
Pin 22    White    CAN-H
Pin 44    Green    CAN-L

b.Click on the Read Password button.

* Plug-in 989: SIEMENS MSD85 IROM TC1796

Material needed:

* Cable 14P600KT02

a.Connect the cable 14P600KT02 to the ECU connector according to the pinout below:

b.Click on the Read Password button

* Plug-in 991: SIEMENS MSD81 IROM TC1796

Material needed:

* Cable 14P600KT02

a.Connect the cable 14P600KT02 to the ECU connector according to the pinout below:

b.Click on the Read Password button

* Plug-in 992: SIEMENS MSD87 IROM TC1796

Material needed:

* Cable 14P600KT02

a.Connect the cable 14P600KT02 to the ECU connector according to the pinout below:

b.Click on the Read Password button

* Plug-in 1012: SIEMENS MSD85.4 IROM TC1796

Due to the ECU high power consumption, you have to supply the K-TAG with an external battery or a stabilized power supply (+12/24V – 5A).

Material needed:

* Cable 14P600KT02
* Battery supply cable 144300TALI
* External Battery or regulated power supply (+12/24V – 5A)

a.Connect the cable 14P600KT02 to the ECU connector according to the pinout below:

b.Connect the cable 144300TALI to the tool and the external battery;
c.Click on the Read Password button.

3. Proceed with the normal operations to read and write.

Recommendation

1.Open the ECU, taking care in not damaging the parts inside;
2.Reconnect the ECU to the vehicle and start the engine, in order to make sure that it is still working and has not been damaged in the opening;
3.Remove again the ECU from the vehicle;
4.Select the right plug-in;
5.Always make a backup copy of the ECU before Reading and / or Writing.

Instructions

1.Connect to the ECU according to the pinout provided for each models:

* Plug-in 986: SIEMENS MSD80 IROM TC1796

The pins Boot can be found on the right side of the ECU.

Available connection mode
Click on the selected mode for the instructions.

? Direct connection

Material needed:

* Cable 14P600KT02
* Solder wire

a.Solder a wire to the Boot pin shown in the picture;
b.Solder a wire to the two CNF1 pins shown in the picture;

c.Connect the cable 14P600KT02 to the ECU connector according to the pinout below

d.Remove all soldered wires before reinstalling the ECU on the vehicle.

* Plug-in 989: SIEMENS MSD85 IROM TC1796

The pins Boot can be found on the right side of the ECU.

Available connection mode
Click on the selected mode for the instructions.

? Direct connection

Material needed:

* Cable 14P600KT02
* Solder wire

a.Solder a wire to the Boot pin shown in the picture;
b.Solder a wire to the two CNF1 pins shown in the picture;

c.Connect the cable 14P600KT02 to the ECU connector according to the pinout below:

d.Remove all soldered wires before reinstalling the ECU on the vehicle.

* Plug-in 991: SIEMENS MSD81 IROM TC1796

The pins Boot can be found on the right side of the ECU.

Available connection mode
Click on the selected mode for the instructions.

? Direct connection

Material needed:

* Cable 14P600KT02
* Solder wire

a.Solder a wire to the Boot pin shown in the picture;
b.Solder a wire to the two CNF1 pins shown in the picture;

c.Connect the cable 14P600KT02 to the ECU connector according to the pinout below:

d.Remove all soldered wires before reinstalling the ECU on the vehicle.

* Plug-in 992: SIEMENS MSD87 IROM TC1796

The pins Boot can be found on the right side of the ECU.

Available connection mode
Click on the selected mode for the instructions.

? Direct connection

Material needed:

* Cable 14P600KT02
* Solder wire

a.Solder a wire to the Boot pin shown in the picture;
b.Solder a wire to the two CNF1 pins shown in the picture;

c.Connect the cable 14P600KT02 to the ECU connector according to the pinout below:

d.Remove all soldered wires before reinstalling the ECU on the vehicle.

* Plug-in 1012: SIEMENS MSD85.4 IROM TC1796

The pins Boot can be found on the right side of the ECU.

Due to the ECU high power consumption, you have to supply the K-TAG with an external battery or a stabilized power supply (+12/24V – 5A).

Available connection mode
Click on the selected mode for the instructions.

Direct connection

Material needed:

* Cable 14P600KT02
* Solder wire
* Battery supply cable 144300TALI
* External Battery or regulated power supply (+12/24V – 5A)

a.Solder a wire to the Boot pin shown in the picture;
b.Solder a wire to the two CNF1 pins shown in the picture;

c.Connect the cable 14P600KT02 to the ECU connector according to the pinout below:

d.Connect the cable 144300TALI to the tool and the external battery;
e.Remove all soldered wires before reinstalling the ECU on the vehicle.

2.Select the right plug-in;
3.Make reading and programming

How to Read – Backup – Write using a Ktag Master tool

Backup: To make a full backup of the ECU, select Backup in the Reading box and click on Read.

Reading: Remove the check mark at the Backup option, select the component you want to read and then click on Read.
Notice: The term Maps at the side of the component indicates where the maps for engine control are stored.

Writing: Remove the check mark at the Restore option, select the component you want to write and then click on Write.
Notice: The term Maps at the side of the component indicates where the maps for engine control are stored.

Restore: To restore the backup file to the ECU, select Restore in the Writing box and click on Write.

Kess V2 V5.017 Ksuite 2.47 Version Software Feedback

April 28, 2019 by wp-admin

Ksuite 2.47 software adds many working protocols comparing old version. Here’s the customer test feedback on KESS V2 EU clone version 2.47 K-suite.

For sale Ksuite 2.47 that works with kess FW 5.017
Added:
CATERPILLAR A5E2 P 549
VOLVO 1.6 /2.0 CONTINENTAL SID807 P 489
FORD TRUCK FPT ENGINE BOSCH EDC7UC31 KLINE P 548
HUSQVARNA KEIHIN CAN P 554
ALL SIMOS 18 18.1 18.2 NEW GENERATION 4.5MB
Some old protocol fixes
CHECKSUMS BUG FIXES

Note:
Ksuite 2.47 work only with kess v2 5.017. or Kess 5.028, not KTAG…software activation is for every computer and there is some new protocols.

Success:
VW Crafter Bosch EDC17CP20 Tricore External read-write OK!
c220 w204.. delphi CRD3…read write ok..
w212 220cdi CRD 2.16 read write obd ok..
VW Golf 5 EDC16U1 OK
Sharan EDC16U31 OK
Passat PCR2.1 Write OK (ECU was already unlocked)
Alfa 147 ME7.3.1 OK
Audi A6 4G 2012 EDC17cp44 Obd Write ok!
Edc17C46 writing on obd TESTED !
Renault scenic 1,5dci 2007 delphi ecu ddcr read/wirte ok!
Vag edc15 read/write ok!
Bmw ms42 read/wirte ok!
Bmw ms43 read/write ok!
Opel Astra H 1,7cdti 2008 81kw denso ecu Read/write ok
Bosch me 7.1 golf 4 2,8 24v AUE engine read/write ok!
Edc16c31 bmw read/write ok!
Edc16u34/31 vag read/write ok!
Delphi (mercedes sprinter om651) read / write by obd
Ford fiesta 2008 1.6 tdi edc1634 read write by odb
VW passat 1.9tdi PDI read/write by obd
Mercedes w211 om646 read/write by obd
new beetle tdi 105cv 1.9tdi 2004 edc15p read and write ok
pcr2.1 ok POLO TDI 6R 9CV READ OK WRITE PERFECT, full by obd2
bmw dde4.0 Read write ok!
Mercedes-Benz CLS 350 CDI BlueEFFICIENCY 4Matic 7AT with Bosch EDC17CP46 was readed with Kess v2 2.34 Tricore and written with Kess 2.47 Tricore
Porsche 997 3.8S Year 2006 Bosch ME7.8.x CARTRONIC WRITE PERFECT OK by k-line test in bench
BMW 320 E46 EDC16C31 OK
Ford Focus TDCI 1.6 EDC16C36 OK
Peugeot 307CC 1.6/PETROL ME 7.4.5 OK
Volvo EDC16C31 read-write on K-line…TESTED !
MED17.1 2.0 TFSI Audi A5 tested without problems (VR)
EDC16CP34 3.0 TDI without problem
EDC17C64 Skoda Octavia without problem (VR)
Mercedes Sprinter 906 2008 edc16c31 Read write obd OK!
BMW Bosch EDC16+C35 via CAN Read/Write OBD ok

Volvo S40 continental SID803A read/write ok
BMW E92 M3 2008 Continental MSS60 read and write over OBD work without a problem
Audi A4 Engine: CABB 118 kW (160 HP) 1.8 l Bosch MED17.5 read over OBD OK!
Audi A5 2008 Coupe EDC17CP04 CAPA 176 kW (240 HP) 3 l Read over OBD OK

Vag dq250 read / write no problem
VW Golf 6 GTD edc17c46 Tprot tricore Read and write without error CRC OK
VW Tigaun EDC17C64 GPT Tricore Read and write without error CRC OK
SEAT LION EDC17C64 GPT TICORE Read and write without error CRC OK

Mercedes B180 CDI 2010 EDC16C32 R/W OBD….OK !
Audi RS6 4F 5.0 TFSI V10 MED9.1 BUH
Read Master ECU OK -OBD
Write Master ECU OK – OBD
Write Slave ECU OK – OBD
When you write master ECU, fan are running, you need a good battery charger

test write edc17cp14 with tp 2011 write by obd use protocol 501 Work fine
Chevrolet Aveo 1.6 liter. 2012 year Delco E83. Read and write ok

test write edc17cp14 with tp 2011 write by obd use protocol 501 Work fine
Chevrolet Aveo 1.6 liter. 2012 year Delco E83. Read and write ok
Ford Mondeo 2.0L 2010 year Automatic transmission success
Toyota Corolla 1.6 automatic transmission success

Failed:

porsche 958 turbo 2011 SIEMENS SDI8 read is by Virtual read ,for ME impossible
write i have message CHANGE STATUT IMPOSSIBLE
NO SUCCES MAYBE ANTI TUNING

BMW E70 X5 Bosch EDC17CP09 Bootloader Tricore Protocol 226
Read OK
Write Not OK, problem with checksum correction

ksuite 2.47 can only write EDC17C74 protocol 510

Kess V2 immo off Yes or No

July 28, 2018 by wp-admin

Here are handy tips and guides for you guys who are trying to do immo off by kess v2 ecu master.

What is immo off? And what is partial immo off?

IMMO off is simply a modded dump of the ecu flash or eeprom or separate immo box to tell the car no immobilisers function

In some immo files you see the letters T or P . T means total, so immo off/disabled. P stands for Partial that one is used to make the ecu virgin and to reprogram new keys (if I am not wrong). the car is drivable only if the immobilizer is connected and running.

used when diagnosing non start car problems not a good idea but helps in trouble shooting.

another place is used when key matching messes up to determine if it is immobilisers or something else playing up

Immo off: should you use kess v2 or ktag?

First. Look here. I have collected some questions and answers from users.

Q: I was wondering if it’s possible to immo off a read or backup read done by a kess v2. need ktag to read separate files?

A: Ktag should work, almost impossible to separate file read by KESS

Q: Flash read by KTAG will be full flash and not only maps as kess ?

A: With ktag you have full eprom and maps.(flash).
With kess you read only maps.

Q: Don’t i need full flash for immo off and not just maps ?

A: Most you need eeprom read. You need ktag for that

Q: when i load a ecu file with kess v2 via obd? Can i turn off the immo in this file ?

A: Some ecus you can’t because you need desolder eeprom some others you can’t no immo off and others immo in flash you can turn off

Q: Any chance to do immo off with Kess?

A: Either you have bad read or its a slave file, nothing we can do with this file …
and you need Ktag or Galletto to make full read, OBD read can’t do immo off.

So, for immo off, Ktag is confirmed to work and Kess yes or no is a question.

Reason why some people think Auto ECU Programmer Kess V2 is not for immo off:

KESS that is ecu programmer, you can read and write ecu , but it does not modify files.

But actually, is it possible to do immo off using Kess V2?

It Depends; on the vehicle make and model!

Because some vehicles have an EEPROM which runs the security function while others which only have a flashfile with a rolling code embedded there in, depending on 2 or 3 other member but mostly gateway Ecu on transponder or drive authorization mechanism.

So you need to know how vehicle security of the respective vehicle ecu works. Some vehicle you can use Kess V2 (can only read and write part of flash(at times not everything therein)) then you need a hex editor to edit the sectors therein either to make key(if you know key ID) or immo off.

There are too many old ecus with immo off in flash, you could do it with kess, but too many others need work in eeprom so will need another tool or even desolder, for those in mcu need proper tools.
Regards.

Tested vag edc15vm! Able to write immo off with Kess V2 from www.obd2tool.com!

Good luck!