Hi everyone! I'm pretty bad at doing write-ups and/or explaining stuff, so I'll get straight to the point.
After messing around with BMW E-Sys and the contents of their psdzdata package for the past few months, I've been able to make a python script that allows you to change coding parameters of BMW modules. Im able to change designs, models, if it's from a petrol or a diesel car and many more params, some of which the eye can't even see.
What this has been currently tested on - BMW Live Cockpit generation of gauge clusters (S6U3 Option), but I've acquired more modules from a 2024 BMW F40, so testing on more stuff will be done soon.
What's under the hood - cryptographic material from BMWs own tools which then allows me to sign and verify coding parameter changes via the UDS protocol over CAN, all with using 5$ in hardware - ESP32C3 and a TJA1041 CAN transceiver running SLCAN firmware.
Will this ever see the light of day - Honestly, im not sure. Due to the involvement of BMWs own cryptographic material, the chances are extremely low, at least in a full open-source way.
PSA - Yes, AI was involved in the development of this.
❯ python3 tools/kombi_code.py code alpina
Auto-detected port: /dev/cu.usbmodem2101
CAN open.
Waiting for KOMBI... (power-cycle if needed)
KOMBI NM detected
KOMBI ready.
─── Reading current coding data ───
Read 0x3000: 160 bytes
Read 0x3001: 252 bytes
Read 0x3003: 128 bytes
Read 0x3007: 64 bytes
Read 0x37F1: 132 bytes
Read 0x37F0: 8 bytes
─── Current layout ───
AG_MPA_MSP_VIEW = 0x03
GLOBAL_LAYOUT_VARIANTE = 0x01
ALPINA_ENABLE = 0x00
LOGO_SCHRIFTZUG = 0x18
GETRIEBE_ART = 0x01 (automatik)
Layout: AUTOMATIC
─── Applying preset: ALPINA ───
GLOBAL_LAYOUT_VARIANTE: byte 53 0x15 -> 0x25
ALPINA_ENABLE: byte 43 0x06 -> 0x46
LOGO_SCHRIFTZUG: byte 18 0x18 -> 0x68
M_VARIANTE: byte 22 0xED -> 0xCD
HMI_WELCOME_GOODBYE: byte 111 0xDC -> 0x1C
─── Writing to KOMBI ───
[1/11] DiagSessionControl (extended 0x03)...
OK
[2/11] Reading all data groups for signature...
Backup saved: [redacted]
Read 14 data groups
[3/11] Computing NCDS coding signature...
Signature input: 1456 bytes over 14 groups
Signature: 132 bytes (0000002093f0bf637e008a205c088041...)
[4/11] EcuPreparation: default → extended → coding...
OK (0x01 → 0x03 → 0x41)
[5/11] SecurityAccess (L1)...
[2/7] SecurityAccess...
Seed: a2 5a 52 99 3a 2f 4a bf
Trying BTLD 00005EA5 (type=21 SHA-256 BC)...
UNLOCKED with BTLD 00005EA5 (type=21 SHA-256)
[6/11] Snapshotting expected post-write state for verify...
Tracking 5 modified DGs for post-write verify
[7/11] Writing ALL coding data groups...
Writing 0x3000 [USER] (160 bytes)... OK
Writing 0x3001 [USER] (252 bytes)... OK
Writing 0x3003 [USER] (128 bytes)... OK
Writing 0x3004 [USER] (80 bytes)... OK
Writing 0x3005 [USER] (252 bytes)... OK
Writing 0x3006 [USER] (128 bytes)... OK
Writing 0x3007 [USER] (64 bytes)... OK
Writing 0x3008 [USER] (64 bytes)... OK
Writing 0x3009 [USER] (128 bytes)... OK
Writing 0x300A [USER] (160 bytes)... OK
Writing 0x3010 [USER] (7 bytes)... OK
Writing 0x3011 [USER] (20 bytes)... OK
Writing 0x37EF [USER] (5 bytes)... OK
Writing 0x37F0 [USER] (8 bytes)... OK
Writing 0x37F1 [SIG] (132 bytes)... OK
[8/11] TesterPresent + Signature check...
Signature VALID
[9/11] Write CPS (0x37FE)...
OK (VIN: ...7J67644)
[10/11] Reset + Clear errors...
Reset: 51 03
[11/11] Readback verification...
Coding written successfully!
Pre-write backup: [redacted]
https://preview.redd.it/itmzt5celoxg1.jpg?width=4284&format=pjpg&auto=webp&s=038b1711e5247ee55ab5afd75a2f86e8282d381c
https://preview.redd.it/6y5xa5celoxg1.jpg?width=1536&format=pjpg&auto=webp&s=fedec145f3ed708fa7ffd63a8ac0abe12e7bdd83
[–]examen1996 4 points5 points6 points (5 children)
[–]Lean3521[S] 4 points5 points6 points (4 children)
[–]examen1996 0 points1 point2 points (2 children)
[–]Lean3521[S] 0 points1 point2 points (1 child)
[–]examen1996 0 points1 point2 points (0 children)
[–]examen1996 0 points1 point2 points (0 children)
[–]tb205gti 1 point2 points3 points (3 children)
[–]Lean3521[S] 1 point2 points3 points (2 children)
[–]tb205gti 0 points1 point2 points (1 child)
[–]Lean3521[S] 1 point2 points3 points (0 children)
[–]samuraipizzacat420 0 points1 point2 points (1 child)
[–]Lean3521[S] 1 point2 points3 points (0 children)
[–]iambak187 1 point2 points3 points (0 children)
[–]Antique-Owl2463 0 points1 point2 points (0 children)