View Single Post
      09-02-2019, 03:15 AM   #3
Private First Class

Drives: 335i (2007 e92) 6MT
Join Date: May 2017
Location: Southern California

iTrader: (0)

Activating locked features (Navigation):
Voice control, navigation, sat radio, bmw apps and Arabic language (why lock only this language??) are locked to the native VIN of the CIC; a method must be chosen to unlock them. So I went with the CIC patcher method, which is the most flexible but also the most difficult. Before I explain how, here are the four methods:

Buy all new certificates - Legally purchase all the features for your VIN. Pros: legal, as OEM as it gets. Cons: expensive; the cost of buying all the certificates might be enough money to buy a newer model car instead...

Hardware emulator - a CAN filter sitting between the CIC and the rest of the CAN topology that prevents the CIC from successfully checking the VIN. Pros: straight-forward hardware install, easy map updates, no mucking around with CIC software. Cons: costs money (and shipping time), requires cutting CAN wires on factory harness if you don't pay for the more expensive plug-and-play harness, cannot add certificates that the original VIN did not have (locked features e.g. sat radio, bmw apps).

Script activation - a small shell script (written by intel123) that runs at boot to activate all the certificates that are locked due to mismatched VINs. Pros: Free, super easy to install. Cons: Cannot add certificates that the original VIN did not have (locked features e.g. sat radio, bmw apps). Still requires a working coding environment with FSTool2 or equivalent to update maps, unless you are willing to cut the CAN wires.

CIC patcher V2 - a small shell script (written by intel123) that modifies how the CIC reads and accepts the root security certificate, allowing you to upload forged certificates. Pros: Allows you to add all the certificates available, including certificates that did not come with the donor car. Cons: Only works CICs from USA or ECE regions running C1A firmware. Additionally, the CIC will now reject the genuine certificates from the donor car, so this is a one-way street (unless you flash it back to stock C1A or replace /mnt/HBpersistence/rcert.swt).

I went with the patcher, which should've been easy but took me a surprising amount of research and trial-and-error. First I couldn't get the software, then I couldn't get it to load, then I couldn't get the CIC to accept any certificates, then I got certificates 17, 19, 1B working, but couldn't get 9C, 6F, etc etc. Weeks went by.

So... in the end, this can be complicated, or it can be easy. The easy way:

1. Get a working coding environment (working EDIABAS). If you've made it this far and have a working NCS Expert with working SP-Daten files, you're good to go here.

2. Use Tool32 to set the VIN in the CIC to your car's VIN. Note the tutorial incorrectly says 17 alphanumeric digits but it's actually 18 digits (17 for the VIN and 1 for the checksum).

3. Get and install Java Runtime Environment 1.5.0 update 22 (Jave SE Runtime Environment 5.0u22). (Some tutorials say 1.4.0 is fine, but I found FSTool2 to be buggy with 1.4.0.)

4. Get FSTool2 version 02.02.00. Look for the installer file called setup_fstool2_02.02.00.exe. Please don't bother with any other version. Run the installer, it will install CarServer, FSTool2, and extra EDIABAS configuration files. It will handle 6F and 9C. BTW if you install it and try to run it without Java, it will not give any errors. It just won't run.

5. Find BMW CIC Patcher v2 by intel123. You will find it on the first post of a super long (80+ page) forum thread. Keep this thread open. Unzip the files. There are 4 folders, 00_PRIVATEKEYS, 01_PATCHER, 02_CERTS and 03_FSC_TEMPLATES.

6. Copy the file from 01_PATCHER\USB_AUTORUN onto the root folder of a USB drive, and plug it into the glovebox USB (the one directly connected to your CIC). It will run, and the CIC will reboot.

7. Go to CIC patcher v2 thread post #746 for the pdf guide on installing certificates for e90 (cic_fsc_Ex_en.pdf). It is NOT complete enough to use, but I will refer to it in a second.

8. Run FSTool2 using the desktop icon. Go to Configuration (the last tab), set the language to English. Scroll to the bottom. Under "Certificates" set FSCS, Root and Sig certificates to 02_CERTS\fscs.der, 02_CERTS\root.der and 02_CERTS\sigs.der, respectively. Under "Keys" set the private key to 00_PRIVATEKEYS\fscs.der. Go to Connection (first tab) and hit Connect.

9. Go to Parameter, and set Diagnose address to 63, Appl.-Nr. to 19 (or whatever certificate you are uploading), Upgrade index to 1, and VIN to the last 7 digits of your car's VIN.

10. Go to Enabling Codes. Click load from file, go to 03_FSC_TEMPLATES, open 00190001.fsc. Click Edit. Put the last 7 digits of your VIN in "VIN short." Click Sign, click Check signature, click Save as (not needed but you can sign all the certs ahead of time!) and click Apply.

11. Go to SWT Develop. (Open the PDF guide from step 7 above! Jump to page 4, do step 6 through step 12.) Click STORE_SIG_CERT, click =>. Click CHECK_SIG_CERT, click =>. Click Execute, look for two successful statuses. Remove STORE_SIG_CERT and CHECK_SIG_CERT using the <= button. Click SET_VIN, click =>, click Execute, look for success, remove using <= button.

12. (PDF guide steps 13-14) STORE_FSCS_CERT, =>, CHECK_FSCS_CERT, =>, STORE_FSC, =>, CHECK_FSC, =>, Execute. Look for four successes.

13. Repeat Step 10 above with 001B0001.fsc. (Load, Edit, Sign, Check signature, [Save], Apply) Check tab Parameter to make sure the application changed from 19 to 1B (old versions of FSTool2 do not auto-update). Now repeat Step 12 above (STORE_FSCS_CERT, =>, CHECK_FSCS_CERT, =>, STORE_FSC, =>, CHECK_FSC, =>, Execute). You do not need to repeat step 11. Repeat steps 10 and 12 for all the certificates you would like to insert (which certificates do what are on page 8 of the PDF guide).*

14. Reboot the CIC. You could a. let the car sit for a bit, b. disconnect / reconnect the battery, c. FA/VO code the CIC (SG_CODIEREN), or d. login with telnet and run "slay HmiMain" - I'm not covering the latter in this DIY though.

15. Assuming you installed at least the 19 and 1B certificates, Navigation should now be selectable. BUT when you select it, it will ask you for an activation code. Pull your 1b file via USB stick**, and use it in Jaeger's FSC generator. If you know what year the maps are in the CIC, you can generate that specific year, otherwise just generate a lifetime code and use that.

Done! Navigation should now be working. You can check your other certificates individually in FSTool2 using GET_STATUS, or all at once using a tool called FSC Tools.

*Inserting certificates only unlocks the feature for cars that are programmed to have the feature, it doesn't add the feature. So if you want voice control for example, you do need certificate 17, but you need to also add the hardware (microphone to headunit - different from the bluetooth microphone that goes to the TCU/MULF/Combox, as well as activation button e.g. multifunction steering wheel $249) and code in $620 (and $249 I think) to CAS/NFRM and default code your CIC. BMW apps requires certificate 9C, a combox, 6FL or 6NF and coding in $6NR (see next post). Satellite radio requires certificate 6F, running an extension to your satellite prep in the trunk (or a full antenna to your shark fin if you don't have prep) and coding in $693->$655 (delete 693, add 655). Disclaimer: I have not tried adding satellite radio to my car, and I already had voice control and TCU.

**An aside - You don't need an IP connection to your CIC for this DIY, unless your CIC is old enough that the USB script fails. If you're getting the generic VIN, you will need to telnet or FTP into the CIC to get your 1b file instead. Forum members will say you can either run ethernet to your OBD2 port, or attach a USB-ethernet adapter to the glovebox USB port. Most USB-to-Ethernet adapters don't work and the old referenced D-Link one is not available; instead get one with the ASIX AX88772 chipset. I bought this one, it works. I think a clue that it will work is that the adapter advertises compatibility with Nintendo Wii / WiiU, but I'm not sure on that.

Last edited by FaxData; 09-30-2019 at 12:39 AM..