[Dtype]

Originally Posted by Terraphantm

With a full dump it wouldn't be super difficult to find the section of code that deals with the CAN messages, but the trick would be flashing the modified software back to the DDE.

I suppose you can stick something in bewteen the Kombi and K-CAN bus and modify the message before it gets to the kombi.

That's not NCS configurable. Might be possible to write custom software for the kombi (which would require an RSA defeat), but at that point you might as well just hack the DDE.

My first ideia was a can blocker to send a message with oil temp id.
Just need to know oil temp Id and engine coolant temp I'd.

[Terraphantm]

Originally Posted by Dtype

My first ideia was a can blocker to send a message with oil temp id.
Just need to know oil temp Id and engine coolant temp I'd.

They're both broadcast on the same ID (0x1D0). Byte 0 is coolant temp (x-48 = ºC), byte 1 is oil temp (same formula)

[Dtype]

Originally Posted by Terraphantm

They're both broadcast on the same ID (0x1D0). Byte 0 is coolant temp (x-48 = ºC), byte 1 is oil temp (same formula)

Thanks! So, need to read from 0xFF and create a new one with 0x1D0. Do you think it's possible? Can you paste here a copy of a messege with those Id's?

[Terraphantm]

Originally Posted by Dtype

Thanks! So, need to read from 0xFF and create a new one with 0x1D0. Do you think it's possible? Can you paste here a copy of a messege with those Id's?

No, there is no message 0xFF.

Here's an example of message 0x1D0 from an E60 535xi:

ARBID	B0	B1	B2	B3	B4	B5	B6	B7
1D0	93	81	62	bd	32	45	0d	84

B0 is coolant temperature, B1 is oil temperature. In this case, coolant temperature is 99ºC and oil temperature is 81ºC.

In the case of the diesel cars, BMW hard coded B1 to FF.

[Sensible_]

Originally Posted by Terraphantm

No, there is no message 0xFF.

Here's an example of message 0x1D0 from an E60 535xi:

ARBID	B0	B1	B2	B3	B4	B5	B6	B7
1D0	93	81	62	bd	32	45	0d	84

B0 is coolant temperature, B1 is oil temperature. In this case, coolant temperature is 99ºC and oil temperature is 81ºC.

In the case of the diesel cars, BMW hard coded B1 to FF.

I would imagine the easiest way to do this would be to change KOMBI pointer to coolant temp rather than oil. That's great info, just caught up on this thread.

[Terraphantm]

Originally Posted by Sensible_

I would imagine the easiest way to do this would be to change KOMBI pointer to coolant temp rather than oil. That's great info, just caught up on this thread.

How do you plan to do that? As far as I can tell, that isn't configurable.

[Sensible_]

Originally Posted by Terraphantm

How do you plan to do that? As far as I can tell, that isn't configurable.

I'm sifting through some dissambled KOMBI code at the moment.

[Dtype]

Originally Posted by Terraphantm

No, there is no message 0xFF.

Here's an example of message 0x1D0 from an E60 535xi:

ARBID	B0	B1	B2	B3	B4	B5	B6	B7
1D0	93	81	62	bd	32	45	0d	84

B0 is coolant temperature, B1 is oil temperature. In this case, coolant temperature is 99ºC and oil temperature is 81ºC.

In the case of the diesel cars, BMW hard coded B1 to FF.

But I can grab that message and send for example b1 info the same as b0.
Do you know all the bytes meaning?

[_TB_]

Originally Posted by Sensible_

I'm sifting through some dissambled KOMBI code at the moment.

If you by chance stumble upon the activator for "Motorsport" display - specifically how we can enable it despite having no DCT. I really like the layout with the big "current gear indicator" - but it throws an error due to not having a DCT.

[6ixSpd]

Originally Posted by _TB_

If you by chance stumble upon the activator for "Motorsport" display - specifically how we can enable it despite having no DCT. I really like the layout with the big "current gear indicator" - but it throws an error due to not having a DCT.

I doubt this is possible as the M3 and non-M actually use different clusters. The M3 clusters have different central layouts and have a few different backlit warnings/display indicators as well.

[giustyle]

Originally Posted by _TB_

If you by chance stumble upon the activator for "Motorsport" display - specifically how we can enable it despite having no DCT. I really like the layout with the big "current gear indicator" - but it throws an error due to not having a DCT.

the only way is flash ALPINA steptronic but you need N47 or N54/55 motor.

[_TB_]

Originally Posted by giustyle

the only way is flash ALPINA steptronic but you need N47 or N54/55 motor.

I'm not talking about the normal gear indicator - which is easy to get, also without the Alpina TCU flash.

I'm talking about the enlarged "D1..D6" "P" "N" - like in the video in this thread: http://www.e90post.com/forums/showth...ght=motorsport

[cypis007]

Originally Posted by Yngvejos

Thanks for this great info.
Just coded my 05 325i to show oil temp. 0 = 50C, 5 = 75C, 10 = 100C, 15 = 125C, 20 = 175C.

Have you been using Sensible_'s method with nettodat file or tool32 from pdf ?

[giustyle]

Originally Posted by Sensible_

I'm sifting through some dissambled KOMBI code at the moment.

In m3 cluster is present this address to RedLine marker:

0x3104 - Redline Marker

this redline is variable on Water Temperature.. i think that is possibile read address on line 0020 (remember 6F Oil temp, 6E KVA, XX Water temp?? )

it's a good idea?

@Sensible_ can you check it on your m3 cluster?

Thanks a lot

[Terraphantm]

DME controls the redline marker.

[giustyle]

Originally Posted by Terraphantm

DME controls the redline marker.

DME controls with water temp..

[Terraphantm]

DME commands the cluster to set it to a specific RPM (and that set point is based on oil temp anyway). The cluster doesn't have any real logic for it.

[Yngvejos]

Originally Posted by cypis007

Have you been using Sensible_'s method with nettodat file or tool32 from pdf ?

I followed the pdf guide and used tool32.

[giustyle]

Originally Posted by Terraphantm

DME commands the cluster to set it to a specific RPM (and that set point is based on oil temp anyway). The cluster doesn't have any real logic for it.

mmhh.. I knew that DME not commands nothing, but the cluster READ parameter from dme (oil temp, water temp, ecc..)
In the canbus travel varius information and important that cluster read correct

[Terraphantm]

Originally Posted by giustyle

mmhh.. I knew that DME not commands nothing, but the cluster READ parameter from dme (oil temp, water temp, ecc..)
In the canbus travel varius information and important that cluster read correct

Look I know what I'm talking about, you're wrong about how the RPM warning field is controlled. The DME has its own logic and sends the target RPM over the bus. Yes, the cluster reads the coolant temperature and oil temperature, but it does not use these to set the variable redline.

From what I can tell, the set point is sent on message 0x332

[Sensible_]

Why are we talking about VWF now? VWF is different I think. It's easy to hijack via the KOMBI. For instance, I have set it on my 330d so that when inpushbstart button for ignition the redline rises to 5000rpm and then when ignition is turned off the redline drops back to the home position. I set it not to change on the diesel with temp. Just my preference. It's easy to change with nettodat.

[robnitro]

So on the diesel dde, we can activate the rpm limit? From what I read here the us 35d dde is different in some ways but I'd like to try it.