I'm getting trojan warnings by two Anti-vir programs, I would not open it outside a temporary VM without a network connection. On the other hand: https://github.com/microsoft/vcpkg/issues/13864
e9x bench setup
- Thread starter ccfj1
- Start date
Does anyone here have an N54 DME msd81 setup on a bench ? If so where are you located and would you be able to help a forum member out in urgent need ?
@RSL @carabuser
@RSL @carabuser
Turns out this tool is IDA Pro 7.2
Does anyone know how an .IPO file can be decompiled with IDA Pro?
Not sure if this is the right place for this but, I was inspired by the OP's bench setup so I'm building my own. I'm attempting to build setup for an E60 which doesn't have the JBBR but has a KGM instead. All my components are from a 2010 E60.
However, I'm a bit confused by the wiring diagram in ISTA. Specifically for the KGM, I just want the MINIMUM connections to power on the KGM on so that it can do the translations with the other BUS networks, however there seem to be alot of power feeds to the box which control alot of the down stream features that I don't need on the bench like the door locks, window motors, outside mirrors., etc. These are all pretty thick wires, 2.5 mm, which is like 14 AWG, I don't want to hook up power feeds that I have no need for.
Can someone enlighten me as to what pins are the ones that I need to power JUST to have the KGM module power up and provide the gateway services for PT-CAN, CAN, etc. ?
Based on the supply diagram below, I'm led to believe that Pin 1, on X16759 would be required, but then the pin out table says that pin is "Signal, load cutout"
In the schematic, what do the things about the metric wire gauge size mean (30<18, 30<KGM, 30<10, 30<12, 30<29) I take it that 30 refers to terminal 30, and the 2nd number references the fuse number, but what does 30<KGM mean then? It's a pretty thick wire, so it seems it does have to SUPPLY a decent amount of current, but what does "Signal, load cutout" mean?
For Pin #27 on X16760, it is described as "Wake-up signal, terminal 15". Shall I assume that this means that it is sn INPUT signal when +12V is applied to this that turns this module on? OR is it that this wire is the OUTPUT signal, when the car is at terminal 15?
<!---->A16760 Body-gateway module
Plug connector overview
Pin assignments at plug connector X16759
Pin assignments at plug connector X16760
However, I'm a bit confused by the wiring diagram in ISTA. Specifically for the KGM, I just want the MINIMUM connections to power on the KGM on so that it can do the translations with the other BUS networks, however there seem to be alot of power feeds to the box which control alot of the down stream features that I don't need on the bench like the door locks, window motors, outside mirrors., etc. These are all pretty thick wires, 2.5 mm, which is like 14 AWG, I don't want to hook up power feeds that I have no need for.
Can someone enlighten me as to what pins are the ones that I need to power JUST to have the KGM module power up and provide the gateway services for PT-CAN, CAN, etc. ?
Based on the supply diagram below, I'm led to believe that Pin 1, on X16759 would be required, but then the pin out table says that pin is "Signal, load cutout"
In the schematic, what do the things about the metric wire gauge size mean (30<18, 30<KGM, 30<10, 30<12, 30<29) I take it that 30 refers to terminal 30, and the 2nd number references the fuse number, but what does 30<KGM mean then? It's a pretty thick wire, so it seems it does have to SUPPLY a decent amount of current, but what does "Signal, load cutout" mean?
For Pin #27 on X16760, it is described as "Wake-up signal, terminal 15". Shall I assume that this means that it is sn INPUT signal when +12V is applied to this that turns this module on? OR is it that this wire is the OUTPUT signal, when the car is at terminal 15?
<!---->A16760 Body-gateway module
Plug connector overview
| Number | X-pin, colour | Description |
| X16759 | 51-pin, black | Component connector Body-gateway module |
| X16760 | 51-pin, black | Component connector Body-gateway module |
Pin assignments at plug connector X16759
| Pin | Type | Description /Signal type | Connection /Measuring notes |
| 1 | A | Signal, load cutout | Fuse holder, front |
| 2 | E | Supply, terminal 30 | Fuse F18 |
| 3 | -- | Not used | |
| 4 | -- | Not used | |
| 5 | -- | Not used | |
| 6 | -- | Not used | |
| 7 | -- | Not used | |
| 8 | -- | Not used | |
| 9 | -- | Not used | |
| 10 | A | Signal, exit light | Exit light, driver's door |
| 11 | A | without active steering Signal, Servotronic solenoid valve | Servotronic valve |
| 12 | A | without active steering Signal, Servotronic solenoid valve | Servotronic valve |
| 13 | -- | Not used | |
| 14 | A | Supply, Hall sensor | Driver's window motor |
| 15 | E | Signal, Hall sensor | System lock, driver's door |
| 16 | -- | Not used | |
| 17 | -- | Signal, Hall sensor | Driver's window motor |
| 18 | -- | Diagnosis signal TXD | Connector X183 |
| 19 | A | Unlock motor signal | System lock, driver's door |
| 20 | -- | Not used | |
| 21 | -- | ASP_LOW Ground | Outside mirror, driver's side |
| 22 | E/A | Touring Signal, LIN bus | Roller cover controller |
| 23 | E/A | Signal, LIN bus | Connector, LIN bus |
| 24 | -- | Not used | |
| 25 | -- | Not used | |
| 26 | -- | Not used | |
| 27 | -- | Not used | |
| 28 | E | Signal, Hall sensor | System lock, driver's door |
| 29 | E | Door contact signal | System lock, driver's door |
| 30 | M | Sensor ground | Driver's window motor |
| 31 | -- | Not used | |
| 32 | A | Signal, lock motor | System lock, driver's door |
| 33 | E | Supply, terminal 30 | Fuse F10 |
| 34 | M | Ground | Ground point |
| 35 | A | Activation Driver's window motor | Driver's window motor |
| 36 | A | Activation Driver's window motor | Driver's window motor |
| 37 | -- | Not used | |
| 38 | -- | Not used | |
| 39 | -- | Not used | |
| 40 | A | ASP_LOW Voltage supply, horizontal mirror adjustment | Outside mirror, driver's side |
| 41 | A | ASP_LOW Voltage supply, vertical mirror adjustment | Outside mirror, driver's side |
| 42 | A | ASP_LOW Voltage supply, outside mirror heating | Outside mirror, driver's side |
| 43 | -- | Not used | |
| 44 | -- | Not used | |
| 45 | -- | Not used | |
| 46 | -- | Not used | |
| 47 | -- | Not used | |
| 48 | A | Sensor ground | System lock, driver's door |
| 49 | M | Signal, Hall sensor | Driver's window motor |
| 50 | -- | Not used | |
| 51 | A | Signal, central arrest motor | System lock, driver's door |
Pin assignments at plug connector X16760
| Pin | Type | Description /Signal type | Connection /Measuring notes |
| 1 | -- | Not used | |
| 2 | -- | Not used | |
| 3 | A | Activation Passenger's window motor | Passenger's window motor |
| 4 | A | Activation Passenger's window motor | Passenger's window motor |
| 5 | -- | Not used | |
| 6 | -- | Not used | |
| 7 | -- | Not used | |
| 8 | E/A | CAN bus low | K-CAN-system bus |
| 9 | E/A | CAN bus high | K-CAN-system bus |
| 10 | -- | Not used | |
| 11 | M | Sensor ground | Passenger's window motor |
| 12 | -- | Not used | |
| 13 | -- | Not used | |
| 14 | E/A | ASP_HIGH Signal, LIN bus | Outside mirror, passenger's side |
| 15 | -- | Not used | |
| 16 | -- | Not used | |
| 17 | -- | Not used | |
| 18 | -- | Not used | |
| 19 | A | Signal, central arrest motor | System lock, passenger's door |
| 20 | -- | Not used | |
| 21 | -- | Not used | |
| 22 | -- | Not used | |
| 23 | M | Ground System lock, passenger's door | System lock, passenger's door |
| 24 | E | Signal, Hall sensor | Passenger's window motor |
| 25 | A | ASP_LOW Voltage supply, outside mirror heating | Outside mirror, passenger's side |
| 26 | -- | Not used | |
| 27 | E | Wake-up signal, terminal 15 | Connector, terminal 15 wake-up |
| 28 | -- | Not used | |
| 29 | E/A | Signal PT-CAN high | Powertrain CAN-bus |
| 30 | E/A | Signal PT-CAN low | Powertrain CAN-bus |
| 31 | -- | Not used | |
| 32 | A | Unlock motor signal | System lock, passenger's door |
| 33 | E | Supply, terminal 30 | Fuse F12 |
| 34 | M | Ground | Ground point |
| 35 | -- | Not used | |
| 36 | -- | Not used | |
| 37 | M | Ground | Ground point |
| 38 | E | Supply, terminal 30 | Fuse F29 |
| 39 | -- | Not used | |
| 40 | -- | Not used | |
| 41 | -- | Not used | |
| 42 | E | Door contact signal | System lock, passenger's door |
| 43 | E | Signal, Hall sensor | Passenger's window motor |
| 44 | -- | Not used | |
| 45 | A | ASP_LOW Ground | Outside mirror, passenger's side |
| 46 | A | ASP_LOW Voltage supply, horizontal mirror adjustment | Outside mirror, passenger's side |
| 47 | A | ASP_LOW Voltage supply, vertical mirror adjustment | Outside mirror, passenger's side |
| 48 | A | Signal, exit light | Exit light, passenger's door |
| 49 | -- | Not used | |
| 50 | A | Supply, Hall sensor | Passenger's window motor |
| 51 | A | Signal, lock motor | System lock, passenger's door |
I’m guessing here and others will hopefully correct my mistakes before you do any damage
what I can see it receives battery current on the pins labeled supply that go to a fuse
That seems to be pin 38 and 33 on connector x161670 and pin 33 and pin 2 on x16759??
what I can see it receives battery current on the pins labeled supply that go to a fuse
That seems to be pin 38 and 33 on connector x161670 and pin 33 and pin 2 on x16759??
Thanks for the reply. I can hook all of them up to my power supply and I don't see that doing any damage, since it should be the same as if it were hooked in the car. However, I need to create extensions to my power supply and hook all of them up which probably equates to a 4 AWG cable, but again I don't want to hook all this up when there are no loads that I will draw down on from the KGM.
Pins 33 (30 amp fuse) and 38 (10 amp fuse) on x16760 seem to be fused 12V+ feeds to power the accessories, not exactly sure which ones exactly, but they would be power windows, door locks, and mirrors.
Similarly, Pin 33 (30 amp fuse) and pin 2 (30 amp fuse) on x16759 seem like they are also feeding some of those same circuits.
On a different practical note, I bought the pigtail connects for x16760 and x16759 on fleabay and I think they came from an E9x, they are the same connector shells as used on the FRM. Therefore, the wire colors and pin outs are different, which is no issue, other than for the bigger pins (like these 30 amp terminals) the E60 KGM has a few more that are populated vs the E9x FRM so IF I NEED them I have to buy separate terminals to get hooked up. However, I don't think I really need all of them and want to avoid wasting time an money on terminals I don't need.
Does anyone know where you can find in ISTA the map/table of all the fuse numbers and their circuit description? When I click on the F18, F10, F12, F29, they all hyperlink to a diagram of the installation location, which is the front fuse box in the glove box, which is kinda unhelpful.
The only reason why I am doing all of this is so I have run other modules off the bench like the OP, who inspired me . I want to have my DME, CAS, KOMBI, CIC, CID, iDrive on the bench. I may also then hook up the other audio/video stuff on the MOST network like the Logic7 and SiriusXM, then do some coding to add HUD and Night Vision, these are all E6X options, that I don't have on my car which is also CCC.
For the KGM, it can't be that the microprocessors that translate all the messages consume more than a few amps, let alone 10 amps. The DME (MSS65) has a far more powerful processor and those seem to be hooked up on a regular basis for bench flashing using 1-2 AMP power supplies.
Pins 33 (30 amp fuse) and 38 (10 amp fuse) on x16760 seem to be fused 12V+ feeds to power the accessories, not exactly sure which ones exactly, but they would be power windows, door locks, and mirrors.
Similarly, Pin 33 (30 amp fuse) and pin 2 (30 amp fuse) on x16759 seem like they are also feeding some of those same circuits.
On a different practical note, I bought the pigtail connects for x16760 and x16759 on fleabay and I think they came from an E9x, they are the same connector shells as used on the FRM. Therefore, the wire colors and pin outs are different, which is no issue, other than for the bigger pins (like these 30 amp terminals) the E60 KGM has a few more that are populated vs the E9x FRM so IF I NEED them I have to buy separate terminals to get hooked up. However, I don't think I really need all of them and want to avoid wasting time an money on terminals I don't need.
Does anyone know where you can find in ISTA the map/table of all the fuse numbers and their circuit description? When I click on the F18, F10, F12, F29, they all hyperlink to a diagram of the installation location, which is the front fuse box in the glove box, which is kinda unhelpful.
The only reason why I am doing all of this is so I have run other modules off the bench like the OP, who inspired me . I want to have my DME, CAS, KOMBI, CIC, CID, iDrive on the bench. I may also then hook up the other audio/video stuff on the MOST network like the Logic7 and SiriusXM, then do some coding to add HUD and Night Vision, these are all E6X options, that I don't have on my car which is also CCC.
For the KGM, it can't be that the microprocessors that translate all the messages consume more than a few amps, let alone 10 amps. The DME (MSS65) has a far more powerful processor and those seem to be hooked up on a regular basis for bench flashing using 1-2 AMP power supplies.
Hi, I have bench setup also of these modules:
JBBF
KOMBI,
RAD2,
TCU,
KLIMA.
Also I just bought CAS module for my bench setup which came without key, key slot, start button. Is it possible to somehow fake ignition/terminal power so that it would light up KOMBI and other modules? Does Pin8->12V do that?
Is my only option to intercept CAS can bus messages and modify ignition message so that other devices on can bus would think that key is inserted and system good to go?
JBBF
KOMBI,
RAD2,
TCU,
KLIMA.
Also I just bought CAS module for my bench setup which came without key, key slot, start button. Is it possible to somehow fake ignition/terminal power so that it would light up KOMBI and other modules? Does Pin8->12V do that?
Is my only option to intercept CAS can bus messages and modify ignition message so that other devices on can bus would think that key is inserted and system good to go?
Last edited:
With out the oem key and cas then canbus shield with emulated ignition would be the only way.
When I started building my bench setup, CAS with key was the basis, everything else comes from that, (and is easy to add on top).
When I started building my bench setup, CAS with key was the basis, everything else comes from that, (and is easy to add on top).
Yes, I was able to communicate with CAS and emulate ignition to other modules. I was able to use NCSExper to read code from modules. But when I choose SG_CODIEREN I get error:
Code:
[20:54:45.023] [2021-03-24] [SERIE] 2063 PABD/CABD A_PL2KMB.IPS Fgnr 265
[20:54:45.023] [2021-03-24] [SERIE] Fehler beim Codierdaten vergleichen/verifizieren SG bereits auf andere FG-Nummer codiert, Codierung abgebrochen
[20:54:45.142] [2021-03-24] [SERIE] 2063 Error COAPI2.CPP coapiRunCabd 6
[20:54:45.142] [2021-03-24] [SERIE] Fehler beim Codierdaten vergleichen/verifizieren SG_CODIERENAny ideas what this error mean?
I guess the issue is thas CAS is from E90 and KOMBI which I try to code is from E92 with different VIN? Their VIN must match? Is it possible to change CAS VIN?
Last edited:
They dont have to match for the bench to work, but if you want to code the kombi then use the onne_vin option, SG_CODIEREN wont work.
you can only change the VIn in either the cas or the kombi via a chip reader (r270), no standard tool can do it.
I have dumped my kombi chip and modded it so that the cas and kombi have the same VIn and coding wise it all works as normal.
the cas should be codable using SG_CODIEREN as normal, only the kombi will have the problem.
you can only change the VIn in either the cas or the kombi via a chip reader (r270), no standard tool can do it.
I have dumped my kombi chip and modded it so that the cas and kombi have the same VIn and coding wise it all works as normal.
the cas should be codable using SG_CODIEREN as normal, only the kombi will have the problem.
Pretty sure only the KOMBI eeprom is special as it can’t be done via standard tools and this causes issues in circuit and only then for some people. and the rest can be done via can/OBD/ICOM
You can code the cas, dme and kombi, the kombi just needs coding with the onne_vin option if the vins does not match that of the CAS.
with a bench setup as long as the wiring is good you can code all modules that are plugged in.
I have bench flashed and coded, JBBR, TV, CIC, CID, ZBE, Combox, MULF, TCU, CAS, Kombi, DME, EDC, HVAC, PDC, Rear camera module, DCS/ABS, Logic7 and Indi Amps.
Hey guys. While ago i was talking with a fellow in Germany who was asking me questions about one of my retrofits on my e93 m3 and i mentioned him that i would like to have E and F series bench setup in my house since i own both. He told me that he got Arduino Nano with MCP2515 Canbus module + JBBF and can do anything without CAS,Key,Ignition,KOMBI etc. So i told him i will order them if you can help me out. He first said okay. Then i got the units and he said well i worked so hard to make this happen and no one helped me so i cant help you with the setup.
Well i now have the parts but not the knowledge to activate this unit. Arduino world is totally strange to me even tho i know how to write HTML coding and stuff. And i have no clue how to create CAS + key emulator by using this SW.
I saw that someone mentions something like that :
const byte Stay_alive[8] PROGMEM = {0x00, 0x00, 0x8A, 0xDD, 0xF1, 0x15, 0x30, 0x02}; // 0x130, Wake up network
const byte Ignition_1[8] PROGMEM = {0x00, 0x40, 0x7F, 0x50, 0xFF, 0xFF, 0xFF, 0xFF}; // 0x26E, Ignition stage 1
const byte Ignition_2[8] PROGMEM = {0x40, 0x40, 0x3F, 0x50, 0xFF, 0xFF, 0xFF, 0xFF}; // 0x26E, Ignition stage 2
Seems like the Arduino works with this type of commands.
If anyone knows how can i do this i will pay for the service to accomplish a decent setup with the Arduino. I always shared my experiences and knowledge with anyone without a cost on many platform. My nick is SaNGRia in any bmw platform.
Well i now have the parts but not the knowledge to activate this unit. Arduino world is totally strange to me even tho i know how to write HTML coding and stuff. And i have no clue how to create CAS + key emulator by using this SW.
I saw that someone mentions something like that :
const byte Stay_alive[8] PROGMEM = {0x00, 0x00, 0x8A, 0xDD, 0xF1, 0x15, 0x30, 0x02}; // 0x130, Wake up network
const byte Ignition_1[8] PROGMEM = {0x00, 0x40, 0x7F, 0x50, 0xFF, 0xFF, 0xFF, 0xFF}; // 0x26E, Ignition stage 1
const byte Ignition_2[8] PROGMEM = {0x40, 0x40, 0x3F, 0x50, 0xFF, 0xFF, 0xFF, 0xFF}; // 0x26E, Ignition stage 2
Seems like the Arduino works with this type of commands.
If anyone knows how can i do this i will pay for the service to accomplish a decent setup with the Arduino. I always shared my experiences and knowledge with anyone without a cost on many platform. My nick is SaNGRia in any bmw platform.
Last edited:
Similar threads
