GS7 program code disassembly project

amg6975

Sergeant
Oct 27, 2019
278
187
0
Ride
2012 135, 2005 ZHP, 2009 fJCW
yes, two bit-quoters in byte at offset 5 (im counting from 0), use lowest one 4 bits:
1 - 6 = Drive Logic Mode 1-6 - example for mode 5 - xxxx0101
7 - 12 = Rennstart Mode 1-6

Hm, Rennstart ("Race Start") seems like it would be launch control, but I don't know why it would have 6 different modes. Maybe it's just the DL setting, but then offsets it if launch control is available?

With this though, it would be trivial to have a interposer use the sport button to cycle through the DL modes. Basically just have it cycle up through until it reaches 5 or 6, then next press would trigger "down presses" until DL hit 1 again. I'm sure it could be done faster than the KOMBI would update so it would just look like the DL mode rolled over back to 1.
 
  • Like
Reactions: aus335iguy

Olza

Corporal
Feb 2, 2020
232
234
0
Minsk, Belarus
Ride
BMW 320d
by the way, we can fool stalk control rennstart rpm from m3 software.
just emulate tempomat stalk can signal from 0x194 offset 2, byte.
00000001 = +100 rpm
00000100 = -100 rpm
 
  • Informative
Reactions: aus335iguy

aus335iguy

Colonel
Nov 18, 2017
2,256
806
0
Down under
Ride
335i DCT 2009
@amg6975 wouldn’t it make more sense to go up with each button press and once reaching six go backwards? I mean if youre aiming to get to s5 and go to 6 you have 5 button presses to get back... just how id like to see it work i suppose - Just ignore me if its not a good idea
 

amg6975

Sergeant
Oct 27, 2019
278
187
0
Ride
2012 135, 2005 ZHP, 2009 fJCW
@amg6975 wouldn’t it make more sense to go up with each button press and once reaching six go backwards? I mean if youre aiming to get to s5 and go to 6 you have 5 button presses to get back... just how id like to see it work i suppose - Just ignore me if its not a good idea

Then how do you know if you're going up or down? It's a better user experience to make it so the same thing happens every time the user presses the button. Plus, if you're trying to get from 4 to 5 and you just went from 5 to 4, now you have to go down to 1 and back up to 5.
 
  • Like
Reactions: aus335iguy

aus335iguy

Colonel
Nov 18, 2017
2,256
806
0
Down under
Ride
335i DCT 2009
If we are working on a device to spoof the GWS then we might also want to look at spoofing the 1M SZL. I have that error at the moment(moved to IKMOS recently)
 

namsu2430

Specialist
Jul 29, 2019
72
40
0
Ride
335i DCT 2009
do we know whats ZB# is for EU PPK 335 DCT flash? ...92?
I've only seen this table before.
DCT Flashes.jpg
 
  • Like
Reactions: aus335iguy

Olza

Corporal
Feb 2, 2020
232
234
0
Minsk, Belarus
Ride
BMW 320d
about that pause intransition R -> D. i think i found some timeout parameters, its the same m3 gts - x35. we can disable or change timeout.
its 1.8 sec when temperature of gearbox oil is above 0 C, and 4 sec (!) when temperature below 0 C. question is can anyone confirm its too long (4 seconds) when cold?
 

aus335iguy

Colonel
Nov 18, 2017
2,256
806
0
Down under
Ride
335i DCT 2009
about that pause intransition R -> D. i think i found some timeout parameters, its the same m3 gts - x35. we can disable or change timeout.
its 1.8 sec when temperature of gearbox oil is above 0 C, and 4 sec (!) when temperature below 0 C. question is can anyone confirm its too long (4 seconds) when cold?
1.8 secs sounds too long for >0c... can you imagine waiting 4 secs to drive ?
 

Olza

Corporal
Feb 2, 2020
232
234
0
Minsk, Belarus
Ride
BMW 320d
1.8 secs sounds too long for >0c... can you imagine waiting 4 secs to drive ?
maybe im wrong with scaling factor. anyway, it needed to be tested. can we try to modify backup binary and reflash with xhp? anyone with android?
tell me your version and ill give a binary.
 

Begood69

Corporal
Nov 13, 2016
234
114
25
Fayetteville, NC
Ride
335i N54 Predator 3.2L stroker
maybe im wrong with scaling factor. anyway, it needed to be tested. can we try to modify backup binary and reflash with xhp? anyone with android?
tell me your version and ill give a binary.
Im on android on mine. Also problem about xhp is it has tendency to install IS files not gts files.
 

RTA

Specialist
Jun 17, 2020
59
25
0
N54 DCT EU 2009 with XHP flash.
I have a normal OBD and an ICOM cable.

Don't mind to try and provide logs.

Only warn me about the risk level of the ROM, I don't get nervous from a failed flash, I do prefer not to brick thinks.

:)
 

Olza

Corporal
Feb 2, 2020
232
234
0
Minsk, Belarus
Ride
BMW 320d
Ok, progress is:
1. Xdf creating
2. Can rewrite calibration data with changed parameters via Winkfpt. Signature check workaround!

Used GTS flash as a base, trying to transfer parameters and logic. But there are too many small or not differences almost in all portions - torque, pressure, logic, shift control. They did a big job for tuning gts dct!

So I dropped and decided to use original GTS calibration and program. Just reviewed all data for rpm scaling (8300->7000) and other conversion things like using ordinary GWS. After some tests with good ppl i can say it is possible to run!

Just make first own version. One day drive.
1. Transition from R-D is more quick and harder.
2. Partload and WOT upshifts without Sport almost perfect imo, i can not even feel torque changes!
3. In Sport it is very fast, i can feel huge punches to transmission when upshift occurs.
4. Low load downshifts sometimes too late, lags, or have “frozen” rpms. There is some jerks just before stop and creeping off. Maybe i forgot to convert something, maybe shift maps mess. No downshift revmatching in D which i liked very much.
5. Steering wheel tips do not work in Auto mode (do not switch temporary to manual). But works in M/S. This is strange, will investigate. Maybe logic or configuration things. Also found time parameter (60 seconds) for temporary manual mode, changed to 10 seconds thinking it will be better.
6. Seems dkg logic modes like XE-E/XS-S are broken, so shift logic not completely correct because of wrong shift maps. This is because i use standard GWS with no Program button. So i have only program1 and program6 (sport) its not a big problem, i just log and retune/move shift maps. Maybe will use logic maps from x35.

Second version is ready to run...

If someone wants little tweaks like final ratio, cutoff rpms, dsc interventions, logic changes. PM me.
 
Last edited: