GS7 program code disassembly project

[doublespaces]

I may be making a mistake but:

28.5cm/2.54= 11.22 in
11.22*.30=3.366in sidewall
3.366*2+19=25.73in tire diameter.

318 isn't tire diameter it seems.

 

[aus335iguy]

At some point in the thread about issues encountered with the GTS conversion he did some math around final drives.. wonder if there’s a clue there?

 

[Olza]

diameter is 653.6mm

maybe radius in mm? 653.6 / 2 = 326 mm?

 

[Olza]

Good question. The GTS has 285/30-19's right? Circumference is 2053.3mm (80.84",) diameter is 653.6mm (25.73".)

hmm, with 654 mm GTS diameter it should be 157 kmh... my previous math was wrongly for my 628 mm 245/40 R17 wheel

 

[Olza]

another formulae: 153 kmh = (((ossrpm * 2) * 318 * 38 ) / 3.15 * 100 000) * 8 / 16

original speed is 156 kmh:
(4000 / 3.15 * 3.14159 * ((285 * 0.30 * 2)+(19 * 25.4))) / 1 000 000 * 60
(4000 / 3.15 * 3.14159 * 653.6) / 1 000 000 * 60

 

[crnizmaj]

hi,
what is a good tool to flash directly tcu ?
thanks

 

[doublespaces]

Hopefully GS7 Flashtool.

 

[crnizmaj]

ok so for now no tool to flash ?
do you know what's the chip in tcu ?

 

[Begood69]

Have u found the pressure line part of it? I bet if u focus on that u will get crazy attention...
Xhp is not working on the dct tune for a long while . Worth it now to look into it.see if they would share the cracked data they got from maxxecu i think it was that cracked that nut. Or get it from them straight.

 

[Begood69]

How can i provide a bump of my tranny flashed gts 442.

 

[namsu2430]

Not sure if this is any help but I contacted a company that has changed the final drive for M3 DCT boxes to 3.62 (for race applications I think) to see if he could help

3.62 R Differential DCT Flash

He said it's cost prohibitive but would this not at least say it's possible? Or do we already know it's possible? I'm not up to date with the latest progress

 

[derekgates]

Not sure if this is any help but I contacted a company that has changed the final drive for M3 DCT boxes to 3.62 (for race applications I think) to see if he could help

3.62 R Differential DCT Flash

He said it's cost prohibitive but would this not at least say it's possible? Or do we already know it's possible? I'm not up to date with the latest progress

It's a bummer to see his response... A group buy or similar setup could help offset those costs.

Otherwise, discovering a way to hack the values/encrypt is still up in the air. If a known method has been discovered it doesn't seem that information is being shared as it is worth quite a bit of money. This should be known as you are reading this thread about discovering values, eh?

 

[namsu2430]

It's a bummer to see his response... A group buy or similar setup could help offset those costs.

Otherwise, discovering a way to hack the values/encrypt is still up in the air. If a known method has been discovered it doesn't seem that information is being shared as it is worth quite a bit of money. This should be known as you are reading this thread about discovering values, eh?

That's what I wasn't sure of. Is the possiblity of a flash unknown or are we still trying to figure that part out. If this company offers a change to 3.62 I would then assume it is possible? But if my maths is right (probably not) 3.15 -> 3.62 is a smaller change than 3.15 -> 2.56 ?

 

[derekgates]

That's what I wasn't sure of. Is the possiblity of a flash unknown or are we still trying to figure that part out. If this company offers a change to 3.62 I would then assume it is possible? But if my maths is right (probably not) 3.15 -> 3.62 is a smaller change than 3.15 -> 2.56 ?

The current status is 'stabbing in the dark hoping we can figure out what the bits/bytes in the TCU flash represents'... then it is figuring out 'how to make the TCU happy with our changes and flash like the stock BMW flashes'...

It's a laborious and extremely tedious process which is why nobody wants to share the secret sauce...


Anything is possible given enough time/money.

 

[mattbarn]

Here they are, both bins for GTS and 335is. Load at 0x80020000.

Attached also 335is calibration file 8606075 - this is for program version 8606066 (!!!).
When flashing with WinKFP specify ZUSB number 8606074. Remove txt extension.

Any chance you can post a bin of the 0pa also?

 

[Olza]

Any chance you can post a bin of the 0pa also?

Yes. Why?

 

[mattbarn]

Just thought I might try my hand at disassembling and decompiling it, and I'd rather not go through the whole thing of finding the file and converting it from hex.

I have done a few Tricore software RE projects before, so maybe I can help.

 

[Olza]

ok. lets discuss why they used some minor offset to main pressure, based on rpm and gearbox temperature?

main_pressure = main_pressure + (Pressure3*Factor3 + Pressure2*Factor2 + Pressure1*Factor1). Factor is interpolated i guess.
so you got one offset for mainpressure from 0 to 5...6.5 bar
second from 6.5...12 to 20 bar.
third is in range 5..6.5..12 bar

so in 5000 rpm/90 oC and 15 bar you get 15 + (-0.65*0) + (-0.65*1.0) + (-0.70*0) = 15 - 0.65 = 14.35 bar
in 3000 rpm and 6 bar you get 6 + (-0.10*0.33) + (0.00 * 0.66) = 6 - 0.033‬ = 5.967

 

[aus335iguy]

the offset for temp May be to account for changes in oil viscosity. The rpm one is likely because clutch take up would vary with rpm and so in both cases the clutch clamping application would likely need to be varied to minimise drivetrain shock, attain the right shift firmness and remain consistent in feel...

500nm delivered at 3krpm needs different strategy than 5k

 

[aus335iguy]

Not explaining it well but hopefully makes sense