xHP DCT Flashing

carabuser

Lieutenant
Oct 2, 2019
964
1
959
0
UK
Ride
Z4 35i & 335i
Started with 8647462 (LM12 cars) then ended up on 8606066 (LM72 cars). My VO is for a LM12 vehicle but my VIN is LM72.

Strange about the flash time. Maybe because it had to flash back to stock? Not tried a second flash yet.
 

aus335iguy

Colonel
Nov 18, 2017
2,258
809
0
Down under
Ride
335i DCT 2009
i never timed the full flash in WINKFP but 10 mins sounds familiar so you could be right about flashing back to stock
 

Olza

Corporal
Feb 2, 2020
233
236
0
Minsk, Belarus
Ride
BMW 320d
Started with 8647462 (LM12 cars) then ended up on 8606066 (LM72 cars). My VO is for a LM12 vehicle but my VIN is LM72.

Strange about the flash time. Maybe because it had to flash back to stock? Not tried a second flash yet.
LM11 its the Z4? whats the differences subjectively?
 

carabuser

Lieutenant
Oct 2, 2019
964
1
959
0
UK
Ride
Z4 35i & 335i
LM11 its the Z4? whats the differences subjectively?

My experience was that the shift points were slightly higher across the board, less hesitation when taking off from a roll (before it would disengage clutches when rolling up to a junction and get confused) and less delay with selecting reverse. Shifts were crisper too.

Another user (Asbjorn) who did the same change also had the same feeling. He would get flywheel chatter in higher gears with the standard 35i flash because of installing an aftermarket flywheel, he said this was greatly reduced with the 35is flash because he felt it held gears longer.
 

RSL

Lieutenant
Aug 11, 2017
937
501
0
I have the flasher module now. The features are nice but I can't really recommend it to anyone unless they are REALLY into their trans.

From my experimenting I've made some assumptions.
-It uses VIN to work out the correct ZB and not VO
-It generates a stock bin file that it places in "Internal Storage\Android\data\com.rbttuning.xhpflashtool\files\xHP Flashtool\Backups"
-It bases any OTS flash off your stock bin and not whatever ROM you flashed previously

It would be nice if xHP were more open about what they do rather than make us guess, it seems from the Whatsapp that a large portion of their userbase are people with odd hardware and software combinations. Makes sense as anyone willing to go to the lengths of buying new hardware and flashing software with WinKFP are also willing to spend €400 on torque limiters.

I'm curious about the flashing process though, it seems to take a while (10-12min with BG cable) so they are doing more than just flashing the data area. I wonder how recoverable a failed flash is, with MHD it seems almost impossible to brick the DME, not so sure with xHP if it does indeed do something in the boot sector.
Agree, there are better things to spend that much money on unless you want it for a very specific purpose and have no swaps....at least until maybe custom flashes get dug into.

Thank you for that path. I had to search about 3 different keywords from it, but finally found it and does look like the stock/initial install file judging by timestamp. I flashed a flash change and re-downloaded, but it's still time stamped from the original setup.

If there's no way to readout what's actually flashed, we may want to start a repository of the stock bins somewhere. I haven't looked at the file yet, but if complete, at least they're something to reference/start from. The swap/non-stock ZB people need to get those files read out somehow and probably custom flash back instead of using their OTS/stock flash options...if it even accepts that. If they can do a full write, they should be able to a full dump, but yeah, they don't make it easy. Someone needs to talk them into reads, not downloads.

My flash only change took a little over 1 minute, but I was on the stock ZB. If you have something that isn't for your exact car flashed to start, it surely does a full write to get rid of it.
 
  • Like
Reactions: Joachim335

carabuser

Lieutenant
Oct 2, 2019
964
1
959
0
UK
Ride
Z4 35i & 335i
Agree, there are better things to spend that much money on unless you want it for a very specific purpose and have no swaps....at least until maybe custom flashes get dug into.

Thank you for that path. I had to search about 3 different keywords from it, but finally found it and does look like the stock/initial install file judging by timestamp. I flashed a flash change and re-downloaded, but it's still time stamped from the original setup.

If there's no way to readout what's actually flashed, we may want to start a repository of the stock bins somewhere. I haven't looked at the file yet, but if complete, at least they're something to reference/start from. The swap/non-stock ZB people need to get those files read out somehow and probably custom flash back instead of using their OTS/stock flash options...if it even accepts that. If they can do a full write, they should be able to a full dump, but yeah, they don't make it easy. Someone needs to talk them into reads, not downloads.

My flash only change took a little over 1 minute, but I was on the stock ZB. If you have something that isn't for your exact car flashed to start, it surely does a full write to get rid of it.
I was thinking the same thing about the stock map repo. I verified the stock map with the files from WinKFP and the generated stock bin contains the correct binary data from the 0pa and 0da files for the latest stock ZB of my car.

It should be fairly easy to record the xHP flash process using a CAN sniffer, saves the hassle of buying expensive hardware to upload from the TCU. An XDF for the TCU would be a lot smaller than the DME one and I think we would only be looking at three hardware variants that cover the majority of cars (F980G (E9x and E8x), F991G(Z4 35is), F111G (M3)). My theory is that those 3 variations are due to those models having different flywheel as the Z4 35is has a slightly heavier one I think. It would be a bit of an asshole move to steal their OTS maps but at the same time I'd like the ability to truly customise things.

The stock map generated by xHP is only 1.5MB and a full program/data bin should be 4MB so it's certainly only a partial data map. Could fill the gaps in from the WinKFP files though.
 

RSL

Lieutenant
Aug 11, 2017
937
501
0
Can you even read their maps? I didn't buy a map pack and never will, but I'd assume they would be encrypted. Only a matter of time before XDF gets sorted and we can do everything ourselves though.

0-01FFFF are FF on the backup/stock ZB download, but there is data from 20000+. That is a huge diff in file size, but repository may still be worthwhile for the data that is available.
 

carabuser

Lieutenant
Oct 2, 2019
964
1
959
0
UK
Ride
Z4 35i & 335i
Can you even read their maps? I didn't buy a map pack and never will, but I'd assume they would be encrypted. Only a matter of time before XDF gets sorted and we can do everything ourselves though.

0-01FFFF are FF on the backup/stock ZB download, but there is data from 20000+. That is a huge diff in file size, but repository may still be worthwhile for the data that is available.

No, you can't encrypt the data when writing to the module, with CAN sniffing you are just looking at all the packets which should contain the target location for the data and the data itself.
 

RSL

Lieutenant
Aug 11, 2017
937
501
0
No, you can't encrypt the data when writing to the module, with CAN sniffing you are just looking at all the packets which should contain the target location for the data and the data itself.
I thought you meant their actual OTS maps, sorry.

Check DME codes after. Had to run out, so flashed TCU back to stock to get some base line DME and DKG logs on current DME map. No light/issues, but all these were sitting there.

++++7/8/2020 2:26:57 PM
- DME active codes -
2E7F - DME: EGS via PT-CAN2 and PT-CAN.
2F81 - DME: Engine switch-off time, instrument cluster timer - DME timer, comparison.
2F83 - DME: Engine switch-off time, instrument cluster timer - DME timer, comparison.
CD9D - Message (transmission data, 0xBA) faulty, receiver DME, transmitter EGS/HIM/SMG/DKG.
CD9E - Message (transmission data 2, 0x1A2) faulty, receiver DME, transmitter EGS/SMG/DKG.
CDB0 - Message error (display, transmission data, 0x1D2), DME receiver, ETC / HIM / SMG / DKG transmitter.
CDB4 - Message (transmission data , 0x3B1) faulty, receiver DME, transmitter EGS/SMG/DKG.
CDC3 - Message (status, DKG, 0x37D) faulty, receiver DME, transmitter DSC/DKG.

- DME shadow (inactive) codes -
CDB8 - Message (torque request, DKG, 0xB8) faulty, receiver DDE, transmitter EGS/SGM/DKG.
 
  • Like
Reactions: Joachim335

Olza

Corporal
Feb 2, 2020
233
236
0
Minsk, Belarus
Ride
BMW 320d
My experience was that the shift points were slightly higher across the board, less hesitation when taking off from a roll (before it would disengage clutches when rolling up to a junction and get confused) and less delay with selecting reverse. Shifts were crisper too.

Another user (Asbjorn) who did the same change also had the same feeling. He would get flywheel chatter in higher gears with the standard 35i flash because of installing an aftermarket flywheel, he said this was greatly reduced with the 35is flash because he felt it held gears longer.
but i see in a data it has e-brake option enabled. does brake - handbrake detection status working well in standart 335?

also, ZB is 8606066 its pre-latest PROGRAM code, but what is data file? i guess 8606076 Z4 35I roadster non china/korea or 8606082 Z4 S35I roadster non china/korea?

-It generates a stock bin file that it places in "Internal Storage\Android\data\com.rbttuning.xhpflashtool\files\xHP Flashtool\Backups"

so it does not backup your current changes? any way to get modified file by Xhp?
so say me your stock data file version and attach that backup, please, did they compressed or masked it?
i have stock bins and can modify something for you, then you can try to replace bin and reflash, maybe it sign it on the fly, or signature protection already removed.

data file size from 0DA should be about 130kb - from offset 0x20000 to 0x3FEFF. and pure code from 0PA about 1.5 mb
 
Last edited:

carabuser

Lieutenant
Oct 2, 2019
964
1
959
0
UK
Ride
Z4 35i & 335i
but i see in a data it has e-brake option enabled. does brake - handbrake detection status working well in standart 335?

also, ZB is 8606066 its pre-latest PROGRAM code, but what is data file? i guess 8606076 Z4 35I roadster non china/korea or 8606082 Z4 S35I roadster non china/korea?



so it does not backup your current changes? any way to get modified file by Xhp?
so say me your stock data file version and attach that backup, please, did they compressed or masked it?
i have stock bins and can modify something for you, then you can try to replace bin and reflash, maybe it sign it on the fly, or signature protection already removed.

data file size from 0DA should be about 130kb - from offset 0x20000 to 0x3FEFF. and pure code from 0PA about 1.5 mb
Sent you a PM.

Z4 has ebrake, none of the E89 came with an old fashioned handbrake.
 

Ant-3244

Lurker
Oct 17, 2018
10
10
0
Ride
335i
Does any one know If theres a way coding out the fault codes from not having a stock Knob attached to the GWS. I ran Billet aluminium shifter on my M3 GWS. Would like to put it back on the stock Gws would also save me tracking a stock knob down.
 

aus335iguy

Colonel
Nov 18, 2017
2,258
809
0
Down under
Ride
335i DCT 2009
Does any one know If theres a way coding out the fault codes from not having a stock Knob attached to the GWS. I ran Billet aluminium shifter on my M3 GWS. Would like to put it back on the stock Gws would also save me tracking a stock knob down.
As far as I know there’s no coding available in GWS
 

azshantris

Corporal
Aug 27, 2019
155
141
0
Ride
2011 135i N55 DCT GTX1000
Does any one know If theres a way coding out the fault codes from not having a stock Knob attached to the GWS. I ran Billet aluminium shifter on my M3 GWS. Would like to put it back on the stock Gws would also save me tracking a stock knob down.
Seems like you would have to look into some custom programming to get rid of the error checks. I'm guessing that it's just an error for the illumination? The selection is a different part of the harness if I'm not mistaken. Maybe you could look into pulling the wires and adding a little resistor set so it thinks it's lighting up. May be easier than the coding.
Or hang the knob down in the trans tunnel above the guibo 😅😅😂
 

Ant-3244

Lurker
Oct 17, 2018
10
10
0
Ride
335i
Seems like you would have to look into some custom programming to get rid of the error checks. I'm guessing that it's just an error for the illumination? The selection is a different part of the harness if I'm not mistaken. Maybe you could look into pulling the wires and adding a little resistor set so it thinks it's lighting up. May be easier than the coding.
Or hang the knob down in the trans tunnel above the guibo 😅😅😂

😂😂 I thought about hiding it in the dash, it throws a display code, unlock button malfunction and park button malfunction
 

azshantris

Corporal
Aug 27, 2019
155
141
0
Ride
2011 135i N55 DCT GTX1000
😂😂 I thought about hiding it in the dash, it throws a display code, unlock button malfunction and park button malfunction
Oooh those should be for the stock GWS I think. Are you reverting or did you never get your trans to flash back to GTS?
 

aus335iguy

Colonel
Nov 18, 2017
2,258
809
0
Down under
Ride
335i DCT 2009
So - im confused. Can one of the XHP users explain to me... The flasher module has sliders and you can tweak various parameters to suit your car. The OTS maps you pay extra for are these same sliders set different ways or do you get further functionality ? That is the flasher gives you shift points up to 7k but the stage 3 map gives 7500 for example I mean whats the use case for the maps other than its set and forget ?
 

Svmp

Specialist
Dec 23, 2019
62
71
0
Ride
M50 DCT & M57 DCT
It's weird, everywhere xHP states, even when asked directly, that the flashing wont work with other than OEM DCT cars. I can anyways identify my Z4 35is DCT in my old E36. I just don't dare to try flashing, because everyone says it doesn't work.

5Lnmicw.jpg


Someone who has flashed the xHP, does this look correct to you (VIN is hidden on purpose)? Next step would be to buy a license and flash away?

@doublespaces, here's one interested in the development (specially for aftermarket things), two projects going on at the moment, both E and F-series DCT:s going into old BMWs with a decent amount of power...