bmw 1998 m3 mss50

by **garyatgma** » Tue Dec 23, 2014 11:09 am

Is there any easy soloutinn to do a immo off on this car?

currently doing a conversion into an e36 compact for drifting :D

by **garyatgma** » Mon Dec 29, 2014 11:03 am

no body know? i will post ori file later on and see if that helps out.

by **defragger** » Tue Jan 06, 2015 11:58 am

i am not sure about mss50, but in me7.5 i have seen someone disable immobilizer in hex code.

they dumped eeprom 95040, increment 0x00000012, 0x00000022 by 1.

and then correct checksum at location 0x0000001E, 0x0000002E by -1

I think you can also disassemble the firmware in the CPU code using IDA Pro or similar, and then look for the function for checking the immo.

best of luck and happy drifitng

by **X-Ander** » Mon Jan 19, 2015 8:38 pm

Also have this trouble, there are 2 flash, but i cant find even who find isn for ews emulator.

by **Lambda1** » Wed Mar 14, 2018 11:05 am

There ist Slave 256kbit and Master 256kbit = 512kbit = Fullread and also 32kbit = partial.
EWS section is in 32kbit, adress depends on SW-Version (3.18, 4.14, 4.16 (MSS50, MSS50.1).
If Fullread think about endian swap.
Its a easy job like nearly the most MSS5* Ecus. Only need one byte swaped.