BMW S1000RR Forum banner
1 - 14 of 14 Posts

·
Vendor
Joined
·
4,097 Posts
Another issue of the 2022 Model Year.

As of July 2021 build of the 2022 BMW S1000RR VIN Sequence
WB10E2303N6FXXXXX

The ECU and EWS modules are firmware locked.

I have 4 2022 ECU's in for ExWERKS V2 upgrades and both the ECU and the EWS are locked in that no access with DimSport, AlienTech, Woolich devices can remove and replace the MAP structure binary files.

The ECU is 0 261 S10 52W BMS-O .. 1 696 358 - 01 .. load software base 170295191


As some can remember this was an issue with the 2017 BMSMP ECU as well. There are 2 modes of entry into the ECU coding. (Bench) / direct probe MPU and (Service) / OBDII port access. The BMSMP was not hacked until April of 2018. EVC was the first to get the access to the ECU and then Alientech and DimSport were very shortly there after. During the time of 2017 I was one of the only people that could provide a complete hardware solution in making the 2017 have the ability to be used as race bike at least with RCK3 equipped ECU. It is no different in this 2022 model in that I have a complete hardware/software solution wither you want STOCK, or my BMWHP V1 or V2 coding, or use Woolich / Other tuner access to the ECU.

However this might be just a small setback in gaining access. Only time will tell.
 

·
Vendor
Joined
·
4,097 Posts
^^ I appreciate your knowledge on these ECU's, however are you saying the 2022 ECU are locked out and thus can't be tuned remotely? if so I'm very :(
2022 at this time with the ECU / DME is LOCKED. Cannot use a Handheld device, cannot send to me and I get into it with a BDM. Its a great paper weight if you want to professionally race. Because what BMW Motorrad wants you to do is buy the Motorrad FIM WSBK approved ECU and wiring package.. BMW Motorrad does not like people inside the stock ECU because the EPA and Euro5 commission complain about it.

$10,000 USD there about for the Motorrad ECU package and it does not support DDC so now you need another $4000-$5000 in rear shock and front forks.
 
  • Wow
Reactions: A B

·
Vendor
Joined
·
4,097 Posts
@BMW_388 but like other ECUs, 2022 ecu will be unlocked with time right? Or does it have a whole different encryption scheme that is not hackable?
The basis of 'hacked' is not even close when it comes to the access of the MPU today.

The basic idea is that the ECU provides a seed -- a short string of byte values -- and the tool is required to transform that seed into a key using a secret algorithm. The ECU applies the same algorithm internally, and compares the key value given by the tool to its own value. If the two agree, the tool is assumed to "know" the secret algorithm, and access is authorized.

You have to sniff the data stream attempts with some very expensive equipment. Then even after you have the data stream breaking it down to the seed and key challenge is difficult in itself. We tried at this for months back in 2002 with the development of www.HPTUNERS.com becoming the result of success... So what finally broke the code or who? Leaks. That is first and fastest way to the answer. Hope that someone inside of a company is pissed off enough that they are willing to provide you even a little snippet of info to crack the algorithm. In the case of the PCM 411 series which ran the LS1/6 engines a nice engineer was paid $50,000 for the one and only algorithm to that PCM. Once you have one, you can build from there. Turned out GM already had 256 Seed and Key algorithm made up and appeared to be something set in stone to take GM to 2025. Now all this was going on in 2002 into 2003.

There was rumors that server point to device point would have data stream protection some day in the future. That day could be here now. I dont really see why BMW took an existing MPU structure and changed the seed and key algorithm mid cycle life. That had to be very expensive for them to do that, or, I need to open up one of these 2022 ECU's and see what MPU is in there. It might not be the TC1793. Again, I dont see that happening based on life cycle of the existing model year only change is exterior that we can see, but, I will ask the client if I can open the ECU. Not my ECU to just open and poke around in just yet.
 

·
Vendor
Joined
·
4,097 Posts
That’s interesting because I may or may not know of someone who has flashed their 22 m package without any issues. What models were you working on?
I already posted the ECU information. All you have to do is remove the ECU you think you flashed as a 2022 and not a 2021 as they do not have any issues and see if the numbers match. Look at the tag sticker on the ECU.

The ECU is 0 261 S10 52W BMS-O .. 1 696 358 - 01 .. load software base 170295191

The manufacture date it appears to be July 2021 and delivery to dealer was November 1 2021. VIN sequence of a 2022 is posted also but again > WB10E2303N6FXXXXX
 
  • Like
Reactions: Garagemoto7

·
Vendor
Joined
·
4,097 Posts
Time goes on.. we shall see. The ones I have are dealer delivered Nov 1.. ECU's are July 2021. If I didnt have 4 of them I would not have said any thing.
 
  • Like
Reactions: Capercat

·
Vendor
Joined
·
4,097 Posts
I got a help support response back from DimSport. They confirm that the new released 2022 with at least a build date of after July sometime the ECU is firmware locked. No access at this time until further testing and development.

I got a response back from Woolich and all they think is I dont have the power plugged into the ECU trying to access it. So my point on that response is they have no clue.

Still awaiting response from AlienTech.

If you had plans on getting your nice new 2022 you better check the manufacture date on the VIN sticker and if it is July or after, you might want to seek a different bike if you had plans to race it.

However, I do have a hardware replacement solution for this issue. It is what I am now implementing to the current 2022 projects I am working.
 
  • Sad
Reactions: Capercat

·
Vendor
Joined
·
4,097 Posts
It’s so frustrating why BMW do this.

I can understand why they would want to lock away things like radar detection on cars and other safety systems but to lock the entire thing is silly. Warranty is lost when you flash so I can’t even see that as the reasoning.

I had plans with mine for some track work and other events where I was looking to flash tune with a full system and remove the speed limiter, now I’m questioning why bother with BMW. Surely they know the knock on effect it will have on aftermarket products?

This exact scenario happened with my M2 Competition and still now over a year later the ECU has not been cracked.
The answer to 'why' is long and many.

The main one in my opinion is EPA and Euro Commission most likely. Look at California soon to be looking at ECU programming in cars. It does not matter you tuned your car/truck to get 50 MPG, it is tuned in the EPA commission checking process and they dont want it. I been dealing with the association of the EPA to performance since 2003 when HPTuners came about and was one of the first software packages to be able to turn off O2 sensors. The EPA hates it ...

Then there is money on Motorrad side. Locking the ECU in the K67 and K66 will force people to get the WSBK FIM package. That is a $10000 USD cost and since it does not support fan control and DDC, there is a huge expense in shock and forks too. The fan of course you can put in with a flip switch on the cheap side of operation to get around that.

Then there is the blown engines in the last 8 months of this year. I have read and heard from dealers it is over 15 engines I am aware of just this year. ( BTW > Zero with my ECU coding ) .. So you think BMWAG is not looking at that issue no matter we blame it on ECU coding or just plain mechanical failure. WHAT>? mechanical failure on BMWAG Motorrad part? Well, there you go, it makes them look bad on the forums. The Suzuki guy like @z00 just loves to brag about how he passed on BMW out of all the blown engine issues. Really just using Z00 as a example of a " OTHER " brand person on here and can look from the outside in on the issue.

Its a huge expense on BMWAG part to jump in mid stream of a product cycle and change something like the ECU access to the MPU. All that dealer software ( ISTA and ESYS ) had to be updated to deal with the change.

Like I said about the 2017 BMSMP. It was released and it was 15 months before the new algor was cracked. We shall see how long on this new BMSO now.
 
  • Like
Reactions: HBguy and Capercat

·
Vendor
Joined
·
4,097 Posts
Just got a message from another tuner apparently reading on here that the XR1000 is locked also with a July build date and on.
 
  • Sad
Reactions: Capercat

·
Vendor
Joined
·
4,097 Posts
I leave it on standard screen so I don't know.
A 200 tyre for street riding you won't use all the edge grip so you're paying extra for no reason.
90% of track day riders at the track on a nice sunny 90F day cant use all the 200 to the very edge either.

Really the edge grip on 200 vs 190 is not the big debate and I dont look at it as an issue. The diameter of the tire at various lean angles is where DTC is calculated from. The DTC will rarely trigger an event at 0 to 10 degrees. In rare cases you can see some starting at 25 degrees and at 30 this is where BMW starts it aggressive code calculations.
 
  • Like
Reactions: Capercat

·
Vendor
Joined
·
4,097 Posts
I have an update on the locked issue.

It mostly falls under you can until you 'can not' .. As in it has now been found that not all 2022 are locked after July date.

So it is strange to me that 4 in California ( I have seen ) , 1 in Florida ( another tuner ) , and 2 in the UK ( another tuner ) are locked with no access via a BDM device.

So, we shall see how this works out in the months to come.

I also saw some strange locking of the EWS modules over the last 2 years. 50% are locked and no access, and the other 50% work with same access that 15-19 had. So far I have been able to make keys on one 2022 and none for the other since that EWS was locked.
 
  • Like
Reactions: Capercat and A B

·
Vendor
Joined
·
4,097 Posts
@BMW_388 You reckon its i-level based?
Well, it appears 'something' happen in June July August that is not consistent.

If the MPU has a different OTP security write that can cause the differences, That is what I have always been told was the issue with the EWS modules that are LOCKED vs UNLOCKED access.

I have seen the BMW release memo on the change of the firmware lock in the cars and S series moving toward BN2020 series. There is a backend token method coming where you have to have a subscription to the ISIS network.

I am pretty sure by middle of 2022 BMWAG will have it all worked out. The cars in F,G.I already have full locks on several their modules.
 
  • Like
Reactions: bennymx

·
Vendor
Joined
·
4,097 Posts
I'm keen to know if the newer i-level's are locking them up. If this is the case, any year model could be locked once it is updated to the latest i-level. Only makes sense if this is the case. If its only a certain production range then maybe a hardware change is what causes it. I have no idea. Just trying to actually narrow down what causes it.
Well, I would not risk updating one of my current ECU's to current 04.32.32 .. but I have 2 coming from a dealer in TN next week and they just updated them today.
 
  • Like
Reactions: bennymx

·
Vendor
Joined
·
4,097 Posts
That sounds bad. Does this mean they can "re-lock" at next service even if you crack it after any service?
I will update you next week on that. One of the ECU coming to me was from 2019 batch I flashed and today it is on 04.32.32.. so I will see how that goes.
 
  • Like
Reactions: cjc and bennymx

·
Vendor
Joined
·
4,097 Posts
some people have a different business model than others.

I feel like it was important for those that are looking for new 2022 even if it was the XR1000 that there was potential issues with the ECU not being the same as the previous 20-21 in programming. Even the Woolich Racing software cannot access the new change in "some" ECUs and that can effect those that are total DIY. Then DimSport confirmed to me the BDM access was not functioning at this time. So SLR is out in that area.

I have handhelds. I have about 10 of them on the shelf actually. That unit access the ECU similar to the KESS on OBDII port. So on the next 2022 I have coming and it will not access with the BDM, I will use the handheld on it. I can use the handheld to load V1 and V2 code. I dont have to request someone to update to latest release at the dealer. I can code around the OSID which is what the DimSport Handheld uses for reference to load what is going in the ECU.
 
  • Like
Reactions: bennymx
1 - 14 of 14 Posts
Top