[iiSonnyii]

Originally Posted by DB_BMW

Well I reached out to them for the tune for a M550, 2021. They indeed confirmed they can do it, however they will not do it over the internet and told me that vehicle has to be physically present. I believe they are not willing to disclose how they accomplished it. Argue all you want, I'm giving facts here.

Guess I just have to wait till it is released here cause I'm not comfortable with sending my DME out.

[Edtex]

DME, a German company, does tune BMW M8's. Those with the locked ECU must be tuned at their shop in Houston. I drove my 2020 M8 Competition down to Houston for the tune. I am super pleased with the results as my car is now 700hp at the wheel which equates to approximately 800hp at the crank. Of course I can definitely feel a huge difference in performance.

[iiSonnyii]

Originally Posted by Edtex

DME, a German company, does tune BMW M8's. Those with the locked ECU must be tuned at their shop in Houston. I drove my 2020 M8 Competition down to Houston for the tune. I am super pleased with the results as my car is now 700hp at the wheel which equates to approximately 800hp at the crank. Of course I can definitely feel a huge difference in performance.

I don't believe they have an unlock for MY21 M340i

[H433x0n]

Originally Posted by Rux

I bet the alphabet soup at the end of my email signature that your company will be one of the first shortlisted few who will be given the ability to sign authorized performance updates. It will be like printing money.

I wish that were the case, but I'm 99.9999999% sure something like this would never happen. There's too much liability in exposing the private keys to any outside parties.

The best case scenario would be a file that is generated offsite and then given to BMW to then sign it. This would also never happen, mainly due to concerns related to emissions and safety aspects of autonomous driving. We do emissions test our vehicles, but not on the same level as an OEM. The emissions standards that the OEMs are required to satisfy and the serious consequences of not meeting them is too much to ever trust to an outside party.

The best case (and most realistic) scenario would be something like a BMW MPPSK kit for the G20. This allows them to satisfy all relevant regulations and keep their data integrity.

[Rux]

Originally Posted by H433x0n

I wish that were the case, but I'm 99.9999999% sure something like this would never happen. There's too much liability in exposing the private keys to any outside parties.

The best case scenario would be a file that is generated offsite and then given to BMW to then sign it. This would also never happen, mainly due to concerns related to emissions and safety aspects of autonomous driving. We do emissions test our vehicles, but not on the same level as an OEM. The emissions standards that the OEMs are required to satisfy and the serious consequences of not meeting them is too much to ever trust to an outside party.

The best case (and most realistic) scenario would be something like a BMW MPPSK kit for the G20. This allows them to satisfy all relevant regulations and keep their data integrity.

Imagine what you could charge for that kit?


Let's go about this is a totally different way. What if it was illegal for BMW to do this in the United States? Take the Massachusetts right to repair law which was newly enacted, which basically states that owners will be given access to their vehicles telematics, GPS etc. If BMW sells a vehicle in MA, they HAVE TO give access to the owner.


I did ask the Redbullteam who built the 1000+ HP S58 M4 how they managed to tune knowing they upgraded the Turbos etc. They used a standalone ECU. So I guess you can swap them. Not even sure how that would work. Totally out of my wheelhouse.

[kimbow]

As far as I am aware you can use a standalone programmed ECU to run the engine, but the engine only. I have looked into this. The problems start with running everything else on the vehicle as the original ECU is linked to the vehicles systems for a lot of other operations. A lot of stuff on the car wont work with this solution. They must have done a hell of a lot of work elsewhere to get the car running properly (and they have the money to do that!) Not a solution for Joe public.

[M2_MEDUSA]

Reviving this thread, I’m curious to know if anyone in the past 2 months almost had heard anything around the crack. I heard rk tunes was close to cracking it but this is rumor. Anyone else hear anything of positive news ? Rumors appreciated (:

[G_B58]

I'd heard that the major ones might skip the 2021, and focus on the new g80/g82, possibly to come back later or might not be worth it for them.

[fcbrandon]

Originally Posted by Enigma735

If they’re using TPM and Root of Trust to cryptographically validate every component of the bootchain then it is not hackable. Not without breaking asymmetric crypto to sign each component (bios, firmware, os) with the appropriate private key. Beyond that they probably have additional static measurements like base hash checks to verify tampering which can also be enforced in secure boot / TPM2. Bottom line, if Bosch implemented TPM based security for bootloader / boot chain at startup as they have been exploring for years in other product lines and enforcing for OTA updates for years now, then it ain’t happening.

This was my assumption in how they're doing it as well. Assuming they have HSMs on the supply line minting the certs that are installed into some TPM/hardware root of trust, then we're left with only 3 options:
- supply chain attack: someone has to get code into the firmware at BMW Corp. Clearly, this is not a realistic option for a few reasons.
- Pull the keys from the TPM. This can be done, but requires an electron microscope and some serious expertise in hardware reverse engineering. Rumor is you can pay someone in China to do it for around $100k, but while possible, I wonder if any of the companies will go this expensive, and likely super illegal, route.
- Exploit a vulnerability in the bootloader or other very low-level firmware. This is the most likely, but as Rux and a couple others in this thread know, that sort of vuln might be worth more to sell itself than the money they'd make selling tuners.

There's a chance for some other side-channel spectre-style attacks, but I don't know if those can scale to to a manufacturing level needed.

I also guess there's also maybe a way to just effectively replicate the full DME functionality in their own software, and just sign and flash it themselves to the DME. Maybe that's the most realistic option? Sounds like a lot of work though.

Actually, now that I'm thinking about it, completely theoretical, but maybe you could wire in some sort of sidechannel processor that exploits a Runtime vulnerability after the bootloader has been verified and launched? That would allow them to leverage easier to find elevation of priv vulns in the software, and maybe even respond to Ota updates? I've never even heard of such a thing, so there's probably a reason I've never seen it 😅

[iiSonnyii]

Originally Posted by G_B58

I'd heard that the major ones might skip the 2021, and focus on the new g80/g82, possibly to come back later or might not be worth it for them.

We share the same ECU as the g80 with slight difference to programs. I believe if the g80/82 is unlock it would be ours would be on the same boat.

[evan103207]

Hey guys, MissionTuning has posted an intriguing disclaimer on their website

[serg1282]

Originally Posted by evan103207

Hey guys, MissionTuning has posted an intriguing disclaimer on their website

Amazing news

[kuzdu]

Originally Posted by evan103207

Hey guys, MissionTuning has posted an intriguing disclaimer on their website

Can't wait, so far the JB4 is holding up...but im sure the bootmod3 stage2 with e30 is a killer.

[m240nj]

Originally Posted by evan103207

Hey guys, MissionTuning has posted an intriguing disclaimer on their website

Amazing news! Looks like I'll have to decide soon whether or not I'm feeling adventurous enough to tune my lease...

[Rux]

I Don't believe it. Sorry. If it is true, it is a hardware "hack" because a software flash will be patched, pushed. Bosch is on contract for 5 years to fix these. But hey, I will hope its true and I am proven wrong.

[tarrant64]

Originally Posted by Rux

I Don't believe it. Sorry. If it is true, it is a hardware "hack" because a software flash will be patched, pushed. Bosch is on contract for 5 years to fix these. But hey, I will hope its true and I am proven wrong.

I have no issues with your perspective - I tend to be more optimistic personally but I get it.

That said, it also requires that Bosch knows what was done in order to bypass what protocols they had in place. Let's not give some of these companies too much credit on how secure their platforms are.

[serg1282]

Originally Posted by tarrant64

I have no issues with your perspective - I tend to be more optimistic personally but I get it.

That said, it also requires that Bosch knows what was done in order to bypass what protocols they had in place. Let's not give some of these companies too much credit on how secure their platforms are.

Mission also has a history of successfully unlocking these DMEs.

[carguy19]

Beta testing... = they already have cars tuned. So they are in already.

Just saying.

[kuzdu]

Originally Posted by serg1282

Mission also has a history of successfully unlocking these DMEs.

Will this be across the board for bootmod3 and mhd?

[iiSonnyii]

Originally Posted by kuzdu

Will this be across the board for bootmod3 and mhd?

Once there is an unlock, you should be able to use either platforms.

[Rux]

Originally Posted by serg1282

Mission also has a history of successfully unlocking these DMEs.

The difference is the ability to OTA push and the ability to remotely relock the DME. I will have faith however and hope it is simple, fast and safe.

[Banana Clipper]

Originally Posted by Rux

The difference is the ability to OTA push and the ability to remotely relock the DME. I will have faith however and hope it is simple, fast and safe.

I wonder if they have anything to block the connection to BMW servers. Perhaps something to make BMW believe the car is off