[MissionPerformance]

Highlights

2019 and 2020 have been very difficult and unsettling years for all of us. As if COVID was not enough, Bosch (manufacture of most modern day engine control modules) decided to hit us with the most secure anti-tuning lock there has ever been. Not only did they release all new bootloaders(software) with increased tuning protection, but this time they ended up going one step further and created a bulletproof hardware (to put it in simple terms) to go with the package, cutting off engine tuning at the source. But to us at Mission Performance, difficult is Never impossible. So with that mindset, we have spent the last 6+ month hard at work, looking for all and any methods of bypassing Bosch security, just like we have always done so in the past.
Fried and bricked DMEs, sleepless nights, and 100s of phone from customers calls asking about 2021 DME locks, we finally can take a deep breath and say this: "2021 DME is not longer an obstacle to Mission Performance".


Aside from 2021 breakthrough, we are also happy to announce that our proprietary mFlasher platform is getting a make-over and is migrating to iOS devices. After years in the making, the mFlasher is currently in private beta testing and scheduled to go into public mid September 2021. As we get closer to that date, a dedicated thread will be created with all the info, but expect something grand! And to give a little hint, NO, this is not an "OTS" or "canned" type of platform, as we are painfully allergic to that style of "tuning".



More In Depth on 2021 DMEs

Some small/yet important key points for the 2021+ DMEs:

1) At this moment, this is an OBD port unlock solution with no need to remove DME from the vehicle.

2) Just like with previous generations, end user will have ability to go back to stock or flash to modified file at any given moment.

3) Full Checksum and CVN correction. Undetectable to any diagnostic equipment.

4) Will it void my warranty? Please refer to the Dealer Warranty info at the bottom of the post.


Now to the most asked question: When can I have it?
There is a great saying in many cultures which goes: "There is no honor among thieves". Not only is it true, it also applies applies well in the tuning world as there truly no honor among hackers. Only few select people/companies in this niche market respect and understand Intellectual Property rights, and have enough decency to refrain from "stealing" from other tuners. Since we went main stream years ago, we have always been the first to the market with the new product including OBD unlocking first Fxx B58 DMEs, F97 AWD->RWD flashing, hybrid range extension flashing, first OBD M340i flashing and list just goes on. One thing that all of our innovations had in common is the fact that someone else "developed" an identical solution days after public release. Sadly, that is not a pun or a joke, but a cold fact that has been proven time after time.

With that that being said, we have learned our lesson and will not be making this unlock available to public until either one of these 3 things happen:
1) We are able to fully secure the unlock process against data-loggers so no user can log traffic and reverse engineer our process. (Also applies to BMW engineers as that is how the tuning "locks" are created by BMW)
2) Any other major company puts in the hard work and unlocks these 2021 DMEs over OBD2 port with no need to Bench Flash.
3) You, the end users, group up together and force every public tuning company to sign a non compete agreement for the 06/2020+ DMEs. Yeah I know, that's a wishful thinking but worth a try.

Direct OBD flashing unlocking put aside, if Bench Unlocking comes out in the near future, we will be offering tuning support for all 2021+ bench unlocked DMEs (as we do now), just not an initial OBD2 unlock.

Please, do not call in asking for us to release it to you for testing. It just won't happen. Though if you are interested in joining our customer wait list, please email your full VIN and Name to: "upcoming_products@missiontuning.com". You will be added to the list and once unlock is released, you will be notified.



Now to the second most asked question: "What happens to my Warranty?"

We have went over the warranty aspect many times before, but lets give this one more shot and lay this subject to rest.

Any Modification to the vehicle, big or small, can void a part of your warranty. Be it muffler change, speaker upgrade or putting on an air ride. But order for the dealer to void your warranty, dealer has to prove that this specific modification is a direct reason your are experiencing the failure.

Example: Installation of aftermarket subs in the trunk can not be a reason for voided warranty of failed transmission. However, improperly installed amplifier/subs that cause extreme voltage spikes (think about giant subs pulling KWs of energy), can void your transmission warranty if dealer can prove that during trans failure, your voltage dropped below certain point.


Void Warranty Vs "Detectability"
There are quite a few manufactures of aftermarket tuning products claiming that their product is not detectable to a dealer. Yes, that can be very much so as dealer won't be able to tell you what product you had installed (unless of course you left the product in when you took the car to dealer) at the time of failure, but what the dealer WILL in all certainty be able to tell is the fact that your vehicle was performing above preset parameters at time of failure.

As of later 2019, BMW no longer checks your Engine or Transmission modules for checksums/CVNs and other fingerprints of modified files. What they do now is check your acceleration, boost, airmass, and 20+ other parameters. They read those values from few modules around the car, one of them is being ABS.
One of the most important parameters ABS records now is air mass flow and acceleration values. Each time the vehicle is plugged into the dealer tool (ISTA), all of these values are read out and compared against a database values for specific chassis. If these values pass the preset parameters (of course account for % of error), ISTA throws an internal error code "Suspected Engine Tuning" and flags your vehicle on internal database. Of course BMW will not use this as a reason to void your navigation, headlights or most body parts warranty claims, but rest assured that if your turbo fails, you will be presented with a fat bill and warranty be denied based on that flag along.

But what about piggyback boxes that claim undetectable????
Ask yourself this simple question: "By installing this box, did my vehicle become noticeably faster?"
If you answered "YES", then congratulations, your box works as advertised but you just passed acceleration threshold and now you are flagged.
If you answered "NO", then congratulations, your warranty is probably still intact, but you paid $$$ for a useless gizmo box.

Either way you turn it, remember that BMW is smart and has teams of engineers working on detecting any tuning or modifications. And no, a piggyback can not trick or block acceleration reading since ABS picks up that data directly from speed sensors in each wheel as well as uses GPS to eliminate false positives readings, such as dyno runs. If anything, unlike proper flash tuning, piggy back leaves minor evidence of being plugged into the wastegate/boost sensors. Those small traces/marks on physical sensor (and fact that now BMW is starting to mark these sensors with dab of paint) is usually enough for a dealer to know that the car was modified, way before they pull acceleration data.

Moral of the warranty story: Got to pay to play. The moment you made your vehicle accelerate faster, by any means, then it is supposed to, you get flagged. So in the end of the day, forget about warranty question and assume your warranty VOID. For a vehicle that is used like it is supposed to and does not get transported from dyno to dyno, your real question should not be who makes the most power, but instead "who did Toyota TRD choose to tune the first pre-production Supra and most importantly, Why."




And Finally, the long awaited Proof Of Concept Video.
This is a 2021 BMW X5 45e (10/2020 production) with the so called "locked" DME.
A quick and dirty, uncut and unedited video of our platform able to unlock and upload our modified file, raising the sport gauges from 400hp (Stock) to 560(Modified of course). And just like in video, no smoke or mirrors. Real car, real product, to real results.

[TruthOne]

[IMG]https://media3.giphy.com/media/nNrkg...w.gif&ct=g[/IMG]

[M340_pilot]

Congrats!

[evan103207]

Excellent Work

[m240nj]

Great work guys!

[Musaabi]

Originally Posted by MissionPerformance

[SIZE="6"]Highlights[/SIZE]

2019 and 2020 have been very difficult and unsettling years for all of us. As if COVID was not enough, Bosch (manufacture of most modern day engine control modules) decided to hit us with the most secure anti-tuning lock there has ever been. Not only did they release all new bootloaders(software) with increased tuning protection, but this time they ended up going one step further and created a bulletproof hardware (to put it in simple terms) to go with the package, cutting off engine tuning at the source. But to us at Mission Performance, difficult is Never impossible. So with that mindset, we have spent the last 6+ month hard at work, looking for all and any methods of bypassing Bosch security, just like we have always done so in the past.
Fried and bricked DMEs, sleepless nights, and 100s of phone from customers calls asking about 2021 DME locks, we finally can take a deep breath and say this: "2021 DME is not longer an obstacle to Mission Performance".


Aside from 2021 breakthrough, we are also happy to announce that our proprietary mFlasher platform is getting a make-over and is migrating to iOS devices. After years in the making, the mFlasher is currently in private beta testing and scheduled to go into public mid September 2021. As we get closer to that date, a dedicated thread will be created with all the info, but expect something grand! And to give a little hint, NO, this is not an "OTS" or "canned" type of platform, as we are painfully allergic to that style of "tuning".



[SIZE="6"]More In Depth on 2021 DMEs[/SIZE]

Some small/yet important key points for the 2021+ DMEs:

1) At this moment, this is an OBD port unlock solution with no need to remove DME from the vehicle.

2) Just like with previous generations, end user will have ability to go back to stock or flash to modified file at any given moment.

3) Full Checksum and CVN correction. Undetectable to any diagnostic equipment.

4) Will it void my warranty? Please refer to the Dealer Warranty info at the bottom of the post.


[SIZE="5"]Now to the most asked question:[/SIZE] [SIZE="5"]When can I have it[/SIZE]?
There is a great saying in many cultures which goes: "There is no honor among thieves". Not only is it true, it also applies applies well in the tuning world as there truly no honor among hackers. Only few select people/companies in this niche market respect and understand Intellectual Property rights, and have enough decency to refrain from "stealing" from other tuners. Since we went main stream years ago, we have always been the first to the market with the new product including OBD unlocking first Fxx B58 DMEs, F97 AWD->RWD flashing, hybrid range extension flashing, first OBD M340i flashing and list just goes on. One thing that all of our innovations had in common is the fact that someone else "developed" an identical solution days after public release. Sadly, that is not a pun or a joke, but a cold fact that has been proven time after time.

With that that being said, we have learned our lesson and will not be making this unlock available to public until either one of these 3 things happen:
1) We are able to fully secure the unlock process against data-loggers so no user can log traffic and reverse engineer our process. (Also applies to BMW engineers as that is how the tuning "locks" are created by BMW)
2) Any other major company puts in the hard work and unlocks these 2021 DMEs over OBD2 port with no need to Bench Flash.
3) You, the end users, group up together and force every public tuning company to sign a non compete agreement for the 06/2020+ DMEs. Yeah I know, that's a wishful thinking but worth a try.

Direct OBD flashing unlocking put aside, if Bench Unlocking comes out in the near future, we will be offering tuning support for all 2021+ bench unlocked DMEs (as we do now), just not an initial OBD2 unlock.

Please, do not call in asking for us to release it to you for testing. It just won't happen. Though if you are interested in joining our customer wait list, please email your full VIN and Name to: [SIZE="4"]"upcoming_products@missiontuning.com"[/SIZE]. You will be added to the list and once unlock is released, you will be notified.



[SIZE="5"]Now to the second most asked question:[/SIZE] [SIZE="5"]"What happens to my Warranty?"[/SIZE]

We have went over the warranty aspect many times before, but lets give this one more shot and lay this subject to rest.

Any Modification to the vehicle, big or small, can void a part of your warranty. Be it muffler change, speaker upgrade or putting on an air ride. But order for the dealer to void your warranty, dealer has to prove that this specific modification is a direct reason your are experiencing the failure.

Example: Installation of aftermarket subs in the trunk can not be a reason for voided warranty of failed transmission. However, improperly installed amplifier/subs that cause extreme voltage spikes (think about giant subs pulling KWs of energy), can void your transmission warranty if dealer can prove that during trans failure, your voltage dropped below certain point.


[SIZE="4"]Void Warranty[/SIZE] Vs [SIZE="4"]"Detectability" [/SIZE]
There are quite a few manufactures of aftermarket tuning products claiming that their product is not detectable to a dealer. Yes, that can be very much so as dealer won't be able to tell you what product you had installed (unless of course you left the product in when you took the car to dealer) at the time of failure, but what the dealer WILL in all certainty be able to tell is the fact that your vehicle was performing above preset parameters at time of failure.

As of later 2019, BMW no longer checks your Engine or Transmission modules for checksums/CVNs and other fingerprints of modified files. What they do now is check your acceleration, boost, airmass, and 20+ other parameters. They read those values from few modules around the car, one of them is being ABS.
One of the most important parameters ABS records now is air mass flow and acceleration values. Each time the vehicle is plugged into the dealer tool (ISTA), all of these values are read out and compared against a database values for specific chassis. If these values pass the preset parameters (of course account for % of error), ISTA throws an internal error code "Suspected Engine Tuning" and flags your vehicle on internal database. Of course BMW will not use this as a reason to void your navigation, headlights or most body parts warranty claims, but rest assured that if your turbo fails, you will be presented with a fat bill and warranty be denied based on that flag along.

[SIZE="4"]But what about piggyback boxes that claim undetectable[/SIZE]????
Ask yourself this simple question: "By installing this box, did my vehicle become noticeably faster?"
If you answered "YES", then congratulations, your box works as advertised but you just passed acceleration threshold and now you are flagged.
If you answered "NO", then congratulations, your warranty is probably still intact, but you paid $$$ for a useless gizmo box.

Either way you turn it, remember that BMW is smart and has teams of engineers working on detecting any tuning or modifications. And no, a piggyback can not trick or block acceleration reading since ABS picks up that data directly from speed sensors in each wheel as well as uses GPS to eliminate false positives readings, such as dyno runs. If anything, unlike proper flash tuning, piggy back leaves minor evidence of being plugged into the wastegate/boost sensors. Those small traces/marks on physical sensor (and fact that now BMW is starting to mark these sensors with dab of paint) is usually enough for a dealer to know that the car was modified, way before they pull acceleration data.

Moral of the warranty story: Got to pay to play. The moment you made your vehicle accelerate faster, by any means, then it is supposed to, you get flagged. So in the end of the day, forget about warranty question and assume your warranty VOID. For a vehicle that is used like it is supposed to and does not get transported from dyno to dyno, your real question should not be who makes the most power, but instead "who did Toyota TRD choose to tune the first pre-production Supra and most importantly, Why."




[SIZE="6"]And Finally, the long awaited Proof Of Concept Video. [/SIZE]
This is a 2021 BMW X5 45e (10/2020 production) with the so called "locked" DME.
A quick and dirty, uncut and unedited video of our platform able to unlock and upload our modified file, raising the sport gauges from 400hp (Stock) to 560(Modified of course). And just like in video, no smoke or mirrors. Real car, real product, to real results.

I've been waiting for this since October when I brought my car in to mission and found out I was a month build too late to get the unlock. Totally stoked! Congrats chenry time to put the 21 to test vs yours

[Patgilm]

Awesome work Alex.

[BobTheBimmer]

Congratulations!! This news just made 2021 a helluva lot better. My hat goes off to you good sir!

[ALotOfKirbys]

Congrats and my email is sent.

[Voodoo_G80]

Didn’t doubt it! Congrats!

[mattssi]

So awesome!

[Holset]

Congrats Nice work!

You guys are good at this cracking stuff any chance that you give a shot at cracking the ZF tcu for 6/2019 and later cars?

[Pantagathus]

Not going to lie, reading this gave me a semi

[Vmaxx]

Very nice. Amazing work! Can you provide any type of estimate or time window when you expect to have this protected and launched to us public users?

[m240nj]

Curious if there will be any tuneability to the mild hybrid system to get more power off the line. Also curious if exhaust sound can be restored to the 2021 to make them sound more like the 2020 while being fully undetectable to the dealer since it sounds like tunes can really only be detected by power increases.

[Vmaxx]

Originally Posted by m240nj

Curious if there will be any tuneability to the mild hybrid system to get more power off the line. Also curious if exhaust sound can be restored to the 2021 to make them sound more like the 2020 while being fully undetectable to the dealer since it sounds like tunes can really only be detected by power increases.

I’m going to say no and no, but just IMO. Alex has never been big on burble or pops and bangs in tunes. For hybrid to offer more power I would imagine we need more battery power and some more than 48v.

[kuzdu]

will this work for the 21 M240 as well?

[mattssi]

And more importantly the g80!?

[MissionPerformance]

Originally Posted by mattssi

And more importantly the g80!?

This solution works on ALL currently released 06/2020+ firmwares, including the G80 and 2021 F97.

[MuffinFlavored]

Alex/Misha,

> 1) We are able to fully secure the unlock process against data-loggers so no user can log traffic and reverse engineer our process. (Also applies to BMW engineers as that is how the tuning "locks" are created by BMW)

You know as well as I do this will never happen.

I see you chose a 2021 X5. That's the MPC style MG1, right? Not the Aurix? Does your OBD solution work for Aurix as well? If it isn't for Aurix, this means you can't do any of the new M3/M4/X3M/M340i, correct? Looks like BMW has yet another bug in their CBOOT BTLD. As soon as you release it (which it sounds like you won't, for good reason), they will patch it. They are one of the only companies I know that pays attention to aftermarket solutions and makes patches in near real time.

I would highly suggest making a video of you either doing an MG1 AURIX car, and/or actually turning the engine all the way on to a running state if all you want out of all of your hard work (and intelligence) is fame/credit.

From the video:

SWFLD: 6253: 080_040_102
SWFLP: 5D55: 080_040_007
BTLD: 6198: 001_025_003
CAFD: 2742: 001_005_0526

Interesting BTLD version. I've also seen this one in the wild lately, but on the AURIX side.

CB_011_253.23.0.0

#DME_86T0#D0#BTL#MDG1G_35up-CB_011_253.23.0.0#MG1CS049_35up

Also in case anybody hasn't seen it, bFlash seems to be boasting they can read (bench?) G80: https://www.facebook.com/BCConsultin...176831/?type=3

[MissionPerformance]

Originally Posted by MuffinFlavored

Alex/Misha,

> 1) We are able to fully secure the unlock process against data-loggers so no user can log traffic and reverse engineer our process. (Also applies to BMW engineers as that is how the tuning "locks" are created by BMW)

You know as well as I do this will never happen.

I see you chose a 2021 X5. That's the MPC style MG1, right? Not the Aurix? Does your OBD solution work for Aurix as well? If it isn't for Aurix, this means you can't do any of the new M3/M4/X3M/M340i, correct? Looks like BMW has yet another bug in their CBOOT BTLD. As soon as you release it (which it sounds like you won't, for good reason), they will patch it. They are one of the only companies I know that pays attention to aftermarket solutions and makes patches in near real time.

I would highly suggest making a video of you either doing an MG1 AURIX car, and/or actually turning the engine all the way on to a running state.

From the video:

SWFLD: 6253: 080_040_102
SWFLP: 5D55: 080_040_007
BTLD: 6198: 001_025_003
CAFD: 2742: 001_005_0526

Interesting BTLD version. I've also seen this one in the wild lately, but on the AURIX side.

CB_011_253.23.0.0

#DME_86T0#D0#BTL#MDG1G_35up-CB_011_253.23.0.0#MG1CS049_35up

No idea who "Misha" is, but yes my name is Alex.

1) Yes there are ways and BMW is currently already implementing a tool-to-vehicle encryption channel (think about SSL on your browser). If we are able to implement that as well, then no datalogging of the actual protocol will be possible.

2) You mentioned BTLD 6198 from the video. Good job for noticing that, and that means you actually can differentiate Bootloader/Prog/Data. What that also means is that you should be able to scroll down the official xml for that bootloader "btld_00006198.xml.001_025_003" (you did get the DME info from that file which you posted) and you will see this line: "<TARGET-START-ADDRESS>80028100</TARGET-START-ADDRESS>". Look at that address and please tell everyone up here, does it belong to Aurix or PPC family? Hint Hint look at memory layout table at the address.
Or better yet, open up the corresponding program xml "swfl_00005d55.xml.080_040_007" and look for requisite or reference field. What do we see there?
<br>$DIF_Ref1: btld-00004294-001.025.003</br>
<br>$DIF_Ref2: btld-00004295-001.025.003</br>
<br>$DIF_Ref3: btld-000048dc-001.025.003</br>
<br>$DIF_Ref4: btld-00005d53-001.025.003</br>
<br>$DIF_Ref5: btld-00006198-001.025.003</br>

Reference 5 is our bootloader used on all 21 G05 hybrids, as and probably other 21 hybrids. But what do you see for reference "REF3"? Oh, that's the typical M340i 0x48DC bootloader, which is once again AURIX, and not PPC.

So please, before speaking out and trying to play conspiracy theory, Please do some research ahead of time and make sure that what you are saying is Correct and True.

P.S. I see you edited your original post and yes, I'm sure you have seen the 6198 on Aurix, since it ONLY belongs to Aurix just like proven in the response above.

[carguy19]

So it doesn't say when we can actually have it in the when can we actually have it section.