[RomeyRome]

Went digging some more to see where com.bmw.psdz.jobs.uds.MCD3_AuthenticateECUforBLUpdate comes from.

Extracted PSDZ_JOBS.jar from psdzdata (each base model has its own).
Decompiled com/bmw/psdz/jobs/uds/AbstractAuthenticateECUforFlashOrBLUpdateOrHDDUpdate.classs (MCD3_AuthenticateECUforBLUpdate just calls that one)

I edited it to just skip it all and return JobErrorCode.NO_ERROR
That got me past the THAT error it, but as soon as it moves on to do any actual flashing, it gets 'securityAccessDenied'. I was hoping it was just some kind of "check" that could be skipped, but nope.

Attached are the 2 relevant classes as they came out of the jadx decompiler. Java is not my native language, so maybe someone else can get a better picture of what it's actually doing.

To recompile the class, you just need PSDZ_JOBS.jar and asam-api-2.0.2-bmw2.jar in your classpath. asam-api in in you esys/lib/3rd-party directory. Then just drop it back into the jar.

[Matthew53]

Load _UDS_DEV.prg and run zgw_status_ethernet and see if there is ethernet connection from HU to ZGW

[RomeyRome]

Load _UDS_DEV.prg and run zgw_status_ethernet and see if there is ethernet connection from HU to ZGW

Appears to be. I've tried it through gateway, as well as direct to to switch on 169.254./16

Code:

apiJob("_DEV_UDS","zgw_status_ethernet","","")


Satz : 0
  OBJECT                          = _dev_uds
  SAETZE                          = 161
  JOBNAME                         = zgw_status_ethernet
  VARIANTE                        = _DEV_UDS
  JOBSTATUS                       = 
  UBATTCURRENT                    = -1
  UBATTHISTORY                    = -1
  IGNITIONCURRENT                 = -1
  IGNITIONHISTORY                 = -1
Satz : 1
  STAT_HU_LINK_TEXT               = HU Link ok
  STAT_HU_AUTO_NEGOTIATION_TEXT   = HU Auto-Negotiation erledigt
  STAT_HU_MDI_X_TEXT              = HU MDI
  STAT_HU_FAR_END_TEXT            = HU kein Far-End Fault Status gefunden
  STAT_HU_LINK_DUPLEX_TEXT        = HU Link ist Full-Duplex
  STAT_HU_LINK_GESCHW_TEXT        = HU Link Geschwindigkeit: 100Mbps
  STAT_OBD_LINK_TEXT              = OBD Link ok
  STAT_OBD_AUTO_NEGOTIATION_TEXT  = OBD Auto-Negotiation erledigt
  STAT_OBD_MDI_X_TEXT             = OBD MDI-X
  STAT_OBD_FAR_END_TEXT           = OBD kein Far-End Fault Status gefunden
  STAT_OBD_LINK_DUPLEX_TEXT       = OBD Link ist Full-Duplex
  STAT_OBD_LINK_GESCHW_TEXT       = OBD Link Geschwindigkeit: 100Mbps
  STAT_PHY_LINK_TEXT              = Kein Phy verbaut
  STAT_PHY_REMOTE_TEXT            = Kein Phy verbaut
  STAT_SMI_REGISTER_ID            = 0                 00 00  ..                    
  STAT_SMI_REGISTER_INHALT        = 0088

Code:

apiJob("_DEV_UDS","zgw_status_get_ipconfig","","")


Satz : 0
  OBJECT                          = _dev_uds
  SAETZE                          = 1
  JOBNAME                         = zgw_status_get_ipconfig
  VARIANTE                        = _DEV_UDS
  JOBSTATUS                       = 
  UBATTCURRENT                    = -1
  UBATTHISTORY                    = -1
  IGNITIONCURRENT                 = -1
  IGNITIONHISTORY                 = -1
Satz : 1
  STAT_FORMAT                     = 0                    00  .                     
  STAT_IPADDRESS                  = 169.254.199.200
  STAT_NETMASK                    = 255.255.0.0
  STAT_GATEWAY                    = 169.254.199.99
  JOB_STATUS                      = OKAY
  _REQUEST                        = 3 Bytes
    0000 : 22 17 2A                                           ".*
  _RESPONSE                       = 16 Bytes
    0000 : 62 17 2A 00 A9 FE C7 C8   FF FF 00 00 A9 FE C7 63  b.*.©þÇÈ  ÿÿ..©þÇc

[Matthew53]

Ok, I think you'll not be able to do anything by OBD. You'd need to write a dump to GL01GS

[RomeyRome]

Ok, I think you'll not be able to do anything by OBD. You'd need to write a dump to GL01GS

Where do I get an appropriate dump?

Also, I've extracted the btld file from psdzdata. Seems like all the tools and images needed to flash the bootloader. Anything useful in there? (image attached) I can ssh into the unit and copy stuff to it, execute, etc.

[BMW-GUO]

Ok, I think you'll not be able to do anything by OBD. You'd need to write a dump to GL01GS

Where do I get an appropriate dump?

Also, I've extracted the btld file from psdzdata. Seems like all the tools and images needed to flash the bootloader. Anything useful in there? (image attached) I can ssh into the unit and copy stuff to it, execute, etc.

How did you extract btld?

[RomeyRome]

Ok, I think you'll not be able to do anything by OBD. You'd need to write a dump to GL01GS

Where do I get an appropriate dump?

Also, I've extracted the btld file from psdzdata. Seems like all the tools and images needed to flash the bootloader. Anything useful in there? (image attached) I can ssh into the unit and copy stuff to it, execute, etc.

How did you extract btld?

nbt_unpack from the attached blog url. Just drag & drop the file on the exe.

[m5proud]

Maybe stupid advice, but did you switch off "ParallelPrograming Mode"?

Use FA of F30 to flash and and than code to F02

From my expirience, it is better to use HW 3.1 HU instead of 4.1

[laquangksxd]

Your nbt evo was broken btld when you V850. The easiest way for you to fix the problem is to backup (adjbock I use hutool pro 3.9). Then write dumps (C, DFLASH) from the same 1 nbt evo (using vvdi prog). After nbt evo works write back to adjbock (purpose to reuse old hdd, hdd is locked by serial number, mac..). This is the sure way to solve your problem.

[Arturino]

@RomeyRome Have you resolved the issue?