ATTENTION !! Users which have not any posts were deleted !
  1. AutoHex II

  2. New Emulator

  3. Immo Bypass

  4. Julie Emulator

  5. AUTO-CHIPS



Solved ✔ EWS3 ME7.2 Location 4
21-08-2018, 17:38 PM, (This post was last modified: 23-08-2018, 10:57 AM by volavka.)
Post: #1
XZBMW  EWS3 ME7.2 Location 4
Can anyone tell me what hex offset EWS location is at?

I have read conflicting information and havent had any good results yet


One is supposed to be located at 0x5A (if read is partial read through galletto) you can toggle this from 0->1 and EWS is off ??? Not working


Another way is to "virginize" DME but Only solution documented is via BDM =
Clear master side 0x4800->0X5D11
clear master side 0x5D50->0x7FFF

Clear slave side 0x3FE4->0X5D00
Clear slave side 0x0x5D80->0x7fff

This will put DME in "virgin" state and can be updated with WinFKP with your VIN and aligned with EWS in INPA

Can anyone comment EWS3 byte location for me7.2 BMW


Solution is as follows
(21-08-2018, 19:38 PM)Enabled Wrote:  Where do you get your info? Almost all of that is wrong or more difficult.

Read ME7.2 in boot mode, 29F400 flash:


Just write FF from 0xFD3C to 0xFD43, and/or 0x1FD3C to 0x1FD43 and/or 0x3FD3C to 0x3FD43...

run the one time EWS sync, and start car.
Quote this message in a reply
21-08-2018, 19:38 PM, (This post was last modified: 21-08-2018, 19:40 PM by Enabled.)
Post: #2
RE: EWS3 ME7.2 Location
Where do you get your info? Almost all of that is wrong or more difficult.

Read ME7.2 in boot mode, 29F400 flash:


Just write FF from 0xFD3C to 0xFD43, and/or 0x1FD3C to 0x1FD43 and/or 0x3FD3C to 0x3FD43...

run the one time EWS sync, and start car.
Reputation: +2 - volavka [+2]
Quote this message in a reply
[-] The following 2 users say Thank You to Enabled for this post:
  • sniper24, volavka
21-08-2018, 20:05 PM, (This post was last modified: 21-08-2018, 20:09 PM by mugenman1111.)
Post: #3
RE: EWS3 ME7.2 Location
(21-08-2018, 19:38 PM)Enabled Wrote:  Where do you get your info? Almost all of that is wrong or more difficult.

Read ME7.2 in boot mode, 29F400 flash:


Just write FF from 0xFD3C to 0xFD43, and/or 0x1FD3C to 0x1FD43 and/or 0x3FD3C to 0x3FD43...

run the one time EWS sync, and start car.

TBH I have a feeling this info i have gathered is from the wrong DME but on bimmerforums only place i could find

This will allow me to sync (or clear ISN but how to just disable EWS on ms43 it is a 60 00 string and you toggle 00 to 01 i believe.... dont quote me\)

I am not unfamiliar with disassembly but couldnt get IDA to play with my .bin properly
Quote this message in a reply
22-08-2018, 02:27 AM, (This post was last modified: 22-08-2018, 02:28 AM by Enabled.)
Post: #4
RE: EWS3 ME7.2 Location
EWS delete on MS42, MS43, and ME 7.2 are difficult programming code hacks (=requires programming experience). None of them are a few simple byte changes. But they're easy to virginize. Looking at your other posts, I see you have done a boot mode, so you're halfway there.
Reputation: +3 - volavka [+2] , mugenman1111 [+1]
Quote this message in a reply
[-] The following 2 users say Thank You to Enabled for this post:
  • mugenman1111, volavka
22-08-2018, 15:18 PM, (This post was last modified: 22-08-2018, 15:23 PM by mugenman1111.)
Post: #5
RE: EWS3 ME7.2 Location
(22-08-2018, 02:27 AM)Enabled Wrote:  EWS delete on MS42, MS43, and ME 7.2 are difficult programming code hacks (=requires programming experience). None of them are a few simple byte changes. But they're easy to virginize. Looking at your other posts, I see you have done a boot mode, so you're halfway there.

Boot mode was easy enough once I found some documentation on the pinout. Have cloned my DME to another unit as well as cloned my EWS off DME to another unit.... was just more curious to look at the EWS structuring but i presume i will have to dis assemble the binary to dig into that stuff


I have a ews off 7.2 for my main vehicle was more curious to investigate things in a diff styled format on my me7.2 stock dump vs my EWS off dump (my ews module is broken )

Ill keep digging in my stock vs EWS off dump and see if i cant figure it out eventually wink

having a hell of a time getting IDA to work with these binary files.

I presumed it had something to do with deleting the way the DME stores the rolling code blocks

I dabble in software engineering for fun and have done a lot of low level programming of kernel stuffs for linux / cell phones

This is just another puzzle to figure out. I thank you for pointing to me it is not as simple as a single byte switch that makes my hunt a little easier than searching for a single byte difference and testing that way.
Quote this message in a reply
22-08-2018, 16:09 PM,
Post: #6
RE: EWS3 ME7.2 Location
You already have ME7.2 ews flash somewhere? I'm curious.
Quote this message in a reply
22-08-2018, 16:28 PM,
Post: #7
RE: EWS3 ME7.2 Location
(22-08-2018, 16:09 PM)Enabled Wrote:  You already have ME7.2 ews flash somewhere? I'm curious.

Check PM biggrin
Quote this message in a reply
23-08-2018, 00:52 AM,
Post: #8
RE: EWS3 ME7.2 Location
Not sure of forum etiquette but this can be closed / marked as resolved
Quote this message in a reply
25-08-2018, 10:32 AM,
Post: #9
XZBMW  RE: EWS3 ME7.2 Location 4
(22-08-2018, 16:28 PM)mugenman1111 Wrote:  
(22-08-2018, 16:09 PM)Enabled Wrote:  You already have ME7.2 ews flash somewhere? I'm curious.

Check PM biggrin
I am fighting with ME7.2 ews off too, can i have that .bin too? tears
Quote this message in a reply
28-08-2018, 21:23 PM,
Post: #10
RE: EWS3 ME7.2 Location 4
(25-08-2018, 10:32 AM)Kisu1337 Wrote:  
(22-08-2018, 16:28 PM)mugenman1111 Wrote:  
(22-08-2018, 16:09 PM)Enabled Wrote:  You already have ME7.2 ews flash somewhere? I'm curious.

Check PM biggrin
I am fighting with ME7.2 ews off too, can i have that .bin too? tears

You never PM me back???secret
Quote this message in a reply
[-] The following 1 user says Thank You to mugenman1111 for this post:
  • volavka


Possibly Related Threads…
Thread Author Replies Views Last Post
  2011 audi a7 immo eeprom location Sandmanrr 3 295 26-02-2020, 17:51 PM
Last Post: rexercio
XZBMW Mini R56 MED17.2 Isn Location cclaypool16 9 662 21-02-2020, 15:26 PM
Last Post: 16eddi67
XZBMW Ews3 check dump Silva1337 3 663 24-11-2019, 16:17 PM
Last Post: petru
  W212 CGW location labik 2 497 18-10-2019, 14:37 PM
Last Post: labik
XZBMW BMW ISN location DDE626 neils 8 1,364 21-09-2019, 08:59 AM
Last Post: PsiDOC
XZBMW Please IMMO OFF bmw E39 EWS3 bialyf01 6 1,003 07-09-2019, 22:56 PM
Last Post: Enabled
XZBMW EWS3 to new DDE5.0 sync brzoza750 3 656 25-06-2019, 17:53 PM
Last Post: ltujustas
  can gateway location in porsche? salaausi 0 273 20-05-2019, 06:44 AM
Last Post: salaausi
  IMMO chip location donkorgyane 7 664 19-04-2019, 09:38 AM
Last Post: donkorgyane
  w164 2008 zgs Location help savoy81 2 362 16-04-2019, 09:43 AM
Last Post: savoy81

Forum Jump:


Users browsing this thread:
1 Guest(s)

Return to TopReturn to Content