E46 Fanatics Forum banner

The day has arrived! By tonight,i will make one last attempt to break bmws ews system

21K views 53 replies 15 participants last post by  neutron325 
#1 · (Edited)
UPDATE: I was foolish and arrogant during my 2nd attempt at breaking through bmws ews system. I didn't do my homework and that's why I failed. Not this time. ROUND 3! Please scroll all the way below for more info.

Truth and speculations about lies told by bmw regarding their dme & ews. This is a prologue, telling you why I believe it's worth risking over $70 to try this experiment. If I'm right, it will free us all from the chains that bound us from our overlord, Bmw. Don't get me wrong, I love their car and I know that in order for me to be able to drive a bmw, they need to make money. That's all good but what I don't like is people making money off another in a dishonest way. Hey, if a key is going to cost me $300, then tell me that. Don't bs me and say there's a 10 key limit (which I have already proved to be not true. Well, you can't have more than 10 key active at one time but you can have more than 10 keys that was once registered to the car) and tell me that I need to have both my ews and dme switched out afterwards. Come on man. $1800?! Well bmw, i hope my hunch is right about this because if I am, this will be my show of defiance against your ruthlessness against us, the owners.

This is the link that verifies what is being said below.

The following procedure should be adhered to when replacing the EWS 3.3 control unit: Before replacing the EWS3 control unit: Leave defective control unit installed in vehicle and in the coding program (Encoding ZCS) select point "1 New coding -1 Replace control unit - 1 Read out data from defective control unit". Coding data and vehicle-specific data is read out of the EWS control unit with this part of the program and buffered in the MoDiC or DIS tester. Now install new EWS 3 control unit. After replacing the control unit: Encode new EWS 3 control unit with coding program selection point "1 New coding - 1 Replace control unit - 2 Transfer data to new control unit and encode control unit". The buffered data is now transferred and EWS - DME/DDE matching is carried out. Note The procedure described above must be adhered to as all the data necessary for vehicle identification is also stored in the EWS control unit. It will be necessary to do without the data readout from the old control unit only if the EWS 3 control unit no longer has diagnostic capabilities. Proceed as follows in this case: Install new EWS control unit in the vehicle and encode with the encoding program and selection point "1 New coding - 2 Re-encode control unit". Then carry out matching with selection point "EWS - DME/DDE matching". In this procedure, the vehicle data necessary for automatic vehicle identification cannot be written to the EWS control unit.

Replacement of engine control unit (DME/DDE)

After replacing the engine control unit, "EWS - DME/DDE matching" must be conducted with the coding program or in the diagnosis program. Important The ignition must then be switched off for at least 25 s.

Hey guys, I just found this while digging through the wds spaghetti online site looking for a schematic in the dwa section. From. What i am able to translate from what I copied and pasted up there, it seems that what bmw has been saying all along is really a lie. I think what all that is really saying is when switching out the ews, if it's still functional, all you have to do is copy the info from the mcu, and rewrite it to the new EWS or.... Why not write it to a used one? With the ak90, i can even write the vin and mileage to it, so why wouldn't that be possible? Seeing that because the ak90 allows me to add, delete, rewrite keys into whatever key # slot i want to, I wouldn't need a new EWS say for example if i reached the 10 key limit.

If for some odd reason you fry your ews unit, BMW claims your dme must also be replaced whenever you change an ews or vice versa. Now based in what was said above, it states that if you cannot obtain the old info on the ews, all you have to do is install a new EWS, program the dme to recognize that module, which, for almost every single module we know of, all you need to do is write vin and maybe mileage right? For a very long time, none of us really experimented in this area and the hardware wasn't really there for us to connect to the mcu for reading. So what makes the ews any different than say a dsc unit? Nothing really. What did you say? Something about rolling code randomization or complex technical nerd jargon that no longer sounds impressive? Why then does inpa and other software have the option to sync ews and dme code? Lol. The rolling code security feature has now transformed from incredible hulk to a fly on the wall. If at any time your key falls out of sync or you have a key that the ews recognizes and the dme doesn't (or vice versa), syncing them solves that problem.

This all leads me to conclude that all those who have had this lie pulled on them can now realize the truth. When you reached your 10 limit and bmw told you they had to switch out your dme and no, you can't just buy another ews or use a used ews was a lie. All they did was erase all the keys on your ews, rewrote in new key transponder numbers in all 10 key slots (so they can once again control this same process), happily accepted your savings, and laughed as you limped off with your tail in between your legs. I mean, did any of you even see the new units? Oh they looked new to you? If you look at my diy for the ak90 for example the computer board itself, which is covered by a plastic housing, has rarely ever been observed by 95% (or more) of bmw owners, in person with their very own eyes. How would you know? Oh because they told you they did? LOL. All they had to do was change the plastic housing on the outside and you would've never know any better. It probably costed $1 to make, $.05 if they allowed china make it.

What if you fried your ews or dme? If it was your ews, all they had to do was get a new EWS, kept your old dme, program the 10 keys to the ews and sync them together. If it was your dme that fried, they'd just get a new dme, resync it to your other modules and ews, reset the keys registered to your ews, syncing them together and done.

So if all that is possible, I don't need to repeat the obvious and tell you then that in theory, you should be able to use a used ews, and dme (this one I have yet to mess with much but should be no different than any other module) and have it programmed and synced without needing to change both. It isn't that hard, doesn't take much time, and shouldn't cost that much. But because it deals with technology that, especially when it came out, was equivalent to witchcraft. They have done a very good job keeping the lie up, which then kept a lot of people from experimenting, having psychologically implanted failure into their brain. It was a brilliant plan. I mean who in their right mind would experiment on their beloved super expensive bmw to mess with something most knew very little about to test their theory? One wrong move and your experiment fails, which then allows bmw the opportunity to implement their "fact" on your a$$ to show you a real good lesson.

Now, all I need is someone in in the Bay Area with an ews or dme issue for me to try it out on and prove my theory. Message me folks! I will do this for the 1st person with this issue for free as long as you get the parts. Let me know whats up.
 
See less See more
#2 ·
So again, if anybody in the Bay Area has ews or dme issues resulting in the need of replacing either module, please contact me so we can work out a plan to prove this theory of mine. In the meantime, I will be purchasing a used already cut key online registered already to another car as well as buying a blank uncut key with no electronic components and seeing if I can get Frankenstein to come alive. I believe that this experiment itself should be enough to prove my theory but i will proceed further in order to make my case. Stay tuned.
 
#3 · (Edited)
Here's several links to some documents that I used so you can see for yourself what I'm talking about. What this link here is saying is that it is possible to change a dme unit and use it with an old EWS. However, they're claiming that this procedure can only be done once. After that, you cannot change the dme again, or if your ews fries, you can't code another one to that used dme. This maybe true, for I can't at the moment think of a work around for this.... Yet. http://wds.spaghetticoder.org/en/zinfo/HEL0498FB1214_0EWAG.htm http://wds.spaghetticoder.org/en/zinfo/SCM0897FB466135001.htm This next link actually states that in order for me to get a different dme to be recognized by your old EWS, i have to have a working key that has been accepted by your ews. That makes sense. So because of this, I'm not sure if I'll be able to code a blank virgin transponder and key, to be accepted at the same time replacing a dme unit, although I'm sure there's a work around for that. This scenario would seem very rare however http://wds.spaghetticoder.org/en/zinfo/WAB0999FB001613501.htm
 
#4 ·
Alright so today, I went ahead and ordered a used bmw key that has already been cut. I will also order a blank uncut key with no electronic components inside. I will attempt to combine the 2 together and start my car. I will document everything as it happens. Stay tuned.
 
#5 · (Edited)
Current eta on blank key will probably be Monday and hopefully Tuesday for the used key. I really don't know what to expect to happen. I guess worse case scenario, I embarrass myself, wasted everybody's time, practically blogged a lie about a company lying, lose $70, and the only thing I'll have to remind me of all this is a bmw key ornament. I've only coded 1 bmw key prior to this, so I'm not so sure I should've put this thread on blast like this before attempting it first. I hope I'm right, for all our sakes. That means our used keys are actually going to be worth something now and most importantly, we will save money by knowing the truth. The truth is all I seek. In order for no doubt to be had with whatever my results reveal, i do not want any skeptics saying things like "ih he probably switched the chip for a working one" or something like that. To show that what I'm doing is real whether or not it succeed, I'll record the important procedure whete there will be no doubt the key I have is not fake. Again, stay tuned.
 
#6 · (Edited)
It's not referring to what you think.

The EWS modules in addition to holding the table of rolling codes also stores the VIN, mileage, and in the case of early E46s, the ZCS key. These must be copied over to the new module to ensure proper functionality, particularly for any future coding that might be necessary.

The actual table of rolling codes is hard-coded (well it's probably on an EEPROM, but the software we have doesn't give access to it). If you get a new DME, it learns the rolling codes from the EWS and commits it to permanent storage - the DME can't learn new codes. If your EWS fails, you need to order a new module and supply BMW your VIN. They will send an EWS with the set of rolling codes pre-programmed, and it should start right up. You just need to copy the other material for other functionality to work properly.

That's the case with EWS 3.3 anyway. With EWS 3.2 and earlier, the EWS table and DME tables can be synced even after the initial pairing.
 
#8 ·
Ah! At long last. I've been waiting for this day to happen for quite some time now. The infamous TerraPhantm himself. You are the reason and inspiration behind all of this. I've been following your research for quite some time now. I mean i guess I should've checked your profile but i thought for a moment, you didn't come in here anymore, being a veteran and all. I have been studying your guides as well as others for 6 months now in regards to WinKFP dme updating. Very well documented. I plan on rewriting once and for all a one stop complete compilation and guide for dme updating so even a 5 year old could update one. Without yours and others like you, trials and error, i dont think I could have pulled it off, especially when I was updating for my very first time, my laptop somehow disconnected, while I was only halfway through the update. Lol. Yeah I freaked out for a second, but of course having done my homework, easy fix. You guys made my life so much easier. I was very well prepared, thanks to you guys of course. I am honored you decided to stop by my thread. I'd be more than happy to hear your input on what I plan in doing. Is it futile? Is it even going to work? Should I quit now before I embarrass myself?
 
#9 · (Edited)
And also, what do you mean by the software "we" have? What software are you speaking about? Oh the ews vin and mileage? Lol. No biggie, or at least I think so. Lol. I don't know if it will work but if there's someone out there crazy enough to try, that's me. I think my ews is ew 3. Now that you've mentioned it, that's one thing that's troubling me about this ews issue. While probing around with mine, I was given the option to change vin and mileage but 2 options were blocked out, which I can only assume are the ZCS key you're speaking about. Now let me ask you of this would work. I know you know that the memory of zcs is stored on 2 modules. If the ZCS key is an issue, can't we use that option on pa soft that gives you the ability to sync (let's use my car as an example) either the ews over to the kmb or the kmb over to the ews. If i was using an old EWS, changed vin and mileage, then when I connected everything, used pa soft to sync and transfer zcs key from kmb over in top of the ews?
 
#12 · (Edited)
By software we have, I mean software that's publically available. I do tbink the EWS can be reprogrammed since RPM motorsports does it. Though they probably reflash an EEPROM using an external programmer.

Anyway, the point is copying the VIN, mileage, and ZCS is all DIS does when you swap in a new EWS. The car will start regardless, but there may be a tamper dot without those steps. You can't just swap in a USED EWS module simply because the rolling codes used to make a handshake with the DME aren't rewritable
 
#10 · (Edited)
Well here it is folks. The keys that we've all been waiting for. On the left, the used key that has been already cut and registered to another bmw, somewhere far away from here. The seller is purchased this from lives in new york, so I can only assume this bmw was or is still somewhere on the East coast. On the right is the remote with no electronics, just the key blade and shell. Tonight I'll be preparing myself for tomorrow when I attempt to make Frankenstein come to life. I hope this works. If it doesn't, then let this thread stay permanently etched on this Site as a reminder to all of you and myself that over a decade has passed and yet we are still unable to thwart bmw technology. That doesn't mean it's the end though. Rest assured that I will be back the day technology allows me to break through this once and for all, allowing us to be able to have the freedom we all seek. The key is experiment is but 1 of 3 that i will be attempting to debunk BMW lies. Although I feel with the key experiment, if proven true, should be adequate proof of my theory, but some may need to see the real deal before they believe. The next 2 experiment in again ask that if you have an ews or dme fail on you and you're in the Bay Area (because more than likely I'd will need to drive to you), I'm willing to try and fix your issue free of labor charge.
 

Attachments

#11 · (Edited)
After some research, looks like this key belongs to a 2003 325i with 118,000 miles last registered. This will be interesting. As you can see, this is how my key registers.
 

Attachments

#14 ·
I've seen the Key trick preformed before (maybe it was on bimmerfest). Anyway there are a couple of threads out there where people have transplanted a transponder from a donor key into a newly cut key then used GT1 to recode the new key with the donor transponder to their car. You have to have at least one good key to make this work. I've been temped to try it myself since I only have one key. It would be great to see you do it and document it. If successful I'm going to do it for sure. Or maybe I don't understand what you are doing, are you trying you get the dme to recognize the new key without using the known good key?
 
#15 · (Edited)
Oh if you need a 2nd key, the link on my signature ak90 will allow you to do so and you do not need a working key with that. Regarding my experiment, it's to get a used key from another car, more specifically the transponder from that car to be changed and recognize by my ews. I didn't realize there was a difference between having a working key or not. My plan was to just stick that donor key in and starting my car with it not thinking I actually would need my own working key to trick the system. I actually haven't seen that trick. Pretty much I'm trying to prove everything bmw said has been a lie. Supposedly that specific key can only be used with that specific mated ews and dme. If i can get this to work, especially without using my own working key, that should debunk that myth, among others. Supposedly with this software, I can even erase all the keys ever registered to the ews. I've tried blanking out key information but that hasn't really worked correctly so I need to look into that some more
 
#17 ·
Lol. Man, instead we couldn't be that much more further. I could've used your help today on 2 dme updates. Essex what might've been the issue I was having in the beginning, but solved and successfully updated, was my car was the last one on file to update. I'm not sure if I was suppose to reload files again first before updating but i was doing 2 e46s 325. After quite a bit of struggling, i was able to do it. Are you suppose to reload the pabd psbgd and assembly line data when upgrading a different dme e46?
 
#18 · (Edited)
After attempting to overwrite the transponder, i have failed. Sorry for letting all those who watched my documentary down. However, I see this as a draw. I struck them first only to be put right back into my place. It's ok. I'll make sure this $70 worth of materials will be reused in a future project. Next time though, I'll be ready to being, like I was my first time. However, I am still confident in my abilities to thwart the ews and dme replacement procedure. Please message me if you're in the Bay Area and let's work together.


THREAD IS NOW CLOSED
 
#19 ·
A week from now, I should be in posession of a tech that will allow all of us to easily rewrite the pages of history. The one thing that many have attempt (although those that did succeed could've at least written a diy and confirm to others with visual proof so we could avoid bmw lies) and failed, myself being one, and also seemingly impossible is..... Reprogramming used keys (transponders specifically) in order to have it start your car. All our lives as e46 owners we have been whispered to about what lies hidden in the night as children, the bmw monster always slinking around in the shadows, whispering lies to us. Most of us now have believed undoubtedly that once a key is programmed to a specific car thats it, the keys' toast, you cannot reuse it for any other purpose. Well, I am about to havce here a tech that will shatter all that. Here are the list of possibilities (since I have not yet confirmed its functionality yet):

Adding new keys
Adding used keys (if key***8217;s password is available)
Resetting used keys into a ***8220;new***8221; state (if key***8217;s password is available)
Recovery of key's synchronization (matching keys)
Blocking and releasing vehicle access via the specific key
Recovering of coding data (vehicle's specific information)
Changing EWS parameters (product number, date of manufacturing, etc)
Resetting used EWS3 (loading default values)
Changing VIN number which is contained in EWS unit
Changing VIN number which is contained in key (since 1998)
Changing mileage in EWS (contained in EWS since 1998 and on)
Changing mileage in key (contained in key since 1998 and on)
Software creates log-file of read and written keys, which helps to exclude the error of casual blocking key with password, etc.
Possibility of control and recovery of variable part of matching code for EWS and engine control unit DME/DDE
Configuring new transponders PCF7930 and PCF7935 to work with EWS unit.
Supports FSU (Firmware Secure Update) from Internet.
USB interface
No AC/DC adaptor required

So there it is folks. It also seems to state that I should be able to program the newer keys to work with our cars as well. That means if I want the newer designed key, the days are over where I have to transfer the electronics across to the shell, increasing the chances that I destroy it before even being able to use it, as I will show you pics later on of the used key I took apart. Well, I also didn't care if it got destroyed, that's why I wasn't so gentle on it. Anyways, check back next week, which I hopefully will get the device then, and see me destroy this 13 year old tech to pieces.
 
#22 · (Edited)
Um... You'd have to send me your ews . Are you sure? Only somebody who couldn't drive the vehicle would do that. I'd feel like my heart was taken from me if i couldn't drive it and it was in driving condition
 
#23 · (Edited)
Oh, and also, here's the list of vehicles that will have their ews destroyed:

3 series (E46)
5 series (E39)
7 series (***1045;38)
X3 (E83)
***1061;5 (***1045;53)
Z4 (E85)
Range Rover Vogue
Rover 75
Mini Cooper

No more locked doors! No more locked doors!
 
#25 · (Edited)
Really? Its not like the info isn't already out there. If a thief really wanted to, he could easily have got it a long time ago and done it. They just don't post diy guides on these type of things. I'm just trying to shed light on the educational side of this. By educating our fellow e46 owners, this can also be information that they now know, but before didn't, and use it to protect yourself. Did you also know that a thief can easily smash the driver side door lock cyclinder and bypass your alarm if you didn't have the feature (only disarm alarm by remote) coded to your car? I easily found it by googling. Nothing really is much of a secret anymore nowadays. Still, that's not even half of it. Its easier to steal a newer bmw than it is our car. They actually smash it in a certain way where the car thinks its being unlocked and it disables the alarm.
 
#26 · (Edited)
I guess this is one of them double edged sword type of thing right? lol. well, I did think about that, right before I reopened this thread. Before, my intent was purely for information purposes, as well as giving us e46 owners out there alternatives to a situation where we are left with none except for the all powerful bmw. This quest of mine was fueled out of revenge. Revenge for taking advantage of so many of us for so long as they sit in their fancy offices becoming rich off our misery.This won't by far impact their wallets by any measure, but man its not fair that after 13 years in existence we still pay an arm and a leg for maintenance and what have you. You know how I ended up here now today while typing this? Had that damn expansion tank not blown up on me, none of this would exist. So blame them and their stupid expansion tank. That was what started this quest. The $400 fuel pump only made me angrier. That's what got me really going.
 
#27 ·
Actually, in between the expansion tank and fuel pump, what helped with the momentum was when I showed up at the stealerships and was requesting a gasket for I think it was either steering fluid resevoir. I swear to you that even I, who have no experience in molding or whatever the process is to create that thing could easily duplicate that particular gasket given the materials. I mean, this thing had to have costed 3 cents to make. What kind of tech or material was used that would've made this thing $30? Then the guy at the counter felt bad for me and felt it was ridiculous too so he lowered it to $20. Yay. I didn't get totally butt raped. Thanks.
 
#30 ·
You mean this part number for the power steering reservoir cap gasket, 32 41 1 128 333? Most online retailers have this for $2-$4. I really think you should avoid the dealership when buying parts for an out of warranty car.

Sorry to hijack your thread with something off topic.
 
#28 ·
So now if my dme goes out I can replace with a used unit from eBay? What about buying a used dme and ews that's mismatched and copy my original dme and ews to the mismatched eBay units? Just to have as a back up? My car is 12 years old and would hate to be out of town and one of those go out.I won't have over a grand to shell out for a new one. If I can do this I'll keep my car but if not I'll trade for another car.I just don't want to deal with that electronic stuff since its not an easy swap

Sent from my SCH-I535 using Bimmer App
 
#29 ·
I don't think they go out that often, even at that age. However, if we speak theoretically, i have yet tinkered with the dme other than flashing euro tune, which I do have now, but the ews hopefully I'll be able to confirm soon that i can do what that list says.
 
This is an older thread, you may not receive a response, and could be reviving an old thread. Please consider creating a new thread.
Top