CAScontrol2

CAScontrol-2 with EGS 6HP / DSG support

What’s new and major differences:

Completely rebuilt hardware and firmware, covers EWS2, EWS3, EWS_EGS and some minor EWS4 functionality,
Software is backward compatible with previous CAScontrol releases and dongle except some limitations and 6HP functionality..
CAS emulation for EGS 6HP unlock or ISN test (via RAM or direct ISN) .

Highlights:

You can read EWS2 ISN directly from EWS – ECU communication line.
You can read EWS3 rolling codes from line and calculate EWS3 ISN from two following rolling codes.
It is possible to use tool as EWS2 or EWS3 emulator.
It is possible to unblock EGS 6HP via CAS_BUS line if RAM is readable from EGS or ISN is already known.
Dongle is useful for various calculations – CAS dump explorer, KEY decrypt, ISN extract from dump, ISN restore from rolling codes etc.

Connection:

EWS line, +12v, GND – pins are marked on a label placed on opposite side of dongle
Must note that pullup inside dongle is weak, sometimes it is necessary to use external pull-up (about 500...1K ohms) If using device as emulator. Or pull-down to ground when monitoring CAS / EWS without ECU attached. Observe what LED does, it must flash periodically if line is alive and there are any messages on it. If you are logging fully working system (ECU + CAS/EWS) no any additional action necessary.
Launch software, choose desired action.

Some common situations:

You have EWS/CAS with keys – You can get ISN without any intervention by simply logging line. No any chances to damage something, no soldering, no device programmers necessary, always safe. Common situation in case if ECU is damaged and needs replacement!
In some cases it is possible to restore ISN in CAS – when ISN is lost by some accident caused by some dangerous tools, but rolling codes remain untouched.
You can test used ECU with known ISN without any intervention in EWS/CAS, test it on the bench etc.
You can unlock or test ISN for 6HP EGS (GS19D, DSG) now,
etc….

Some things to know:

CAS transmits messages to EGS via CAN network and via CAS_BUS. If three invalid messages received, EGS goes into “tampered” mode, STAT_AUTHENTICATED_WERT = 2. No more messages accepted, valid or not, until EGS restarted.
On startup STAT_AUTHENTICATED_WERT = 0.
EGS is authorized (no matter via CAS_BUS or via CAN) if STAT_AUTHENTICATED_WERT =1.
EGS ISN is 4 bytes long, usually last 2 bytes are common with ECU.

Overall:

When sending something to EWS signal line be sure that EWS/CAS is disconnected (or at least inactive).

Main software:

EWS2 functions:

Everything is as simple as possible -

In case of EWS2 ISN is always 12 bits long. That's why first digit is always replaced with 0.

When sending something to line be sure that EWS / CAS is disconnected (or at least inactive).

EWS3 - logger:

Calc - get ISN from RC1 and RC2 values. ISN box is highlighted green if ISN is calculated.
Read – continuously read rolling code from line. If 10 valid rolling codes are read out from line, RC1 box is updated. Now you can switch off ignition, turn it on again. When new (updated) rolling code received, software waits for another 10 valid codes to be sure they all match each together, then updates RC2 box and calculates ISN.

In case of EWS3 ISN is 16 bit (2 bytes) long, rolling codes are 32-bit values.

EWS3 - emulator:

Align - send ISN for alignment with ECU. Alignment procedure is described in official BMW documents. In some words:

must set EWS / CAS or emulator for alignment, fixed ISN code is sent to ECU now,
must send command to ECU to accept this value. Use INPA, DIS, Tool32 or any other suitable diagnostic tool.

Note that INPA script tries to communicate with CAS or EWS first. Ignore any errors and continue.

Send – continuously sends rolling code to line.
Next RC – next rolling code is calculated. If button is pressed when send takes place, new rolling code is transferred immediately to line. Otherwise displayed only.
Proceed as CAS – check this box if ECU wish to see CAS instead of EWS. Don't worry about this option, for most known ECU's it doesn't matter at all.

EWS EGS 6HP / DSG:

or:

RAM – load RAM from file and send what's necessary for EGS. If RAM file is valid, ISN box becomes green. Otherwise warning message displayed.

Then you can use any diagnostic tool to check EGS status and unlock it (reset ISN) if necessary.

Connection to EGS 6HP (GS19D) –

It is a good idea to make some wiring harness:

CAScontrol2 line must be connected directly to PA_BUS. Diagnostic tool you can attach directly to PTCAN.

Terminate CAN bus with 120 ohm terminator.