# Blocked Starter -EWS re-learn on BDC cars?



## babaks (Dec 4, 2017)

Hopefully it doesn't come down to changing REME. 
When I query the REME from Esys it give me the correct VIN and serial number. I looked over most of the jobs for REME in tool32 but couldn't find one that gives VIN.
Inside Tool32 I found a BDC job called steuern_ews4. It accepts two parameters but I can't find any documentation for it. Can this be the solution? 
I appreciate any help.


----------



## babaks (Dec 4, 2017)

Anyone?!


----------



## God-Follower (Oct 3, 2014)

babaks said:


> Anyone?!


Did you ever end up finding a way to realign the EWS Babaks?

Have another guy asking similar questions here:
https://www.bimmerfest.com/forums/showthread.php?t=1318233


----------



## babaks (Dec 4, 2017)

Sorry for the long delay. I finished the project and didn't get a chance to login to the forum for a long time.

Here is the recap:I was trying to replace a water damaged REME with a used one. I opened mine and there was damage on both high voltage and low voltage side.The used one programmed in the car fine but refused to pair with BDC. so it refused to accept DME request for turning the starter. It seems a bit redundant because the DME is happily paired and asking for the start signal but REME ignores the request. A virgin REME gets paired once to the BDC and they stays married. This is similar to some EWS4 DMEs.

I found a debug feature in tool32 which said one can unlock a EWS4 locked REME if you have the original key which was used to pair the REME. I attempted to write a brute force program to guess the key but the program needed years to finish, so this failed.

Then, I tried to remove the tricore chip (this chip is used in several other DMEs by BMW) from my broken REME, reball it a put it in the used REME. I did this, but unfortunately my tricore chip was also water damaged. (this process worked for a few other modules on my car) I rebelled the main chip from the replacement REME and put it back again, the REME booted. so the reballing procedure was correct.

The last attempt was forcing the tricore chip to boot from the CAN bus read its content modify it and write it back. For this to be successful I needed to have a dump from a virgin REME. I finally bite the bullet and bought a new REME. When it arrived I didn't have the patient to open it and try get the binary dump, I just put the new REME in the car, programmed it and that was the end of it. I still have the car and I am really enjoying it. 
If someone is willing to continue this path I can share some picture/information that might help them setup the CAN boot on the tricore chip if they are willing to share the results here.


----------

