Here's some values for a guide. These are the only three that really need changing. The duration tables define how long between taking your foot off the accelerator and fuel injection being cut. As you can see the stock values are very short for most cars, but for the Z4 they were increased to give us a more sport exhaust sound.

The timing table is not something I fully understand, I read the MSD81 technical specification which has a section on "minimum ignition angle" and found that this is the table responsible for the ignition timing during overrun but it's not as simple as just targeting the angle entered in the table, it is influenced by other factor and differential tables. The axis in this table is mg/stk, our engine sits firmly in the 75mg/stk area during overrun so just work on that area.

Stock values for INA0S car (335i)
Attachment 59868

Stock values for INA0S car (Z4)
Attachment 59869

My current values, somewhat comparable for the MHD "medium" setting.
Attachment 59870

THe uploads are still pending moderation so I just put them on google drive instead: https://drive.google.com/drive/folde...XC?usp=sharing

File INA0S.xdf has been approved.

File IJE0S Fuel Cut Tables.xdf has been approved.

File I8A0S Fuel Cut Tables.xdf has been approved.

Hey I was just about to post these haha. I found today that the MHD aggressiveness is just editing Timing (main). No special tables like MHD has claimed before. This is what the timing table looks like on aggressive(Link)(notice the -16). Minimum rpm causes the timing below that rpm to not be touched. MHD doesn't even use the "Minimum Ignition Angle During Trailing Throttle (Base)" table in the mentioned XDF.

While I was looking for some stock roms on bimmerboost, I found a this XDF which I found the table I was making was part of a bigger "Minimum Fuel Cut Delay (Normal)" table(Link). MHD only edits a portion of a tables.

MHD mentioned they toggle a flag to get the burble how it sounds. I'm currently debugging a program that I wrote to convert the CANBUS data from a flash into a flashable bin. After that is complete, I should be able to do a full compare and see what bytes have changed.

If you have those DAMOS files I would love to have them. I've been doing all my work just by reversing the flashes.

I saw someone already linked the MSD80 DAMOS files in another thread for you.

Have you started to reverse the machine code from the 2MB flash? I've only just started looking at it with Ghidra but I'm not certain that it has a full instruction set for the tricore 1796. The assembly code it generates looks OK but it's the first ECU assembly I've ever seen so not sure if it's complete.

That was me haha. I found it on my downloads... Must have downloaded it awhile ago...

I have just started with mapping out the firmware but I haven't had the actual time to dig into it.. I'm too busy rn fixing other peoples car and with work to be able to dig into this. I did however load a bin with IDA and didn't find much. I think IDA was expecting a full eeprom dump..

The normal 2 minute flash writes the memory 0x40000-0x7F8DC. I'm going to generate a full bin by doing a full flash with winfkp and load it into IDA.. I'm getting a ktag here in a bit so I should be able to get a full eeprom dump that way as well.

I'll send you a copy of IDA 7.2. The only DRM they use is a password protected installer which happens to be vulnerable to Brute-forcing in this version. I'll pm you a zip of all the files just so you have it.

What is the actual purpose of the minimum RPM table. I can't find how it's actually effecting the timing. Also what is the difference and factor table?

The documentation says that the difference table is an offset on that timing value and the factor is a multiplier on it.

So if you have -11 as your timing value and an offset of 1 and factor of 0.5 the final result that's used as the ignition setpoint should be -5.

I think the minimum is the cutoff at which point the engine will use the timing value for idle control rather than the setting for PU/PUC engine mode.