[NZ_M3]

Ok so first things first

Two things to consider here:

1. Can the mileage be tampered with within the original modules?
- Yes absolutely! But it is almost always detectable if you know where to look.

2. Can you "freeze" the mileage of the car within the original modules and have it undetectable?
- again yes if you know what you are doing!!

I will address both below.

However - In my opinion the best way to determine if the mileage of a car seems consistent with the mileage shown on the cluster or key read out is to actually check the car over in detail by looking at things like:
- bushings - are they new if on a low mileage car?
- suspension? Check bolts that hold these assemblies - usually very obvious if changed and worn.
- undercoating - how much dirt build up in hard to clean places - under plastic sheilds, behind wiring covers, behind exhaust dust shields.
- look at the exhaust system - the higher the mileage the worse these look
- CV joints and boots - these are self explanatory and are perhaps the best indicators of true mileage of a car.
- lastly the seats. Lift the covering on driver and passenger seat and look at the foam on shoulder bolsters, hip bolsters and entry thigh bolsters. I can guarantee you that on a high mile car the blue memory foam on the csl seat bolsters (found around the shoulder and waist support area) will be ripped, and thr yellow type soft entry foam will also be ripped.

Part 1 tampering with mileage in original modules:

The E46 M3 CSL records mileage in the following modules only
- odometer/cluster clock under the motorola M35080V6 chipset
- Light Control Module in the eeprom
- EWS3 module Usually with 0D46J chipset
- keys - in the original remote key in the EML10030A immobliser chip or in valet key in the PCF7935 immobliser chip
- SMG module

That's it nothing else records mileage in our cars.
The dme keeps a record of mileage when it is updated so reading the UIF will give you those mileage on the date it is updated.

So how easy is it to tamper with these mileage? First you need to understand how it is updated!

The main recorder of mileage is the cluster and light module. These two modules check with each other every 50km-ish to see if the mileage matches. If it is more than this out the odometer triggers the tamper dot.

The ews module increments the mileage shown from the cluster and this is updated in the key each time it is used.

The smg module also pulls the mileage in an incremental update.

So how easy is it to change the mileage in each of these modules?
- some extremely easy. Here I will address each.

Light Module - provided it is not above firmware CI35 this module can be manipulated with tools like PA Soft to change vin and mileage easily. However without a matching cluster vin and mileage the tamper dot will show.

Smg module - this believe it or not has a reset function built in that allows the module to reset the recorded mileage and pull new mileage from whatever is shown on the cluster - again tools like PA Soft can reset this counter.

EWS module - quite a few tools out there now can manipulate this module and change mileage vin ect. Many of these tools however require you to remove the epoxy coating to the eeprom pins or ground one of the circuits. I only know of one tool that does not require this and is capable of manipulating this module through obd. So again reasonably easy.

Keys - the EML chipset in the original keys can be manipulated with an expensive tool. However this requires a security code to be broken before it can be done. And it does not always work. Cheaper tools can occassionally do it but again can be a bit hit and miss. The valet keys with the PCF chip can be swapped out for a blank one or rewritten with the right tools. What you will find with tampered cars is it will not have at least one original EML chiped key. Instead it will have clone keys that look like the real thing but carry the PCF chipset.

Instrument cluster/ odometer - can be completely disassembled and the motorola M35080v6 chipset swapped for a blank one. Or with the correct tool you can solder 7 lines to the back of the main cluster chip and manipulate the M35080v6 chipset that way. This however almost always leaves a clue and soldering tampering when you look on the back of the board. However with good equipment and soldeing tools this can be almost made undetectable.

So how do you check!?
- use INPA to check the cluster- if it has been disassembled by an amateur the needles might not be calibrated correctly. Under INPA there are functions that allow you to move the needles a certain preset degree - run these and you will notice uncalibrated cluster needles pointing at the wrong place when the function is run.
- pull the cluster out and check the back of the mainboard has no resoldering marks.
- make sure it has an original key that reads correctly on the official key reader at the dealership.
- pull the ews module under the dash and make sure the epoxy coating covering the main board and pins have not been Scratched away.
- use WINkFP to check DME and SMG module UIF (user information field) is consistent with mileage update and dates. You can almost always check. These with official dealer records.

I will do a separate post about "feezing" the mileage of these cars if there is a demand for it. But I am a little worried about posting this on a public forum just in case people use it to dupe mileage. So some feedback please if I should post this!!