nisprog reflash utility

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

bradsm87 wrote:

VC269

... WTF is wrong with me. It's in my spreadsheet, I regenerated the list in ecuidlist.c, and... failed, twice. Sorry.

Try adding "gk" after the nc command in your ini files - I'm hoping it works fast with "all" ECUs; if it starts into slow mode on certain ECUs I might be able to tweak the command further .

bradsm87 · **Joined:** Thu Apr 14, 2011 8:16 am **Posts:** 425

fenugrec wrote:

bradsm87 wrote:

VC269

... WTF is wrong with me. It's in my spreadsheet, I regenerated the list in ecuidlist.c, and... failed, twice. Sorry.

Try adding "gk" after the nc command in your ini files - I'm hoping it works fast with "all" ECUs; if it starts into slow mode on certain ECUs I might be able to tweak the command further .

No worries. Will do. nisrom finds the keys fast with all the roms I use so hopefully gk is the same.

I've flashed 4 times with 1.03b and every time connected perfectly the first time and work flawlessly. Thanks again.

LeftoverPi · **Joined:** Sat Nov 23, 2019 2:55 pm **Posts:** 21

I'm sorry for not reading this entire thread, but I'm wanting to get into tuning on my 370z. I want to help out with this effort any way I can. I'm an embedded software engineer and I work on brake controller ECUs, so I have some relevant experience (and access to good tools).

What do you think would be the best way for me to contribute?

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

LeftoverPi wrote:

I want to help out with this effort any way I can

Thanks. As it stands, there is a viable workflow to reflash most K-line ECUs from about 2001 to 06-07. Some early units are based on the sh7051 which currently doesn't have a kernel, but there is very little demand for that atm. Later models are CAN-bus, easier to reflash but I haven't worked on those much. I know some people here have, but as far as I know there's no opensource software available to reflash.

What I'd really like to see is my "oj2534" project for an opensource J2534-compliant cable get off the backburner and become reality, which would mean one single cable for K or CAN ECUs, flashing and logging. RR supports logging on the K-line only with a J2534 cable, but nisprog is K-line only and doesn't support J2534 at all.

LeftoverPi · **Joined:** Sat Nov 23, 2019 2:55 pm **Posts:** 21

This is interesting. Do you have anything out there on GitHub for this?

My "day job" is literally writing bootloaders for ECUs so we have these tools laying around.

a33b · **Joined:** Sat Jun 24, 2017 2:23 pm **Posts:** 315

https://github.com/fenugrec/nisprog

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

PM (email) sent

biela · **Posted:** Thu Jan 16, 2020 12:48 pm

Hello

I tried running the kernel on Nissan Almera 1.5 with QG15 engine (66kw). 2002 year. ECU is MEC20-601.

I get different errors:

With npk_SH7055_35.bin:

Code:

diag_os_gethrt() resolution <= 3us, avg ~1us
diag_os_getms() resolution: ~16ms.
diag_os_chronoms() : resolution: ~16ms
Calibrating timing, this will take a few seconds...
diag_os_millisleep(50) off by +4% (+2075us); spread=24%
diag_os_millisleep(40) off by +17% (+6884us); spread=17%
diag_os_millisleep(30) off by +4% (+1237us); spread=4%
diag_os_millisleep(20) off by +56% (+11236us); spread=57%
diag_os_millisleep(14) off by +10% (+1455us); spread=12%
diag_os_millisleep(12) off by +30% (+3610us); spread=30%
diag_os_millisleep(10) off by +56% (+5608us); spread=57%
Calibration done.
nisprog v1.02
nisprog: Interface set to default: DUMB
nisprog: Type HELP for a list of commands
nisprog: Type SCAN to start ODBII Scan
nisprog: Then use MONITOR to monitor real-time data
nisprog: **** IMPORTANT : this is beta software ! Use at your own risk.
nisprog: **** Remember, "debug all -1" displays all debugging info.
interface is now DUMB
Note concerning generic (dumb) interfaces : there are additional
options which can be set with "set dumbopts". By default
"K-line only" and "MAN_BREAK" are set.
port set to: \\.\COM5
dumbopts set to:    72
testerid: using 0xFC
destaddr: using 0x10
diag_l2_iso14230.c:736: Read/Write timeout.
diag_l2.c:438: Read/Write timeout.
L2 StartComms failed
now using 7055.
Must be connected normally (nc command) !
nisprog: Settings loaded from nisprog.ini

With npk_SH7055_18.bin:

Code:

diag_os_gethrt() resolution <= 2us, avg ~1us
diag_os_getms() resolution: ~15ms.
diag_os_chronoms() : resolution: ~16ms
Calibrating timing, this will take a few seconds...
diag_os_millisleep(50) off by +4% (+2080us); spread=24%
diag_os_millisleep(40) off by +17% (+6886us); spread=17%
diag_os_millisleep(30) off by +4% (+1234us); spread=4%
diag_os_millisleep(20) off by +56% (+11234us); spread=56%
diag_os_millisleep(14) off by +10% (+1426us); spread=12%
diag_os_millisleep(12) off by +30% (+3638us); spread=30%
diag_os_millisleep(10) off by +56% (+5609us); spread=57%
Calibration done.
nisprog v1.02
nisprog: Interface set to default: DUMB
nisprog: Type HELP for a list of commands
nisprog: Type SCAN to start ODBII Scan
nisprog: Then use MONITOR to monitor real-time data
nisprog: **** IMPORTANT : this is beta software ! Use at your own risk.
nisprog: **** Remember, "debug all -1" displays all debugging info.
interface is now DUMB
Note concerning generic (dumb) interfaces : there are additional
options which can be set with "set dumbopts". By default
"K-line only" and "MAN_BREAK" are set.
port set to: \\.\COM5
dumbopts set to:    72
testerid: using 0xFC
destaddr: using 0x10
Connected to ECU !
Using short headers.
ECUID: 5M316
Key candidate   dist (smaller is better)
0: 0x634D157A   6
1: 0x3722E94F   8
2: 0x968148AD   15

Using best choice, SID27 key=634D157A, SID36 key1=4B1D6294
Use "setkeys" to change keyset.
now using 7055.
Using 3932 byte payload, padding with garbage to 3936 (0x0F60) bytes.
got bad 27 01 response : General_Error, Requested_SID_securityAccess Error_requi
redTimeDelayNotExpired
sid27 problem
nisprog: Settings loaded from nisprog.ini

Any help is appreciated.
Thanks

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

biela wrote:

Code:

nisprog v1.02

Please use 1.03

Code:

port set to: \\.\COM5
dumbopts set to:    72
testerid: using 0xFC
destaddr: using 0x10
diag_l2_iso14230.c:736: Read/Write timeout.
diag_l2.c:438: Read/Write timeout.
L2 StartComms failed

What type of cable are you using, and are you sure it's the right port

biela · **Posted:** Thu Jan 30, 2020 12:37 pm

Hello

With 1.03 version:

Quote:

diag_os_gethrt() resolution <= 1us, avg ~1us
diag_os_getms() resolution: ~16ms.
Calibrating timing, this will take a few seconds...
Calibration done.
nisprog v1.03-01af433
interface is now DUMB
Note concerning generic (dumb) interfaces : there are additional
options which can be set with "set dumbopts". By default
"K-line only" and "MAN_BREAK" are set.
nisprog: Type HELP for a list of commands
nisprog: Type SCAN to start ODBII Scan
nisprog: Then use MONITOR to monitor real-time data
nisprog: **** IMPORTANT : this is beta software ! Use at your own risk.
nisprog: **** Remember, "debug all -1" displays all debugging info.
interface is now DUMB
Note concerning generic (dumb) interfaces : there are additional
options which can be set with "set dumbopts". By default
"K-line only" and "MAN_BREAK" are set.
port set to: \\.\COM5
dumbopts set to: 72
testerid: using 0xFC
destaddr: using 0x10

Try "help <command>" for further help
Connected to ECU !
ECUID: 5M316
Key candidate dist (smaller is better)
0: 0x634D157A 6
1: 0x3722E94F 8
2: 0x968148AD 15

Using best choice, SID27 key=634D157A. Use "setkeys" to change if required.
now using 7055.
Using 4516 byte payload, padding with garbage to 4544 (0x011C0) bytes.

got bad 27 02 response : General_Error, Requested_SID_securityAccess Error_inval
idKey
sid27 problem
nisprog: Settings loaded from nisprog.ini

Tried gk command:

Code:

nisprog> gk
Nothing @ 8416. Trying long search, press Enter to interrupt (may take a few sec
onds to interrupt)
FFFF8000
FFFF807E
FFFF80FC
FFFF817A
FFFF81F8
FFFF8276
FFFF82F4
FFFF8372
FFFF83F0
FFFF846E
FFFF84EC
FFFF856A
FFFF85E8
FFFF8666
FFFF86E4
FFFF8762
FFFF87E0
FFFF885E
FFFF88DC
FFFF895A
FFFF89D8
FFFF8A56
FFFF8AD4
FFFF8B52
FFFF8BD0
FFFF8C4E
FFFF8CCC
FFFF8D4A
FFFF8DC8
FFFF8E46
FFFF8EC4
FFFF8F42
FFFF8FC0
FFFF903E
FFFF90BC
FFFF913A
FFFF91B8
FFFF9236
FFFF92B4
FFFF9332
FFFF93B0
FFFF942E
FFFF94AC
FFFF952A
FFFF95A8
FFFF9626
FFFF96A4
FFFF9722
FFFF97A0
FFFF981E
FFFF989C
FFFF991A
FFFF9998
FFFF9A16
FFFF9A94
FFFF9B12
FFFF9B90
FFFF9C0E
FFFF9C8C
FFFF9D0A
FFFF9D88
FFFF9E06
FFFF9E84
FFFF9F02
FFFF9F80
FFFF9FFE
key still not found. Maybe it's the one stored at ffff8416 anyway: 0xD0BB83E7 ?
the sid36 key is still unknown though. Good luck.

And debug option:

Code:

diag_os_gethrt() resolution <= 1us, avg ~1us
diag_os_getms() resolution: ~16ms.
Calibrating timing, this will take a few seconds...
Calibration done.
nisprog v1.03-01af433
interface is now DUMB
Note concerning generic (dumb) interfaces : there are additional
options which can be set with "set dumbopts". By default
"K-line only" and "MAN_BREAK" are set.
nisprog: Type HELP for a list of commands
nisprog: Type SCAN to start ODBII Scan
nisprog: Then use MONITOR to monitor real-time data
nisprog: **** IMPORTANT : this is beta software ! Use at your own risk.
nisprog: **** Remember, "debug all -1" displays all debugging info.
interface is now DUMB
Note concerning generic (dumb) interfaces : there are additional
options which can be set with "set dumbopts". By default
"K-line only" and "MAN_BREAK" are set.
port set to: \\.\COM5
dumbopts set to:    72
testerid: using 0xFC
destaddr: using 0x10
L1 debug is 0x8C: READ WRITE DATA
diag_l1.c:155:  _send: len=5 P4=5 l0flags=0x1011; 0x81 0x10 0xFC 0x81 0x0E
diag_l1.c:253:  _recv request len=1024, timeout=70;got 7 bytes; 0x83 0xFC 0x10 0
xC1 0x5D 0x8F 0x3C
diag_l1.c:253:  _recv request len=1017, timeout=23;diag_l1.c:253:  _recv request
 len=1024, timeout=50;diag_l1.c:253:  _recv request len=1024, timeout=100;Connec
ted to ECU !
diag_l1.c:155:  _send: len=4 P4=0 l0flags=0x1011; 0x02 0x1A 0x81 0x9D
diag_l1.c:253:  _recv request len=1024, timeout=60;got 9 bytes; 0x07 0x5A 0x31 0
x35 0x4D 0x33 0x31 0x36 0xAE
diag_l1.c:253:  _recv request len=1015, timeout=23;diag_l1.c:253:  _recv request
 len=1024, timeout=50;ECUID: 5M316
Key candidate   dist (smaller is better)
0: 0x634D157A   6
1: 0x3722E94F   8
2: 0x968148AD   15

Using best choice, SID27 key=634D157A. Use "setkeys" to change if required.
now using 7055.
Using 4516 byte payload, padding with garbage to 4544 (0x011C0) bytes.
diag_l1.c:155:  _send: len=4 P4=0 l0flags=0x1011; 0x02 0x27 0x01 0x2A
diag_l1.c:253:  _recv request len=1024, timeout=60;got 8 bytes; 0x06 0x67 0x01 0
x54 0xB7 0xE8 0x21 0x82
diag_l1.c:253:  _recv request len=1016, timeout=23;diag_l1.c:253:  _recv request
 len=1024, timeout=50;
diag_l1.c:155:  _send: len=8 P4=0 l0flags=0x1011; 0x06 0x27 0x02 0xB3 0x0D 0x2D
0x91 0xAD
diag_l1.c:253:  _recv request len=1024, timeout=60;got 5 bytes; 0x03 0x7F 0x27 0
x35 0xDE
diag_l1.c:253:  _recv request len=1019, timeout=23;diag_l1.c:253:  _recv request
 len=1024, timeout=50;got bad 27 02 response : General_Error, Requested_SID_secu
rityAccess Error_invalidKey
sid27 problem
nisprog: Settings loaded from nisprog.ini

In device manager, I can see COM5 used by my blue VAG COM 409.1 cable.

Thanks

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Hi,

biela wrote:

Code:

Connected to ECU !
ECUID: 5M316
Key candidate   dist (smaller is better)
0: 0x634D157A   6
1: 0x3722E94F   8
2: 0x968148AD   15
...
nisprog> gk
....
key still not found. Maybe it's the one stored at ffff8416 anyway: 0xD0BB83E7 ?
the sid36 key is still unknown though. Good luck.

Haha, you have a weird ROM or completely unknown keyset. Only solution will be a slow dump and post here.

biela · **Posted:** Thu Feb 06, 2020 5:18 pm

Hello

This is the bin from an slow dump.

Attachment:

Nissan_Almera_QG15_MEC20601_5M316_sh7055.bin

And also a little definition.

Attachment:

5M316.xml

Thanks

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Quote:

5M316

try keys 0xD0BB83E7 (sid27) and 0xB88BCF03 (sid36). "help setkeys"

biela · **Posted:** Sat Feb 15, 2020 5:04 am

fenugrec wrote:

Quote:

5M316

try keys 0xD0BB83E7 (sid27) and 0xB88BCF03 (sid36). "help setkeys"

Hello

Keys work fine, thanks.
I had to use

Code:

npconf p3 0

, but read and write the ECU fast and with no problems.

blacknipel · **Joined:** Sun Sep 10, 2017 4:12 pm **Posts:** 24

Hi! Does this program work with the ecu Hitachi A56-001? (Nissan x-trail t31)

RomRaider

Forum rules

nisprog reflash utility

Who is online