RomRaider

There is completely another M32r architecture with propriatery loaders.

I'm trying to connect to a 2003 Altima that is our Lemons Race car. I'm getting the following:



What does the 27 01 response mean?

Thank you for any help!

So to follow up on the above we tracked down that the "Electrical loads active" probably indicated that something like the headlights or HVAC was on. This is a fully stripped race car with a "questionable" harness at this point, so we spend the morning pulling fuses, etc with no luck. Then I tracked down that a lot of the accessory loads are controlled by the IPDM module, so we disconnected the CAN BUS from that module so the ECM wound't see what it thought were loads and it worked!

So figured I'd document this in case someone else runs into this error in the future.

Okay long story short.

I made my first tune file and tried to upload it back to ecu but block 12 made error. No communication to ecu anymore. So I bought second ecu and tried upload original file back and again block 12 error and same issue

I used kernel npk_SH7055_35.bin and setdev 2 7058 to download file. setdev 1 7055 did not support the file size.

And same settings to upload but when almost done block 12 error from 0x080000-0x09FFFF bad response. Little confused is the real file size 512kb or 1024?

And now when try to use nisprog it tells read/write timeout. Ecu bricked?

Hi all! I collected some *.bin i have from Nissan Teana J31 JDM VQ23DE with slow mode without kernel using. It's permanent invalid key sid27 error with different "setkeys". Gk has no results. I loss any hope to success.
So feature of JDM 9W73B is absence the immo in stock (ecu of my car).
9W73A the same but with immo (my ecu fo experiment).
Other bin is the lefthanded vehicle.
Use it if necessary. My regards.




UPD: One more incomprehensible things. When i type some "setkeys" from proposed list into 9W73A - it's work true. But when it's happen into 9W37B (setup in the car) nisprog require sid 27 and sid36 both.

UPD2: one more: nissan ners and consult III plus can't define this both ecu for reprogramming.

I don't understand, please elaborate.

It's true that those 3 ROMs have different keysets, none of which are in nisprog. They will be added next release. https://github.com/fenugrec/nissutils/c ... 3b5535a370

Hello! I'll try.
When I connected to 9W73A and type: "setkeys 0x816c3398" it was answer from nisprog "Now using SID27 key=816c3398, SID36 key1=693c80b2". But when it was 9W37B the answer from nisprog on my "setkeys 0x6d571f84" (from list of course) is request of SID36 too. The only way. SID27 and SID36 both. Sorry, but I can't send a picture with proof now. Some later I think it posible.

[quote="nissan90x"]When I connected to 9W73A and type: "setkeys 0x816c3398"[quote]
Ok I think I see what you mean. For 9W73A, 0x816c3398 would be the wrong keyset anyway according to what I found (see the git commit posted above). So you would have to give setkeys both s27 and s36 keys , since the combination of both is not (yet) known by nisprog.

So, for 9w73b try for example "setkeys 0xC7B27ADF 0xAF82C6F9"

Thank you! I'll try this "setkeys" today!

UPD: it's ok! Reads and writes correctly both ecu with setkeys from github!

ok i am having problems dumping using kernels, i have multiple ecus and get the same error, im using a bench setup.
my current ecu part# 23710-5y713
here is nisprog cmd
diag_os_gethrt() resolution <= 0us, avg ~0us
diag_os_getms() resolution: ~15ms.
Calibrating timing, this will take a few seconds...
Calibration done.
nisprog v1.03-01af433
interface is now DUMB
Note concerning generic (dumb) interfaces : there are additional
options which can be set with "set dumbopts". By default
"K-line only" and "MAN_BREAK" are set.
nisprog: Type HELP for a list of commands
nisprog: Type SCAN to start ODBII Scan
nisprog: Then use MONITOR to monitor real-time data
nisprog: **** IMPORTANT : this is beta software ! Use at your own risk.
nisprog: **** Remember, "debug all -1" displays all debugging info.
interface is now DUMB
Note concerning generic (dumb) interfaces : there are additional
options which can be set with "set dumbopts". By default
"K-line only" and "MAN_BREAK" are set.
port set to: \\.\COM5
dumbopts set to: 72
testerid: using 0xFC
destaddr: using 0x10
Unrecognized command. Try "help"
Connected to ECU !
ECUID: 5Y713
Key candidate dist (smaller is better)
0: 0x5414CDA6 3
1: 0x88733BA0 6
2: 0x968148AD 8

Using best choice, SID27 key=5414CDA6. Use "setkeys" to change if required.
now using 7055.
Using 4516 byte payload, padding with garbage to 4544 (0x011C0) bytes.

SID27:SUXXESS !!
SID 34 80 done.
SID36 block 0x008D/0x008D done
SID 36 done.
sid37: sending 0x37 0x7D 0x94
SID 37 done.
SID BF done.
ECU now running from RAM ! Disabling periodic keepalive;
Connected to kernel: SH7055_35-60507ea
You may now use kernel-specific commands.
nisprog: Settings loaded from nisprog.ini

nisprog> dumpmem my_rom.bin 0 524288
npk dump @ 0x00000000, 1 B/s, 4340 s remaining no / incomplete / bad response
0x21 0xFD 0x00 0x00 0xA7 0x6C 0xFF 0xFF 0x7F 0xFC 0x00 0x00 0xA7 0x6C 0xFF
rxrawdump failed
nisprog>

here is my .ini

#This is just an example .ini file to show some of the possible commands.

set
interface dumb
#Customize this to your hardware
port \\.\COM5

#This should always be OK
dumbopts 0x48

# No need to touch these unless you know what they are
l2protocol iso14230
initmode fast
testerid 0xfc
destaddr 0x10
addrtype phys
up

# now connect
up
nc

setdev 1
runkernel C:\nisprog\npk_SH7055_35.bin
what am i missing? i have been able to dump without kernel...hours later... thank you all!

unrecognized command ... are you using the same .ini you pasted ?



looks like timing issues. try increasing rxe value (npconf rxe...)


Don't try to reflash until you solve those issues and can do a fastdump 100% reliably every time.

Thanks fenugrec! ill try this as soon as i can.

thank you! i got it working, i can now dump and flash no problem!

Hello. Please tell me what am I doing wrong? 64F7055F40

Logging to file log.txt
Connected to ECU !
ECUID: 9W73B
Key candidate dist (smaller is better)
0: 0x816C3398 9
1: 0x6D571F84 10
2: 0x968148AD 12

Using best choice, SID27 key=816C3398. Use "setkeys" to change if required.
now using 7055.
Now using SID27 key=C7B27ADF, SID36 key1=AF82C6F9
Using 3480 byte payload, padding with garbage to 3488 (0x0DA0) bytes.

SID27:SUXXESS !!
SID 34 80 done.
SID36 block 0x006C/0x006C done
SID 36 done.
sid37: sending 0x37 0x46 0x92
SID 37 done.
SID BF done.
ECU now running from RAM ! Disabling periodic keepalive;
Connected to kernel: SH7055_18-f59d260
You may now use kernel-specific commands.
p3 set to 0 (0x0).
Connected to kernel: SH7055_18-f59d260
nisprog: Settings loaded from nisprog.ini

nisprog> flrom 9W73B.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : (total: 0)

y : To reflash the blocks listed above, enter 'y'
f : to reflash the whole ROM
p : to do a dry run (practice mode) without modifying ROM contents
n : To abort/cancel, enter 'n'
> p
reflashing selected blocks (dry run). Note, some (harmless) write verification errors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
Reflash complete.
nisprog> flrom 9W73A.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, (total: 16)

y : To reflash the blocks listed above, enter 'y'
f : to reflash the whole ROM
p : to do a dry run (practice mode) without modifying ROM contents
n : To abort/cancel, enter 'n'
> p
reflashing selected blocks (dry run). Note, some (harmless) write verification errors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
Block 00
got bad RequestDownload response : 180nm: bad DL_ERASE
nisprog>

Hello, could you please share the definition files for 9W73B and 9W73A