RomRaider

Hello all!

Would anyone be able to help provide some knowledge on these things? So with switches, I noticed it has data set in hex IN the definition template. NOT in the definition file. Does that mean switches have to be added to the definition template per ECUID, or is the data being presented inside the definition template as hex just required for RomRaider to allow it? On top of this, how would you even be able to figure out where some of these switches are? By the small sample size, it looks like they're similar to bitwise switches. So what's with having two separate switch types?

Onto DTCs; Through cross referencing I was able to locate a few of the DTC bitwiseswitches, DTC supmask, DTC descriptor, and DTC Options. So I was able to find a lot of stuff for enabling the LOGIC, but is there any way to force enable a DTC for testing purposes?

Romraider previously only supported the radio button type switches. These are the ones where you can replace bytes with alternative bytes to accomplish a desired behavior. This is a very powerful tool, but would require cumbersome definitions to manipulate even an 8bit bitwise byte. For example, 256 combinations would be required to set the preference for 8 DTCs.

Bitwise editing allows you to drill down further to the individual bits, and so you only need 8 definitions for that same byte. As seen in the CID supmasks, this can be down 32 bits at a time. As a 4-byte "long" data type, this would require 2^32=4,294,967,296 combination options.

With regard to where you find the definition templates, this is dependent on whether the template will be universally applicable to all ROMS, or if the bytes may differ on unique ECUs. If one is modifying code rather than data, it is unlikely that the same modification will apply universally, so the switch is placed in a ROM specific definition rather than the base template.

With regards to force testing a DTC. The only way I am aware of is to turn on the logic by flashing. Then manually create the fault.

Tons of good information there! Thank you so much for sharing! It’ll definitely help me out quite a bit with figuring out some of these supmasks and such! It’s a shame about the forcing DTCs thing, however. It doesn’t sound like a fun time haha I wish we could force trigger DTCs under certain scenarios. Mainly for boosted applications or for custom systems. But that’s probably getting into custom ECU territory haha

I am working on a 2006 Maxima ZK01B and was wondering if anyone had pointers on finding the DTC supmask & DTC bitwiseswitches?
The Descriptor & Options are very easy to find but the others are giving me some headache because I don't understand the logic. I have Ghidra but I am still learning my way around that software.

No idea if this is correct but via the learning and logic here it looks good. Going to flash & check it. Any tips would be greatly appreciated.

I have bitedit if you want to test some dtc off