RomRaider

Hello,
I'm new to this forum so have a few questions regarding newer version ECU and ROM.

1. I have a 2010 370z (Z34), Can I still dump my ROM using nisprog?
ECUID is 23710-1EN2A or 23710-1EX2A as per VIN look-up.

2. What do you mean by CAN-only? How were older model 350z ECUs programmed?

2. MCU is 7059 as per attached picture. Can reprogramming effect the security system built into the ECU?
Such as NATS-IVIS/NVIS pairing with BCM?

3. In worst case scenario ECU is bricked, can it be reflashed via consult 3? or can I get a 2nd hand ECU and re-communicate ECU to BCM via consult 3?

Thanks!
Steve S

I can't be overly helpful because.im just getting into this myself (2017 370z here), but I'll post my understanding, with the hopes of people correcting me if I'm wrong.

1&2:
I believe the older Nissans before around 2008/9-ish used K-line. Our ECUs only use CAN. Looking at the FSM I think there is still K-line tucked away inside the vehicle, but we don't use it for anything. I don't believe Nisprog supports the non-K-line ECUs.

3:
I'm not sure how the seed/key works on these ECUs for SecureAccess services (SID 0x27), but it's not needed to do a ROM dump. As it turns out, we can dump our ROM using nothing but the "Read data by address" service, with no security involved.

How I dumped my ROM:

I have an UpRev cable and they have has an option to "read ECU". Unfortunately the file they save is encrypted and you must send it to them for any work to be done with it. I took a CAN bus trace of their tool reading the ECU. I then wrote a small program the reconstruct my ROM from the bus data transferred. The moderators here delete my attachments because they incorrectly assume I'm posting some h4xored proprietary UpRev data, but if you think it's helpful to you I can send you my (completely stock; non-UpRev!) ROM from a 2017 370z

Hi LeftoverPi,
Thanks for the many answers. Its been a while since I lasted worked with MCUs. Last worked on Intel 8bit 8051 based controllers that need UV erase before programming.

As a bit of trivia, Hitachi was using Motorola MC6502 CPU which they made themselves under license back in the late 70s and early 80s.
1Mhz with only a few external K of RAM and ROM. Basic injector and ignition timing was done via hardware and the CPU just calculated durations and sent this info to a PLD chip. Hitachi also made many other ICs used in the ECU but times change and this is no longer the case.

Anyway with regards to Z34 ECU, isn't there an easier way to dump ROM via advanced user debugger (AUD) or some other terminal interface?

Or is this all about reading/writing ROMs without opening ECU up?

And for me to get started, what sort of OBD2 cable do I need to get started? I have a ELM327 with bluetooth but from reading posts on this forum they refer to VAG-COM KKL 409.1 cable? Do I need to buy this?

And is there anything I can do to help? Looking at trying to dump ROM as you did and then reflash a 2nd hand ECU via bootmode.
Or should I wait and see what you guys come up with?

Thanks!
Steve S

To my expirience CAN-only ECUs had started since MY2013 or so, for such ECUs there is no way yet to read/write via OBD cable using freeware/opensource tool.
But the option with AUD debugger is still an option I've posted here http://www.romraider.com/forum/viewtopic.php?f=65&t=13225 some info about my handcrafted tool for this. Read via AUD / reflash via bootmode is still possible for these ECUs.

Hi Shuher,
Are you sure CAN only ECUs are 2013 on as the 370z was released in 2009 which uses the SH7059 1.5MB flash memory?
On my car (2010) the K-line is connected on the Data Link Connector. But not sure if it is being used. See LAN.pdf in FSM.

And I just noticed external eeprom. What is this used for? Assumed all memory was internal to MCU??

Thanks!
Steve S

For those cars I've seen it was the case. It's mostly related of course to our market here in Russia but I hardly believe that it was so special for us

I also had a chance to work with JDM ECUs from MY2009/2010 and they were kinda "dual" - diagnosis was possible via both CAN or KLine while ROM pulling was only possible via KLine.

So ROM dump would be possible if Nisprog supported 7059 MCU as from what I can see only has 7055 and 7058?

Also, what is external eeprom used for? Bootloader + security IDs?

Not sure if your particular ECU is "dual" as well, but if so - I assume nisprog could do the dump.

EEPROM contans a lot of useful data, including security ID, DTCs details, self-learning (idle air, etc) and a lot of other stuff. But not the bootloader - it is in the CPU's ROM.

Thanks for the info. I might backup this external EEPROM as it may be linked to the

security system of the car which links ECU to BCM.

It's also my understanding that all (USDM) 370zs use the "CAN only" ECUs. I'm not sure about JDM. I've also heard that the HR versions of the 350 are CAN only, but I doubt that.


Even in the 2017 FSM there is only one tiny easy to miss line that says the K-line is present but only for diag, and all control takes place over CAN


Any data that is different per individual ECUs, or must be saved across power cycles will go there. So things like any learned data and some DTCs, VIN, etc... For some customers we also have to store things like successful and failed programming attempts, incorrect seed/key interaction count, and more recently for cybersecurity enabled OEMs we store public keys and all data that needs to go along with that infrastructure.

I hear a lot of talk of the VAG-com cable. I have access to Vector tools and software through my job, so that's what I use as my passthrough device.




When I get home I'll post my ROM along with the program that I wrote to reconstruct it from the CAN log. Hopefully this time the mods will realize there's no proprietary dada and not delete my attachments.

If the ROM is stock, then it can be posted without issue. Tuned by "others", commercial ROMs or portions of or images of tables are not allowed on the forum.

I would be interested in how that works. I'm attaching my 2011 G37x rom that I manually extracted for your research, hopefully it will help.

Hi scumbagsleeper,
How did you extract this image?

Thanks!
Steve S

Had to solder to cpu and extract manually.

Also the file name was wrong. It is 1NX6B (not 1NX6D)


LOADER80
SH705927N
1FZ3XWN3
1NX6B