RomRaider

Hi Guys - I've been searching the web for a while now looking for an ECU option for my current car (Y34 Nissan Gloria) and from what I have found the options are quite slim.
Most aftermarket ECU's don't support the trigger setup and I'm not really wanting to spend ridiculous money with custom trigger setups ect. (Budget build)

I'm not so savvy on the coding side of things but have been following this thread and looks like it might be a promising option. I have attached a picture of the ECU from the Gloria, it has 2 x 7051 Processors - Wondering if anyone has played with this setup or could shed any light on it. Managed to get my hands on a second ECU so I'm willing to try different things to read / write the ECU.

Have got myself a VAG KKL adapter but have not managed to get coms with the ecu with Nisprog. NDSII Can pull the ECU part number but didn't play for the full version so i'm yet to see and engine parameters.

Cheers

Jacob

Hi,
that's an interesting ECU - we knew/suspected there were twin-processor units but it's the first one I actually see. Some ideas

- for NDS2 / nisprog : try different combinations of testerid and ecu address; nisprog has a "fastprobe" command to assist with this ( I think NDS2 also has a probe function)
- I assume a standard OBD2 connection (iso9141) over the K line works ?

I'm not familiar with the 7051, you'd have to find out if they have an AUD port; if it's routed to some test pads on the PCB that would probably allow you to dump the ROM(s) and from there work out what (if any) reflashing functions they support. Also check for boot mode connections that will allow you to reflash / recover a bricked ECU.

In the meantime if you can get higher-resolution photos of both sides of the PCB, that would make a nice addition to the hardware page on the wiki

There is no AUD port in SH7051 chip.
The upper right chip has bootmode pads in PCB solder side and is most probably engine or engine\transmission control related.
Nisprog is probably able to get ROM image from that chip.
Another chip is probably transmission or throttle control related if an electronic throttle is present.

Yep, there is no way to dump the ECU apart from off-board programmer (quite simple though, only ~32 pins are used in parallel mode ) or if we are lucky enough and these old ECUs support SID 0x21.
And if you are twice lucky and the approach with uploading and executing your own code inside ECU will work - ROM programming routines are almost the same as for 0.35um version of SH7055 chip and I got these part of code tested already.

Thanks for the fast replies guys. Ill have another play with Nisprog tomorrow and see if it will get any com's (Maybe a Rom). Had an issue with the VAG - KKL adapter so that took some time to overcome, the OBD2 pinout was incorrect and one of the capacitors on the circuit board wasn't even soldered to its pad... That's what you get for an $11 adapter haha. From what I can see the Nissan Data Scan software has got com's through the K-Line but its not the paid for version so all I was able to see was the Ecu Part Number - Not really keen to pay the $70 without knowing 100% if it will work.

I'm also under the impression that the second processor is used for throttle/traction control. Would be nice to have a play with that too as the throttle is quite slow and unresponsive... The throttle looks like some early version of fly by wire. Runs a cable to the throttle body but has Hall effect sensors and Throttle motor inside.

Once I got the VAG - KKL software to work it managed to get com's and told me it ran ISO9142-2 (I think its actually ISO9141) The mechanical shop I used to work at has a G Scan and it made com's with the engine ECU.


Fenugrec - Ill get those photos for you tomorrow.

What ECUID does it have? Is it something like 1AH403?

Sauher - ECUID 23710-AG920 (That's the ECU in the Gloria - I think the one I got off Ebay is a 23710-2G900. Got that for $60 Posted. Score!)

Have had a closer inspection of the ECU - Solder pads connected to pins 165(PG5/TxD1) and 166(PG6/RxD1) on both processors.

Also found solder pads which are connected to processors named HL01 to HL08 and HL11 to HL13.

Will get some more detailed photos tomorrow and upload them. Does anyone recommend another OBD2 interface rather than the KKL VAG. Don't really trust it too much.

Hmm, seems that both CPUs have K-Line connection and could be accessed exactly according to ISO14230 - being distinguished by target address.

So I had quite a productive day yesterday, managed to get Nisprog to get Coms with the ECU and started to extract the Rom. I ended up taking far too long so stopped it half way through. I have it pulling a Rom as we speak so once I get that out and compile it ill upload it for you guys to have a look at.

Nisprog did come up with something saying it couldn't execute a hack mode? Still managed to start extracting the Rom.

Fenugrec - I have attached a .rar file with detailed images of the ECU

Cool. Feel free to log in and fill in any extra information you find on the wiki, I just added your photos (cropped + straightened)
https://nissanecu.miraheze.org/wiki/Ecu_hw#type_E
Any info such as wiring, test points you find, nisprog parameters if they were unusual, etc.

nisprog's "hack mode" is the fast (~100B/s, best that can be done over K line) dumping method. I think it fails if you're not using proper source / tester addresses when connecting. What addresses were you using ?

Thanks for that Funugrec, will be sure to put up any additional information I find.

This is the a copy of the config file I'm using with Nigprog -

#debug all -1
set
interface dumb \\.\COM11
dumbopts 0x48
l2protocol iso14230
initmode fast
addrmode phys
destaddr 0x10
testerid 0xfc
up
diag
connect
np 0
np 5 0 524287
disconnect
exit

Try replacing

to

it's a typo in the forum post

Bingo! Thank you very much Shuher! Pulling the Rom much faster now.

Have successfully extracted the Rom! Guess that was actually the easy part, now for the hard part...

SH7051F has in fact 256kB.
Try to find an address of the second chip and upload it's 256 kB ROM.