RomRaider

Hi All! Before I start waffling, thanks to everyone who's posted on here and fenugrec for nisprog! Loads of great info on here,
to the point where I've always found the answer to my issue. I've moved over from the Subaru camp so have some rr experience, but not so much
Nissan ECU know how.

I couldn't find much ELgrand tuning info on here (or the internet), so here's where I'm at:

Pulled the ROM, with the kernel after a few iterations.
Commands I used:

set
interface dumb
port \\.\COM10
dumbopts 0x48
# No need to touch these unless you know what they are
l2protocol iso14230
initmode fast
testerid 0xfc
destaddr 0x10
addrtype phys
up
nc
setdev 1
setkeys 0x71DE1D63 0x85E192D
npconf p3 0
npconf rxe 30
runkernel C:\NissanTuning\Kernel\npk_SH7055_35.bin
dm kerntest.bin 0 524288
stopkernel
npdisc

I ran it through nisrom, I've attached the output and the debug log. There are a couple warnings, this one "no IVT2 ?? xxx. Last resort,: IVT2 value out of
bound, probably due to unusual RAMF structure.bad/reversed alt cks bounds; brute force technique: Possible IVT @ 0x1000 Probable IVT !", I assume is not good,
but I'm not sure why? (I know what IVT is, after some reading.). I tried to cross reference other roms in nisrom, these are also in the debug log, all I could
deduce is mine is different.

Steps so far, read, read, read some more, pull rom (eventually), compare rom to other roms in hex editor, look confused, search definitions in both github repos, tried to find a similiar one to compare to or better still reference, failed, resigned to creating definition from scratch, installed Ghidra, compared some more roms, watched fenugrec Youtube videos on IDA, realised I'd run out of talent....

I've attached my attempt at a definition file, I think I've got the values right but Romraider throws the "ECU Definiton not found" error, I think
this is because I haven't defined a table in the file.

Therein lies my problem, I can't seem to identify a table. I've compared table memory locations in xml def file AM900 (this one seems the most similar) with the
relevant rom and tried to match that with my rom but I'm missing something somewhere.

Obviously the main issue is my lack of knowledge, but I'm working on that

Any input would be gratefully recieved, maybe a post I've missed or some other nugget that will get me moving in the right direction?

Thanks!

Not too sure about IVT stuff, but don't forget that you need to have all your definition files in one folder, then run the combine all file. Then make sure that RomRaider has the definition file set as the nissandefs.xml file that gets produced when you run combine all.

I defined a couple maps for ya in this file. Just drag it to your folder and run combine all. It doesn't include much, but it should give you a starting point at the very least. Even being SH7055, it cross references somewhat well with CF48D. For someone new to ROM disassembly, I'd HIGHLY recommend using wols over anything use. Even with 2,100+ maps defined, I almost exclusively use wols for ROM disassembly, then I verify in Ghidra or IDA if needed. But wols is incredible for helping visualize the data being presented.

Here nisrom is having trouble finding the secondary "interrupt vector table". Earlier ROMs don't have one at all. Usually the IVT address is found along with a few other interesting addresses in the FID metadata struct. So far I've found that metadata is laid out pretty uniformly given a certain FID code such as 705520. For some reason yours is the first to deviate from the 6 other 705520's I've analyzed and on which nisrom is based...
I'm not sure how I would go about fixing this special case cleanly, and in any case I don't think it's worth the effort. Plus, nisrom found the important one (IVT @ 0x1000) manually anyway.
For tuning you can pretty much ignore all this; only relevant when you want to dig deeper in the disassembly or modify code in the "altcks" area ( https://nissanecu.miraheze.org/wiki/Checksums ), which nobody really does, ever.

Thanks Pytrex, I got the defs combined and setup in rr, I could load and edit other roms just not mine, I'll give your file a whirl and see how i get on.

I followed the link to wols in this post https://www.romraider.com/forum/viewtopic.php?f=65&t=13464 but it gives me a 404? I had a google but nothing decompiler-esque comes up, can you point me in the right direction?

Edit - [wols link works fine, needed to change the language to English from German.]

Thanks fenugrec, I'll re-read the wiki. Not sure, I'll be modifying code anytime soon .

Just in case.. -> https://www.evc.de/en/download/wols.asp

I'm referring to the wols Demo version by the way. There's a paid version, but it's not needed at all. But once you download it, you'll need to configure it to fully utilize the visualization aspect of it all. So you'll want to go to the taskbar in wols and click "Miscellaneous" -> "Configuration" -> "Text-Mode" (Under 'View') -> Enable "For hex values, remove leading zeros". Then you can go to the top right of the taskbar and you'll see colored columns, just click it and it should color the values. Also, it'll have the data setup as hex values to start with. Towards the top right of the task bar it'll have "FF" selected. Click the "255" right to the left to view the data in decimal form.

So you can view said data in a few different ways. uint8, int8, uint16, int16, uint32, and int32. If you're going to be defining maps, you'll need to have an understanding of when to use which one. Inside the A2L.xml or whatever definition template you use there will be "storagetype='xxxxx'" for each map. So if you're uncertain on how you should be viewing the data to locate a specific map, just check the definition template and it'll tell you. For 16 and 32 u/i, there'll be another option to view the data in either LoHi or HiLo. It'll default to LoHi normally, but you'll always want it in HiLo. But what I've found is that the data is typically chunked up pretty much by type. So you'll get uint8 chunks, then uint16 chunks, back to uint8, etc. Signed bytes (intXX) will show up randomly.

I think I might make a post about ROM Disassembly inside of wols, so there will be more info there if I decide to make it.

Right, this makes much more sense. I've got wols up and running now and configured as you describe.

This was definitely the nugget I was after, thanks for detailed steps. Much appreciated!

@pytrex, thanks again for getting me started. I've been chipping away, almost 40 tables defined now. I have a question regarding the intake cam table comment you left in the definition file "This looks extremely odd. Needs to be verified as cam timing"

What looked odd to you, the table itself (location or ?) or the contents?
I've attached images from wols, from my comparisons I think you mean the map.

I also wanted to get a "four eye" on my process, I've also attached images from Ghidra. I've cross referenced severals roms CF48D, WL90B (mine) and CD002 which is almost identical to mine.
When I looked at CF48D in Ghidra it had 2 xrefs and the functions were different, however when I looked at CD002 the functions are identical.

So, is it safe to assume that it is the cam table in my rom, even though the map looks really weird (CD002 def. already has cam table defined).

Thanks!

First, you should take down those wols screenshots haha It's copyright protected and we don't want any trouble

But I looked into it more, that definitely is your Intake Cam Timing map, surprisingly enough. I'm quite confused by why your cam timing map is so weird, but at least we can verify that it's the actual map haha Good find on your ROM lining up with CD002!

Oops!, thanks for the heads up, rookie mistake on my part. Images removed!

Thanks for taking the time to check. I can start to unravel why it's odd.
I'm starting to think some one has been fiddling, sorry "tuning" already, a couple of the other tables, like Target AFR have over eager values.

I won't know until I start logging a few runs, but thats for another day

You’re all good haha You would need to compare against another ROM from the same vehicle type (same options as well) to verify whether changes were made or not. I can’t recall what values your ROM had, but do remember that your ROM will be different from CD002’s values due to the vehicle differences. CF48D and CD002 are 350z ROMs, so the values won’t directly line up with your ROM.

Do you have an OpenPort 2 cable? That will be needed to datalog with RomRaider. Nissan Datascan 2 is VAG-COM compatible, but its about $40 if I remember correctly. Well worth it IMO as it has some really useful consult functionality. Clearing self learns is essential for fuel tuning!

I do have both an Openport and Nissan Datascan. The Openport was from my Subaru tuning days, you can't flash without one really and for $40 Nissan Datascan was well worth it.

As for comparing roms, finding another Elgrand E51 rom is proving tricky. I've checked the E50 rom posted elsewhere on here. But it doesn't seem to follow the same logical order as the majority.

Honestly, at this stage, I don't think I really need to know what it was. I can figure out if its any good from logging it. What I can tell is it shouldn't be that far away from, say a Maxima, they are a similar large luxury car, pushing similar HP. I'd want it to be nearer the 350z (notwithstanding the completely different variable length intake manifold and Cats that are jamming up the std. exhaust ). Either way large block values right across the rev range, when all the other roms I've checked show smooth transitions doesn't feel quite right to me. It may be fine, but half the fun is finding out. I'm not going to get any massive increases anyway, it's naturally aspirated unlike the Subaru.

Know anyone in the neighborhood that drives one ? or lying around in a scrapyard... I've done that once to get the ECUID before buying a spare - bring a small 12V battery and laptop , hook up to the donor vehicle (here they usually leave the keys in the ignition).

Re wols screenshots : if it's the demo version, there shouldn't be any problem posting screenshots here ? or is there some rule I'm not aware of...

I talked to dschultz about it and they’d rather not risk any legal action from having even the Demo screenshots posted here. Realistically, it’s hard to argue that it’s copyright protected. But it’s not worth the risk associated with posting the screenshots. Hence why my guide over wols was posted on the wiki and not directly here on Romraider

But in reference to finding a similar ROM, it’a pointless unless a similar ROM is also more defined than yours. Otherwise you would just be able to compare what maps are and are not there, but not what any of the maps actually are or do.