RomRaider

Here, this thread is specifically for the standalone "nisprog" reflash utility.

GPLv3 source code is available on github

Current binary release: 1.05-2523639_20220616 (announcement post)
Download link at end of post, or on Sourceforge for unregistered forum guests:
https://sourceforge.net/projects/nispro ... z/download

See the end of this post for release signatures.


Current status is: has been working great for many different people's setups over the past few years.

Highlights:

• supports Nissan K-line ECUs based on SH7051, SH7055(180/350nm), SH7058
• supports Subaru K-line ECUs based on SH7055(180nm), SH7058
• 100-110 B/s dump speed if not using a kernel
• > 5 kB/s dump speed with npkern
• > 5 kB/s flash write speed with npkern
• up to 8x-256x speed gain by only reflashing modified blocks (*)
• guesses the needed keys for many many ECUIDs

(*) flash block size varies from 4kB to 128kB. If a single 4kB block is different, there's no need to reflash the whole 1MB... so yeah. To my knowledge nisprog is the only software with this functionality, and is probably one of the fastest reflash tools for K-line-only Nissan ECUs. Granted, some commercial tools are faster because they use the CAN bus to transfer bulk data !

New users *MUST* take 5 minutes and read the README and USING files included in the release! Any question that is answered directly in those two files or by typing "help" inside nisprog will be answered with RTFM.

Starting with 1.04 I will be including precompiled npkern builds.

Known problems / stuff that needs fixing :

• debug logging sucks. It's a pain to copy error outputs to report issues, I know. I'm working on that...

If you find this useful, please consider supporting me (and don't forget RomRaider!), see my signature.

I recommend verifying hashes/signatures to match the information on the SourceForge mirror and the files themselves.

Can't wait to test it out.

This looks awesome! Thanks for the precompiled link and new features! I read through the "USING.txt", looks like this update makes reflashing a breeze, no more entering lots of manual keys, blocks, etc.

I'll try this one out very soon and give you some feedback, thanks again!

Great work mate.
I've been reading up on your work the last week or so on this forum.
Few days back I downloaded the freediag prog. I managed to get my ecu id but had timeout errors on diag. It matched the Nissan data scan ecu ID.
I will test out this latest nisprog on weekend and as soon as I have my 2002 tb48 aussie patrol Rom dump I will upload to share.
Quick question, if I do dump using the kernel and something goes wrong will I brick my ecu? Should I do slow dump first as backup.
I'm not going to be doing any flashing as will have steep learning curve to create definition. (so expect noob questions in future...)
Thanks in advance.
Brett

My thoughts are to do a non kernel backup first.

I can help somewhat with definitions as the major stuff is relatively easy to find.

I don't like absolutes, but I'd say it's very unlikely. If you have 1-2h to spare (and a battery charger), you can certainly do the 100B/s regular dump first. (I don`t call it "slow dump" because there's an even slower mode, ~ 15B/s IIRC !)

Of course normally the kernel just stays in RAM and disappears when you're done, so unless you accidentally type a "flrom" command with all the right parameters etc, you should be fine.

Ok so i tried out the standalone Nisprog.
Here is how i used it:

set
interface dumb
port COM5
dumbopts 0x48
l2protocol iso14230
testerid 0xfc
destaddr 0x10
addrtype phys (case sensitive)
up
nc
#Connected shows ECUId as VC266 same as NDS2
#best choice SID27 Key=211CE348 SID36 key1=19EB3063
setdev 0
dumpmem test.bin 0 1023
#this seemed to work well 106B/s, see attached file

#then i thought bugger it i'm gonna try the kernel
runkernel e:\nisprog\npk_7055_18.bin
#using 4606 Byte Payload
#padding with garbage to 4608 (0x01200) bytes
#got bad 27 01 response 0x7F 0x27 0x94 SID27 problem

So i'm not sure what the go is, do i need special keys (mum said is was special..) and if so how do i go about this?

Also how can you use the nisprog.ini file to auto run the commands upon starting nisprog?

Cheers
Brett

VC266 : out of curiosity what "distance" did it report for that key candidate ?

IIRC the 0x94 code in there means something special indeed, I forget what it is... something like "conditions for letting you do the securityalgo not met" - maybe battery voltage, engine running, something else...

I'll try to take another look later this weekend

Well now i just realised i forgot to mention that i couldnt connect whith ignition on it had to be running.
That's why i thought bugger the slow way im gonna use the kernel and save 20L of fuel..
Maybe i've done something stupid.

some people are having trouble at the connect step, it sometimes takes a few attempts before it works (timing issue). Try that with IGN ON but the engine not running.

Okay i tried it again without engine running... it did connect on 3rd attempt.

But same kernel issue.

Key candidate distance distances:
0 0x211CE348-6
1 0x705A2287-3
2 0xE5D097FC-13

There is probably no known key for your ROM.
Spend an hour to got ROM image without kernel.

if you're lucky that second candidate 0x705A2287 could maybe work. try "setkeys 0x705A2287" before runkernel
[EDIT - I suspect a typo in the reported distance for that 705A2287 key ? I get "8" instead of "3" ! ]

otherwise like Sasha said, you'll need a regular dump first to extract the keys from the ROM.

Ive now done the regular dump and to not waste any more space on silly questions on this topic i will post rom in stock ROM list.
Thanks guys.

Another "special condition to be met" I noticed few days ago.

Coolant temperature must be high enough, not sure what is the exact target but reflashing the car which stayed whole night outside at -3 C (~25 F) failed on the step of passing SID27 authorisation. Small warm up to 55 C (~130 F) of coolant temperature allowed to do the reflash.

I also heard that for some Nissans it also fails this step if coolant temperature is too high (more than 60 C/ 140 F), but my particular ECU it's not the case, I did a reflash having 80 C/ 176 F engine temperature.