RomRaider

Hard to say for their tuned ROMs, may be they are well-customized.
But my personal test on MY2006 JDM and MY2008 European Nissan Tiida with HR16DE (HR15DE) engines shown same result - no starter rotation, no impulses on ignition coils and fuel injectors. More deep modification, falsifying the handshake between NATS and ECU was required.

Good day ,
I am currently getting an error on connection when attempting to connect to an older JDM vq 25 ecu

the error is as follows

diag_os_gethrt() resolution <= 0us, avg ~0us
diag_os_getms() resolution: ~16ms.
diag_os_chronoms() : resolution: ~15ms
Calibrating timing, this will take a few seconds...
Calibration done.
nisprog v1.02
nisprog: Interface set to default: DUMB
nisprog: Type HELP for a list of commands
nisprog: Type SCAN to start ODBII Scan
nisprog: Then use MONITOR to monitor real-time data
nisprog: **** IMPORTANT : this is beta software ! Use at your own risk.
nisprog: **** Remember, "debug all -1" displays all debugging info.
interface is now DUMB
Note concerning generic (dumb) interfaces : there are additional
options which can be set with "set dumbopts". By default
"K-line only" and "MAN_BREAK" are set.
port set to: \\.\COM24
dumbopts set to: 72
testerid: using 0xFC
destaddr: using 0x10
Available commands are :
npconn
npdisc
npconf <paramname> <value>
setdev <device_no>
setkeys <sid27_key> [<sid36_key>]
kspeed <new_speed>
runkernel <file>
stopkernel
watch <addr>
initk
dumpmem <file> <start> <#_of_bytes> [eep]
flverif <file>
flblock <romfile> <blockno> [Y]
flrom <romfile> [<orig_rom>]
npt [testnum]
log <filename>
stoplog
set <parameter value>
test <command [params]>
diag <command [params]>
vw <command [params]
dyno <command [params]
debug [parameter = debug]
source <file>
help [command]
exit

Try "help <command>" for further help
nisprog: Settings loaded from nisprog.ini

nisprog> nc
Bus Error: got 0x1 expected 0x81
diag_l1.c:235: We detected write error on diag bus.
diag_l2_iso14230.c:944: We detected write error on diag bus.
diag_l2_iso14230.c:736: Unspecified Error.
diag_l2.c:438: Unspecified Error.
L2 StartComms failed
nisprog>

This indicates a pretty low-level error, i.e. possibly something wrong with your cable, K line wiring, battery, etc... Did your setup work as-is on other ECUs ? are you sure you have the right COMxx number ?

same power supply , cables used before, same error with multiple cables .
before , everything worked as is

Strange... you're sure you have the right \\.\COM port ?

Try this, with everything plugged in and powered normally but IGN off (so the ECU won't respond) -

that debug test is not recognised

"l0test" is letter L and number 0

problem solved.... was a grounding issue on the test bench.

not sure why I still have that issue in some cars.

First of all thanks a lot for creating this software!

I am trying to dump my rom of my '04 350Z and using nisprog 1.02 with the kernels from github.
Results;
ECU ID: CE860 with multiple key candidates. After I connected I executed the following commands;
Npconf p3 0
NC
Setdev 1
Runkernel d:\npk_7055_18.bin
DM d:\dump.bin

With the following result;
No / incomplete / bad response
0x21 0xfd 0x00 0x00 0x01 0x04 0x00 0x00 0x01 0x04 0x00 0x00 0x01 0x04 0x00 0x00 0x01
Rxrawdump failed

Does anybody know what is happening? What am I doing wrong? I tried the other key candidates but they resulted in SID 27 errors

Currently the low speed dump is beeing done and will attach soon.

I found out that I have to set kspeed 31250 and it works. Since my AT5 is swapped for an MT6 I will try the CD700 ECU which is in the rom list and see if my car runs like it should.

The dumped rom is attached for those who want to create the definitions.

Glad you managed to make it work at 32500bps. What happened is the kernel responded but for some reason your combination of K hardware, USB stack, OS and random timing variations prevented the whole response from being read fast enough.
Instead of changing kspeed, you could try extending the read timeout to "catch" the whole response -- try or some other number, the default is 20. If this helps, it will be very important to do the same thing before attempting a reflash.

Speaking of which, swapping the whole ROM like you intend to do is mildly risky, unless you're absolutely certain that the internal ECU hardware is identical. Best case, everything works; bad case, you'll get some sensor / actuator DTCs and probably instant limp mode; worst case you can damage the engine.

Reading your reply makes me very happy the reflash using CD700 was successful and besides an ABS DTC I could simply reset it only made things better. There seem to be more ifs and buts then I estimated. I did the reflash using the kernel and the Kspeed 31250. I am using this cheap CH340 VAG-COM cable so I guess that might be the source of the timing problems.

I will try soon with the npxconf rxe 30 setting if I can read full speed.

As for reading the binary file, what is the best way to create the definition files? I am able to open it in hex-editor and wols but I have no idea where to start, also read the 'How to create XML defs for RR (nissan-specific)' and 'How To: Get started with IDA and disassembly' topics but cant find a way to make anything readable out of it.

I got it working by searching hex code in the CD700 rom and finding the same hex code in the CE860. Attached is the def file.

Is there a way to recognise the code corresponding to the registers? In IDA as cpu config I used the renesance 4B and the IDA code definitions on the nisutils github but still didn't get any understandable descriptions of the hex code.

Based on the 6Y303 rom and definitions I thing I found the Speed Limit for both CE860 and CD700. Is anybody willing to validate these files for me? Or how to validate myself? If they are correct I will make a pull request on github.

As for the hardware id of CE860 where can I find this, is it in the rom or printed on the ECU casing?

Tomc: the hardware ID is indeed only in the ROM, not printed anywhere. It's always stored roughly in the same area, near a "DATABASE" string.
But please, to continue discussion on your ROMs, start a new thread.