nisprog reflash utility

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Code:

Now using SID27 key=5414CDA6, SID36 key1=E303BF23
Using 38377 byte payload, padding with garbage to 38400 (0x09600) bytes.

For the record, the problem was a bad kernel file : the "38377 byte payload" indicates a 38kB file, whereas all the kernels are around 4kB.

TomC · **Joined:** Thu Oct 26, 2017 4:11 am **Posts:** 34

fenugrec wrote:

TomC wrote:

Could you please clear up some stuff for me on how you did this?

Well, I already knew where the SID 27 errors were generated, I had just never backtracked to find the cause for 0x95. So I looked at the disasm for CD800;

Code:

ROM:00014AD6 60 50                 mov.b   @r5, r0     ;r5 was set to FFFF966D a few lines before
ROM:00014AD8 C8 30                 tst     #h'30, r0         ;this is the test
ROM:00014ADA 89 03                 bt      loc_14AE4
ROM:00014ADC E4 27                 mov     #h'27, r4 ; '''
ROM:00014ADE E5 95                 mov     #h'FFFFFF95, r5     ;preparing to send the "27 95" error

Then, I sortof took a tangent that ended up being useless : I looked for code that set those bits in FFFF966D and found those other two state variables. Then I remembered to check in the ZB060 ROM since it has that awesome A2L def; the 0x95 error code was equally easy to find and with an almost identical conditional:

Code:

ROM:0003840E 84 51                 mov.b   @(1,r5), r0   ;here, accessing ffff8a87
ROM:00038410 C8 30                 tst     #h'30, r0     ;testing the same bits
ROM:00038412 89 03                 bt      loc_3841C
ROM:00038414 E4 27                 mov     #h'27, r4 ; '''
ROM:00038416 E5 95                 mov     #h'FFFFFF95, r5

And I got lucky that FFFF8A87 is "important enough" to have been defined in the A2L file. A lot of internal state variables are not defined in there.

This is amazing (still magic to me but okay), I watched the FFFF966D adress and many thing happend when I was pushing buttons and pedals in the car. It changed when I pushed the break, when the PNP-switch changed state and by that time I ended up at the same 2C 00 2C 00 code stirkac had before. After putting the fans of the heater to off the state changed to 0C 00 0C 00. So I guess we identified code 0x95 combined with the 2C to be the Load Switch which in this case was the A/C or heater fans.

Finally we flashed the CD700 rom on the CD800 car with the steering wheel buttons and break + clutch pedal switches and now he has working CC!

@fenugrec if you don't have time to implement the 0x95 code in nisprog I will give it a go when I can find some spare time soon.

Thank you guys for all the help!

Next goal is finding something like deacceleration fuel cut since someone is requesting for pop's & bangs...

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

TomC wrote:

@fenugrec if you don't have time to implement the 0x95 code in nisprog I will give it a go when I can find some spare time soon.

Thanks, but already done:
https://github.com/fenugrec/nisprog/com ... 29db82478f
it'll be in the next nisprog release.

skeruno · **Joined:** Sat Oct 28, 2017 5:24 pm **Posts:** 8

Hi there,

I have a issue with reflashing a new rom. I have done a lot successfully already but i have not seen this message before. The second key needs to be loaded to run the 7055_18 kernel. But while flashing it seems to be unable to erase block 6. Someone knows whats going on?

Connected to ECU !
Using short headers.
ECUID: CE821
Key candidate dist (smaller is better)
0: 0x7B472BD1 3
1: 0xEED9A107 3
2: 0x968148AD 13

Using best choice, SID27 key=7B472BD1, SID36 key1=8F7577FC
Use "setkeys" to change keyset.
now using 7055.
nisprog: Settings loaded from nisprog.ini
nisprog> runkernel npk_7055_18.bin
Using 3908 byte payload, padding with garbage to 3936 (0x0F60) bytes.
SID 27: seed = 0x00 0x00 0x8B 0x91 ; using NPT_DDL algo (scode=0x7B472BD1),
got bad 27 02 response : General_Error, Requested_SID_securityAccess Error_invalidKey
sid27 problem
nisprog> setkeys 0xEED9A107
Now using SID27 key=EED9A107, SID36 key1=D6A9ED21
nisprog> runkernel npk_7055_18.bin
Using 3908 byte payload, padding with garbage to 3936 (0x0F60) bytes.
SID 27: seed = 0x8B 0x91 0x3F 0xAB ; using NPT_DDL algo (scode=0xEED9A107),
SUXXESS !!
SID 34 80 done.
SID36 block 0x007A/0x007A done
SID 36 done.
sid37: sending 0x37 0x8C 0x25
SID 37 done.
SID BF done.
ECU now running from RAM ! Disabling periodic keepalive;
Connected to kernel: SH7055_18-2fc59c4
You may now use kernel-specific commands.
nisprog> flrom roadster03-08-2018002.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 6, 7, (total: 2)

y : To reflash the blocks listed above, enter 'y'
f : to reflash the whole ROM
p : to do a dry run (practice mode) without modifying ROM contents
n : To abort/cancel, enter 'n'
> y
reflashing selected blocks.
Block 06
got bad RequestDownload response : 180nm: bad DL_ERASE
nisprog>

Kind regards,

Vincent

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

skeruno wrote:

nisprog> setkeys 0xEED9A107
Now using SID27 key=EED9A107, SID36 key1=D6A9ED21

Let me know what ECUID this is and I'll add its key to the next release.

Quote:

got bad RequestDownload response : 180nm: bad DL_ERASE
nisprog>

your ECU is not 180nm, you'll need the 7055_35 kernel

a33b · **Joined:** Sat Jun 24, 2017 2:23 pm **Posts:** 315

skeruno wrote:

Connected to ECU !
Using short headers.
ECUID: CE821

skeruno · **Joined:** Sat Oct 28, 2017 5:24 pm **Posts:** 8

Hi there!

Thanks fro your feedback. i tried the 35 kernel at first. but if gave me a "wrong kernel" error. So i switched to the 18 one. The 18 still have me errors and i found out i needed the second keyset. For some reason i stayed with the 18 kernel instead of switching back to the 35 with the second keyset. So its my error. sorry about that.

I do have an other weird thing: when running nisrom i dont get the checksum locations returned. Thay state "N/A". What am i missing? below the output of nisrom.

kind regards,

Vincent

Code:

file   size   LOADER ##   LOADER ofs   LOADER CPU   LOADER CPUcode   &FID   FID   FID CPU   FID CPUcode   RAMF_weird   RAMjump entryIVT2   IVT2 confidence   std cks?   &std_s   &std_x   alt cks?   &alt_s   &alt_x   alt_start   &alt_end   alt2 cks?   &alt2_s   &alt2_x   alt2_start   RIPEMD160   known keyset   s27k   s36k   guessed keyset   s27k   s36k   &EEPROM_read()   EEPROM PORT   
./bla.bin   512k   50   0xE24   SH7055   21   0x30F4   5ZVS8N02   SH7058   21   +0   0xFFFF8438   0x1000   0.99   0   N/A   N/A   1   0x1400   0x1404   0x1408   0x30F2   0   N/A   N/A   N/A   0   1   0xEED9A107   0xD6A9ED21   1   0xEED9A107   0xD6A9ED21   0x45D64   0xFFFFF766

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

skeruno wrote:

when running nisrom i dont get the checksum locations returned. Thay state "N/A".

Usually it indicates a corrupt or incomplete ROM dump (sometimes not exactly 512kB - make sure it's really 512*1024 bytes). nisrom isn't perfect but in my experience it finds checksums very reliably.

skeruno · **Joined:** Sat Oct 28, 2017 5:24 pm **Posts:** 8

Hi there!

I've done the dump serveral times at 512k which resulted in those fields being empty. But after dumping more(1024K) it seems that the fields are filled in. So i have the slight assumption this is a 1024k rom? Or am i wrong?

Code:

file   size   LOADER ##   LOADER ofs   LOADER CPU   LOADER CPUcode   &FID   FID   FID CPU   FID CPUcode   RAMF_weird   RAMjump entryIVT2   IVT2 confidence   std cks?   &std_s   &std_x   alt cks?   &alt_s   &alt_x   alt_start   &alt_end   alt2 cks?   &alt2_s   &alt2_x   alt2_start   RIPEMD160   known keyset   s27k   s36k   guessed keyset   s27k   s36k   &EEPROM_read()   EEPROM PORT   
./test.bin   1024k   50   0xE24   SH7055   21   0x30F4   5ZVS8N02   SH7058   21   +0   0xFFFF8438   0x1000   0.99   1   0x71F4   0x71EC   1   0x1400   0x1404   0x1

edit: added the roms file in 512 and 1024 version. Maybe some of you can help me out?

edit2: when opening the 1024k rom with the nischeck enabled romraider it gives me a checksum error. Im quite lost

Kind regards,

Vincent

Sasha_A80 · **Posted:** Sun Aug 05, 2018 10:09 am

This in fact is SH7058 ROM image.

skeruno · **Joined:** Sat Oct 28, 2017 5:24 pm **Posts:** 8

Hi there!

thanks for the feedback! figured it out now knowing its a 7058. this explains the size. The checksum was still on end="0x7FFFF". when changed to end="0xFFFFF" the checksum was correct.

Thanks a lot!

Kind regards,

Vincent

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

skeruno wrote:

7058.

Oops, yes, I should've noticed that. Obviously you'll need the 7058 kernel to reflash. Good to know everything's working now.

cs2000 · **Joined:** Tue Aug 07, 2018 10:18 am **Posts:** 3

Hi guys,

One of the members here (stirkac ) posted about this tool over on 350z-uk.com so i cane here to check it out and im having some issues.

In my ini file i have determined my ECU to be of the 7055 type, so have added these options

Code:

Setdev 1
Runkernel c:\nisprog\npk_7055_35.bin

I can connect the car to the program, the car fans start spinning and Nisprog says the ECU is running in RAM, but whenever i try to do a dump of the ECU using this parameter:

Code:

dumpmem my_rom.bin 0 524288

I get this message in Nisprog

Quote:

No / incomplete / bad response
0x21 0xfd 0x00 0x00 0x01 0x04 0x00 0x00 0x01 0x04 0x00 0x00 0x01 0x04 0x00 0x00 0x01
Rxrawdump failed

If i comment out the two lines i added to the INI file and connect without using the kernel, i have managed to successfully dump the rom in slow mode with a battery charger connected over the space or 90+ mins, but wanted to run it from the kernel really as i don't want to do any flashing at such a slow speed.

Any tips on what to do?

stirkac · **Joined:** Tue May 22, 2018 4:33 am **Posts:** 22

cs2000 wrote:

No / incomplete / bad response
0x21 0xfd 0x00 0x00 0x01 0x04 0x00 0x00 0x01 0x04 0x00 0x00 0x01 0x04 0x00 0x00 0x01
Rxrawdump failed

looks like connection/timing issues... some say opening media player helps. maybe stop the kernel and retry connecting few times.
Using debug mode will let you see more connection info (look for timeouts):

Code:

debug l1 0x8c

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

cs2000 wrote:

Quote:

No / incomplete / bad response
0x21 0xfd 0x00 0x00 0x01 0x04 0x00 0x00 0x01 0x04 0x00 0x00 0x01 0x04 0x00 0x00 0x01
Rxrawdump failed

Smells a lot like just a timeout, try increasing the rxe value (see npconf command)

RomRaider

Forum rules

nisprog reflash utility

Who is online