RomRaider

Hey guys,
I wanted to give back to this incredible community. I've helped couple of people get the head around all the things needed to be able to dump and edit the ROM. A lot of this is quite simple but information is scattered around different topics, repositories and websites. So I present to you a tutorial for guys willing to fiddle around. Starting from all the hardware and software you need, to the specific commands you need to use.

These guide should be applicable to cars from 2002-2010 (but depends on the model)
WARNING: This is not plug-and-play. You will need to manually configure tool so it works with your car. User interface is in command line, you should know how to enter commands there.

Any feedback is also welcome!

What you need
- Windows Laptop
- At least basic understanding of Command Line and ECU tuning
- Download software (Tools list below)
- VAG-COM KKL 409.1 Cable (search ebay, amazon etc for it, there should be plenty available)
- Install drivers for VAG-COM cable, they should with included CD or use http://www.wch.cn/download/CH341SER_EXE.html
- Install 32-bit Java for RomRaider (on Java download page select file ending with X86)

Tools List:
- Nisprog for dumping/flashing ROM (viewtopic.php?f=64&t=13259)
- NPKern, a kernel that will allow you to flash (viewtopic.php?f=64&t=13259)
- Nissan ECU Definitions for RomRaider (viewtopic.php?f=64&t=13325)
- RomRaider software for ECU file editing (https://www.romraider.com/index.php/RomRaider/Download)

Preparation
1. Download and install software tools
2. Copy »nisprog« folder to C:\
3. Connect your OBD cable to computer..
4. Open Start menu (Windows logo) on your computer and choose »Devices and Printers« menu. If you installed your cable driver correctly, you should see which COM port your cable uses (ex. USB-Serial COM3). Remember this number for next step.
5. Edit nisprog.ini file in »C:\nisprog\« with program of your choice (WordPad works OK) and set COM port number to match yours. Look for line under »# !!! Set COM port number here« and change only last digit. Save and close the file. Leave the file open, you will add 2 more lines in next step.

ECU Specifics
You must first know which ECU you have to use appropriate flashing kernel, since few variations were used over the years:
1. Open VIN lookup page https://nissan.epc-data.com
2. Enter your VIN or as they call it »frame number« in the search box
3. In the right menu next to diagram, click on »D: Engine electrical«, followed by »ENGINE CONTROL MODULE« and click »ENGINE CONTROL MODULE« one more time.
4. Look at first column, »OEM part number«, the last 6 characters are your ECUID (ex. CD80A)
5. Look up your ECUID in table here STOCK ROM LIST, and take note of FID IC in the same row - a six digit number. If you didn't find exact match, your ECU has not been defined yet. You can try with anything that starts with same sequence as your ECUID, but you will have to post your downloaded ROM to forum to be decompiled.
6. Edit nisprog.ini file in »C:\nisprog\«. Use FIC IC number to add lines AFTER what is already there without quotes and save the file:
a. If it starts with 7055 add »setdev 1«. If it starts with 7058 add »setdev 2«.
b. If the number starts with 7058 add »runkernel C:\nisprog\npk_SH7058.bin«
If the number is 705513 or less add »runkernel C:\nisprog\npk_SH7055_35.bin«.
If the number starts with 7055 but has last two digits greather than 13, use »runkernel C:\nisprog\npk_SH7055_18.bin«

In the end, your file should look like this, but with commands specific to your car:


Dumping stock ROM from ECU
1. Turn on your car ignition to ON (do not start the car)
2. Turn off all the accessories in car (dome light, ventilation, headunit)
3. Connect your OBD cable to car and computer
4. Open »C:\nisprog\« folder
5. Double-click nisprog.exe. A command line window should be shown.
If you did everything right, reflash kernel should be running (you will hear car's fans running)
6. Do not proceed if previous steps didn't work!!! Close nisprog window and retry. You have a communication problem if it does not work.
Double check preparation steps, try to see what program log says is wrong. Also check forums.
7. If your FIC starts with 7055 type »dumpmem my_rom.bin 0 524288«,
if it starts with 7058 type »dumpmem my_rom.bin 0 1048576« in command window.
8. You should see progress and once done, the ROM is downloaded and saved in C:/nisprog folder as my_rom.bin.
9. YOU ARE NOT DONE, follow the steps below
10. Type »stopkernel«, car fan should stop running
11. Type »npdisc«
12. Type »quit«
13. Now turn off ignition ad disconnect the cable from your car.
 
Modifying ROM
1. Install 32-bit Java if you didn't do it yet.
2. Open included RomRaider folder. Open »run.bat« file and RomRaider should start. When prompted, open Definitions Manager.
Add included nissandefs.xml to the list of definitions by ckicking »Add...« at the bottom of the window and using browser to select »C:\nisprog\nissandefs.xml« file.
3. Use »File-> Open Image...« menu and select the file you downloaded from your car, which is in »C:\nisprog« folder
4. Maps should appear in left menu. Hopefully the definitions contain your ECU. If not, check for updates in NissanDefs link provided!
You can try to ask someone to create you a definition on RomRaider forum.
5. Make changes. Any modification should be done based off dyno and logging data!
The best application for logging is Nissan DataScan II (paid, but worth it).
Read up on UpRev tuning guide http://uprev.com/UpdateFiles/software/UpRev%20Nissan%20Tuning%20Guide.pdf.
6. Save your edited ROM to »C:\nisprog« folder under a name you will remember

Flashing edited ROM
1. Follow steps 1-6 in »Dumping stock ROM from ECU« section above
2. Make sure communication is stable and that kernel is running, car's fan should be running.
3. Type »flrom YOUR_ROM_NAME.bin« to start flashing procedure, confirm option you prefer when program asks you how to flash.
4. DO NOT POWER OFF if you suspect there were flash errors! You can still upload original rom or fix communication errors here!
Ask for help on forums, read »USING.txt« in nisprog folder.
5. Hopefully your modified ROM was successfully flashed.
YOU ARE NOT DONE YET! Follow steps 10-13 in »Downloading ROM« section above to stop communications
6. Remove the cable, turn OFF car ignition
7. Start the car and see what you did


[EDIT 2018/7/22] change 350z specifics to make this guide generally applicable to all Nissans
[EDIT 2018/7/24] added guide to post, use the most up to date software versions

Thanks for putting that together, it is nice to have a consolidated resource to gather the info for newbies.

My only $0.02, other than the odd typo, is that the guide title (add this thread) should be more broadly focused. How to guide for NISSAN rather than 350Z.

If you have access to the Nissan parts software (epc), after a VIN lookup I think it loads the correct part # for the ECU . Something like "23710-8U901" with the last half being the ECUID. Might not work for all models though.


Meh, IMO if someone can't spend a few minutes to learn a handful of commands, then a few seconds to type them, maybe they shouldn't be reflashing their ECU at all... I think it would be a waste of dev effort to make a GUI front-end, but of course nothing prevents you from doing so.
Interfacing to the CLI will be messy, you'd almost be better off linking against libdiag and some of the nisprog code, then calling command handlers directly instead of trying to pipe stuff through stdin/stdout.

Great hint I will include that in my guide, found this https://nissan.epc-data.com it requires a bit of digging through categories and it got my ECM right! it will be helpful for newcomers to lookup ECUID



Perhaps I explained my idea wrong, I was not going to use cli directly but rather np_backend + other functions from your toolset. But as you said, few commands is not so difficult to configure once. I will rather try to make some improvements to RomRaider in my spare time.

A better source for that info (exact ECU model number is

https://nissan.7zap.com/en/er/

That website you linked to originally never found my VIN number and seems rather outdated, this one works fine. Steps are almost the same

Input VIN
Confirm details are Correct
Click Engine Electrical
Click Engine Control Module
Locate the ENGINE CONTROL MODULE item and the part number is listed there

great find, thanks! I will include that in next version

This is absolutely incredible. Thanks for putting this tutorial together! And fenugrec, murphys_law, dschultz, and all else involved in bringing us this open-source method, I cannot thank you enough!

Does anyone know if native linux support is in the works? I ask because I'm considering dropping a raspberry pi into my 350z with touchscreen to pull diags and sensor info over obd2, and I'd love to be able to integrate this and kick things off with bash scripts, etc etc. And RomRaider already has a linux release, so this would be the last missing piece. I'll try out the dumping and flashing using Wine though, and see how that goes.

For nisprog and all my utilities : there's no need to. They have always supported linux and can be compiled natively, I just don't distribute *nix binaries for a number of reasons.

This is my VIN: JN1AZ34D93T108423, nothing comes up using https://nissan.epc-data.com/ but using https://nissan.7zap.com I get part number 23710CD001 for the ECM. Is this just not supported yet?

Thanks
Josh

Hi Guys,

When I look up my com port on my laptop. It comes up as Port_#0001.Hub_#0003

I have tried to enter this multiple ways but I still get a com failure.

This is what I have.

# No need to touch these unless you know what they are
set
interface dumb

# !!! Set COM port number here
Port \\.\Port_0001.Hub_0003 No need to touch these unless you know what they are
dumbopts 0x48
l2protocol iso14230
initmode fast
testerid 0xfc
destaddr 0x10
addrtype phys

# now connect
up
nc


Any help would be great. Still learning.

Nah that's its location in the host's USB "tree", it's not a port name. try


to see a list

Hello,

I have a Nissan primera P12 1.8 car (2003). I did everything like described in the first post, but im stucked.

Nisprog can't communicate with ecu via com port 09. This is my setting:

set
interface dumb
port \\.\COM09
dumbopts 0x48

#sorry, you still need these
l2protocol iso14230
initmode fast
testerid 0xfc
destaddr 0x10
addrtype phys
up
nc
npconf p3 0
runkernel C:\Users\...........\Desktop\Nissan files\ECU remap\Software\Nisprog_JO\npk_SH7055_35.bin



But with nissan datascan II software can communicate with ecu at com port 09. Whats the problem? Help me please.

Thank You

In order to help, we'd need you to post the output when you try to connect.

Try changing the timing parameters, running a media player in the background. Is the leading '0' in 'com09' necessary?

I tried with COM9 but still not working. This is what i get by 09.

Which cable are you use? you need simple k-line cable only.