RomRaider

First of all, thanks to EVERYONE who shares their information here. I have learned so much from all of you!!
But now it is my turn to give back.

As a long time Nissan enthusiast (especially those VQs!!!) and micro-controller fanatic I have often wondered why no one has put together an Arduino based CAN BUS ROM dumper? For those that are not aware of the Arduino platform, they use super cheap, 8 bit, 16 Mhz processor that are very capable, even with only 2K RAM and 32K program memory!

Sooooo....since I couldn't find one, I decided to try to make one.
After all, wouldn't it be nice to have a FAST and CHEAP way to dump the Nissan/Infiniti (and probably *ANY* CAN bus) ECU ROMs?
-AND- wouldn't it be nice to do it without a PC?
-AND through the OBD port?
-AND- have it copy a 1MB SH7058 in about 3 1/2 minutes to a SD card??

Soooo, after almost 200 hours of CAN Bus & OBD SID research, programming, testing, debugging and more testing it is 90% done!


Now, part of the planning for this project was to make sure there is NO WIRING or SOLDERING required. Not everyone has a soldering iron or has the patience for stripping and soldering wires.

To keep it simple, I use inexpensive and readily available "Arduino Uno Shields". A shield is a board that has long pins that connect to the Arduino Uno or another shield.

In my setup I use:
• Arduino Uno clone: $3-15
• Arduino Uno CAN Bus shield: $6-25
• DB9 to OBD cable: $5-15
• Arduino Uno Data Logging Shield w/Full size SD Card: $2-14
• Arduino IDE (FREE and easy to use!)

For about $15 to $70 you have a cheap and fast method of dumping your ROM.
Note: The low cost amount is from AliExpress and the higher cost amount is from Amazon.

Current program functionality:
• Reads ECU ID and uses it for the filename on SD card + copy number. For example: 2NX2A_01.bin, 2NX2A_02.bin
• Checks for ROM size from 512K to 2M (I don't think 2M ECU exist just yet, but why not add it
• Copies the ROM from 0x000000 to ROM size to SD card.

To Do:
• Add error checking (the CAN Bus chipset does most of this in the hardware)
• Add LCD or LCD touchscreen to indicate progress and errors

I would like to thank the following for their helpful posts:
• fenugrec
• LeftoverPi
• SteveS
• Shuher
• scumbagsleeper
• FrankVQ

Next Steps:
• Determine where the newer CAN Bus ECUs checksums are located
• Determine the available maps
• Determine the SID 27 passkey algorithm (or maybe just brute force the password)
• Then UPLOAD via the CAN bus!!

"This sounds interesting, but where is your ******* source code?"
As for the source code, if there is enough interest, I will post it on GitHub.
This way folks smarter than me can make it better!

However, before I post the source code, I want to add additional error checking and clean up.
Then I want to do more testing on different ECUs. I have a few Nissan vehicles that I can get easy access to and I want to test how well it works. Also, I will test it on a late model Mazda and Subaru, after a minor code change.

My overall goal is to make it quick, easy and cheap to get CAN Bus enabled ECUs (any ECU from 2008+) ROM dumps.

July 2021 UPDATE:
The CAN bus board I used is no longer available. It was kind of unique as it allowed you to select the "Chip Select/CS" by a switch so it didn't conflict with the CS on the SD card.

I am going to try a few other CAN bus boards and try to come up with an easy to assemble (no jumper wires or soldering) solution.

I don’t know crap about this stuff but I think this would be an incredible tool to have! Plenty of Nissan and Infiniti owners are stuck having to spend $750 for a tuner license from uprev for what? Something you can get for $13 thanks to Fenugrec. Plus it would open up open source tuning for so many people! Right now we’re limited to K-line ECU’s only. By adding in CAN line ECU’s, we’re adding everyone from ~07/10-2020 (I thinkkkk) So it would allow those with more modern vehicles to have access to what we currently have.

Well done !




checksums : that should already be solved, nisrom locates checksums for all the ROMs listed in the "stock ROM list" thread, and the handfull that I have here and not updated in the table. Well, except the SUM16 checksum, it's described on the wiki but I didn't code it yet. If you want to try your hand adding that to nisrom I can be of assistance.

available maps : it's the same, tedious process as K-line ROMs. Either get lucky and find def for a different ECUID but has identical ROM layout, or work it out from the most similar def you have. Or option 3, the ultimate solution - find an A2L file for it.

SID27 : isn't it the same algo as on K-line ?

Flashing via tool made of DuPont jumpers and breadboard? That scares me But for dumping purposes it's really nice to have, especially for the ROMs with unknown keys.

Anyways - cool stuff, really well done! Even though if I had 200 hours of spare time I would be instead writing a "driver" for nisprog to support VAG K+CAN cable allowing to do same flashing using it. Also no soldering required, just 7$ cable from ebay/aliexress.

It depends on the experience and the background.
Someone prefers to program microcontrollers while others would like to program PC's.

$5-$10 ELM or VAG K+CAN is the cheapest basis for both alternatives.
Arduino may be the simpliest way to startup.

ELM is only capable to handle 8 byte packets as I managed to find out while during reflash chunk size is 128 bytes, so VAG cable is the only option from the cheap ones. For the rest I fully agree.

I use to reflash PIC18F25K80 microchip when a customized equipment is do be developed.
32kB ROM allows an universal CAN programmer plus 3-5 different kernels to be loaded into ELM cable.
Thus the original ELM software is not an issue and is completely wiped out.
The recent generation VAG K+CAN uses PIC18F2680 chip and is capable to hold up to 15 kernels.
Renesas FDT or similar free software is used at the PC end.

PC-minded developers may prefer to use modified ELM cables or VAG K+CAN as is.

Hmmm... Reflashing of ELM - that's the thing I didn't think of, was mainly referring to stock tools for sake of further availability it's better to use stock hardware, as cheap as possible. But yeah, it always depends...

Checksums:
I thought you mentioned the "CAN ROMs" had a different structure? Anyways, In the next few days, I will see what nisrom does

SID27:
I have no idea... I will have a look at your code to attempt to understand what you have done. My C programming level is "beginner+"

fenugrec:
Thank you again for all your work you have done on this!

No DuPoint jumpers or breadboard are used. By using a "shield" they simply stack on top of each other, like a daughter board.
Now I did use jumpers and a breadboard for the CAN bus sniffer, but that was cropped out of the picture

I don't think I have the programming skill to write a driver.

This was a project to better understand the CAN bus.
The next project is a CAN bus based bluetooth gauges for engine temp, oil temp, brake line pressure, etc. If you have ever installed a gauge in a car, it is a HUGE pain... find a power source, route the cable through the firewall, mount the gauge somewhere on the dash etc.

You'll still need a power source for it and if so - what's the difference, 1 or 2 wires to be layed?

One of the project goals was to have a robust, simple to use, portable way to dump a ROM.
I have done a little programming on PCs, but I really like the simplicity and speed of the Arduino platform.

If all goes well, this will be another tool to pick from

Nope... The power comes from the OBD port.

It is difficult to see in the picture, but the Arduino simply plugs into the OBD port. It powers up and dumps the ROM.

Before the Arduino direction was decided, I did a little testing with an ELM327. Either I didn't get the message format correct, or it doesn't support the higher level SIDs. It does support receiving multi-frames on the CAN bus (as shown on page 37 of the manual) BUT I don't think it supports sending multi-frame as this is really outside its design scope. (as I see it)

UPDATE: I just did a little ELM327 test. The $30+ name brand OBD scanners (Veepeak BLE, Vgate iCar Pro, OBDLink MX+) *DO* support the higher level SIDs. The cheaper ones may or may not. In one case the $14 OBD scanner was tested to show ELM 2.2 compatibility, but ignored the upper level SID.

I might be wrong, but I get the sense this is perceived as a "competitive" alternative.
It isn't... It is just another "tool in the pouch"

We all reach for our favourite tools first, the tried and tested.
If all goes well, I hope to provide an additional tool to pick from