nisprog reflash utility

Sasha_A80 · **Posted:** Fri Feb 12, 2021 2:11 pm

In fact I have seen that 7055S has SDSR = 0x0201 and 7055F returns useless data.
It was long ago and I recommend to check that finding since I maybe wrong.

The were a lot of incompatible "updates" in 2002-2004 with 7055F-7055SF movement in Subaru.

The ecu code was really the same. The internal primary bootloader had cosmetic changes and had another bootloader ID for the factory equipment be able to use an applicable kernel.

fenugrec wrote:

Sasha_A80 wrote:

SH7055F returns nothing useful, SH7055S\SH7058\SH7058S\SH7059 returns the family.
SDSR register 0xFFFFF7C2

Interesting... but how can that work ?

7055F (350nm) has SDSR = 0x0201 (or 0x0200 depending on TRST) ?
7055S has SDSR = 0x0201 (same)
7058 has SDSR = 0x0201 (same)
7058S has SDSR as 0x5001
7059 : SDSR = 0x0F01

7055F , 7055S and 7058 datasheets say exactly the same thing about SDSR...

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Code:

Monitoring 0xFFFF6804; press Enter to interrupt.
0xFFFF6804: FF FF BF 94

Thanks.

Ok, next test is very different this time - maybe Sasha is right and this is 350nm. This test kernel is modified to bypass the usual 180 vs 350 test, and read SDSR.
Can you do (almost) the same thing : flrom practice mode; then watch 0xffff6800 once (no need for ffff6804).

MaRS_R wrote:

The year of release is most likely 2007 or 2008, but since I could not read the eeprom, I cannot see the VIN.

I think you can check the VIN with a SID 9 request, e.g. "diag sr 9 2".
Or use freediag (similar to nisprog but more general), run 'scan' then 'test rvi' (those commands are not in nisprog).

Sasha_A80 · **Posted:** Sat Feb 13, 2021 11:52 am

There was the first Denso 32bit SH7055F based ecu for Subaru Forester AT Turbo that never got SH7055SF chip till 2007 year.
This may be the same case.
Other cars used SH7055F in 2003-2004 and were switched to SH7055SF within a year and to SH7058F the next year.

Verify ecu power supply current on the bench. SH7055F based ecu needs 300-450 ma, the same design with SH7055SF installed cut the current to a half.

MaRS_R · **Posted:** Sat Feb 13, 2021 1:29 pm

fenugrec wrote:

Ok, next test is very different this time - maybe Sasha is right and this is 350nm. This test kernel is modified to bypass the usual 180 vs 350 test, and read SDSR.
Can you do (almost) the same thing : flrom practice mode; then watch 0xffff6800 once (no need for ffff6804).

Code:

Connected to ECU !
ECUID: 9W73B
Key candidate   dist (smaller is better)
0: 0x816C3398   9
1: 0x6D571F84   10
2: 0x968148AD   12

Using best choice, SID27 key=816C3398. Use "setkeys" to change if required.
now using 7055.
Now using SID27 key=C7B27ADF, SID36 key1=AF82C6F9
Using 4084 byte payload, padding with garbage to 4096 (0x01000) bytes.

SID27:SUXXESS !!
SID 34 80 done.
SID36 block 0x007F/0x007F done
SID 36 done.
sid37: sending 0x37 0x1C 0x84
SID 37 done.
SID BF done.
ECU now running from RAM ! Disabling periodic keepalive;
Connected to kernel: SH7055_35-7055t06
You may now use kernel-specific commands.
        p3 set to 0 (0x0).
Connected to kernel: SH7055_35-7055t06
nisprog: Settings loaded from nisprog.ini

nisprog> flrom 9W73A.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, (total:
16)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> p
reflashing selected blocks (dry run). Note, some (harmless) write verification e
rrors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
        Block 00
Erasing block 0 (0x000000-0x000FFF)...
writing chunk @ 0x000F80 ( 96 %,  3303 B/s, ~    0 s remaining)
Write complete.
        Block 01
Erasing block 1 (0x001000-0x001FFF)...
writing chunk @ 0x001F80 ( 96 %,  3391 B/s, ~    0 s remaining)
Write complete.
        Block 02
Erasing block 2 (0x002000-0x002FFF)...
writing chunk @ 0x002F80 ( 96 %,  3438 B/s, ~    0 s remaining)
Write complete.
        Block 03
Erasing block 3 (0x003000-0x003FFF)...
writing chunk @ 0x003F80 ( 96 %,  3391 B/s, ~    0 s remaining)
Write complete.
        Block 04
Erasing block 4 (0x004000-0x004FFF)...
writing chunk @ 0x004F80 ( 96 %,  3391 B/s, ~    0 s remaining)
Write complete.
        Block 05
Erasing block 5 (0x005000-0x005FFF)...
writing chunk @ 0x005F80 ( 96 %,  3391 B/s, ~    0 s remaining)
Write complete.
        Block 06
Erasing block 6 (0x006000-0x006FFF)...
writing chunk @ 0x006F80 ( 96 %,  3348 B/s, ~    0 s remaining)
Write complete.
        Block 07
Erasing block 7 (0x007000-0x007FFF)...
writing chunk @ 0x007F80 ( 96 %,  3435 B/s, ~    0 s remaining)
Write complete.
        Block 08
Erasing block 8 (0x008000-0x00FFFF)...
writing chunk @ 0x00FF80 ( 99 %,  3469 B/s, ~    0 s remaining)
Write complete.
        Block 09
Erasing block 9 (0x010000-0x01FFFF)...
writing chunk @ 0x01FF80 ( 99 %,  3067 B/s, ~    0 s remaining)
Write complete.
        Block 10
Erasing block 10 (0x020000-0x02FFFF)...
writing chunk @ 0x02FF80 ( 99 %,  3416 B/s, ~    0 s remaining)
Write complete.
        Block 11
Erasing block 11 (0x030000-0x03FFFF)...
writing chunk @ 0x03FF80 ( 99 %,  3408 B/s, ~    0 s remaining)
Write complete.
        Block 12
Erasing block 12 (0x040000-0x04FFFF)...
writing chunk @ 0x04FF80 ( 99 %,  3445 B/s, ~    0 s remaining)
Write complete.
        Block 13
Erasing block 13 (0x050000-0x05FFFF)...
writing chunk @ 0x05FF80 ( 99 %,  3453 B/s, ~    0 s remaining)
Write complete.
        Block 14
Erasing block 14 (0x060000-0x06FFFF)...
writing chunk @ 0x06FF80 ( 99 %,  3260 B/s, ~    0 s remaining)
Write complete.
        Block 15
Erasing block 15 (0x070000-0x07FFFF)...
writing chunk @ 0x07FF80 ( 99 %,  3411 B/s, ~    0 s remaining)
Write complete.
Reflash complete.
nisprog> watch 0xffff6800

Monitoring 0xFFFF6800; press Enter to interrupt.
0xFFFF6800: 8E A9 33 33
nisprog>

and very long with display!

Code:

diag_l1.c:253:  _recv request len=3, timeout=800;got 3 bytes; 0x01 0xFC 0xFD
writing chunk @ 0x07FF80 ( 99 %,   320 B/s, ~    0 s remaining)diag_l1.c:155:  _
send: len=137 P4=0 l0flags=0x1011; 0x00 0x86 0xBC 0x02 0x07 0xFF 0x80 0x01 0xFF
0xFF 0xFF 0x4E 0x48 0x55 0xFC 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF
0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0xFF 0x71 0xA8

diag_l1.c:253:  _recv request len=3, timeout=800;got 3 bytes; 0x01 0xFC 0xFD

Write complete.
Reflash complete.
nisprog> debug l1 0
L1 debug is 0x0:
nisprog> watch 0xffff6800

Monitoring 0xFFFF6800; press Enter to interrupt.
0xFFFF6800: 8E A9 33 33
nisprog>

fenugrec wrote:

I think you can check the VIN with a SID 9 request, e.g. "diag sr 9 2".
Or use freediag (similar to nisprog but more general), run 'scan' then 'test rvi' (those commands are not in nisprog).

Code:

nisprog> diag sr 9 2
msg 00 src=0x00 dest=0x00
msg 00 data: 0x7F 0x09 0x11
nisprog>

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Code:

nisprog> diag sr 9 2
msg 00 src=0x00 dest=0x00
msg 00 data: 0x7F 0x09 0x11
nisprog>

Ah yes, on my ECUs (north america) I have to connect differently (OBD2 mode via iso9141 etc) for that request to be supported. Maybe it's the same for yours.

MaRS_R wrote:

Monitoring 0xFFFF6800; press Enter to interrupt.
0xFFFF6800: 8E A9 33 33

Thanks.
Ok, next test.

- no need for "debug l1 0x8c", it will generate too much noise
- use a ROM that is almost identical to your current ECUID except one block at the end (in case something goes wrong). Don't use 9W73A, I think all blocks were different ?

- 1) practice mode
- 2) watch 0xffff6800 once
- 3) if it looks like "8E 00 33 33", real reflash will probably work.
- 4) if it was "8E 00 xx xx", probably OK too
- 5) if it was "AA 00 xx xx", reflash may fail. That's why you want a test ROM that will only erase the last block: that shouldn't brick the ECU.
- 6) try a real reflash (don't select "the whole ROM" of course !)

@Sasha, thanks for the info. That would make sense - Denso probably didn't hurry to change to 7055S on every ECU immediately after release, and I imagine they probably had 7055F purchase contracts for a few years after 2003...

MaRS_R · **Posted:** Sat Feb 13, 2021 2:32 pm

fenugrec wrote:

Ah yes, on my ECUs (north america) I have to connect differently (OBD2 mode via iso9141 etc) for that request to be supported. Maybe it's the same for yours.

Code:

scantool> Scan

Trying ISO9141:
L2 connection OK; tring to add SAE J1979 layer...
ISO9141 Connected.
Connection to ECU established
Exploring Mode 0x01 supported PIDs (block 0x00)...
Exploring Mode 0x02 supported PIDs (block 0x00)...
Exploring Mode 0x05 supported PIDs (block 0x00)...
Exploring Mode 0x06 supported PIDs (block 0x00)...
Exploring Mode 0x08 supported PIDs (block 0x00)...
Exploring Mode 0x09 supported PIDs (block 0x00)...
Requesting Mode 0x01 PID 0x01 (Current DTCs)...
MIL light ON, 0 stored DTCs
Requesting Mode 0x02 Pid 0x02 (Freeze frame DTCs)...
diag_l2_iso9141.c:502: Read/Write timeout.
diag_l2_iso9141.c:626: Read/Write timeout.
Request failed, retrying...
diag_l2_iso9141.c:502: Read/Write timeout.
diag_l2_iso9141.c:626: Read/Write timeout.
Retry failed, resynching...
        OK.
Mode 0x02 Pid 0x02 request failed (-8)
Requesting Mode 0x01 PID 0x13 (O2 sensors location)...
diag_l2_iso9141.c:502: Read/Write timeout.
diag_l2_iso9141.c:626: Read/Write timeout.
Request failed, retrying...
diag_l2_iso9141.c:502: Read/Write timeout.
diag_l2_iso9141.c:626: Read/Write timeout.
Retry failed, resynching...
        OK.
Mode 1 Pid 0x13 request failed -8
Oxygen (O2) sensor monitoring not supported
Requesting Mode 7 (Current cycle emission DTCs)...
diag_l2_iso9141.c:502: Read/Write timeout.
diag_l2_iso9141.c:626: Read/Write timeout.
Request failed, retrying...
diag_l2_iso9141.c:502: Read/Write timeout.
diag_l2_iso9141.c:626: Read/Write timeout.
Retry failed, resynching...
        OK.
No DTCs stored.
Non-continuously monitored system tests (failures only): -
scantool> test rvi
ECU doesn't support VIN request
ECU doesn't support Calibration ID request
ECU doesn't support CVN request
scantool>

MaRS_R · **Posted:** Sat Feb 13, 2021 2:40 pm

fenugrec wrote:

- no need for "debug l1 0x8c", it will generate too much noise
- use a ROM that is almost identical to your current ECUID except one block at the end (in case something goes wrong). Don't use 9W73A, I think all blocks were different ?

- 1) practice mode
- 2) watch 0xffff6800 once
- 3) if it looks like "8E 00 33 33", real reflash will probably work.
- 4) if it was "8E 00 xx xx", probably OK too
- 5) if it was "AA 00 xx xx", reflash may fail. That's why you want a test ROM that will only erase the last block: that shouldn't brick the ECU.
- 6) try a real reflash (don't select "the whole ROM" of course !)

Code:

Connected to ECU !
ECUID: 9W73B
Key candidate   dist (smaller is better)
0: 0x816C3398   9
1: 0x6D571F84   10
2: 0x968148AD   12

Using best choice, SID27 key=816C3398. Use "setkeys" to change if required.
now using 7055.
Now using SID27 key=C7B27ADF, SID36 key1=AF82C6F9
Using 4104 byte payload, padding with garbage to 4128 (0x01020) bytes.

SID27:SUXXESS !!
SID 34 80 done.
SID36 block 0x0080/0x0080 done
SID 36 done.
sid37: sending 0x37 0x26 0xA0
SID 37 done.
SID BF done.
ECU now running from RAM ! Disabling periodic keepalive;
Connected to kernel: SH7055_35-7055t07
You may now use kernel-specific commands.
        p3 set to 0 (0x0).
Connected to kernel: SH7055_35-7055t07
nisprog: Settings loaded from nisprog.ini

nisprog> flrom 9W73B.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : (total: 0)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> p
reflashing selected blocks (dry run). Note, some (harmless) write verification e
rrors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
Reflash complete.
nisprog> watch 0xffff6800

Monitoring 0xFFFF6800; press Enter to interrupt.
0xFFFF6800: 8E A9 33 33
nisprog> flrom 9W73B.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : (total: 0)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> y
reflashing selected blocks.
Reflash complete.
nisprog> flrom 9W73B.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : (total: 0)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> 10 y
Aborting.
nisprog> flrom 9W73B.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : (total: 0)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> 10y
Aborting.
nisprog>

Code:

nisprog> dumpmem 01.bin 0 524288
npk dump @ 0x0007FF00,  4489 B/s,    0 s remaining

MaRS_R · **Posted:** Sat Feb 13, 2021 2:59 pm

fenugrec wrote:

- 5) if it was "AA 00 xx xx", reflash may fail. That's why you want a test ROM that

Code:

nisprog> flrom 01test.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 6, 8, (total: 2)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> p
reflashing selected blocks (dry run). Note, some (harmless) write verification e
rrors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
        Block 06
Erasing block 6 (0x006000-0x006FFF)...
writing chunk @ 0x006F80 ( 96 %,  3483 B/s, ~    0 s remaining)
Write complete.
        Block 08
Erasing block 8 (0x008000-0x00FFFF)...
writing chunk @ 0x00FF80 ( 99 %,  3487 B/s, ~    0 s remaining)
Write complete.
Reflash complete.
nisprog> watch 0xffff6800

Monitoring 0xFFFF6800; press Enter to interrupt.
0xFFFF6800: AA 00 00 40
nisprog>

Should I try to write this file?

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Quote:

nisprog> flrom 9W73B.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : (total: 0)

no modified blocks = ROM file is identical, you can't force nisprog to reflash a single block.

MaRS_R wrote:

Code:

nisprog> flrom 01test.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 6, 8, (total: 2)

Should I try to write this file?

No.

fenugrec wrote:

- use a ROM that is almost identical to your current ECUID except one block at the end (in case something goes wrong)

Take your 9w73b dump, change 1 byte near the end. It has to report as "Modified blocks : 15 (total:1)". I'm not sure how else to explain this.

Worst scenario : it could successfully erase that block, but fail to rewrite it.
More probable : it could fail to erase, then abort. No damage.
I'll say it again : if you change block 6, or 8, or anything other than the last (15), and reflash fails : you will probably brick your ECU.
Make sure you understand what I wrote.

MaRS_R · **Posted:** Sat Feb 13, 2021 4:22 pm

fenugrec wrote:

Worst scenario : it could successfully erase that block, but fail to rewrite it.
More probable : it could fail to erase, then abort. No damage.
I'll say it again : if you change block 6, or 8, or anything other than the last (15), and reflash fails : you will probably brick your ECU.
Make sure you understand what I wrote.

Even if I change it separately in block 15, it automatically changes and 6. Apparently the checksum are being recalculated

Code:

nisprog> flrom 7FFE0_0.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 6, 15, (total: 2)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> p
reflashing selected blocks (dry run). Note, some (harmless) write verification e
rrors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
        Block 06
Erasing block 6 (0x006000-0x006FFF)...
writing chunk @ 0x006F80 ( 96 %,  3483 B/s, ~    0 s remaining)
Write complete.
        Block 15
Erasing block 15 (0x070000-0x07FFFF)...
writing chunk @ 0x07FF80 ( 99 %,  3470 B/s, ~    0 s remaining)
Write complete.
Reflash complete.
nisprog> watch 0xffff6800

Monitoring 0xFFFF6800; press Enter to interrupt.
0xFFFF6800: AA 00 00 40
nisprog>

Code:

nisprog> flrom 7FFE0_0_not_checksumm.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 15, (total: 1)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> p
reflashing selected blocks (dry run). Note, some (harmless) write verification e
rrors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
        Block 15
Erasing block 15 (0x070000-0x07FFFF)...
writing chunk @ 0x07FF80 ( 99 %,  3470 B/s, ~    0 s remaining)
Write complete.
Reflash complete.

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

MaRS_R wrote:

Even if I change it separately in block 15, it automatically changes and 6. Apparently the checksum are being recalculated

Yes that's true, if you're modifying in romraider (or maybe wols - no idea if there's an option to *not* fix checksums)
Exceptionnally for this test you should use a hex editor instead . It will cause a bad checksum (P0605) but that's still preferable to bricking .

MaRS_R · **Posted:** Sat Feb 13, 2021 4:32 pm

fenugrec wrote:

MaRS_R wrote:

Even if I change it separately in block 15, it automatically changes and 6. Apparently the checksum are being recalculated

True, yes, if you're modifying in romraider.
For this test you can modify it with a hex editor . It will give a bad checksum (P0605) but that's still preferable to bricking .

Code:

nisprog> flrom 7FFE0_0_not_checksumm.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 15, (total: 1)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> y
reflashing selected blocks.
        Block 15
Entered flashing_enabled (unprotected) mode
Erasing block 15 (0x070000-0x07FFFF)...
diag_l2.c:542: Read/Write timeout.
no ERASE_BLOCK response?
nisprog>

Looks like I did something wrong! :shock:

Code:

nisprog> flrom 7FFE0_0_not_checksumm.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 15, (total: 1)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> y
reflashing selected blocks.
        Block 15
Entered flashing_enabled (unprotected) mode
Erasing block 15 (0x070000-0x07FFFF)...
diag_l2.c:542: Read/Write timeout.
no ERASE_BLOCK response?
nisprog> flrom 7FFE0_0_not_checksumm.bin

checking block 00/15 (000000-000FFF)...diag_l1.c:183:  Bus Error: bad half duple
x echo!
diag_l1.c:233: We detected write error on diag bus.
diag_l2_iso14230.c:966: We detected write error on diag bus.
diag_l2.c:518: We detected write error on diag bus.

l2_send error!
nisprog> watch 0xffff6800

Monitoring 0xFFFF6800; press Enter to interrupt.
diag_l1.c:183:  Bus Error: bad half duplex echo!
diag_l1.c:233: We detected write error on diag bus.
diag_l2_iso14230.c:966: We detected write error on diag bus.
diag_l2.c:518: We detected write error on diag bus.
diag_l2_iso14230.c:1033: We detected write error on diag bus.
diag_l2.c:542: We detected write error on diag bus.
npk sid23 failed : -16
RMBA problem
nisprog>

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

Code:

reflashing selected blocks.
        Block 15
Entered flashing_enabled (unprotected) mode
Erasing block 15 (0x070000-0x07FFFF)...
diag_l2.c:542: Read/Write timeout.
no ERASE_BLOCK response?
nisprog>

Everything is weird about your ECU...

Quote:

Looks like I did something wrong! :shock:

In this case when you see "bad half duplex echo" it's usually a bug in nisprog (long story, it's hard to fix). Don't disconnect the battery / poweroff the ECU yet. Try closing nisprog, wait a few seconds, then reopen + connect.

MaRS_R · **Posted:** Sat Feb 13, 2021 4:47 pm

fenugrec wrote:

In this case when you see "bad half duplex echo" it's usually a bug in nisprog (long story, it's hard to fix). Don't disconnect the battery / poweroff the ECU yet. Try closing nisprog, wait a few seconds, then reopen + connect.

Does the same

Code:

nisprog> flrom 7FFE0_0_not_checksumm.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 15, (total: 1)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> p
reflashing selected blocks (dry run). Note, some (harmless) write verification e
rrors WILL
occur if there are "modified blocks" ! (i.e. ROM file differs from ECU ROM)
        Block 15
Erasing block 15 (0x070000-0x07FFFF)...
writing chunk @ 0x07FF80 ( 99 %,  3467 B/s, ~    0 s remaining)
Write complete.
Reflash complete.
nisprog> flrom 7FFE0_0_not_checksumm.bin

checking block 15/15 (070000-07FFFF)... done.
Modified blocks : 15, (total: 1)

        y : To reflash the blocks listed above, enter 'y'
        f : to reflash the whole ROM
        p : to do a dry run (practice mode) without modifying ROM contents
        n : To abort/cancel, enter 'n'
> y
reflashing selected blocks.
        Block 15
Entered flashing_enabled (unprotected) mode
Erasing block 15 (0x070000-0x07FFFF)...
diag_l2.c:542: Read/Write timeout.
no ERASE_BLOCK response?
nisprog>

fenugrec · **Joined:** Wed Jan 08, 2014 11:07 pm **Posts:** 652

MaRS_R wrote:

Does the same

yeah ok, but if I understand, you can connect again , and your ECU contents didn't change ? No damage ?

If everything is back to normal I'm taking a break from this. I'll have something else to try in a few days.

RomRaider

Forum rules

nisprog reflash utility

Who is online