RomRaider

Edit to avoid future confusion

This ROM has identical SupMask values in two places and I was using the wrong one.

I was using SupMask base address 0x3D04

The actual SupMask is at 0x3C4D

Both have identical values. I'm not sure what the 2nd one is for, if it's used at all.

Progress has slowed in recent times with these ECUs and I understand that as people's motivation move on to other things.

I'm a hobbyist tuner and I'd really like to help push progress with these ECUs to keep going. I occasionally get paid tunes and I'm more than happy to give half of what I get to people who are familiar with disassembling these ROMs who can help get to the bottom of things like this. I can contribute by testing things in the real world and submit information updates and changes for NissanDefs updates. I think DTC SupMasks not working is a pretty serious issues that needs investigating.

Any help would be greatly appreciated. I can pay.

On my bench ECU with another DTC code, I just tried both the SupMask method and zeroing out the option data and even that did not stop that DTC coming up.

I even tried BitEdit's trick of zeroing out the fault code in the descriptor table but that just made it come up as P0000.

OK I just discovered the Mode 6 TID SupMask as well although I'm not sure how helpful that will be in this case because some of the codes that I unsuccessfully disabled have nothing to do with any of the mode 6 TIDs.

I want to try and reduce the amount of times I flash fix candidates to the owner's vehicle remotely so I'm hoping to get some ideas before I stuff the owner around too much.

Cheers!

Hmmm. AFAIK, supmasks should be the end all say all no matter what. Just like CID supmasks, if it's not enabled, then the logic won't be enabled. I've had no issues with disabling any DTC through supmasks within CF48D. Now, it's interesting how this isn't appearing to be the case for you. Definitely something worth looking into further!

My latest suspicion is that the 3rd byte in the DTC descriptor table, that we call a hardware flag, may be an indicator of groups of DTCs that must be either all enabled or all disabled and disabling individual DTCs must not work.

I don't want to stuff the owner around any more so I'm going to flash a change with all rear O2 DTCs disabled via SupMask, all DTC options for those DTCs zeroed out AND the mode 6 SupMasks for those functions disabled. I'll need to wait for another vehicle to test whether or not zeroing the options was necessary or not.

There is a list of bytes located prior to the DTC list that contain bits for if the DTC is enabled or disabled. Instead of defining individual DTCs and using the "supmask" (which disables every part of the DTC, including freeze frame related data which you may need) you should be defining the list as it is, a structure. There is a byte in the structure which indicates the byte offset in the list i mentioned, and another byte which indicates the bit to turn on/off in order to disable the DTC. In some cases, there will be multiple instances of the same DTC, this is why defining the list as a structure is far better than using this supmask technique you've all been doing.

This sounds interesting. Could we get some more info and examples?

Edit: I found this stuff before the DTC descriptor table for ZB060 but none of the TB48DE ROMs have this at all.

First post edited

So VD70A has a DTC SupMask at 0x3C4D and it also has one at 0x3D04.

It looks like most, if not, all, DTCs use the 3C4D ones BUT there is one known function in here that ref the other SupMask! The same function refers to the DTC descriptor table and DTC status array too so it's definitely DTC related.

Both full SupMask 0x3D long arrays have identical values except for one single bit at offset 0x34 bit 1 for P1102.

I think I'll just set my defs up to change both SupMasks just in case and I'll stop zeroing out the DTC option data.

Checkout CF48D’s DTC section. Eventually gonna merge more together, but each individual byte is 8 bits of DTC’s. They should all be within the same block as well.

Yep I always got that.

My ROM has two completely separated DTC SupMask Blocks. The first one is the proper one. The second one is used by one DTC which is strange. Check it out for yourself at the two SupMask start addresses. All 61 bytes are identical between the two except for a single bit in one of them. Looks like something overlooked or laziness during VD70A's development so they just left both there rather than updating the code on that one DTC.