K-line open-source reflash utilities

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

K-Line open-source flashing utilities
There are now two options for this:
1. Command Line Interface (CLI) option - nisprog/npkern - originally by fenugrec for Nissan & modified for Subaru by rimwall
2. Graphical User Interface (GUI) option - FastECU/npkern - GUI application by MiikaS, kernels originally by fenugrec for Nissan & modified for Subaru by rimwall

CLI Option
nisprog (originally for Nissan reflash) has been expanded to 7055/7058 Subarus over K-line (experimental status). nisprog is an open-source flashing solution using ordinary USB to OBD2 cables (such as VAG-COM cable). It has been in use by the Nissan folks for a number of years now.

Full credit to fenugrec, as author of nisprog and supporting applications. fenugrec was very helpful as I stumbled my way through the coding additions to nisprog and the kernel. If you find this application useful please consider supporting (in this order) fenugrec and me. Full credit to MiikaS for loads of testing on the 7055 350nm 2002 Forester XT.

This is for K-Line flashing only. It will not work for CAN-only vehicles (~2007 onwards). I will post an open-source CAN flashing solution shortly in a separate post.

This is beta stage. SH7058 has been bench-tested successfully by me multiple times. SH7055 (350nm chip) as found in cars like the 2002 Forester XT has been successfully tested by MiikaS.

The minimum file package for execution is available in the first post of this thread: https://www.romraider.com/forum/viewtopic.php?f=64&t=13259
The full repo is available here: https://github.com/fenugrec/nisprog
How to use guide available here: https://github.com/fenugrec/npkern/blob/master/doc/USING.txt (Subaru sections reproduced below).
How it works is available here: https://github.com/fenugrec/nisprog/blob/master/SubaruSIDs.txt plus discussion here: https://github.com/fenugrec/npkern/issues/7

How to use guide:
(note that the Subaru needs to be in 'test mode' - green connectors connected)

Code:

***** SUBARU section
- all the same warnings as above apply
- whilst nisprog was initially written for Nissan, it now has some additional commands for communicating with and flashing Subaru ECUs
- only Subaru ECUs based on SH7055S or SH7058 (that don't use CAN communications) are currently supported
- SH7058 has been bench-tested. SH7055S is yet to be tested (volunteers welcome).

Software Setup
- all files can be downloaded from github: https://github.com/fenugrec
- nisprog and npkern can be compiled from the github files, or the following minimum files are required for Subaru comms/flashing
   * nisprog.exe
   * ssmprog.ini
   * ssmk_SH7058.bin or ssmk_SH7055_18.bin
- put these files all in the same directory along with the binary ROM file for flashing (eg) newROM.bin
- newROM.bin needs to have Checksums corrected for any changes. If you use Romraider Editor this will be done automatically.

Hardware Setup
- a windows PC or laptop plugged in to power (if the laptop battery dies during a flash, the ECU may be bricked)
- any simple serial USB to OBD-II cable. Cheap ebay VAG-COM cables should be fine. Install the windows drivers that came with the cable.
- plug the cable into a USB port and make sure it is detected and working in Device Manager. Note the COMx number that the cable has connected to.
- plug the cable into the OBD-II port on your vehicle
- have a battery charger running on your car battery to ensure voltage doesn't drop too low (if this occurs, the ECU may be bricked)
- turn the key in the ignition to 'ON' but do not start the car

Initial setup
- edit ssmprog.ini to have the correct COMx number (from above):
   port \\.\COM1
- for Subaru, nisprog initially uses a RAW connection, and then switches to ISO14230. Therefore, the settings required in ssmprog.ini are:
   l2protocol RAW
   initmode fast
   testerid 0xf0
   destaddr 0x10
   addrtype phys
   speed 4800

Running nisprog
- nisprog interacts with a command line interface
- start a Command Shell in Windows (press Windows+R keys and type "cmd")
- move to the directory in which you stored nisprog.exe (eg: type "cd\nisprog")
- run nisprog with the start commands from ssmprog.ini (type "nisprog -f ssmprog.ini")

Connecting & SSM commands
- type "spconn" to connect to the Subaru ECU
- if connection is successful, the ECU ID number will be reported
- once connected, nisprog command "diag sr" can be used to interact with the ECU using the SSM protocol (see: https://romraider.com/index.php/RomRaider/SsmProtocol)
- only the command/response data needs to be entered (nisprog completes the header and checksum)
- for example, to issue an "ECU Init" request, type "diag sr 0xBF"
- another example, to read 8 bytes at 0xFFFF6000 type "diag sr 0xA0 0x00 0xFF 0x60 0x00 0x08"

Set 7055 or 7058
- type "setdev 7058" or "setdev 7055" to tell nisprog which ROM you have

Running the kernel
- type "sprunkernel ssmk_SH7058.bin" or "sprunkernel ssmk_SH7055_18.bin"
- if loading of the kernel is successful, the kernel build ID will be reported
- the ECU is now running from the kernel program in RAM and is no longer running from the ROM

Test kernel operation / dumping a ROM
- dumping a ROM is a good test to ensure stable operation
- type "dm TestDump.bin 0 0"
- this will take 3-4 minutes to dump the ROM into TestDump.bin. It wil auto-detect ROM size based on "setdev" command.
- review the file to ensure a successful dump

Flashing a whole ROM (practice or for real)
- type "flrom newROM.bin"
- enter "p" for practice mode or "y" for real mode
- nisprog will give you the choice to flash all blocks, or only the changed blocks

Exit Process
- if the kernel is running, type "stopkernel" to stop the kernel and restart the ECU
- all learned values in the RAM will be reset as part of this process
- if the kernel isn't running, type "npdisc" to disconnect from the ECU
- type "exit" to exit from nisprog and return to the command line

Troubleshooting
- you are mainly on your own
- see comments above in the Nissan section
- help may be available on the Romraider forums

GUI Option
Available here...

Windows 7, 32-bit version: https://www.syvanenmotorsport.fi/wp-content/uploads/2022/08/bootloader_test_win7_32bit.zip
Windows 7, 64-bit version: https://www.syvanenmotorsport.fi/wp-content/uploads/2022/08/bootloader_test_win7_64bit.zip
Linux 64-bit version: https://www.syvanenmotorsport.fi/wp-content/uploads/2022/08/bootloader_test_linux.zip

More info here...

https://www.syvanenmotorsport.fi/forum/%20...%20.msg9#msg9

Port selection still not at use. When selecting bootloader connection under 'bootloaders' it will automatically change right mcu to device selection, otherwise right mcu must be selected if restarting software and kernel still running. With 16-bit ECUs, only Dump ROM is/should be working, no write or compare because it was just testing with OpenECU kernel. Other disabled ECUs will also not working and no plans to add those to this as this software was only made for JDM Forester XT/CS testing.

So first, under 'bootloaders' select 'Subaru 02 32-bit' to connect JDM Forester XT/CS bootloader and it will automatically upload kernel. If kernel upload is succesful, then just select Dump ROM, Compare ROM, Test write ROM or Write ROM.

Linux version needs atleast Qt 5.12.8 version installed (with QtSerialPort).

And as obvious, there is no guarantee in this software, use it at your own risk. I am not responsibility in any way of bricking your ECU or damaging your car

Any problems, just send message to MiikaS.

[first edit: updated to reflect 7055 350nm kernel now available]
[second edit: updated to include GUI Option]

SergArb · **Posted:** Fri Jun 17, 2022 2:39 am

Very nice work!
I have a early Denso ECU, from JDM Forester XT. It's on bench. Based on SH7055, but can't be flashed via EcuFlash.
If you have interest, we can manage with it. Stock ROM presented in list http://www.romraider.com/forum/download ... p?id=34278

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Yes, that looks suitable for the ssmk_SH7055_18.bin kernel. As per the user guide, try "dm testdump.bin 0 0" to confirm the kernel is running.

For a test write I suggest you try a minor edit in a part of the ROM that won't matter (eg) 0x60028. Let us know how it works!

SergArb · **Posted:** Fri Jun 17, 2022 11:27 am

It won't connect. It's not usual Denso K-line ecu. EcuFlash can't even read it. But FreeSSM connects without a problem.

Attachment:

AG572_Nisprog.jpg [ 77.05 KiB | Viewed 12734 times ]

Attachment:

AG572_FreeSSM.jpg [ 164.37 KiB | Viewed 12734 times ]

Other tool with debug window, that connects also:

Attachment:

AG572_EcuExpl.jpg [ 190.1 KiB | Viewed 12729 times ]

Maybe you can analyze stock rom, to find connection properties?

MiikaS · **Joined:** Tue Jun 06, 2017 2:11 pm **Posts:** 206

I have JDM Forester Cross Sports ECU (2A04446310) on bench which is the same series ECU as SergArb have (2A04446305). These are Densos early 32bit DBW ecus with sh7055 that uses 16bit connector and layout on pcb. ECU init command (0xBF) will respond from terminal but startCommunication (0x81) will not respond at all. I can test different commands with this ecu straight from terminal if it helps any.

And these have also 6-pin line end connector, that I think needs to be connected while programming, but I'm not sure do those lines need to be grounded or voltages in it...

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

I've been working through A8AK210A. It is quite unusual. It has the typical SSM commands which is why it responds to EcuExplorer and FreeSSM, but everything else is different.

It doesn't seem to have the UDS commands (SIDs 0x81, 0x34, 0x36, 0x31) to load and jump into a kernel. Instead, it has a complicated routine at startup that relies on specific off / on timing of Port F pin 14 (PF14). There are other port values too - may be related to the test mode connectors. If the timing of PF14 is just right, then it jumps into a small bootloader with a few limited commands. I haven't finished working through it, but they look like it allows the loading of a kernel, and then a jump to address 0xFFFF6004 to start running the kernel.

The watchdog seems to toggle at 3.3ms (twice as fast as normal). If we can solve the load / run routine, you may need a slightly different kernel.

I'll keep working through it. In the meantime, do you know what PF14 is connected to? Ignition maybe? Test connectors? PF2 and PE7 also seem to be important. Any ideas on what these are?

MiikaS · **Joined:** Tue Jun 06, 2017 2:11 pm **Posts:** 206

PF14 is connected to line end check 2 in 6-pin connector. When ECU is powered it is 6v, grounding line end check 2 pin will drop it to 0.5v. Changing line end check state from 0 to 5v is common method in 16-bit ecus with wrx02 flash method in ecuflash when connecting to ecu.

PF2 and PE7 is yet unsolved but trying to figure those out too.

SergArb · **Posted:** Sat Jun 18, 2022 11:02 am

It can be read and written on the bench via CAN lines. But it's not opensource software. Universal Denso CAN bootloader, works with all SH7055/58 Denso ECU's(Not only Subaru, many other brands too).

I have some pinouts:

Attachment:

AG572.png [ 149.6 KiB | Viewed 12671 times ]

Attachment:

2002 SG5 AT Turbo 2.0 DOHC_EN.jpg [ 239.73 KiB | Viewed 12671 times ]

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Getting close to working out the commands. Do you have a means of simple communication with the ECU ? For example, can you send commands like ECU Init: 0x80 0x10 0xF0 0x10 0xBF 0x40...?

We will need that to try the commands.

MiikaS · **Joined:** Tue Jun 06, 2017 2:11 pm **Posts:** 206

rimwall wrote:

Getting close to working out the commands. Do you have a means of simple communication with the ECU ? For example, can you send commands like ECU Init: 0x80 0x10 0xF0 0x10 0xBF 0x40...?

We will need that to try the commands.

Yes I can send commands to ECU.

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

The timing procedure to enter the serial comms bootloader is quite tricky. You will need to work out how to change / confirm the state of some pins. Here is the process...

To access the serial comms bootloader, the following needs to occur:
- startup conditions should be: PF14 is 0, PF2 is 0, PE3 is 0. If so, serial comms on SCI2 are established at 9600bps
- within 10 seconds of start, set PE3 to 1 and briefly set PF14 to 1, PF2 stays at 0. "Briefly" means either for 208-228ms or for 670-730ms
- if success, the ECU will set PF9 to 1. Then, within 72.6ms PL2 needs to be set to 1 in order to proceed. If PL2 is not set in time, the ECU will send a Negative message "0x66 0x49 0x99"
- if these conditions are met, execution jumps into a SCI2 based bootloader

Based on your post PF14 is line end check 2. Do you know what PL2 and PE3 are? Can you control them?
(note: I was wrong about PE7 - it should have been PE3)

We need to make sure you can control PE3, PF14 and PL2 with this accuracy in timing before looking closer at the serial bootloader commands.

I can also see the CAN bootloader in the ECU code. My plan is to figure out how it works, but I need a PC to CAN connector of some kind plus open source code. What is the Universal Denso CAN bootloader you mentioned?

MiikaS · **Joined:** Tue Jun 06, 2017 2:11 pm **Posts:** 206

rimwall wrote:

The timing procedure to enter the serial comms bootloader is quite tricky. You will need to work out how to change / confirm the state of some pins. Here is the process...

To access the serial comms bootloader, the following needs to occur:
- startup conditions should be: PF14 is 0, PF2 is 0, PE3 is 0. If so, serial comms on SCI2 are established at 9600bps
- within 10 seconds of start, set PE3 to 1 and briefly set PF14 to 1, PF2 stays at 0. "Briefly" means either for 208-228ms or for 670-730ms
- if success, the ECU will set PF9 to 1. Then, within 72.6ms PL2 needs to be set to 1 in order to proceed. If PL2 is not set in time, the ECU will send a Negative message "0x66 0x49 0x99"
- if these conditions are met, execution jumps into a SCI2 based bootloader

Based on your post PF14 is line end check 2. Do you know what PL2 and PE3 are? Can you control them?
(note: I was wrong about PE7 - it should have been PE3)

We need to make sure you can control PE3, PF14 and PL2 with this accuracy in timing before looking closer at the serial bootloader commands.

I can also see the CAN bootloader in the ECU code. My plan is to figure out how it works, but I need a PC to CAN connector of some kind plus open source code. What is the Universal Denso CAN bootloader you mentioned?

I will look out pins and make some system for triggering.

Is there any command or something that I can confirm that it is in SCI2 based bootloader mode?

SergArb · **Posted:** Mon Jun 20, 2022 12:21 am

rimwall wrote:

I can also see the CAN bootloader in the ECU code. My plan is to figure out how it works, but I need a PC to CAN connector of some kind plus open source code. What is the Universal Denso CAN bootloader you mentioned?

https://www.remaptools.com/product/modu ... ootloader/

rimwall · **Joined:** Fri Aug 21, 2020 6:05 am **Posts:** 315

Quote:

Is there any command or something that I can confirm that it is in SCI2 based bootloader mode?

If you send one or more bytes at 9600bps and then send nothing for 10ms, you should get a negative response - something like 0x66 0x0F 0x8A

If you have an oscilloscope, the other way to tell is that PB15 will be toggling at 3.3ms

MiikaS · **Joined:** Tue Jun 06, 2017 2:11 pm **Posts:** 206

rimwall wrote:

Quote:

Is there any command or something that I can confirm that it is in SCI2 based bootloader mode?

If you send one or more bytes at 9600bps and then send nothing for 10ms, you should get a negative response - something like 0x66 0x0F 0x8A

If you have an oscilloscope, the other way to tell is that PB15 will be toggling at 3.3ms

Thanks, I will try that later.

I have oscilloscope, so checking that is possible too.

Send you pm too

RomRaider

Forum rules

K-line open-source reflash utilities

Who is online