Read/Write a CAN enabled ECU with RomRaider

a33b · **Joined:** Sat Jun 24, 2017 6:23 pm **Posts:** 315

I picked up an ECU for testing and am pleased to report that all functions described here work as expected for me.

waraey · **Joined:** Fri Mar 03, 2023 1:08 pm **Posts:** 7

a33b wrote:

I picked up an ECU for testing and am pleased to report that all functions described here work as expected for me.

Reading worked fine for me. Writing did not....

First try it ended unexpectedly:

.... (many lines)
1677817731098: writing address 0x01B280 : ok
1677817731119: writing address 0x01B300 : ok
1677817731135: writing address 0x01B380 : ok
1677817731157: writing address 0x01B400 : Ending session: 000007E01081
End session ACK: 000007E87402

After successive trying it finished but failed to validate:
... (many lines)
1677819607458: writing address 0x0FFE00 : ok
1677819607478: writing address 0x0FFE80 : ok
1677819607498: writing address 0x0FFF00 : ok
1677819607520: writing address 0x0FFF80 : ok
Closing download service: 000007E0318200
Download service closed: 000007E8718201
Verifying download:
...
Verification response: 000007E8718208
Ending session: 000007E01081
End session ACK: 000007E85081

I think now the ECU is stuck in download mode. The good news is I have dumps of the stock rom and the rom I want to write, bad news is I don't have a way to successfully write.

Logs attached for anyone who could help advise.

dschultz · **Posted:** Sat Mar 04, 2023 1:33 am

Did you try to write the ROM you read without any modifications?

waraey · **Joined:** Fri Mar 03, 2023 1:08 pm **Posts:** 7

dschultz wrote:

Did you try to write the ROM you read without any modifications?

I feel like a dope.

I tried writing the original, and it failed at 0x00E800, but on a second attempt it succeeded. All good and working again.

It seems I am not able to just take a .bin from the same exact PN ECU and write to this ECU (effectively trying to clone it). I wanted to have a backup ECU, but it seems there is more I need to learn.

Possibly something in EEPROM that is used to validate bin belongs to this specific ECU? Appreciate any direction via DM/Message.

Just a note, the test writing with the "t" option worked on both the original and desired .bin files.

Thanks

8336nM · **Joined:** Fri Mar 10, 2023 6:41 pm **Posts:** 2

I think I got this method to work, but having some issues. I got an ECU from a 14 q50, I'm trying to swap this into my s13. I got a .bin file from a Russian dude on some forum (key off). I was able to write it into the ecu but I get no response from the ecu when I tried to scan in using the Consult3+ with a VI2 or VI3. Not sure if the checksum is fixed or not. Haven't tried to write the backed up stock file back in. Any help would be appreciated.

waraey · **Joined:** Fri Mar 03, 2023 1:08 pm **Posts:** 7

8336nM wrote:

I think I got this method to work, but having some issues. I got an ECU from a 14 q50, I'm trying to swap this into my s13. I got a .bin file from a Russian dude on some forum (key off). I was able to write it into the ecu but I get no response from the ecu when I tried to scan in using the Consult3+ with a VI2 or VI3. Not sure if the checksum is fixed or not. Haven't tried to write the backed up stock file back in. Any help would be appreciated.

This is the same issue I had. Writing anything but the stock rom would not work for me. I suspect there may be a checksum or validation that is stored in the eeprom. Still not sure, but more investigation needed.

dschultz · **Posted:** Sun Mar 12, 2023 8:10 pm

Edit the ROM with RomRaider and the checksums will be correct when you save to a new file.

8336nM · **Joined:** Fri Mar 10, 2023 6:41 pm **Posts:** 2

dschultz wrote:

Edit the ROM with RomRaider and the checksums will be correct when you save to a new file.

I was wondering if that would work. Only problem is that I'm missing the definition file. I know you can buy the definition file for TunerPro software.

israelvzla · **Joined:** Tue Apr 12, 2016 2:35 am **Posts:** 28

I'm having a problem trying to read a can ecu from a 2014 Qashqai, I'm using a Mongoose Pro Nissan interface as a J2534 interface, I don't know if it affect the reading.

Code:

C:\Program Files\RomRaider>java -Djava.library.path=lib/windows -cp RomRaider.jar com.romraider.io.j2534.api.TestJ2534NCS MongooseProNissan
J2534 Firmware:[MongoosePro Nissan FW:1.5.1.0 BL:1.1.9.0 SN: SJTJQ0000001108F], DLL:[MongoosePro Nissan J2534 Library v1.7.9.0], API:[04.04]
J2534 Interface Pin 16: 12.8VDC
J2534 Config item 1: Parameter: LOOPBACK, value:0
J2534 Config item 2: Parameter: ISO15765_BS, value:0
J2534 Config item 3: Parameter: ISO15765_STMIN, value:0
J2534 Config item 4: Parameter: BS_TX, value:65535
J2534 Config item 5: Parameter: STMIN_TX, value:65535
J2534 Config item 6: Parameter: ISO15765_WFT_MAX, value:0

--- Vehicle Information ---
Mode 9 PIDs: 40000000
VIN: SJNFBAJ11Z1462030
DTC 1: P0190
UDS 22 1103 BattVDC request  = 000007E0221103
UDS 22 1103 BattVDC response = 000007E86211039F
Init request = 000007E010C0
Init response = 000007E850C0
UDS 22 1103 BattVDC request  = 000007E0221103
UDS 22 1103 BattVDC response = 000007E86211039F
Ident request = 000007E02110
Ident response = 000007E861103134454637423030303030
UDS 21 01 request  = 000007E02101
UDS 21 01 response = 000007E8610118594800
UDS 21 request  = 000007E02100
UDS 21 response = 000007E8610080000000
UDS 22 request  = 000007E0221100
UDS 22 response = 000007E8621100E4010043
UDS 22 request  = 000007E0221120
UDS 22 response = 000007E8621120288C0119
UDS 22 request  = 000007E0221140
UDS 22 response = 000007E862114003040081
UDS 22 request  = 000007E0221160
UDS 22 response = 000007E862116010000101
UDS 22 request  = 000007E0221180
UDS 22 response = 000007E862118000400000
UDS 22 request  = 000007E0221200
UDS 22 response = 000007E8621200913F80FD
UDS 22 request  = 000007E0221220
UDS 22 response = 000007E8621220E8620001
UDS 22 request  = 000007E0221240
UDS 22 response = 000007E862124000890001
UDS 22 request  = 000007E0221260
UDS 22 response = 000007E862126000400331
UDS 22 request  = 000007E0221280
UDS 22 response = 000007E862128000000500
UDS 22 request  = 000007E0221300
UDS 22 response = 000007E86213007F6C0000
UDS 22 request  = 000007E0221400
UDS 22 response = 000007E87F2212
UDS 22 request  = 000007E0221500
UDS 22 response = 000007E862150000000000
UDS 22 request  = 000007E0221600
UDS 22 response = 000007E87F2212
UDS 2C request  = 000007E02CE0020101110101020201110301020302120101020402120F01020502121001
UDS 2C response = 000007E87F2C11
UDS 21 request = 000007E021E0
UDS 21 reponse = 000007E87F2112
Ending session: 000007E01081
End session ACK: 000007E85081

I can read those parameters, the problem comes when trying to read a backup, the output file is always 66kb with weird data.

israelvzla · **Joined:** Tue Apr 12, 2016 2:35 am **Posts:** 28

israelvzla wrote:

I'm having a problem trying to read a can ecu from a 2014 Qashqai, I'm using a Mongoose Pro Nissan interface as a J2534 interface, I don't know if it affect the reading.

Code:

C:\Program Files\RomRaider>java -Djava.library.path=lib/windows -cp RomRaider.jar com.romraider.io.j2534.api.TestJ2534NCS MongooseProNissan
J2534 Firmware:[MongoosePro Nissan FW:1.5.1.0 BL:1.1.9.0 SN: SJTJQ0000001108F], DLL:[MongoosePro Nissan J2534 Library v1.7.9.0], API:[04.04]
J2534 Interface Pin 16: 12.8VDC
J2534 Config item 1: Parameter: LOOPBACK, value:0
J2534 Config item 2: Parameter: ISO15765_BS, value:0
J2534 Config item 3: Parameter: ISO15765_STMIN, value:0
J2534 Config item 4: Parameter: BS_TX, value:65535
J2534 Config item 5: Parameter: STMIN_TX, value:65535
J2534 Config item 6: Parameter: ISO15765_WFT_MAX, value:0

--- Vehicle Information ---
Mode 9 PIDs: 40000000
VIN: SJNFBAJ11Z1462030
DTC 1: P0190
UDS 22 1103 BattVDC request  = 000007E0221103
UDS 22 1103 BattVDC response = 000007E86211039F
Init request = 000007E010C0
Init response = 000007E850C0
UDS 22 1103 BattVDC request  = 000007E0221103
UDS 22 1103 BattVDC response = 000007E86211039F
Ident request = 000007E02110
Ident response = 000007E861103134454637423030303030
UDS 21 01 request  = 000007E02101
UDS 21 01 response = 000007E8610118594800
UDS 21 request  = 000007E02100
UDS 21 response = 000007E8610080000000
UDS 22 request  = 000007E0221100
UDS 22 response = 000007E8621100E4010043
UDS 22 request  = 000007E0221120
UDS 22 response = 000007E8621120288C0119
UDS 22 request  = 000007E0221140
UDS 22 response = 000007E862114003040081
UDS 22 request  = 000007E0221160
UDS 22 response = 000007E862116010000101
UDS 22 request  = 000007E0221180
UDS 22 response = 000007E862118000400000
UDS 22 request  = 000007E0221200
UDS 22 response = 000007E8621200913F80FD
UDS 22 request  = 000007E0221220
UDS 22 response = 000007E8621220E8620001
UDS 22 request  = 000007E0221240
UDS 22 response = 000007E862124000890001
UDS 22 request  = 000007E0221260
UDS 22 response = 000007E862126000400331
UDS 22 request  = 000007E0221280
UDS 22 response = 000007E862128000000500
UDS 22 request  = 000007E0221300
UDS 22 response = 000007E86213007F6C0000
UDS 22 request  = 000007E0221400
UDS 22 response = 000007E87F2212
UDS 22 request  = 000007E0221500
UDS 22 response = 000007E862150000000000
UDS 22 request  = 000007E0221600
UDS 22 response = 000007E87F2212
UDS 2C request  = 000007E02CE0020101110101020201110301020302120101020402120F01020502121001
UDS 2C response = 000007E87F2C11
UDS 21 request = 000007E021E0
UDS 21 reponse = 000007E87F2112
Ending session: 000007E01081
End session ACK: 000007E85081

I can read those parameters, the problem comes when trying to read a backup, the output file is always 66kb with weird data.

Solved, its the ecm apparently defective, I've tested another CAN only ecu and I could read it and write it, but this one, neither with official software can do it, I would love to save it.

dschultz · **Posted:** Sun May 14, 2023 12:27 pm

Glad to see that this works with another J2534 cable.
Do you have the stock ROM that you can try writing to the failed ECU, or did you want to back up before writing?

What was the full command line you used to get this result?

israelvzla · **Joined:** Tue Apr 12, 2016 2:35 am **Posts:** 28

dschultz wrote:

Glad to see that this works with another J2534 cable.
Do you have the stock ROM that you can try writing to the failed ECU, or did you want to back up before writing?

What was the full command line you used to get this result?

I have some roms that I,ve collected here and other sites, I.E. ECM actual rom is 4EF7B, and I have 4EF7A and some other roms wich I already tried without success, I've tried official tool, Nisprog, and some other tool wich says seed key incorrect, ECM is corrupted in some way, I have checked for hardware issues and it's perfect.

e34shaw · **Joined:** Wed Sep 10, 2025 4:16 am **Posts:** 3

This would be a lot simpler...... but I'm on a Chromebook(OS is Linux based) I have a partition running full-on Linux so I downloaded the Linux version of RomRaider and got it running, on to trying to flash my SH7058 in my Altima SE (VQ35DE-AT).. I have nisprog installed using Wine(windows emulator) in order to do that. since Nisprog is command based, it just starts inside of the Linux terminal, but I havent figured out the npkern part of using nisprog to read/write, or even what I'm supposed to with the npkern page on GitHub.....

my other problem is with romraider site being down as much as it is (not hating just stating) I haven't found a romraider definition file for my car yet.

any help with any of this would be sweet, I'm mostly trying to remove the 125mph governor and do some logs and try to see why my scan tool says both O2 banks read lean(0.27 exactly on both sensors at idle) rather than playing the guessing game with replacing parts. and probably mess with shift points/try to make the select shift a little less restrictive. Thanks.

RomRaider

Forum rules

Read/Write a CAN enabled ECU with RomRaider

Who is online