QR25DE Tuning

[moldbruja]

took 2 1/2 hours to dumb 260kb i hope ndsII has better dumb speed !!

[fenugrec]

moldbruja wrote:
> took 2 1/2 hours to dumb 260kb i hope ndsII has better dumb speed !!

What version of nisprog were you using ? I get 100B/s speeds with the latest, so yes it's slow (90 minutes to dump my Sentra) but not that bad. In theory. Oh btw, I think your ROM should have 512kB total. But it doesn't matter much, the interesting stuff is mostly in the lower part, like you already have.

[EDIT]
I forget if it's mentioned somewhere, but you're really supposed to enable "block duplex removal" with "set dumbopts 0x48" or something similar. That makes a big difference in speed.

[moldbruja]

i use version 1.05 on slow mode np 4 i think ill try resume next week, i did dumbopts 0x48 but only reads about 4 address and dropped in np 5 (fast dump) since i stop on 261kp i think i can resume the bin file or should i need to merge two bin files ???? mean while i been try to identify some of the maps !!! i think ill be a great deal if someone check this

[fenugrec]

v1.05 ? I'm only up to nisprog_1_03 ( see the firt post , http://www.romraider.com/forum/viewtopi ... =7&t=10897 ), so I'm guessing you're using an old version based on *freediag 1.05*. The version numbers don't match, i.e. nisprog 1.03 is based on freediag 1.07.

Yes, if the first ~260kB were downloaded successfully, you should be able to continue the dump (you need to manually adjust the start address), but you will need to manually concatenate the two parts.

Can't help with the maps for the moment, sorry.

[moldbruja]

so today i checked out renault escape vq35de a2l file looking for any clues that would help find out value for rpm limiter it turnout to be just a 1 value address which make it even harder to find i hope this would help someone because it didnt for me !!! 000 128 044

[moldbruja]

ok guys so i use oda today dont know how accurate this online disassembler is since it only uploads 256kb but i start looking for 124 decimal value on al the instructions set funny thing is i found a single set that uses sts match and 124( same rpm value for fuel cut) http://shared-ptr.com/sh_insns.html

in dont think this may be a huge progress since i cehck out some other sh7055 disasemmblys evo 9 and renaults vq35 and it seems there are differrent way of writting a fuel cut rpm limit!!!!

[Tom]

I had a quick look at your ROM. I would say your rev limiters are:
0x539E - fuel cut - 0x1F0 = 496 x 12.5 = 6200 RPM
0x53A0 - fuel restore - 0x190 = 400 x 12.5 = 5000 RPM
0x53A2 - no load fuel cut - 0x1D8 = 472 x 12.5 = 5900 RPM
0x53A4 - no load fuel restore - 0x180 = 384 x 12.5 = 4800 RPM

[moldbruja]

wow tom thanks thats really help full!!!

[AK_Eyes]

Tom wrote:
> I personally used the Renesas Flash Development Toolkit. The key is to
> supply 250Hz clock signal (green wire on the attached pic) while flashing
> otherwise the external WDT will reset the MCU. This method is specially
> useful if you have a bricked ECU.
>
> [attachment=1]flash connection s.jpg[/attachment]
>
> There is an easier way to flash it (but longer) if you have an activated
> NDSII software and the ECU is working ok. PM me if interested.


Hey Tom,

I just saw your response to my post. I do have an activated NDSII software, I think it was the first purchase I made after buying my 350Z. With a lot of help I have successfully reflashed an ECU I bought out of a junkyard from a Maxima with a vq35de. Can you reflash via NDSII and K-Line? I tried to PM you but it said I haven't posted enough in the forums to PM people.

Also, I noticed you have a 350Z too and had identified a few maps a year or two ago. How much have you figured out by now? Interested in finding DTC address's, rev limiter, etc. too. Heres the oem dump from my car (06 350Z w/ vq35de and VVT on exhaust, MT, base model):

Thanks

[murphys_law]

Bump, I've started down this path in the last week and should be able to provide some information about the USDM spec V, along with the 02/03 Nissan Maxima which also uses the SH7055. Attached is my dump from the Maxima. I'm hoping to pull the rom from the sentra this week/weekend. I'm also working with/on the 2006 g35 6mt revup(sh7058.) I've got some tip in knock that I'm hoping to get rid of on the g35.