-
-
Notifications
You must be signed in to change notification settings - Fork 17
/
USING.txt
161 lines (115 loc) · 4.54 KB
/
USING.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
If you're having trouble reading this file or "nisprog.ini" (no newlines, etc) :
try opening with a different text editor.
I'm not going to write a nice manual for this, sorry.
If you don't pay attention you can brick your ECU !
The core commands (set, debug, etc) are from freediag's code base;
refer to its manual for more info : http://freediag.sourceforge.net/Scantool-Manual.html
********************************
**** getting help inside nisprog
In nisprog, you can do either
"help <whatever_command>"
or
"commandname ?" to get descriptions and help etc. I think most of it should be pretty self-explanatory.
********************************
**** command availability vs npkern
Some commands only work if the ECU is running npkern (see github.com/fenugrec/npkern ) :
flverif
flblock
flrom
OTOH, "dumpmem" always works, but is way faster if npkern is running. See "runkernel" command.
********************************
**** If you get in trouble (weird errors, etc)
"debug l1 0x8c" will start showing all sent/received data which helps for tracking some issues.
To disable those messages, just do "debug l1 0"
Try adjusting timings, etc. (see parameters for "npconf" command)
If you want me to help, I'll need
full console output (previous commands, all errors etc)
nisprog version
OS, K line hardware / drivers, etc.
Filing issues on GitHub is ideal. Or you can post on the RomRaider forums.
********************************
**** "submenu" commands
some commands (like "set", "debug", etc) also act as submenus, i.e.
######
set
interface dumb
port asdfasdf
up
## does the same thing as
set interface dumb
set port asdfasdf
######
Here are some example commands.
Note, these may become invalid as I work on nisprog and forget to update.
#######################################
set
interface dumb
port \\.\COM19
dumbopts 0x48
l2protocol iso14230
initmode fast
testerid 0xfc
destaddr 0x10
addrtype phys
up
#connect to ECU
nc
#optional, if the suggested keysets do not work with your ECUID : guesskey
gk
# Or, if gk failed, (let me know if this happens !), specify keys manually.
#setkeys 0x55552727 0xAAAA3636
#try "setdev ?" to see choices
setdev 7055
#some extra parameters if you're having timing issues (frequent read timeouts etc)
#try "npconf ?" to see list.
#Setting P3 to 0 usually works well and makes comms faster.
npconf p3 0
#if you're having read/write errors and playing with some npconf parameters doesn't help:
#try changing the kernel comms speed. By default this is 62500bps.
#kspeed 31250
#Run Kernel. Note, spaces in filenames will not work !
runkernel D:\dev\nis_kernels\npkern\npkern.bin
********************************
**** dump commands
# dumpem uses regular fastdump, or npkern fastdump if available. Syntax is "dumpmem <file> <start> <len>"
#Yes, dumpmem works on RAM addresses.
#Yes, dumpmem works with EEPROM addresses, with some caveats. Try "help dm".
# Even better : you can "dm file.bin 0 0" to dump the entire ROM (size determined by whatever
# device was set with "setdev". I.e. 512kB for 7055, 1024kB for 7058 etc. )
dumpmem asdf.bin 0 256
#shorthand , same thing:
dm asdf.bin 0 256
#find differences between ECU contents and specified file.
flverif patched_rom.bin
********************************
**** reflashing !
flrom whatever_rom.bin
#nisprog will offer a few choices for reflashing; it can selectively reflash only the modified blocks.
# i.e. a 7058 ROM is 1MB, split in 16 "erase blocks" of various sizes.
# for example block 15 (0x0F) starts at offset 0x000E0000 in the ROM, and is 128kB in length.
# It is normal for a flrom "dry run" to report write verification errors, since it does NOT modify the ECU.
********************************
#Having some timing, or incomplete response errors ? Add some delays with "npconf" and try again.
#Don't panic, and DO NOT POWER OFF THE ECU if you suspect there were flash errors !
#all done ? are you sure ? Then stop the kernel which will restart the ECU. Note, this has the same effect
#as power cycling the ECU / cutting all power to it, so DTCs and self-learn values may be lost, other DTCs may appear etc.
stopkernel
#and disconnect / quit
npdisc
quit
********************************
#your laptop or nisprog crashed, or you quit before stopping the kernel ?
#No problem. Restart nisprog;
#do your usual
set
interface dumb
port blablabla
etc
#with one difference : kernel is running comms at a different speed, so :
set speed 62500
#connect should work on the first try
nc
#and set kernel speed , and init the already-running kernel :
kspeed 62500
#initk (optional)
#continue where you left off !