Open source tuning and ECU cloning with Nisprog/VAGCOM

[undertow]

Some people over at the romraider forums have been busy reviving the open source tuning scene. Its now possible to read and flash pre-facelift gen 4 ECUs with the Nisprog tool, and also read and write the EEPROM that holds the immobiliser pairing data, all with a common $15 CH340-based VAG-COM cable. This means you can read the immob EEPROM data from your ECU, install a spare, flash your EEPROM data into the new ECU, and the car will start right up. Then you can flash the ECU happily without worrying about bricking the ECU. ECUs can be had cheap on ebay if you keep an eye out - I scored one for under $100

See the thread here and links therein:
https://www.romraider.com/forum/viewtop ... 40&t=19937

The below is confirmed working on my MY04 GT, and should work the H6 ECUs too:

Grab the compiled nisprog.exe and SH7055_35_EEPSCI4 kernel from the romraider thread (I may repost them here if there's any interest)
Pop them in a folder along with smprog.ini
Open cmd in above folder and run the following: (after hooking up the green test connectors near the ECU)
nisprog -f ssmprog.ini
spconn
setdev 7055
sprunkernel ssmk_SH7055_35_EEPSCI4.bin

The kernel will now be running in ECU ram

To dump the immob EEPROM (keep this somewhere safe - it's effectively your keys):
dm eepdump.bin 0 0x00 subeep

To dump your ECU ROM:
dm ecudump.bin 0 0

Flash ECU:
flrom myrom.bin

To flash the immob EEPROM data into a new ecu:
flsubeep myeep.bin 0 0x100


There are also CAN kernels with this functionally which should work on the post-FL CANBUS cars

[bigBADbenny]

Thanks for sharing, that’s HUGE news!

[Ric]

How easy is it to brick your car if you don't know what you're doing?

[bigBADbenny]

Generally, when flashing an ecu rom file, the action of keying off - *with a corrupt or incomplete flash* - will brick the ecu.

This assumes that a backup of the current, known good ROM was made, and a successful test write of that and the new ROM was performed prior to attempting a reflash, since trying to flash any rom that didn’t pass that step would be illogical.

The causes of an unsuccessful reflash include a corrupt ROM file, eg a file that didn’t pass the checksum after its creation, transmission or archiving, or a continuity issue, eg the loss of the usb ecu connection via obdii, or power to the laptop pc or the possibility of the laptop crashing.

Thus avoiding a bricked ecu involves *not* keying off - in the instance of the Ecuflash reflashing log text suggesting an unsuccessful reflash.

Before keying off, a successful reflash of any, preferably the previous known good tune ROM file, is required.

In the case that the Ecuflash log text suggests an unsuccessful flash, it’s essential to not key off,
Sick Chips in Melbourne can bench reflash bricked ecus.

Some bricking prevention can be achieved with redundancy: a backup plan for everything involved with the ecu reflash.

This especially applies to the vehicle power supply, since keeping the key on prevents a bricked ecu in the event of an unsuccessful reflash.

Obviously the plan B might extend to having a backup ECU: this is apparently achievable with a C$200 eBay key programmer box. Eg the Silca SBB Key Programmer — Latest version V46.02 is said to work on Gen4 h4 & h6.