Patrol 4x4 - Nissan Patrol Forum banner
61 - 80 of 380 Posts
I have no update. My country is covered with snow. Temps below zero. Not good conditions for road testing as i have only MTs.
In the meantime i try to understand how this ecu handles MAF signal and maintains AF ratio.
 
No ones remapped the patrol yet so there's no files to share. I put my Navara on a dyno twice while I was remapping that, so afr's were measured then but otherwise I was just tuning it by exhaust temp. I have an afr guage on my bike which I plan to put on the Navara at some point.
Damn. looks like ill be getting a new wideband AFR meter then.

how did you go adjusting injection quantity and ignition timing on the road?

once i can get my hands on a decent copy of winols ill start messing around with it.
 
You can't live tune the ecu so you just have to make changes and go for a drive and test it, pull the chips out write them again, put them back in and go for another drive. Time consuming but if someone comes up with a base tune they want to share it gives everyone somewhere to start.
 
Is anyone willing to share their "remapped" file?
would be good to have an edited file to compare the ori file with to see where the changes are being made.

also, how are you guys measuring AFR when making changes?
Technically you can work out AFRs using a bit of math. I'll be doing this initially then putting it on the dyno to fine tune.

Sent from my work phone because I don't have the time to get my laptop out. its a Samsung cause im cooler than you
 
No ones remapped the patrol yet so there's no files to share. I put my Navara on a dyno twice while I was remapping that, so afr's were measured then but otherwise I was just tuning it by exhaust temp. I have an afr guage on my bike which I plan to put on the Navara at some point.
Yet being the operative word.
I'll be testing out the ecu and chips tomorrow if the rain stops long enough. :)


Sent from my work phone because I don't have the time to get my laptop out. its a Samsung cause im cooler than you
 
Have you found out how this ECU handles MAF signal? It is not clear to me.
What ECU version/number do you work with? What year and transmission does your car have?
Technically you can work out AFRs using a bit of math. I'll be doing this initially then putting it on the dyno to fine tune.

Sent from my work phone because I don't have the time to get my laptop out. its a Samsung cause im cooler than you
 
Well today's experiment was a failure. NATS did it's job and the car refused to start.:(

Sent from my work phone because I don't have the time to get my laptop out. its a Samsung cause im cooler than you
 
Technically you can work out AFRs using a bit of math. I'll be doing this initially then putting it on the dyno to fine tune.

Sent from my work phone because I don't have the time to get my laptop out. its a Samsung cause im cooler than you
yes but wouldn't that be requested AFR not actual AFR?
or am i missing something?
 
It is very difficult to prevent reverse engineering in electronic hardware and this sort of stuff where people say a DI cant be programmed, is really just not true. I don't get all that interested in electrical stuff anymore (apart from audio visual entertainment) Im more passionate about the mechanical side of engineering but out of respect for people like geeyoutoo Ill offer my thoughts on this. Yes I am an electrical engineer but some of the best dumpers on this planet are people who are self taught. There is a real underground scene with this sort of stuff with people from all walks of life.

If you want to dump ROMS and/or edit it the following will deal with 99.99999% of whatever could be there:

1. You get lucky and the board uses programmable EEPROMS. These can be rewritten many times. Actually there is a limit but its a dam lot and for all practical measures your not going to have a problem. Just remove the proms and dumo them using a prom programmer. Proper programmers have checks like CRC checks to make sure everything went OK and not corruption occurred. There is ways to put software checks into the prom data but there is also ways to defeat those checks.

2. If they are write once ROM chips, then the process is kinda the same. Remove them from the board and if your going to probably be doing it allot, put a socket on the board and then simply program with a programmable eeprom of the same capacity, pin layout and voltage regulation. The board wont know the difference if the ROM is programmed the same.

3. If one or more of the ROMs is a mask ROM your going to have a harder time. A mask rom is a rom where the contents of the ROM data is actually produced physically during the lithographic process of making the chip. Dont fear though, people have proven it is entirely possible to defeat this in their garage too. The basic process is to use acid to delid the rom and then use a microscope to figure out the bits and byte layout. There is no universal standard to the layout of what is a one or zero, but its not much of a hassle it will only make sense one way and not another way. Hot Tip: If you know the make model of the CPU reading the mask ROM, you can then get the instruction set manual for it, and with that, you now have all the op codes for the CPU so its then easy to sanity check if your reading the mask rom correctly as the op codes will be in binary if its correct.

4. As it should all pretty much work if your doing bit exact dumps onto new ROMs, thats a good test. If you find that when you change even a single bit value and it wont even bootstrap anymore, then your probably facing some sort of security in the software. This can be defeated too, like what is currently happening with the cat and mouse game between the bluray alliance and people decrypting blurays.

If your facing surface mount roms you guys might find it easier to get it removed/socketed by a company with all the SMD and other gear to make this reliable and not brick the board.

So thats a basic overview of this scene and I hope it helps someone. Cheers
 
Probably not. Don't know if it would be as easy as using the original programming as the replacement would have to have the same pin out and processor I think. The main problem is the immobilizer, Navaras don't have them so was not a problem for them.
 
61 - 80 of 380 Posts