Nissan Connect and J-Link

[extrid]

Friends hello. I ask for more help on working with J-Link. I got a Nissan Connect LCN1 and I decided to re-comment with him. In general, I made a mistake when I corrected the sectors and he at first stopped displaying data about the device in the blocking mode (date, device number and serial), and then went out altogether. But the original full dump and the 507 sector remained. The question in the next actually - for a very long time J-Link writes down, when pouring a full dump of 64MB, it records 1% for an hour !!! Those. it takes more than 4 days to write a full dump !! - Well, this is unrealistic. It writes in slow mode (without use of RAM). Can you please tell me if it's possible to speed up the process with the settings in the Use target RAM tab?
Simply, for example, when setting up JTAG speed as an adaptive clocking, the dump is calculated in 1096 seconds, and when 12000KHz is selected for 382 seconds. But the record does not affect.

[extrid]

552126552127
Somebody will tell what address and size RAM can be applied?

[Juliano31]

This use ram from radio unit CPU.Not use ram from you PC.. need knwon what is adress ram accesed by the CPU radio...I not known this...maybe the developer model software and found this.. use a decompiler program..

[Thinner]

Hi,

try this project file (http://www.digital-kaos.co.uk/forums/showthread.php/673861-Nissan-Bosch-LCN?p=3323571&viewfull=1#post3323571).
RAMAddr = 0x20000000
RAMSize = 0x00018000
UseRAM = 1

wbr



552126552127
Somebody will tell what address and size RAM can be applied?

[extrid]

Many thanks to Thinner!!!
Tell me please, in which line is code encrypted? The code I know is 0834.
552941
Thank you in advance!!!

[Thinner]

Hi,

yes code is correct, but you have to thank irfa for the project file (or petronijul who posted first (http://www.digital-kaos.co.uk/forums/showthread.php/655810-need-omap-5948-jtag-proje?p=3255195&viewfull=1#post3255195))

There is no fixed line, sector 507 isn't handled like an eeprom by firmware.

Your dump is bad, first line should be:
00000000: F0 F0 F0 F0 18 00 02 00 00 00 00 00 00 00 02 00
not
00000000: F0 F0 F0 F0 02 00 18 00 00 00 00 00 02 00 00 00

Maybe you need to adjust some parameters in project file.

But it's still a very interesting unit, never heared of such a part number yet:
Bosch PN: 7513750007
Serial: CM0007F0119401
Date: 151001
HW-Version: 034
SW-Version: E652

Can you provide a full dump, please?

wbr

[extrid]

Hi!
553010
I realized that my dumps are incorrect comparing with others...
I read the device without using target RAM and using flash base address 0x28000000.
552999
I blocked it with incorrect codes and then unlocked by erasing several sectors.
553004
553006

My device crashed as a result of an error when trying to overwrite a full dump.
Now with the correct setting (use RAM and flash base address 0x0) dump from the unresecting device, this is the
553009
Now I can not write back any of the dumps.
Thank you!

[extrid]

I realized that in my dumps the columns are swapped.
553056

[Jupiter199]

Try code is 0834

[Thinner]

Hi!
553010
I realized that my dumps are incorrect comparing with others...
I read the device without using target RAM and using flash base address 0x28000000.
552999
I blocked it with incorrect codes and then unlocked by erasing several sectors.
553004
553006

My device crashed as a result of an error when trying to overwrite a full dump.
Now with the correct setting (use RAM and flash base address 0x0) dump from the unresecting device, this is the
553009
Now I can not write back any of the dumps.
Thank you!

Hi,

i don't know your intention to force a unit lock, to erase various sectors or to write wrong data, but now the flash content is seriously messed up.

IMHO you need to find a way to write back original dump. Try to find someone who can rewrite flash externally (experienced users like prodan or Raimax maybe can help here).

Here it is your dump in correct byte order
553256

Good luck.

wbr

[audiopoint]

need nissan code

[smoggy]

need nissan code
try code 1626

[prodan]

Hi folks,
I'm offering my personal good working project for Omap59xx and S29GL512 for Nissan's LCN units for exchange. It reads the entire flash for about 180 seconds and erase+write it for less than 9 minutes without any interrupts. It erase and writes even the protected bootloader sector0 as well. I'm interested of Nissan LCN's encryption algorithm. I didn't found time to deal with this, shame on me...
For any proposals welcome in pm.

With my best regards!

[Jupiter199]

I found an algorithm witout LCN.
Do you think I will not be able to deal with the project?

[prodan]

I found an algorithm witout LCN.
Do you think I will not be able to deal with the project?

Some people are good with hardware, others - with algorithms... obviously I'm from the first one. I'm offering what is mine. As I said - don't take it personally ;)
I invested my time in this and if someone thinks it's valuable and it cost the saved time making his own project (which is not a big secret by the way... just have to read carefully a thousand pages pdf), we can save our time for what we are good with ;)
wbr

[Voznyis]

После неудачной разблокировки (отключилась питание) погас. 093 коннект1 помогите пожалуйста с дампом и проектом. Ошибка memory access timeout

[shooting]

После неудачной разблокировки (отключилась питание) погас. 093 коннект1 помогите пожалуйста с дампом и проектом. Ошибка memory access timeout

Use English only here......

wbr

[Voznyis]

After unsuccessful unlocking (power off) went out. 093 connect1 please help with the dump and the project. Memory access timeout error
PART NO. 7612830093 DNN: TBE523 Index: F SW: E603 (0603) MH: 009 HW: 034 Week: 382

[shooting]

После неудачной разблокировки (отключение питания) погас. 093 connect1 помогите пожалуйста с дампом и проектом. Ошибка тайм-аута доступа к памяти
PART NO. 7612830093 DNN: TBE523 Index: F SW: E603 (0603) MH: 009 HW: 034 Week: 382

USE ENGLISH!

wbr

[maki]

need code and reset counter...thanks!
NissanLCN EU
7 612 830 051
BOSCH Made in Portugal
CM0051 A 1855918

[smoggy]

need code and reset counter...thanks!
NissanLCN EU
7 612 830 051
BOSCH Made in Portugal
CM0051 A 1855918
try code 3007

[Voznyis]

Prompt the project to read and fill a full dump in case of error memory access timeout

[Karel7777]

tell me the password from the radio, the radio is completely locked, who can help?

[Karel7777]

l/kdhgkjgkjhjkg

[Karel7777]

CM0032B0791005
7612830032
Nissan lcm eu
Bosch

[smoggy]

l/kdhgkjgkjhjkg

wrong or bad dump

[Karel7777]

I'll try to count again

[Karel7777]

[QUOTE = smoggy; 4095969] неправильный или плохой дамп [/ QUOTE]
Here is sector 507, now I read the entire dump, is 507 correct?

[Karel7777]

file in down

[smoggy]

[QUOTE = smoggy; 4095969] неправильный или плохой дамп [/ QUOTE]
Here is sector 507, now I read the entire dump, is 507 correct?

still bad ...................

[Karel7777]

I can't understand what I'm doing wrong

[Karel7777]

that's what I'm reading

[Masculine039]

Hello! Can somebody find code? Thanks

[smoggy]

Hello! Can somebody find code? Thanks
try code 2624

[Masculine039]

try code 2624
Thank you so much!! Code is right!

[Masculine039]

Help me with one more) its last. trying to read so months. now j-link work fine )))

[smoggy]

Help me with one more) its last. trying to read so months. now j-link work fine )))
try code 6111

[Masculine039]

try code 6111
Thank you again!!! work fine!! I dont know how u calculate code from this dump..)

[Alert]

Hi, Guys!)
Help with pin-code, please))

[simplus]

place a dump in the format BIN.

[Alert]

Dump in the bin...
Archive ZIP.
Bin format no possible attach.

P.S. 8488
solved

[Mankyro]

Hi, Guys!)
Help with pin-code, please))
Bad dump .....