Bootmode

=SHBootmode= The "Boot mode" feature of the SH705x mcus allows to reflash them even if the main ROM (referred to as "user MAT" in the Renesas docs") is hosed. It requires physical access to the PCB, however.

Wiring
Location of the testpoints will vary between PCB hardware versions, but some patterns seem to be common : [TODO - add pic
 * There are two sets of 6 test points on the PCB "back" :
 * 1) PL5
 * 2) MD1
 * 3) SCI1_TX
 * 4) SCI1_RX
 * 5) GND
 * 6) nRST
 * They also seem to have their counterparts on the component side of the PCB, which may be easier to connect to. This is an example of a 6Z67A PCB with the Boot mode testpoints identified:

Links
Note : these, and pretty much all the info online, refers to using SHbootmode to unbrick Subaru ECUs. The exact process they describe is not applicable to Nissan ECUs, even though they appear very similar.
 * RR thread
 * RR thread
 * NASIOC thread