|
|
ak475671 發表於 2011-8-22 13:03 ![]() 5 g0 D; |: t( J0 ^ L
版主你好
- x3 E& R7 {; L. R版主知道哪裡有教學嗎使用DOS提KYE的過程不是很了解不知道有沒有教學可以參考的呢
2 Z8 [- _. k2 {# C另外你說他提取 ...
6 U. ]* D% g2 v+ GDosFlash ReadMe.txt 說明文件
. {' H' Y! Q$ ~. l3 [1 d
* m3 [- h1 l& b* wDosFlash V1.9 Release Date 01.01.2011& x+ Y: Y/ S1 S6 b2 w! Y
---------------------------------------
' c) x" q1 C$ e# T" X* y- SATA and IDE port scan improved in DOS and Windows1 Z A' r4 L+ ^ ~" g
The ports are now enumerated with the CONFIG_ADDRESS and CONFIG_DATA register instead of using interrupts2 K, p& b1 y8 u) v+ T4 `
in DOS and SetupDixx functions in Windows. This change will detect more ports in Windows than the old
) h- v5 z5 f( A b' W& E& r! s SetupDixx method.( F* f7 b& d! L+ o+ k1 x, Q1 t
- Settings saved to ini file for DosFlash32 and DosFlash64
5 h2 A, J5 h p+ f5 M Settings like Port, Position, Task, COM Port, Enable Drives and DvdKey state are now saved to an ini file% |5 e% T* c5 D" ]
inside the program folder. If the ini file is not present it is created after the first run. On the first% L( k/ p1 T- @/ ? w
startup DosFlash will choose the most common and stable settings.
3 |# k; M3 J( W) `. M- A; X- EnableDrives option included in dialog as a check box
: u/ c- d/ m3 F' X6 ?7 o! e Due to high demand we removed the "Enabling CD-/DVD-ROMs" MessageBox on program termination and included* d' j7 C x* o
a check box "Enable Drives" inside the dialog. For security and more stability this is deactivated on the
- `2 V+ x2 D1 U1 p( \4 W/ J8 s first run. If you enable it the checked state is saved to the ini file.
7 r' f- p0 T3 u9 \9 K' X8 n2 f- enabling drives in Windows caused some hangs from time to time, this is now fixed by a recoded enable
) r Z. f* O. I9 P5 d drives function
4 c& F* L. K& p- J% x. f7 _- port drivers portio32.sys and portio64.sys are now added to the executable and unpacked during runtime
$ e& }" }! Q- ^' \- PATA and SATA controllers list updated
7 F1 y) W2 d1 S3 Z- Fix for NForce motherboards in combination with drives like the "Samsung SH-D163C", "LG DH18NS40" or" i! E0 W3 s. ?' O
"LiteOn iHDS118"
, u( b' J& X' e9 h7 e4 ^ Some drives have problems with flash identify, read, write and erase. This is clearly related to the; c/ A! D2 F1 F& D4 w
NVidia NForce chipset. For manual mode in DosFlash16 an additional command line parameter is added called+ V t" A4 q+ J7 e( B% [
"NFORCE FIX". This parameter should be set to 1 for NForce chipsets if you experience strange problems.0 w8 M2 A- C6 b& w. D4 b- B5 M
In DosFlash32 and DosFlash64 we added a static control which shows if the NForce Fix is applied or not.
& i& x! C7 n5 t: O, @ Remember there is no need to activate this with every drive. It seems to be a combination between drive
& V! ~6 y! N" N9 P1 F; ` and NForce chipset that causes the problem. The fix is automatically applied for DosFlash16 in auto mode,
4 {( t4 X/ T8 ~" E2 t' u2 H DosFlash32 and DosFlash64.2 s1 \' H7 ?1 P# ~! r2 I
- DosFlash32 and DosFlash64 are now DPI Aware for Windows70 h3 b& S w( \- {' _
- New task Verfiy Key/Inject Key added for verification/injection of drive keys
: D% X# @% t8 H- L All DosFlash versions now have the possibility to validate drive keys against an XBOX360 drive and set0 N+ Q' w" L6 q6 g6 c3 X
the key for an XBOX360 drive. We use the same authentication method like the console to verify a key.
: m% I6 Z) @5 W# u, R+ ?& ?4 \ In the Windows versions you have the choice to paste the drive key from the clipboard to our custom hex: ^2 I) Q5 }4 u1 t4 a
edit control or load a key file. To add a key simply click right inside the hex edit control and select
: n2 F& X- [4 E0 _ your choice from the shortcut menu. In DosFlash16 you can enter the key in the format "1A-2B-3C" without; U- m) k3 j& n
quotes. Remember that a key has 16 bytes of data. The key file to import should also have 16 bytes of data
6 J3 a1 l! L5 s like the key files exported by LiteOn Key functions.
* t: C, r+ U; K4 G- Removed multiple key extractions for LiteOn Key functions, added Verify Key after extraction
3 M; O B( z9 Y+ @9 I For LiteOn Key functions we removed the multiple extractions, because the key is now verified immediately
9 G% v' k7 ]. s! F4 y against the XBOX360 drive.
0 ^* N( V6 t# L! q4 w- LiteOn Key V1 and V2 now also extract the file Serial.bin and the 2nd inquiry file Inquiry2.bin
: }3 \& c9 o; e3 A2 ~* I We added the file Serial.bin and Inquiry2.bin to LiteOn Key functions. Inquiry2.bin is only generated for8 |0 a5 P) r; ]- H( t1 p# O! I0 {
LiteOn drives V1 and V2.( Y: B& d! z' H+ e
- The drive key of Maximus patched UART drives can be extracted by using the task "LiteOn Key V1 (DvdKey)"7 `* K/ V3 L# W x5 R
The drive check has been removed from LiteOn Key functions. This way we can extract a key from an UART . j, r2 |% |6 q# h% K# O
patched drive firmware by Maximus.8 v2 }; G; t; I( [! k
- LiteOn files are now extracted to a destination folder instead of prompting the user for every file name./ W+ c( B5 T8 }6 k* r8 D2 `
- LiteOn key extraction tasks separated per drive version in "LiteOn Key V1 (DvdKey)", "LiteOn Key V2 (FreeKey)". r/ J' ~5 L6 i0 n" d/ q9 {
and "LiteOn Key V3 (Tarablinda)"8 N6 | w9 J+ z. L# j1 s1 R) l
- In DosFlash32 and DosFlash64 the number of installed COM ports in the system are now enumerated instead of: Y1 _' ]2 a+ h% u* w! S2 L- N
adding port 1 to 4
# `( a6 `7 Y7 [6 T: {- For failing cdb commands the sense code is returned5 v" i2 N- o* n- \8 ^; b
- Geremia's Tarablinda functionality added
9 V. O, d @% c! G: {5 g We added all Tarablinda tasks to every DosFlash version. You can extract the key by choosing the task" ^. G8 O V& A$ x3 O
"LiteOn Key V3 (Tarablinda)". For read, write and erase of the flash simply use the standard functions.
4 G" X" G6 V* `6 v9 P Pay attention that the "LiteOn Erase V1/V2" task is only available for older LiteOns and not for the Slim.8 k9 Q9 {2 l! \- x3 B5 E8 U# K- o2 [
You should use "Read Flash", "Write Flash" and "Erase Flash" for the Slim. "LiteOn Key V3 (Tarablinda)"4 M5 O/ N! H2 {# M( B0 z3 r* V
extracts 1 additional file in comparison to Tarablinda v04b, this file is called Xtram.bin and contains
/ R9 o/ h7 @3 E9 F2 J' h- M a dump of the XTRAM8000 area. This can differ in a few bytes from one dump to the next.( e2 d9 x# y0 B1 \2 z1 ]7 Q& d
- Device Reset in DosFlash16 manual mode is now done automatically, there is no option to turn it off anymore) B$ ]: ~; W, a I9 n; ?
- Code optimization to work with modern SATA2 controllers added, remember to set SATA controllers to IDE and
; [, n$ j2 ~2 o! d6 ?- p: ? not AHCI mode otherwise Port I/O will not work
+ p+ f0 V3 G( x4 I3 n; D8 ]- Warning: The read, write and erase of the Slim drive is considered risky in general! So pay attention and
5 P1 t/ t5 `/ N- K& i always remember you use DosFlash on your own risk every time! Even during flash read the Slim gets flashed
9 L/ c) s! h* m: ` with a patched firmware sector to retrieve the complete dump!
& Z" v* c3 ]- O& D% F8 Q: x- We had to change many command line arguments for DosFlash16 Manual Mode, because of the NForce Fix, added( ~7 c, E' j Q! Q
Tarablinda support and splitting of LiteOn Key functions. To get a better understanding we added the example S2 H8 V4 F: N2 }7 ?% r) h6 R
section below.
$ W @( w! D. d0 K, ]% a( s% T [9 I9 {% Q8 U& [' e1 J4 f1 j8 b
, K. ]7 d8 |7 RDosFlash16 Manual Mode Examples7 V. ^* D- K1 [ s7 D$ q$ y! m
---------------------------------
( T h; w- M! k) Q- Extract drive key on a " LDS DG-16D2S 74850C" over UART -> "LiteOn Key V1 (DvdKey)"1 F- G: b# j4 s T. E M
DOSFLASH LITEON K V1 0970 A0 1
* @- b+ ^5 A5 q4 _5 _
$ ]/ F) w& ?' g& A6 t- Extract drive key on a "LDS DG-16D2S 83850C" over SATA -> "LiteOn Key V2 (FreeKey)"
% F t& m4 K) I, i$ ^4 k q/ F DOSFLASH LITEON K V2 0970 A0
5 R8 r3 i: \' y; p( K) _5 v i! z
- Extract drive key on a "LDS DG-16D4S 9504" over SATA -> "LiteOn Key V3 (Tarablinda)"9 \8 H. h4 u0 N; _7 o
DOSFLASH LITEON K V3 0970 A0
1 C& f7 T! U" Q" a/ O( A* r# U& a6 S1 p$ Z* B' e
- Read firmware on a "LDS DG-16D4S 9504" -> "Read Flash" this is considered risky!* o: l3 k& C. B4 @5 a
DOSFLASH R 0970 1 A0 3 0 4 FWOUT.BIN 03 `7 D+ Y( i8 o% p& v
& V$ F a2 Z/ r2 a1 I- Write firmware on a "LDS DG-16D4S 9504" -> "Write Flash" this is considered risky!
1 u# m8 x5 G" `% A- B/ [5 J DOSFLASH W 0970 1 A0 3 0 4 FWIN.BIN 0. F3 |4 i4 U& X9 Y1 `& f4 Q e
' o2 i C/ l4 d1 m' h/ I4 y2 N1 a
- Erase firmware on a "LDS DG-16D4S 9504" -> "Erase Flash" this is considered risky!7 H& b7 r3 U" }8 l4 W6 p
DOSFLASH E 0970 1 A0 3 0 4 C7 0
8 A& M# D* V3 [2 n- \3 {* [, r4 k: e) s) u2 `+ T
- Erase firmware on a "LDS DG-16D2S 74850C" or a "LDS DG-16D2S 83850C" -> "LiteOn Erase V1/V2"
3 N {' W* [9 o+ n DOSFLASH LITEON E 0970 A08 _2 G9 g; U7 V# H# Y6 z
. Q9 t+ Y0 D" l# ^0 S- Read firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Read Flash"5 o: G2 \) c. V8 u' X. r! Q
DOSFLASH R 0970 1 A0 2 0 4 FWOUT.BIN 15 l/ }; m6 J6 Q5 L* ^) w
' [5 w7 c0 [) G- m6 p3 o
- Write firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Write Flash"( C+ |4 b: u l) g0 z0 H- x8 C' @* @
DOSFLASH W 0970 1 A0 2 0 4 FWIN.BIN 1) X3 _+ d& p! H+ R# W
2 D. L3 E Z. w, _- Erase firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Erase Flash". K/ q: h4 H) O# z3 P
DOSFLASH E 0970 1 A0 2 0 4 C7 1
# U8 l+ P( e1 O5 K4 R$ d
* N5 }/ H' K2 e2 N6 h- Verify drive key on a XBOX360 drive, enter the drive key manual! |- n% n, E9 t) e
DOSFLASH V 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF& T- [( w r5 i$ m6 P" M
3 m) p7 k+ U8 Q! o' _2 i( w
- Verify drive key on a XBOX360 drive, load a drive key file1 S7 u$ X6 G% u( ^: J9 z( ]! a i
DOSFLASH V 0970 A0 KEY.BIN/ M. E' z: d, G2 P
! T% P6 e6 t" ^, V$ @8 h. W- Inject drive key on a XBOX360 drive, enter the drive key manual: G: H- I. o: ?9 ~, [
DOSFLASH I 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF, F1 ]% `9 `" h- k
: n* ~6 Z7 P1 B' n
- Inject drive key on a XBOX360 drive, load a drive key file
+ ?; y0 U5 |1 G0 } DOSFLASH I 0970 A0 KEY.BIN
( K1 T( a: l4 C" B* r7 j3 M
9 w- D6 \' U" [ N2 MFor DosFlash drives on which we can extract the key via UART are considered V1. Drives we get the key over! `7 j$ w+ L7 A# L
SATA are considered V2. The new Slim is considered V3 but only firmware version 9504 is supported atm.
5 A% S. t7 C/ u+ U/ z7 J' | _3 |: y8 E
* H9 ^' A; @+ _2 [% q x
Many thanks to Geremia, Modfreakz, Redline99 and Tiros for their support. Special thanks to Geremia and' q9 }9 q2 \9 [0 B- w
Modfreakz for drive sponsoring, testing, coding and much more. It is always a pleasure to work with you
) F* E; Y6 N9 Q' J$ fprofessional guys! Respect to Maximus for his UART enable patch. I'm looking forward to your magic Lizard4 l3 C& I. n- E
hardware flasher!2 K. }2 P1 D6 F/ D% n0 e/ t/ b& s% ]
0 K. ]7 d3 B/ m1 W2 e3 |8 Z6 w
Happy new year 2011!
* M p" R; _1 ]9 X9 E4 p( sKai Schtrom
; F9 c v' l1 V+ ]# w7 `6 ^6 H5 {- x' w# T/ N
************************************************************************************************
. r K0 m5 h" n7 V% ^6 C: {2 o& @& z: \5 A9 f
+ H' y3 K* N1 ^! p7 y2 s5 F2 D
DosFlash V1.8 Release Date 08.08.2009
% U! _* b" Q6 _---------------------------------------4 e2 Q# \# Z; }( q5 V, J
- now supports LiteOn PLDS DG-16D2S 83850C V2 Geremia/Maximus LiteOn FreeKey method
6 ^! I: }0 F5 T) V Y" ]. D- huge firmware read/write speed increase, especially if run from a floppy disk
* O$ L8 X! |# ~0 a6 i- updated IDE/SATA motherboard chipset list
. N0 \5 m0 E6 C# ?3 L. U/ y* z+ K8 o- new IDE/SATA detection for Windows and DOS
: `6 s. p4 b- _8 x. }- DosFlash.typ embedded in executable file7 Y v: _+ Q6 l9 z7 ^
- LiteOn V1 drive key is now extracted 10 times and compared against each other," H E& P" a% Y! ]! B
after the extraction a summary is displayed sorted by the most common matches# U$ O" r: v5 O& p/ Z7 K1 K1 q
- LiteOn V2 drive key is extracted 2 times and compared% f! j2 v3 V# Q" K
- new BenQ unlock keys added to unlock all known BenQ drive firmwares5 l+ K& z! `* S
- command line parameter "EnableDrives" removed, DosFlash asks the user on0 [8 N$ k A: O5 \, |
application close if he wants to enable the drives or not, during the tests it
# }9 N" m' d$ ~5 A+ t( y8 ` seems that IDE drives have problems with the enable, SATA drives seem to
9 K4 [/ f1 t1 X work fine& V- J4 T3 a% i, u8 w5 p; {
- new 64-bit DosFlash edition added called DosFlash64, because some driver$ t) q. V. R8 j2 Y
functions don't work as expected in the 32 bit compatibility mode on Windows x644 ~0 G# A1 Z c
- Beta state removed/ K e1 n3 U7 j8 v# I! f! W
- ready and tested on Windows7 X86 and x64
4 n4 w0 ^, [" t. t. ~4 S/ D' W2 V7 s# @# H
4 g _! [: f( M9 ?0 @Geremia/Maximus FreeKey method with DosFlash16
4 z9 I8 u4 I' F* @) Z5 F------------------------------------------------
. \- ~7 R: W8 ^We have added one cmd line parameter for DosFlash16 in manual mode. The COM port
1 s5 S, }3 n7 Cis simply ignored and can have any value for the V2 drives.
; i! u- L6 o/ ^; Y; w( xUse the following command line to extract your free key from 83850C:
! v# p. f n' y8 S7 @' ?- DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin enckey.bin1 _3 z5 N9 f8 F2 @1 T
+ ]# N% c" W; ^$ O# O: { d1 t
. v' n4 E3 K( m/ x# a* h6 ]
Tips for running DosFlash on Windows 77 T' z: @+ c( ~
----------------------------------------
5 ^( m5 w/ q( z) m# g
6 l+ O5 @6 Q" M0 Q( iSince Windows Vista 64 Bit and upwards it is necessary that every driver is signed. Because
* B0 H, `$ A& j. d' h( _the DosFlash driver will not be signed by MS due to some unknown reason we need to circumvent& X1 B3 Z% \* H) J$ _9 p
this check. You have the following 2 possibilities to do this.
0 n3 u1 ^0 _. K" A, z+ b8 J( X) G0 y2 X0 P. a7 v# O
Safe Way of Disabling Driver Signature Enforcement; W$ _" A$ m8 L8 `; ]
1) On Windows 7 bootup press F8 to get to the extended boot options screen3 Q2 X$ q0 H, }
2) Choose "Disable Driver Signature Enforcement"
' W/ x6 g2 g; T; l7 Y3) To start DosFlash right click on it in Windows Explorer and choose
- O5 n4 j! A" I0 H# q5 h "Run as administrator" > answer the message box with "Yes". P* c3 b8 ], t1 v% ^% v, Q4 a% U
4) Short after the program started a "rogram Compatibility Assistant" warning message
" q9 A {$ n$ X; a" U2 w2 S: c5 m is displayed, you can simply ignore this by pressing the "Close" button
! z3 J2 S- O" |/ ]" [3 x
1 A1 x e8 e8 o* ]7 MRecommended Way of Disabling Driver Signature Enforcement7 N: h* {, f& Y7 Q" U/ Z7 {, }! [
1) Disable User Account Control (UAC)
1 q& @. o% F* A1 g W/ H - go to "Start Menu" > "Control Panel" > "User Accounts and Family Safety" > "User Accounts"3 g1 V! l$ ]) ?- ?
- click on "Change User Account Control settings"" F( G, v0 V& Q6 x K9 F
- set the slider bar to the lowest value (Never notify) > click "OK"- ], K6 w& q& k
2) Sign the DosFlash driver: A+ }. ~; ]# q' b$ N4 X" U4 [
- download the "Driver Signature Enforcement Overrider" (DSEO) from' o8 j% m% E. w$ K) B. J# c
http://www.ngohq.com/home.php?page=dseo
, N2 b* k( J6 A, R# ~% | - start DSEO > click "Next" > "Yes" > choose "Sign a System File" > "Next" > enter the path to
2 o- g6 a: z; f/ q$ f5 F! A+ T the used driver (portio32.sys or portio64.sys) > "OK" > "OK"
% F' f8 x A2 g: ^6 z3) Disable Driver Signature Enforcement
& i& Z( K! |1 ^ K! J - start DSEO > click "Next" > "Yes" > choose "Enable Test Mode" > "Next" > "OK"
. ^. j f" |: S" r1 _+ I4) Restart the computer# A5 w# j8 m, C
' A5 T" \! g6 F3 j$ R1 _$ F8 K* A) x
Keep in mind that with the recommended way the changes will have effect on every reboot without
- M+ ]0 S' K7 r8 Z* Odoing anything manual. The first way needs to be done over and over again. In addition the second; n. U2 F8 E1 P# ?
way can be used to sign every driver that doesn't run natively on Windows 7.
3 t" ]- [# L; P6 m0 W+ N. K9 I$ c7 ]0 g0 }" u* p' @
For use of the VIA Cards in Windows 7 it is recommended to uninstall the VIA driver. This can be
) [- C- \6 V1 L/ S' Fdone like follows:
) U' v4 t' `5 ?- f& E- start "Device Manager" > expand "Storage controllers" > right click on "VIA RAID Controller" >
; m. e2 f; c j choose "Uninstall" > "OK"$ h+ G7 s+ F0 k8 [
- rename C:\Windows\inf\vsmraid.inf to vsmraid.inf_
4 z3 x& a, G% c2 `0 q- rename C:\Windows\inf\vsmraid.PNF to vsmraid.PNF_
6 s+ U% }* F2 O: K" M' k8 x9 ?( R. M- rename C:\Windows\System32\drivers\vsmraid.sys to vsmraid.sys_, y; c M# j8 Z+ Q2 a2 M7 S
- reboot computer- v$ o; v6 ?% F) p }4 ^
) _+ L" ?+ @5 p! s2 z
6 `6 n6 B0 p* L9 tMuch respect and credits go to Geremia and Maximus for their money saving FreeKey app
. e( _* v* i) Cand their lightning like decryption speed!
. ]: m+ ^& ]1 Q: R8 F8 y5 K) [! I, D( R; o c- I
In Dedication To The Birth Of FreeKey On August Fifth 2009$ ?% g) }- A; ^6 \6 r& u/ V! J+ d
Kai Schtrom) v( g' [/ G8 y0 _" f
; v) Z" V2 R% r% ]! ~, U
2 q G+ C$ t' }5 w' U; \************************************************************************************************ u5 ]& j" w) b
! U' N3 S7 H. g7 Z) i/ O
5 f6 L' L5 Y9 m. z1 `( n
DosFlash and DosFlash32 V1.7 Beta Release Date 23.12.2008
1 A7 U g2 H. d1 D6 u' e-----------------------------------------------------------
8 P- {6 T2 p1 c( i$ K- now supports LiteOn PLDS DG-16D2S 74850C and Geremia's LiteOn Erase and DvdKey method
' c4 N2 J( i& k- K* h& A5 ]+ x# g
, h$ ?- Y, c' L, F* e# |/ v/ b5 w j& l- Y8 n
The following only applies to the new XBox360 LiteOn drive PLDS DG-16D2S 74850C.
0 T' h0 S+ n& K- S { _; e, w4 t- C* p6 Y+ e
; U0 s# {4 r% L, e
Geremia's DvdKey method with DosFlash16 with the PC's psu K `7 z" Y2 t3 `% q
----------------------------------------------------------- P9 Z2 j$ [ _: B/ y
- disable CD-ROM boot option in BIOS$ c) M8 l. S1 U4 j
- connect LiteOn to your PC's power supply unit and SATA port
! N% X0 F4 A2 y Z/ e- power up PC, wait until bootup is finished
W2 n2 s: O9 U' p( J- a- J J. C- eject tray of the LiteOn and shutdown PC completely
' Y$ L v g$ S/ C- L) z- push the LiteOn tray half in! C& X3 d R. U! j6 F' u. B# l
- power up PC and boot into DOS
) _6 D! t, d. G1 w! L+ s# V$ b- run DosFlash16 in auto mode+ u& n1 e/ ?* ]/ m
- if you read the following:+ R: K( Q/ I- G. w) b% U) k }( \
MTK Vendor Intro failed on port 0x????.
9 [( u, o. d. g, |! w If you choose to resend the command you should turn the drive off and on9 [7 e0 N/ q& {
after you pressed "Yes".& D/ j+ K; |4 J
Do you want to resend the command until the drive responds (Y/N)?
, r2 P) C; v7 O9 B- press 'N' for "No"0 `9 I% t3 R1 C9 Q4 @, Z
- choose the number of your LiteOn ATAPI drive
' m$ L( c1 q3 c& y0 |- enter "LITEON K" to read the drive key
- ~8 u4 O0 k; x6 M3 K- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
" S" _" z. w2 R+ ]) g- enter the number of the COM port
4 J; e6 U' y+ D. o' J- if you read the following:' V1 l9 U! g+ }* g
To receive the drive key use Geremia's DvdKey method like follows:
5 s* A6 n- F, m8 x0 H8 r! h9 G) | - Connect your drive with a serial cable to the COM port
/ f: Q; H3 A& R - Eject drive tray
0 Y% m% W. {: q- P' a - Power off drive
( B7 r$ g1 c9 ?; o! G. q" ?/ L/ u4 ~! ~; H - Push drive tray in until it is half open* K/ C1 Z2 Y+ V" S/ w
- Power on drive
p6 z1 Z: N) @. X- m - Press "Yes" if you are ready
5 y, e8 U# b8 O5 R8 { Are you ready (Y/N)?
% _3 m6 p; _* \/ R" v- simply press 'Yes' without doing anything of the above, because we+ I" O. v, p* M! D
already did that before+ p Y2 U/ x# b& g8 o# v
- after this DosFlash16 displays your DVD-Key and saves your key and identify data
# C5 P6 s3 L2 p I+ w- to do the above steps in manual mode use the following command line if your drive& ?& }. ^8 N2 X% j/ g+ K9 o
is connected to port 0x0970 and serial cable is on COM port 1
/ J C1 F2 j0 u3 T& { DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin- N& u3 L( t3 H8 q4 u
8 R! N" A7 M* i- C$ A( l, S! V2 e) }2 S9 C3 ]
Geremia's DvdKey method with DosFlash16 and 2nd psu- C. D; {9 U& a7 `1 r# `
-----------------------------------------------------: ]0 Z; q' h( \! t/ n: I" j
- connect a separate power supply unit to the LiteOn, don't turn it on yet
) h& S' s* f/ e; a7 G- power up PC and boot into DOS
9 F5 x. C6 X2 g; I- O- turn on the LiteOn psu
. l4 b1 n& D+ W1 P3 [; p0 B* r/ v3 X- run DosFlash16 in auto mode& t. d% b! g U9 \1 o
- if you read the following:
/ R! k$ l& C/ p# j! C MTK Vendor Intro failed on port 0x????.
1 W# J6 e$ _) R5 ] If you choose to resend the command you should turn the drive off and on; |/ j0 l# ^& g
after you pressed "Yes".
( ?6 l2 I3 [; k& B1 | Do you want to resend the command until the drive responds (Y/N)?
! l3 [" G& X6 \3 b" t2 K- press 'N' for "No"
9 Z3 u# Z3 a k" R- choose the number of your LiteOn ATAPI drive' Y- B- k6 l7 b. U, X
- enter "LITEON K" to read the drive key
- @' ?$ L. H% W; }+ p3 R- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
K* @/ s- I" p; \: I: @- enter the number of the COM port
3 w- M8 h$ F9 O- if you read the following:! z4 m {2 |3 g! a6 t# S8 v! @/ ]
To receive the drive key use Geremia's DvdKey method like follows:& q: c% s4 ~! g# r
- Connect your drive with a serial cable to the COM port& |1 v4 h' `) U9 F
- Eject drive tray
_( j% G4 C# [5 F( w, r - Power off drive, O7 k' w! g0 ]4 u1 S3 E. f
- Push drive tray in until it is half open
% {- l, S- Z/ c; E$ b - Power on drive
K- C8 |" E+ p" f+ ?" d7 T0 L - Press "Yes" if you are ready
6 Z; v5 h6 p/ Q4 g0 O! h Are you ready (Y/N)?
0 e& }: H J5 R( L8 c. i- do the above and press 'Yes'
$ p; ?, I' }- a- l' K- after this DosFlash16 displays your DVD-Key and saves your key and identify data6 X$ e' V+ q+ `
3 H' h3 `8 X, S
" x+ y- Y( M, GGeremia's LiteOn Erase method with DosFlash16 and 2nd psu' q0 c" t/ b H! K0 }4 A& N+ v7 K' ?
-----------------------------------------------------------% }: y" g; e) Z: H) T3 X: f8 Z
- connect a separate power supply unit to the LiteOn, don't turn it on yet6 g# ~/ u! \6 b, Y7 J4 m
- power up PC and boot into DOS" l+ y2 G6 f" v2 j `
- turn on the LiteOn psu
3 I; I8 _# e6 R* c- run DosFlash16 in auto mode- f* P# U0 t- S
- if you read the following:
& j& Q1 e+ A7 S& ^/ M! A( f+ w) r MTK Vendor Intro failed on port 0x????. |+ X8 \& _* ]/ ?
If you choose to resend the command you should turn the drive off and on8 Q+ D1 F% r: r$ S8 g
after you pressed "Yes".
* d9 f- c1 \" r Do you want to resend the command until the drive responds (Y/N)?
, b! S, v- Y7 }$ k- press 'N' for "No"
4 l1 ~/ C5 s7 m* K2 V3 M& u- choose the number of your LiteOn ATAPI drive, [* I; @6 I1 z6 c. `! k
- Warning!!! Keep in mind that you will need the drive key before you erase the flash,5 @: M6 d; I. t. j
without the drive key your XBox360 will not work anymore) p* k6 I+ Q* j, p( L
- enter "LITEON E" to erase the flash
0 t) l# v. j. H' W/ B- the first time after the LiteOn Erase the drive needs to be repowered to give+ k% E$ W. C( d; Q5 C
flash chip access, this can be achieved by repowering the drive before another: R- U3 M# E7 G% H2 R: E6 {0 }6 q
DosFlash16 start in auto mode or by doing a MTK Vendor Intro Power Brute
% i/ b# v0 w; _6 s- in my tests it did not work to power the drive with the PC's psu, because it will0 f8 k# h ` b" l* }% C9 M
always respond with busy status
! k; I" \5 i# ^/ r) X- DosFlash16 can now read, write and erase the flash chip like usual
3 F3 ^7 E. p( ?* n- to do the above steps in manual mode use the following command line if your drive
, V& W0 d0 p- M4 ? is connected to port 0x0970
' G+ w' i/ q+ F: a. T DosFlash LITEON E 0970
, A$ b8 ^8 w, d8 f6 m& u
" O, c5 S8 `: I% I! |2 k& y+ W" ?: A& Z8 Y/ O/ c+ k
Geremia's DvdKey method with DosFlash32 with the PC's psu; t1 _+ q# x% i z; |4 D
-----------------------------------------------------------' y, H0 ]) s( o% Q! R! y
- disable CD-ROM boot option in BIOS
$ E# V) ~( Z* |4 {3 w) n4 u$ \- connect LiteOn to your PC's power supply unit and SATA port/ q$ t a- }5 t" l+ n7 B5 ?1 _
- power up PC, wait until bootup is finished G0 v- ~2 {' x
- eject tray of the LiteOn and shutdown PC completely# y5 r) p1 \! h4 c4 g+ h: F
- push the LiteOn tray half in
+ g# x& |' x4 k# @- power up PC and boot into Windows
- w6 R, D+ a+ m. O, f' ~. M- run DosFlash327 w% m6 e% |* o6 x
- if you read the following:
' y8 e& T5 I5 C: j u5 \* n4 Z1 w MTK Vendor Intro failed on port 0x????.
! z( S Q5 b( L; H& B4 B, p If you choose to resend the command you should turn the drive off and on* ^" V" i9 ]0 q! G
after you pressed "Yes".
) o+ X- _ b4 E5 @! m) \ Do you want to resend the command until the drive responds?! y& ~1 j6 n7 t! }; p; n
- press 'No'
" z; e7 k4 K( L- choose "LiteOn DvdKey" as flashing task( [* v, Y6 T( K8 O
- choose the COM port number& i) i' [9 Z- ?5 r: t1 }2 C
- press on "LiteOn DvdKey" button
7 ?5 Y. x* b! Q- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
* Z' X+ a7 o+ x5 X' F- if you read the following:0 Q8 S0 Q' w' h0 ?
To receive the drive key use Geremia's DvdKey method like follows:: y6 |; d$ {/ o/ U
- Connect your drive with a serial cable to the COM port0 T4 ^/ K W# [ v
- Eject drive tray5 x4 [& B, ]7 q7 b. H! ~1 X1 s
- Power off drive
( W( B0 l7 f4 \ - Push drive tray in until it is half open
1 g& J) N9 F9 j" j' b - Power on drive
, H3 V8 P' n; O7 a' Y" `2 @4 T+ R - Press "Yes" if you are ready
Y8 s3 P. ~5 q' } Are you ready?! z+ u7 _- h4 r
- simply press 'Yes' without doing anything of the above, because we
- A- v+ u; g P9 r. J* o* B1 ` y: q% i already did that before" m" G: T! l/ W/ X2 A: q: R
- after this DosFlash32 displays your DVD-Key and saves your key and identify data3 I$ x. ]" I: O% V
8 Z& i: [. z% }% f' Y
# m3 X" x& F! ~! a3 Q) P0 f$ V
Geremia's DvdKey method with DosFlash32 and 2nd psu
. A% D% x% J+ I% Z& `3 [-----------------------------------------------------
8 B+ \* O7 r3 C E+ u2 q" E) v. X# [- connect a separate power supply unit to the LiteOn, don't turn it on yet
9 {2 e2 F6 a! \4 P9 ?, S- power up PC and boot into Windows
) ^) G9 S# F" y) {& v8 u- turn on the LiteOn psu* g: r' A/ q5 S2 i
- run DosFlash329 D& U* J2 }1 ]! S9 M1 h. ?! c
- if you read the following:
5 z6 ?/ L8 f) E/ i& b' u MTK Vendor Intro failed on port 0x????.! M1 g: K* y' D7 `
If you choose to resend the command you should turn the drive off and on
/ [# ^$ L% X- Q) x after you pressed "Yes".
) ^4 p3 O; c# {& ^( v! y4 l, n Do you want to resend the command until the drive responds?
9 D5 d" V# J1 ~- a- press 'No'
8 u7 T" b5 K7 J [- choose "LiteOn DvdKey" as flashing task
0 Q6 h+ t% S: m/ i$ ]) r- choose the COM port number3 u3 p8 W4 t+ V: e
- press on "LiteOn DvdKey" button
% z/ g- q8 I" Q4 w- K- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
a' z8 d$ w' [& ^- if you read the following:. j3 d s6 C/ x# | J) I$ H: Y C
To receive the drive key use Geremia's DvdKey method like follows:
$ H- N0 ~% s7 j: R5 @ - Connect your drive with a serial cable to the COM port) w. O J$ h9 ]! y3 y$ y7 o, k
- Eject drive tray3 [- }3 M3 f* G8 L% `+ X, S8 K
- Power off drive0 F) Q) J6 [* w, B- ^! V" l
- Push drive tray in until it is half open
& @; E# z6 [' [ - Power on drive7 W) E) S o ~ a) L
- Press "Yes" if you are ready
. a3 k. _: y+ c3 B* g Are you ready?5 _8 a) @; c4 ^3 e; U7 o' ]. V7 R
- do the above and press 'Yes'
+ ^# a, A7 C6 U. I: o1 u; k9 e1 {3 Y- after this DosFlash32 displays your DVD-Key and saves your key and identify data
: H) J- w0 B# o2 S) z" G9 V3 a& O! x4 T2 O+ Z c& ?+ i3 C% s
& ~; d& `. x" b( u/ p2 [' ~. r
Geremia's LiteOn Erase method with DosFlash32 and 2nd psu
, v' w# k; U; K-----------------------------------------------------------# Z6 R: A+ _$ [
- connect a separate power supply unit to the LiteOn, don't turn it on yet
C; f6 i7 t2 z4 A+ ^( c6 E- J; k- power up PC and boot into Windows" Q0 V( ?# L) {7 `/ ?
- turn on the LiteOn psu$ b D! [ Y3 h
- run DosFlash32
# l8 {7 i# E% r* d2 A! C! o- if you read the following:
7 [2 J' G b+ P1 u MTK Vendor Intro failed on port 0x????.- \/ E! U! m) M. n% P3 g$ y$ i
If you choose to resend the command you should turn the drive off and on
$ d3 ?. M+ a( Q0 i9 K) _" S after you pressed "Yes".
6 J1 M) w) `+ o5 Y* |' w Do you want to resend the command until the drive responds? k1 h) a$ W+ I* X: j8 c2 p
- press 'No'
7 q5 J- O" ^ T- the LiteOn flash is not identified
5 b) w5 `+ K+ b) y! w- choose "LiteOn Erase" as flashing task
H) v& n0 [1 t" C- Warning!!! Keep in mind that you will need the drive key before you erase the flash,6 Q7 B+ o2 M- k, x+ }6 m
without the drive key your XBox360 will not work anymore! V1 R1 N4 R; z& x; K
- press on "LiteOn Erase" button
" F+ W. O/ `. f% Z" r- the first time after the LiteOn Erase the drive needs to be repowered to give9 z# o2 B% u8 n8 O' Z8 u
flash chip access, this can be achieved by repowering the drive before another
_% ~8 H$ k/ j( G DosFlash32 start or by doing a MTK Vendor Intro Power Brute: \2 D X' k" L: G7 u: v2 c
- in my tests it did not work to power the drive with the PC's psu, because it will2 Y& F1 M* }! ~
always respond with busy status% `9 M7 ^! a. z8 w0 Y+ }
- DosFlash32 can now read, write and erase the flash chip like usual
1 b& R4 F/ e. h |- a6 f5 x( _
: b, d, D) H% Y& r2 f! R! K! x3 V( r' x m% ~
Respect to Geremia, Modfreakz, Podger, Redline99 and Tiros.
; r; |- H8 W: q1 w( L. t" ~7 y. t. @" g4 g$ d0 j) S
Like a wise man said: "0x2E is the MTK Intro of Death"
: H" x+ w. B, PKai Schtrom
e5 O1 X; p. X+ h x' R+ K+ E! b8 \
+ N) S* I+ C! R' H& f************************************************************************************************6 I( _/ P% S. w V( g7 A
6 l& V7 r- y. g. s& X0 x2 U8 ]0 b6 X& p0 W
DosFlash and DosFlash32 V1.6 Beta# l, T+ [' R* v! F. Z6 T' K! d' a
-----------------------------------
* [: s; A5 u& c- fixed power brute unlock bug for VIA cards, this can stop your VIA from working
5 z/ \! ]& f3 A" F# c with the power brute unlocking in Version 1.56 Y" p+ E( n B7 O0 h
- for DosFlash16 in auto mode on DOS my VIA card works best if I do a cold boot
5 p" s8 L; A( G0 o5 ^3 e and power up the drive short before or with the PC
# ^, H) ?2 T+ Z5 L/ N5 E1 \' b- for DosFlash32 on Windows my VIA card works best if I power up the drive short
* O) ~6 m5 }4 c1 U9 p: l+ k before starting DosFlash32
5 |- H2 P+ L3 b S4 m# N( H' N% n7 @- for me the VIA works with internal and external connectors on DOS and Windows
( i$ m3 \" H/ V6 ]% F* K$ z$ P( M: f3 p. P% g
Sorry for the trouble!
! ?9 U! A9 ^4 `% |) k/ bKai Schtrom3 C$ E1 d" Q( m0 Y2 D) C
, s8 T% t/ ]6 L! {( @8 H
7 ^/ t( T# w9 q' ?# O$ i************************************************************************************************& \# m4 ]$ D2 d
D2 }4 m+ L+ |3 G) P# K. z
8 x' ^8 k! W/ @
DosFlash and DosFlash32 V1.5 Beta
( l. F0 k6 r; [. w* O& d-----------------------------------
% L5 @" A: { ~4 [. d- now supports serial flash chip MT1309E with mediatek status 0x72 like the SH-D163B, SH-D162D, m) P: O1 Y) U: s7 r: U# |
Asus DVD-E616A3, Asus DVD-E818A3, Sony Optiarc DDU1671S
( W1 @& y- L3 v5 X- SST25LF020A and SST25LF040A chip support added
0 C7 F, W4 D' M, d4 o5 r' p% I- DosFlash32.exe ported from MFC to plain Windows API, exe size is now 22 KB' \9 _1 y7 A$ F) O6 Z* f
- new port i/o driver, because giveio.sys can't be compiled for 64 Bit Windows" n! h. v6 X6 L' D% q( v# k
- DosFlash16 changed slighly in manual mode, one parameter is added to support SST25LF020A and" {; |9 Z: \0 g; V
SST25LF040A4 W* M$ d- B8 d) R
- two new methods of BenQ soft unlock are now possible on all motherboards with only one power
( c/ f1 v: `$ L% K supply unit
- L" Y& R" [; \2 g9 q5 ]- 1st method is powered by Geremia's unlock core, thanks for the complete idea, concept and$ U" l2 R: Y! S( E0 b. ~* T, |
source to Geremia1 A6 M* d' `* o/ J5 s
- 2nd method is the Magic28 key send, this only works on BenQ VAD6038 firmware, thanks to
2 ^: p+ _" E/ H. Y( r) G c4eva and podger for the initial idea
1 O- K5 i4 W, w# Q0 l- the two unlock methods are send one after the other if the drive is a possible unlock; @. S3 J6 f2 g) N5 r
candidate, first the Magic28 command, then Geremia's unlock commands and after that the& s1 g5 E: f- }. @
already known power brute unlock is send to the drive, you can cancel any of these methods
6 W% ]/ k& o, E2 \: x before they are send to the target, this only applies to BenQ drives with a locked flash
0 l3 P4 I9 N: M% H. F0 }0 u- DosFlash.typ updated; ~0 u5 l7 [( o& }
- other minor improvements* }) D s8 u! D" |
- DosFlash32 is now ready for
3 O2 v4 F- C7 D7 R' M - Windows 20001 Y' J, R9 W4 O5 n9 F
- Windows XP 32 Bit8 h8 p5 R' n" N" c6 W. {
- Windows XP 64 Bit& i) T0 |' ^& f4 p, S
- Windows Server 2003 32 Bit
- d: v* W/ g; h8 n4 M' m. r0 F - Windows Server 2003 64 Bit
1 ^' x2 ]" D8 k, F* t - Windows Vista 32 Bit+ N2 W+ J; b0 A4 w7 u. v+ y
- Windows Vista 64 Bit
$ ~" X& ?3 X( t% z3 a& s- Warning: Drivers for Windows Vista 64 Bit need to be signed, because we can't afford the) ~1 w* u1 Z, {$ w* v' n
money to let portio64.sys sign you need to do the following:
" K" b1 i7 h0 G/ I6 k. d 1) Log on as Administrator
1 h6 t$ J" y% `* G- j 2) Enter the following command in a Dos-Box:" k1 a. y. e! v+ ]8 T# w/ q# u T
"bcdedit -set loadoptions DDISABLE_INTEGRITY_CHECKS"; H( H0 S1 `9 x( k
(we made sure there are no typos in the line above)  . O* i0 _6 f( t, U/ ^. x g, I
3) Press enter and reboot your PC7 R8 n1 D# \' x/ ]: T6 F( {
4) Press F8 key upon initial system boot up% I9 E: A0 U/ @' F, g' T6 R
5) Choose to disable forced driver signing enforcement for that boot session
6 x7 B' i9 e) l' a
0 E4 J2 k& t: [2 r$ q5 j& G5 f) {* y1 t( m2 T9 o+ d$ N
The following only applies to drives with a locked BenQ flash.8 y1 [7 s/ ]# W. M8 }$ r0 r" q7 K9 Y
1 `/ S* i% w) }) }+ U/ T/ D
# s0 ?( u0 D9 o- Y
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with the PC's psu( n2 N3 Z9 ~1 n$ F2 a
----------------------------------------------------------------------------------------- X' ~" z9 m: g; }2 u' C
- disable CD-ROM boot option in BIOS7 j& n, {) l% S2 f
- connect BenQ to your PC's power supply unit and SATA port
2 C6 q# y/ O6 w% p8 }- power up PC, wait until bootup is finished
$ V. _8 b9 L9 z" { y8 _- eject tray of the BenQ and shutdown PC completely
, h4 k# @7 B5 l/ Z- push the BenQ tray half in0 j/ m4 w. j# L- }4 @
- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash32
. K: ?3 y, I( @, F7 K1 j/ ^: K$ i- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
J, E2 T% M+ X$ c" `; m6 Z- if you read the following:$ e. D% x1 ?$ X, U5 y5 `) {
MTK Vendor Intro failed on port 0x????. Because there seems! w6 R4 T7 l" @0 n0 `
to be a BenQ drive connected you should try Geremia's5 D% ?. q3 M- F! I) A% K2 z7 x% c
unlock method.0 L1 z- j8 o( G1 U6 |; \: |
- Eject drive tray
6 y) e0 i4 z" j4 Z) S q$ u/ d/ i - Power off drive
) I9 X) g( l5 y/ c7 N - Push drive tray in until it is half open
: @+ v! u$ O1 ~+ | - Power on drive
7 [7 F: }5 ]4 ^) |( t - Press "Yes" if you are ready
6 V! B8 F4 v' C F9 Y Are you ready (Y/N)?' R; R5 }9 J& d, P& F* s& c7 r. ^% {: F
- simply press 'Yes' without doing anything of the above, because we
2 t# w3 @3 c( D! C( u4 B$ O already did that before starting DosFlash16 / DosFlash32
0 A1 n1 O2 a- c( B- the BenQ flash should now be identified
$ }, R: D1 O' g) ~/ B+ J0 j- go on like usual5 B4 k) T5 A6 n7 E5 N" H/ r
" b9 ~9 B3 R' L0 d8 h4 P- ~
% u3 w0 Y6 ~# e/ o; A. e: t$ @" q+ Q
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with 2nd psu
' W- I) f1 k& ?. O" C% T------------------------------------------------------------------------------------) k9 T! a% J' O( x" w0 K
- connect a separate power supply unit to the BenQ, don't turn it on yet" r8 A% z7 o1 Z8 s
- power up PC and boot into DOS
2 H9 n& Q& t* G$ e) F* P- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows/ o, ~8 }; q; C+ R9 c
- if you read the following:4 E- ^3 X3 d8 X. |2 Q0 c C
MTK Vendor Intro failed on port 0x????. Because there seems8 R, |! J& r7 A5 L w# o8 N
to be a BenQ drive connected you should try Geremia's ^4 o; H3 R+ O
unlock method.
6 m/ b4 D2 H# K$ E, t% ?0 T% B - Eject drive tray
' ?, S- M5 m7 j0 I2 \" ?) x - Power off drive7 j$ J' J5 V) G# T
- Push drive tray in until it is half open2 [7 @) n# }; _ u
- Power on drive( h) ]$ B6 A( c* T$ f
- Press "Yes" if you are ready
; c2 |# @# e2 e7 I8 P, x/ ^ Are you ready (Y/N)?2 n- O. E- Q1 u7 I7 \6 `
- do the above and press 'Yes'
! U7 C R. ]0 |/ ~8 B1 I0 Q' }- the BenQ flash should now be identified
( c$ X% k& ^" U# `; @$ V5 w- go on like usual% W4 O5 |. O3 r. M' \1 F0 A% ]4 W
5 K3 c& E) F# [6 p# @) d
5 h3 ^) F5 C& q, aMagic28 BenQ unlock with DosFlash16 / DosFlash32 on any motherboard
" l* L2 h0 v5 v---------------------------------------------------------------------$ }' \" v5 ]: ^4 y* L8 H
- connect BenQ to your PC's power supply unit and SATA port
5 y2 a _, X8 j4 D7 M* k/ b9 F- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash328 R9 x+ p( S l# d; i; z4 p q# h
- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
B6 [3 Y2 k4 Z8 a, ?4 R$ _4 c- if you read the following:" J- d! r" W: m/ z
MTK Vendor Intro failed on port 0x????. Because there seems0 U0 a \, S8 o# d
to be a BenQ VAD6038 drive connected you should try the
$ s& [" C; r3 Z* C' a. N- l Magic28 unlock method.
. M# \, z: A' l; j Do you want to send the Magic28 command?
0 T" J/ B. Q8 E+ ]$ l) s& B; s, k- press 'Yes'- s4 [& A' [( b) p, [3 S/ k9 g* ?
- the BenQ flash should now be identified
# G0 g: v( E" ~# f: T$ h& |- go on like usual! r9 o4 o1 u. z; J; o
9 g* W6 W j$ u( G1 c) N/ p3 n$ n, e5 \6 f# @0 {3 q; d0 Y
Thanks to Redline99 and Tiros for help and support./ n3 A7 } ~6 k g: C. M6 \
: V$ W9 a' _( t! x( A8 F5 a6 g: bIt's all about DOS!
# k3 M, ^7 l, `, D p$ `Thanks guys for the excellent team work!- T2 x5 v$ |# R# B: J
Geremia, Modfreakz and Kai Schtrom
- F D! M& J4 W# J) T
& s' Q0 ]( F) P, g# j
$ P5 R4 ]& v. a/ f& W************************************************************************************************
- C0 f$ z. E8 G" r
1 m G9 k0 p# a/ J2 U. g. c1 [- z+ \5 u6 ~! R
DosFlash and DosFlash32 V1.4 Beta
& S8 A) M* B6 R \! R" n% Y) o/ H g-----------------------------------3 r2 p' @6 S# C/ w# ?) n: Y, @
- DROM6316 flashing support
7 A* ^3 n% W) g- G0 x- a flash erase is now always done with a chip erase and not a sector erase command, because
) `# C4 M0 ~2 x$ G! ` the sector erase gives problems for some Winbond flash chips including the DROM6316- X2 a% ^$ y. e
- DosFlash.typ corrected and updated+ F0 m5 H+ N: p- F4 y, K1 n4 Z3 h
- for a detailed explanation on the soft unlock look at the included file SoftUnlockByIriez.txt,
3 O' m+ N9 u5 E9 ]; S# v3 d it contains a very good explanation by Iriez from XBS, thanks for that one!
( q ~' A5 I6 q; |/ T+ Z* i/ J7 u8 W: s* Y0 b' j; O0 q$ M
Thanks to Iriez, Jumba, Redline99 and Tiros for help and support.. \; y: g( j/ {* n8 a) U
* I5 }& ]* U- j, s7 Z- VHappy DROM bricking!- c# X; [1 ?3 s& D
Team Modfreakz and Kai Schtrom
: j7 n; X# O+ a5 u" d( V" n3 [ [# r, v `
: T6 f- d$ q: t************************************************************************************************
5 Z( m t7 r( b& _# E1 H" n5 \1 N
) H# T/ p/ I" }DosFlash and DosFlash32 V1.3 Beta
' J# [) d# M. r. P-----------------------------------6 u3 q3 }& E* K# B: @' e% ^
- BenQ optimization in unlocking the flash chip, it should now be possible to read/write/erase5 i' A7 ]0 ]) J( }
the flash without any soldering or wire tricks, the drive is polled for the correct mtk
2 s* x" x5 j( T' { unlocking status after power on, this only works for VIA cards and NForce boards atm
_& r! J) g' \- DosFlash32 has one additional parameter, if you start it with the parameter "EnableDrives"
3 @6 |4 ?5 G! e) G3 u+ U7 y all the DVD-ROMs are enabled in device manager after flashing, this could give BSOD on some
O6 l! ^: A0 X' `& g9 A5 y" M systems, therefor you need to create a DosFlash32 link and add that parameter manual to use it
* H" i2 ^5 J0 o7 S% Q- DosFlash16 has one additional parameter "Send ATAPI Device Reset" in manual mode, this could: ^0 _! v. p. T# Y2 ]
give better chances for soft flashing on some VIA - motherboard combinations
, A6 e7 @& S0 F+ b- better support of Intel chipsets, drives can now be flashed if the controller is not set to9 H2 e2 k+ R4 P* l! ^& }: r
native mode in the BIOS
4 o7 l i) |% c- a) n: S- the following controller list includes vendor and device IDs that are hardcoded to identify: i; L( ^: T! E2 p, W) y- w
the controller type (IDE or SATA), this is needed if the BIOS uses IDE ports like 0x01F0 or
2 ~& _9 u+ C" e* {1 z/ K! ` P+ a 0x0170 as SATA and not as IDE channels, this list is NOT related to soft flashing
2 u9 g4 A4 S9 G- the following chipset support is added% V2 k! @5 y; I. t
- VIA cards: `$ Y. Q' ]) Y6 A! A
- all VIA cards with a 6420 chipset
, z) j E: Q9 c8 G, ] } - IDE Controllers: T( Q/ S) g$ P7 }, k
- NVIDIA nForce 2 IDE Controller
' J4 P; ^5 p& n- F1 E& T) }& S% \ - NVIDIA nForce 4 IDE Controller# o2 G! C+ a9 U4 D+ Z
- Intel ICH9
' a, a. X0 k+ L; @ - Intel ICH (i810,i815,i840)" o, s8 t+ H, `8 a+ E
- Intel ICH0
# {* w( m4 t3 _* Z* F6 ~( @; ?- Z" K - Intel ICH2M
% P9 ]! L _( a4 W0 k - Intel ICH2 (i810E2,i845,850,860)$ T0 g6 ?, W- e8 ^
- Intel C-ICH (i810E2)
& S' w; Z p4 q2 p; T - Intel ICH3M) Z* t2 i# F; [3 ~
- Intel ICH3 (E7500/1)
% B% m" o9 ?7 K* @! t/ [2 G - Intel ICH4 (i845GV,i845E,i852,i855)
$ R) P2 k8 D9 w+ N - Intel ICH5
, L4 m1 P) R5 T" U. I. v7 ]. H, {6 U - Intel ESB (855GME/875P + 6300ESB)& A w3 n, ^8 m; [
- Intel ICH6 (and 6) (i915)
5 T2 g6 f D/ @! m3 u5 b6 ] - Intel ICH7/7-R (i945, i975)" u5 l1 T$ \- S2 G
- Intel PIIX3 for the 430HX etc
# b4 U8 a2 Z0 u+ w" j - Intel PIIX4
; c, K3 Q- U( I3 Z& @- S/ N - Intel PIIX4 for the 430TX/440BX/MX chipset
2 [# f4 P+ p! M- k1 X7 l4 ] - Intel PIIX3 L# Z9 S. ^# w5 F2 @. \
- SATA Controllers
# b' g4 S" s8 S1 c M W% x - NVIDIA nForce 4 SATA Controller7 M& X; V3 H% b# f
- NVIDIA nForce 2 SATA Controller5 P4 [% @5 Q+ L3 L: Y- ~" S) H) Q
- NVIDIA nForce 3 SATA Controller
5 U, s1 u: Q \" l7 y# P - NVIDIA nForce MCP04 SATA Controller
; K8 r* l, l+ v6 W: r - NVIDIA nForce MCP51 SATA Controller* l: `* [3 |: C) P( w
- NVIDIA nForce MCP55 SATA Controller
' A( Y# t. E( \ [5 B$ H( x - NVIDIA nForce MCP61 SATA Controller* v' T. d, x: B$ o2 T, \0 {2 r9 V* w
- Intel 82801EB (ICH5)' L' F9 H4 z9 k- x
- Intel 6300ESB (ICH5)& j- S$ K# u. G: R
- Intel 82801FB/FW (ICH6/ICH6W). f5 I7 w! |& g2 R+ _# @% B: i) `* j
- Intel 82801FR/FRW (ICH6R/ICH6RW)
! N% x# s# u. }! F: ~6 x - Intel 82801FBM ICH6M D$ x1 r- I0 v, [: ], B
- Intel Enterprise Southbridge 2 (631xESB/632xESB)
- C5 A' a) O# D/ c; Z; y5 Q; i - Intel 82801GB/GR/GH (ICH7, identical to ICH6), x* c+ B$ }3 ~
- Intel 2801GBM/GHM (ICH7M, identical to ICH6M)5 h2 j6 A$ m7 v% \; ]/ t
- Intel SATA Controller IDE (ICH8)
: M* a0 m/ d+ @4 z - Intel Mobile SATA Controller IDE (ICH8M)
4 W* |0 `* B9 @0 i) n3 {4 v - Intel SATA Controller IDE (ICH9)
: U* P) r9 j9 W1 z9 E+ I) ~ - Intel SATA Controller IDE (ICH9M)
( [. g& Z8 W' r1 N0 V+ [# l
$ W, E! `3 f0 o; T
, o- f6 S- }( VThe following only applies to a software flash on a locked flash. The methods have been tested
& n# ]- Y2 x8 v; iwith the BenQ and the Sammy. The VCC trick will work on any motherboard, but you need to do
2 q! Z% o; G( O, Y- f& Wsome soldering and cut traces.9 K( P# C7 V; }- `8 q& w! I# [& j
% l/ b: }9 q5 r2 \$ }/ S
?. M5 k7 y3 m9 a, }9 c; D; ^1 LSoft Flashing the BenQ in DOS with a VIA card and DosFlash16 in manual mode
5 Y% P+ w3 b8 f# D! Q# D-----------------------------------------------------------------------------
5 J1 b- J; w) _5 z- first you need to know the port addresses of your VIA card, you can get these by starting
3 Y1 t8 u" O- H6 X5 c; k msinfo32 on Windows XP and looking at the port listing for SCSI devices
: Y# @) R4 |6 H* _6 l- for the 6421 the 1st port is internal SATA, 2nd is external SATA and 3rd is internal IDE
; [/ r* B& B3 {$ a( z- for the 6420 the 1st and 3rd port are internal SATA6 I" f% z: [0 z" g# l6 j
- you need the starting address e.g. 0xD000 or 0x7000+ {$ K: h1 d. {+ b% E- M0 d
- be warned that these addresses can change from computer to computer, they are assigned
: E, q/ x N# b; ^* } at bootup, but Windows XP should display the ones you need for flashing in DOS8 y5 ]9 _9 A# w: R' _
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or # O7 Z" y/ j. E, n: e6 `
Xecuter Connectivity Kit)
6 i7 F5 z6 U6 Y; a0 g7 g( ~- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
" a( C8 O* h: R# J: W need to power the drive off and on during soft flashing% G# N6 P- |) h" \
- cold reboot or reset the computer& v+ `+ b& y( x, z9 h3 \6 r9 z
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk
, G/ [% {9 x% e# V1 Y! ]% j- at the prompt type: 4 I. `6 H+ V& t9 }- N: e
DosFlash r 7000 1 a0 1 4 a:\orig.bin 0
! D# h4 s: l2 Z, F7 |3 e8 L - instead of port 7000 use the starting address your VIA card uses
. h+ l" c5 ]" ?" k e! k+ a' w$ ~, P- press return# L$ ^! _3 _6 k
- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes3 I# ^' {% Q. Q( `9 `; ~, ~/ p
- after you pressed Yes the drive status is shown on the screen, it's something like 0x7F,* b9 x9 q- S2 ], L& c8 J# ~' D( K; Y
this will change during the next few steps
, {2 M* n! {7 K1 k% ]! K7 I- V8 C- turn on the BenQ psu and wait 2 or more seconds, status changes between 0x51 and 0xD1: ?: `. a% y# K/ ^# A/ @3 x, W
- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1
$ |( |7 }' S) ?; Z6 |% p- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start- O% X- T* X; N) U' m
- this worked only one time after the computer is powered on or resetted for me
: Z% ?, A- z* H- writing and erasing works the same way0 f$ E! X# C5 J- i3 o, S
- for writing type:- Y4 k+ |& U H9 c+ J) Z7 @: D
DosFlash w 7000 1 a0 1 4 a:\ixtreme.bin 0
" U+ d/ u; z6 G7 E- for erasing type:5 G5 R5 c8 Q# a# i, {% D
DosFlash e 7000 1 a0 1 4 D8 0 (D8 is the sector erase opcode for the BenQ flash, if you need
6 ?; H5 n+ c( n- _: t% U- j to erase another drive, lookup the value in the datasheet or DosFlash.typ)8 p4 v5 m ~5 w- D, S" r
- if you experience any problems try to use 1 as the parameter to the ATAPI Device Reset, cause* g* E- s% c1 J0 X
the same VIA card will react differently on another motherboard sometimes
; E' N: ]/ Y4 q9 d
' V& M% l3 N9 }5 W% v0 ]" A( s; z. D `, R
Soft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in manuel mode/ j, }5 b; f9 t& U8 I
---------------------------------------------------------------------------------------
, b& [; j6 |8 U% j: K0 ~- first you need to know the port addresses of your NForce motherboard, you can get these by 5 ?3 o1 W: n6 v' |8 @0 c% h6 d$ h
starting msinfo32 on Windows XP and looking at the port listing for IDE devices
% p3 {$ m6 Z, p- on most motherboards the 1st and 3rd ports are used for SATA% e* o/ h1 O- i9 A* Q( V
- you need the starting address e.g. 0x0970 or 0xE9009 L& C s" M$ H& K) P* o* b
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or & u+ e; S8 x k9 S) D
Xecuter Connectivity Kit)
8 Z& ~% h z$ ^" f- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we( T6 E$ I) C# M2 ~# C
need to power the drive off and on during soft flashing; P% p0 [& `2 X+ y5 A% I P
- cold reboot or reset the computer
6 |% l; ?8 b; d9 f- A2 u- boot from a DOS disk, I used a Windows XP MS-DOS startup disk
( ?) `# o3 \! F( u# q- A) _& z9 P* Q- at the prompt type:
3 }% d1 |/ y4 A9 I DosFlash r 0970 1 a0 1 4 a:\orig.bin 1 9 s i, t! P; `+ s p. U
- instead of port 0970 use the starting address your NForce motherboard uses" u0 C" h: {2 S/ h
- press return
4 I1 s s2 p: J& g5 \- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
8 l2 n% b2 ^& P1 c- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,. H" F% K s& ?/ a( }! g+ V
this will change during the next few steps0 ~# J K. [' w# `0 D) Q2 r* g' P
- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start) K3 s/ S# [6 o: R3 Y
- writing and erasing works the same way3 s8 o/ R& l& c
- for writing type:3 } T& S6 B( z' V# v0 k! Y+ w, b$ E; K
DosFlash w 0970 1 a0 1 4 a:\ixtreme.bin 1, U# h) F2 d5 C. d7 L4 H
- for erasing type:
, n% R: a, G9 y! g z( t% ~, w* K DosFlash e 0970 1 a0 1 4 D8 1 (D8 is the sector erase opcode for the BenQ flash, if you need6 i- n0 s6 |0 c6 J0 F ~
to erase another drive, lookup the value in the datasheet or DosFlash.typ)1 A. k0 J% v- G' G1 s9 i0 ?3 f
& h6 W1 n1 V8 Y" K, L& x+ C, A# Q: x: Z9 _5 _6 F' t8 ?
Soft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in auto mode3 q+ [) M: g7 \( t
-------------------------------------------------------------------------------------3 J& ]3 a1 i# s* i1 h" b
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or
: ]; o% e0 N4 i/ R Xecuter Connectivity Kit)
! `8 r! {" F* m! h- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
1 B" g- b# j7 j% z ` w! | need to power the drive off and on during soft flashing. l/ H5 s& @% ~0 f) s
- cold reboot or reset the computer2 O! w+ U5 w" N: C) M
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk
, A7 V1 N8 [! d+ X- wait until you are at the cmd prompt0 m9 ^$ }) O2 L$ V: f, E
- turn on the BenQ psu
& [ _) A4 I% j: D- at the prompt type:
" g" S9 i- {% s5 r+ t, j% } DosFlash
2 S) W) W: U4 T7 p9 S. Q- press return
4 c6 z/ ]4 E5 o3 F7 f# K" u6 m- during scann of the BenQ's port DosFlash16 will ask you if you wanna resend the mtk vendor
) n: I ~2 A% @) n5 ?- F intro cmd, press Yes) V1 X2 t. r3 P" F6 \) }3 e3 p
- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,6 U# \( _* V2 J. Z* R7 t! g: r/ B
this will change during the next few steps/ n8 q0 c3 e3 U- n _% R8 i" @
- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1! q7 }+ C2 O0 ?6 ^
- turn on the BenQ psu, you should get a good drive status 0x73 and flash access is granted
, d5 b1 ?, X3 A& g4 p3 L' L! R- you can now continue as usual using DosFlash
9 b: ?* z* n) ^/ S; s9 h' I- writing and erasing works the same way2 c) t7 P& l$ V; @' o' e
- if the ports are scanned there is the possibility that you'll get the resend question for) o2 f. w+ V; j5 ^0 ?' d, {
other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,; W7 ^3 w3 m& e- V
if you know the NEC is at that port you should press No and press Yes only if the port of
8 N3 z9 N, q7 { the BenQ is shown or simply disconnect the NEC
/ Z5 D. ^# i2 m5 d. z( v/ g5 E0 `% S( f
* V. s: v9 B* F, B. O. r4 _: ]2 p2 I9 x2 M) _1 r5 q
Soft Flashing the BenQ in Windows XP with a VIA card or NForce motherboard and DosFlash32- U. j* V* I8 c, b* q5 S
-------------------------------------------------------------------------------------------
. A7 [/ v; \5 D% u6 p- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or * r3 `0 u" \5 ?- M }2 t& c6 Z2 \
Xecuter Connectivity Kit)" w) _: U5 R) b$ w! O1 q# G& K( |
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we- N2 D; L8 R" N
need to power the drive off and on during soft flashing3 W$ d: {: k7 q+ K& g: q5 ]7 O t. v
- cold reboot or reset the computer3 s* }/ X: T$ E3 x9 ]2 V( }
- turn on the BenQ psu when you are in Windows XP) F2 Z1 k1 A: z% U* a
- start DosFlash32! J. J# u7 }( J7 N! H6 {+ c) w `0 Y
- DosFlash32 will ask you if you wanna resend the mtk vendor intro cmd, press Yes8 A. s0 Q2 N. r0 b4 K) \
- turn off the BenQ psu and wait 2 or more seconds0 ^! `1 g6 H2 X3 z
- turn on the BenQ psu, the DosFlash32 dialog should show up
8 P) b* Y4 J' Z4 z- the flash should be recognized by DosFlash329 O* s. y5 c2 B' ^9 x5 d8 K
- you can now read, write or erase the flash/ G4 W o* o% X0 u- N6 d
- you should be able to do the flashing more than one time in Windows, only do the power 4 j( o8 o, Z2 G
off/on trick again8 r( e! H1 ^9 J8 }1 \# Q! \5 B8 ?
- if the ports are scanned there is the possibility that you'll get the resend question for
0 p; O; i! J$ a/ ^ other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,
) E) n5 t2 W S( }# A0 | if you know the NEC is at that port you should press No and press Yes only if the port of2 C% j' m: j5 V
the BenQ is shown or simply disconnect the NEC
6 P3 S+ O) g. y& B) U( X9 d8 j+ S5 {. f1 C
; y6 d) A9 Z! w7 l
Many thanks to jumba for the great idea of BenQ polling!
6 {; {- l4 \3 T" Z1 i, ^Thanks to Iriez, Jumba, Redline99, TeamModfreakz, Tiros and all the IRC people for testing
1 ^, U4 u8 `& N- ]" w) U, y3 z; b4 ?and support.
1 a! a2 L" T9 ]1 c* V8 K. L k* P7 g" ]
Join us on IRC efnet at the channel #dosflash for support.
0 m$ c2 |9 }3 r% L/ V9 {9 A- a2 n# R* e- ~8 D% M
Don't brick your BenQ!
. E* x e3 h* s, P7 W& HKai Schtrom
2 d8 Q+ w: C, K6 I7 F) o8 F8 A, ~) ]* }% S2 I% G
# }: E+ k4 P- c- x
************************************************************************************************( M- i7 w' n/ v9 A1 n
0 f+ q' A6 F( L% e d0 F z
$ G7 C( j+ J. f8 I+ V+ b aDosFlash and DosFlash32 V1.2 Beta6 d1 E q& Z; T6 U$ w% v+ x
-----------------------------------
7 o: f' h& B% W% T" V( X5 q( m- bug fix for BenQ recognition$ o9 Q w( i* G# O; @
- manufacturer and device id are sometimes 0x00 for a correct installed switch# Y" V( q, P: h) g2 M1 j) I
- this issue is fixed with an additional ATAPI device reset before the mtk vendor intro is sent& e) Q' B# L0 U) M* f$ h0 P
7 w/ K- R) m6 VThanks to Redline99 who fixed my buggy code by adding one line!
- B4 ~: J: i& X2 R" S3 q- u, l5 j6 P6 r
/ e& G6 B# K0 Z
************************************************************************************************
. M, r* G# u' l! C5 t; F2 r
% q5 b0 K& j/ f5 x& G6 `6 b2 h) ?
3 N( d( a% v7 R, hDosFlash and DosFlash32 V1.1 Beta- @2 S4 K, R3 A6 O' S, {
-----------------------------------( Y# _2 h1 \" G4 _+ @
- DosFlash.typ modified for better BenQ support
% Z2 ? ~4 n9 v- DosFlash16 Flash Manufacturer and Device ID screen output restructured7 U0 K3 I5 ^( b! i
- flash chips are first erased before writing starts1 b% T, a6 S: l* C. N: y& L
- DosFlash32 no reenable of DVD-ROMs in device manager after flashing, this means you can't see the drive
4 w/ [$ K4 J9 A& q, x; W and maybe have to activate it manually again in device manager, this could give better compatibility and) L {7 [5 o. l3 r
hopefully no more blue screens! _6 G8 U) j' N0 T
4 k9 X! [* y5 p1 y U) A8 C4 B
Many thanks to Jumba, Redline99, TeamModfreakz and Tiros for inspiration and help!
0 E3 u$ [5 b2 O+ C
, }; ~; H; H8 X: H" I. F
* a4 j% A. b- _- S************************************************************************************************4 e+ _1 i0 j4 w, S
" J; Y* `( ~& A @" x: w
" @; x' T. ~3 c6 ZDosFlash and DosFlash32 V1.0 Beta& f" b x9 E6 m4 O& Y0 \
-----------------------------------! E! Y4 d- T+ } r/ ^
DosFlash can be used to read/write/erase the flash chips of most CD/DVD-ROM drives
! Z) z& _, Y o4 zthat have a mediatek chipset installed. DosFlash is for DOS flashing, DosFlash324 p4 [2 v F% M3 L3 m* p5 X
for Windows flashing.0 @: v6 x% ~: g5 y+ V+ v, ]3 o
9 q" g. d. G/ r$ |+ a d/ y$ |5 \0 J" x. e( r
Features:- P/ x7 r& B/ m9 F. b) n5 q
-----------$ M0 @$ m4 |; n- S! W6 O4 O* x
- flashes IDE and SATA drives
, @8 k" ]7 v6 m4 v6 f8 C- supports parallel and serial flash chips5 Y" L8 q! W7 j4 b ]: {6 U
- flash drives in Windows with direct port access
2 |6 v" n& Y% f4 {: E4 t- no vendor cdb flashing commands are used# q# F4 c: B6 s9 L/ |
- tested with the following drives:
, D0 v2 s2 x# q: ^' i* [3 G - TS-H943A MS25, MS28! I" U; o D- ~! O ?
- SH-D162C
4 z% e) | b) u1 ?' P$ e, f - SH-D163A
; u1 U( j9 f+ k* o' u - and some other drives like Liteon, Hitachi, ...
. b, J- {3 k2 Z0 \$ N- NEC drives are not supported, cause they have no mediatek chipset installed) L8 d( {. o- ^# [- T0 R
* ?" e- J. O0 ~; ~8 v! Z! D
) a: H/ E5 G4 K3 J: y# N1 n6 g7 BDosFlash
& T& t2 N9 y4 o) W2 W. s----------
- G. [$ p0 V6 v$ dDosFlash supports two flashing modes, Auto and Manual. If you type DOSFLASH at a DOS prompt it
1 ~6 n$ t( C4 s" |will start in Auto mode. All drives and the corresponding flash chips are detected automatically.9 m0 O5 Z$ `. v/ U5 h: ^
If you can't get a flash chip recognized due to a bad flash or other problems you should use the1 E5 M6 {0 @% j- {4 X, {
Manual mode. In Manual mode you can enter all the parameters used for flashing by hand. The M! D- n4 L* [) ?
following help screen is displayed if you start DosFlash with a wrong number of parameters:
9 ~9 F* H' j$ S: B3 U: s
& U& p$ y Q0 a8 r
+ V- Z2 M W. N2 C9 u5 CDOSFLASH by Kai Schtrom, 08/05/2007 (Ver 1.0 Beta)9 u* ?7 p* Z. ^4 ~
DOSFLASH [R|W|E] [PORT] [PORT TYPE] [DRIVE POS] [FLASH TYPE]
( S p' w! ]- w8 y0 R [FLASH SIZE] [FLASH SECTOR ERASE OPCODE] [FILE NAME]9 ~0 j4 ^8 _2 H( R) a; j+ e
R: Read FLASH
2 }( A5 G# H9 n' L4 r/ }& Y. X W: Write FLASH
( C6 G8 o7 k, c6 c E: Erase FLASH
3 H- W8 Z9 d* A2 } PORT: Port to send command to
( I3 h6 M! V" x* @+ z, V PORT TYPE: 0 for IDE, 1 for SATA
+ F: l I2 V! ~9 \. c: k+ A DRIVE POS: A0 for Master, B0 for Slave
+ k8 \) r# @8 W% ~/ g; _ FLASH TYPE: 0 for parallel flash, 1 for serial flash4 ?9 I# ?8 O# V4 V+ ^/ R% o
FLASH SIZE: size of flash chip in number of banks) M* Y" k+ k8 M) s6 G
FLASH SECTOR ERASE OPCODE: individual sector erase opcode command byte
. h1 R- b% y% H# L this is only needed for erasing a serial flash: `3 I3 A$ L2 m5 p
FILE NAME: name of the file to read/write from/to flash# b9 [ R+ N8 a R$ [4 m
All numbers are intepreted as hex values!
) K3 v& ~8 q8 i8 L$ Q7 W- Y* `6 L# D; }2 V" J5 o8 s3 u5 y2 T2 h/ p
Example Usage:* H5 g9 E+ L o$ t! v, {
"DOSFLASH R 01F0 0 A0 1 4 C:\flash.bin"! v& ~4 u1 K1 O8 h- I
=> Read serial flash with a size of 4 bank (262144 bytes) from Master Device
G$ w& `% q$ `# E/ t, O" q on IDE port 0x01F0
- Q& _0 f, {# \9 e0 T* I! C0 C"DOSFLASH E C000 1 A0 1 4 D8"- b1 |0 A, `3 a4 b+ Z6 q6 W
=> Erase serial flash with opcode 0xD8 and a size of 4 banks (262144 bytes)
" M) V! g# i- Y) O from Master Device on SATA port 0xC000
0 S$ j0 q0 x) w
2 E) Y/ M/ A' h2 q$ \+ g
. E1 ?: C( Z2 I: s: JExplanation of the Parameters:
5 L& {6 J( l8 A- q7 q0 [--------------------------------
+ g: I9 E) d; I. W! Q3 s t1 I$ C; z! d, B7 V3 t# ^6 l
[R|W|E]
/ A+ e& O4 `! s3 l: B: j6 a---------
+ ]) r' `, G8 X7 O( p1 t# D5 y" G- this will set the mode of flashing, it is recommended to first try read on any
7 X: {6 t' U3 _: b8 V# I drive, if the read will fail, it is highly unlikely that a write or erase will% s5 W: G3 ]5 y: B0 T7 l
succeed
3 I0 P8 K# j! l6 A6 @$ X( i% b
: k$ Y9 z1 Y' p4 r, E[PORT]
- z+ o6 T0 H- ~( m3 K" v. H--------, J9 g" l* t' w9 l+ t8 Z6 @8 C5 Q
- the port to which the drive is connected, a port number should always be entered+ G) p3 W3 m, R/ P. I
in hexadecimal and have 4 hex digits, valid ports are: 01F0, 0170, C000, C800
4 v3 N; \4 B+ ]/ O2 C3 @- this option can be used if your PCI adapter card or on board IDE/SATA ports are
8 i& @5 F( R2 _+ K4 z! q" ^ not identified by the auto mode4 |- m/ V# G+ Y) I
. l2 F1 u" \! B3 V[PORT TYPE]6 b# g# m8 g7 [
-------------
1 `1 N; q4 @: K4 Z8 O' x- the port type tells DosFlash what type of port is installed on the before entered/ v: @3 `0 g3 x9 N- B3 \9 H
port address
+ `0 E; d# ^, S( N) K, ~* k- valid values are 0 for IDE and 1 for SATA
3 M. U! }3 ?( [: s% V7 N- make sure you never mix the wrong port with the wrong port type, this could give
& b: m& t( O" `6 c$ U4 K strange results or in the worst case a bricked drive4 J: u5 ^6 P5 `# {$ T1 Q
! R; x6 ^! O+ {& B* G5 q
[DRIVE POS]
; c+ Z/ U0 T, N* h% t-------------: w" s' V8 \, h: k( f8 ^! d# X- o, s
- old style IDE channels have the possibility to connect two drives at one IDE# _ l, d% |2 C
channel, the first drive is called the master, the second drives is called the
! N1 U' ]! k7 T) N$ {; ~5 g slave1 i+ Q- Q: [4 h `
- you can select which drive should be flashed on the channel, A0 selects Master,: n, P$ h$ X* B7 G! p' k4 Y
B0 selects Slave/ O$ f3 ]- O0 n% _- @
- on SATA ports this value is always A0, cause you can only connect one drive to& I+ @1 B% U$ T( x
a SATA port, so for SATA you will always type A0 here1 N5 L/ a" r1 ?0 s% Y8 z
- it is not recommended to flash IDE drives with another drive connected to the
$ y+ h2 p6 m/ E/ N same IDE channel, this could be risky if something in the Master/Slave selection# \" d* H$ [! l4 t5 ?
fails* G; E% c5 M6 E. d9 Y) y% [- [) X
8 O- k: [1 q. d2 Q[FLASH TYPE]( z$ w$ l9 F4 u; ~/ Q
--------------
( a# K: A; \" S1 W9 d: U- there are two types of flash chips out for CD/DVD-ROM drives atm; \. |1 W, l1 t& a9 s) w
- the older type is parallel flash, which is also supported by mtkflash for example! g6 H- h8 ~, Y& D
- the newer type is serial flash, which is supported by flashers like XSF3 F! i1 i! h' \
- the problem here is that no tool is out that can flash serial flash chips on
( D5 `+ I N# S( g& B SATA ports
$ S/ M! O3 u) {" W' ~; e2 q * c' O3 l8 p: L. Q: V
[FLASH SIZE]& V* e6 E4 ^1 }) Y# i* V, @$ b
--------------
* u% Z1 J9 ]5 E n9 a8 M3 k. m- this is specifies the flash chip size in banks
) e, f1 G* X0 T7 x" G& G- one bank is always 65.536 bytes in size! K, p; {7 q$ G' C( b, F _
- if you know your drive has a flash chip of 262.144 bytes in size you need to enter 4
$ i9 p* D6 M; q
$ _( c" a) W6 p+ \! w; E* x[FLASH SECTOR ERASE OPCODE]" \# B3 X/ m' a/ `' Y5 B
-----------------------------2 {1 z( {. Z, @- P& w; }
- the opcode used in the flash chips datasheet for erasing# P0 m3 G8 K' i& c) m3 @
- for serial chips this command can be different from the standard and needs to be
! J7 l1 C& X' z8 f# o6 U, W2 a' @$ B$ N entered for flash erase
7 F4 D6 {. }1 @! A: h+ e- for parallel flash chips you can enter a dummy cmd byte, the integrated command
5 @$ w; ~. \# V5 N should work on all parallel flash chips without a prob( V) k' ^) I( R, N& p" K0 r
6 r1 V+ k {6 b& X[FILE NAME]
2 k% B l, K4 r1 Z1 o-------------
$ E/ D( s( o% C* U3 M# W- name of the file that should be used for flashing# W6 \* g0 ?, A. \2 A9 i
- for reading operations this should be the output file, `3 Y6 m. B" c$ B B( r
- for writing operations this should be the input file
0 W# S& x9 T- ^
* ]1 M$ a* ~0 N5 o0 ]' [* J3 h S4 W" g4 K+ E" e# g' v W
Hints and Warnings9 i) G* t% a t! b% z/ ?
--------------------( n }6 {# U9 a/ F& t- q
- read, write erase TS-H943A MS28 after the firmware stealth has been disabled with Enable0800 disc
$ _/ Q4 q' N- e7 j - this only works one time, after the first mtk vendor specific intro cmd is send9 ~, H( U* S) j" D5 U$ f2 g0 M
- if the mtk vendor specific outro cmd is send the chip goes back to stealth mode and you need
0 L" q) c& Z9 S/ w4 B again the Enable0800.iso to disable it
$ F* F" S. p/ v) u4 @3 E - therefor the mtk vendor specific intro is send at program start to all present devices and the6 ^" d0 D0 `( D7 H
mtk outro is sent at program end
$ ~4 X4 N# I: D3 H1 K B - if you have a chip manufacturer id of 0x02 and a chip device id of 0x02 for the TS-H943A
* a; j3 ~- S' l3 l the flash chip is in stealth mode and won't give access to any reading, writing, erasing
) o# j0 k% E, h! a' }$ b- always have a look at the DataSum generated, this is exactly the DataSum of mtkflash
4 ~( P+ S% D2 g - the DataSum is calculated as the sum of all bytes of the firmware in a short integer
* }$ ~# }. S# D8 Q" H2 k; Y- F - to make 100% sure that the flash is written right compare that DataSum to a known one
7 @; Z; I4 q9 W0 U$ w- this tool has not been tested on all drives out there, the typ list is simply copied from well, t: t$ L3 }6 a. ~% B( G8 B: C
known programs like mtkflash and XSF% K0 n, G' r* f! U3 n0 V. K
- always try a flash read on a not yet tested drive before doing anything else ~$ O" k1 r ~7 a1 V7 r
- if the read doesn't succeed it is highly unlikely that a write or erase will
, i9 c h1 k" e% s7 R, K- some LiteOn drives seem to have probs to write the firmware correct, this prob seems to be; M; j8 b, e8 l: K* \9 v! z
related to windows register flashing, cause even an assembler app can't do this error free2 Y- ~* W5 t7 l5 ?- a9 }/ L9 o+ {) w
- if you get errors on LiteOn drives, write the flash two times in a row$ B' h# Q# q/ o! V& }
- for direct port I/O in windows the givoio.sys driver is used, this driver is loaded at DosFlash32
- C7 ~) b2 D* ~; i, E1 s; j5 T start and unloaded at program end, be warned, this driver can possibly make your system unstable,
* d6 m4 G" I6 V# A2 J x/ [$ i it's intention is to let privileged assembler instruction like in and out pass, even in windows,
( ]9 p* I, i6 X4 n5 n$ `. C if this driver is not used you will not be able to get direct access to port registers: j& d6 b5 ~4 u; d5 ? Q2 C8 w
- DosFlash was tested on MS-DOS 6.22 and later, you can easily copy it on a MS-DOS boot disk created
* X5 b6 B. V% R1 @6 J; U in Windows XP and start DosFlash directly from the disk
9 Z, u! v. g7 k- don't forget to also copy the DosFlash.typ file, it has all the informations about flash chips
3 l8 Y- L: E& c" R2 F for auto mode flashing
; M, T2 B$ m2 g5 d y3 W- DosFlash32 was tested without a prob on Windows XP SP2, you'll need also the typ file for the ; y; {5 E3 h9 a" a: ^: T. ]5 q
win version
: G8 K1 R( u9 D& W5 q. T# p- DosFlash32 will deactivate all CD-ROMs in device manager at startup, this is better for flashing,
+ J2 U% b& _6 f cause Windows seems to poll the drives all the time and this could result in a bad fw file or- |! K+ l9 r! Z
a program hang, the drives are activated again at program end( Z4 X' ] q, T
- you should make sure that the flash is not in an erased state at program end, cause device manager+ p( O2 k. I: m" e* z Y
don't like drives that do not respond to the inquiry command7 Q+ L" t$ E9 ~: }2 y5 r9 Z
- deactivating all CD-ROMs could take a few seconds, so please be patient at program start
1 S+ g$ w5 W# }7 M! N7 D( W- ^- DosFlash and DosFlash32 will try to scan for the VIA 6421L Raid Controller card, based on vendor& q0 I$ c( J. o" A+ s' T
id 1106 and device id 3249, it doesn't matter if the card driver is installed or not
. Q3 k$ R2 W5 j
: o- H7 K, ?. q0 C V. t& Y
! q8 T& u5 k! D% V& _Many thanks to Dale Roberts and his Direct Port I/O driver giveio.sys!" y" h6 G: \- b: Y
% S! X5 `4 i" |5 {0 {' W* Q. x% x
Avoid a bad flash!; p1 v3 t2 ~4 ]+ w( `. y& _7 \9 v) V
Kai Schtrom |
|
窺視卡
雷達卡
樓主
顯身卡
發表於 2011-8-21 21:08:07
