|
|
ak475671 發表於 2011-8-22 13:03 ![]() , C1 S m& \: a) Y3 B! r$ L
版主你好" p5 {/ f3 _/ U U6 h
版主知道哪裡有教學嗎使用DOS提KYE的過程不是很了解不知道有沒有教學可以參考的呢
# z" ^$ k. B% ]另外你說他提取 ...
DosFlash ReadMe.txt 說明文件
' f& Q2 E6 {" M' S* }+ X: b3 n6 \0 w/ Q- {( p5 F
DosFlash V1.9 Release Date 01.01.2011! B* q6 ^% s( ~4 W
---------------------------------------8 C% b% A. K9 Q8 `: ]3 f& }
- SATA and IDE port scan improved in DOS and Windows2 O2 Q, K" \# j/ |# j! u/ T+ |
The ports are now enumerated with the CONFIG_ADDRESS and CONFIG_DATA register instead of using interrupts n: }4 e' J% |
in DOS and SetupDixx functions in Windows. This change will detect more ports in Windows than the old ) r# B* d/ s3 i5 s
SetupDixx method.2 Y8 V$ [7 \& y( f6 @* \
- Settings saved to ini file for DosFlash32 and DosFlash64
( ]& y$ D" S$ U5 W. y; R- t Settings like Port, Position, Task, COM Port, Enable Drives and DvdKey state are now saved to an ini file& {/ {# d5 l. z) ~: e9 F @6 W! E
inside the program folder. If the ini file is not present it is created after the first run. On the first
* G4 ~. R* u& E y startup DosFlash will choose the most common and stable settings.: z1 F4 k0 ^% p* ]$ d$ b/ d
- EnableDrives option included in dialog as a check box
# E p" `- O- E Due to high demand we removed the "Enabling CD-/DVD-ROMs" MessageBox on program termination and included. G( ?* F0 O4 j* b2 d. `. k
a check box "Enable Drives" inside the dialog. For security and more stability this is deactivated on the- b3 l: H2 S4 E" y, H& D7 [+ ?: {
first run. If you enable it the checked state is saved to the ini file.
4 f- k) r& V8 Z0 N0 r- enabling drives in Windows caused some hangs from time to time, this is now fixed by a recoded enable
) g0 |$ b+ d) v: K drives function
1 k( `8 ?: H& A$ Y; u/ B% X- port drivers portio32.sys and portio64.sys are now added to the executable and unpacked during runtime0 ?* p; L, v1 W+ n* k. H5 S% M
- PATA and SATA controllers list updated: r4 R+ k5 K* W) g
- Fix for NForce motherboards in combination with drives like the "Samsung SH-D163C", "LG DH18NS40" or% n* ^& x) u4 B8 `9 q/ L
"LiteOn iHDS118" |4 P1 b1 K" @6 J& y
Some drives have problems with flash identify, read, write and erase. This is clearly related to the5 B& n1 _0 H6 P. m
NVidia NForce chipset. For manual mode in DosFlash16 an additional command line parameter is added called
7 n. ]5 T) I; Z- O! `" I% N "NFORCE FIX". This parameter should be set to 1 for NForce chipsets if you experience strange problems.6 R6 D$ K* o I. i5 |! H1 g
In DosFlash32 and DosFlash64 we added a static control which shows if the NForce Fix is applied or not.: o- j, s1 ^& o
Remember there is no need to activate this with every drive. It seems to be a combination between drive( f4 Z) K" Z( q% g) T3 M- E
and NForce chipset that causes the problem. The fix is automatically applied for DosFlash16 in auto mode,
. S- m; m# G F& t DosFlash32 and DosFlash64.
' @$ P" X7 B# t) Y: v- }- DosFlash32 and DosFlash64 are now DPI Aware for Windows7
# Z. [$ F, j9 R" p. w! s5 A9 q- New task Verfiy Key/Inject Key added for verification/injection of drive keys0 D: _! @7 v+ d2 x3 ]
All DosFlash versions now have the possibility to validate drive keys against an XBOX360 drive and set: c# r/ r# H5 p9 { }- O
the key for an XBOX360 drive. We use the same authentication method like the console to verify a key.4 P( h! a8 q4 M0 |- Y7 j" \+ K
In the Windows versions you have the choice to paste the drive key from the clipboard to our custom hex8 z* f5 J! j1 E" s
edit control or load a key file. To add a key simply click right inside the hex edit control and select
' ~- J I! ?* D: {4 S your choice from the shortcut menu. In DosFlash16 you can enter the key in the format "1A-2B-3C" without: s( n" g c" v" B8 q, _9 Q
quotes. Remember that a key has 16 bytes of data. The key file to import should also have 16 bytes of data
' l: ]2 _5 g7 ?# a& X like the key files exported by LiteOn Key functions.
6 Q- [; \% g( d$ w' [- Removed multiple key extractions for LiteOn Key functions, added Verify Key after extraction
7 @) ]# w$ F# W) P7 S @* a) x For LiteOn Key functions we removed the multiple extractions, because the key is now verified immediately" j. `' D! Y+ e$ L+ ]# s3 p
against the XBOX360 drive.
c w! w6 u8 g" F0 C1 c- LiteOn Key V1 and V2 now also extract the file Serial.bin and the 2nd inquiry file Inquiry2.bin: [& e' L/ Q+ d+ X
We added the file Serial.bin and Inquiry2.bin to LiteOn Key functions. Inquiry2.bin is only generated for
* t+ W) Y- a( d* I) I LiteOn drives V1 and V2.
0 j, G4 w; ~& r' ^% P9 S/ i- The drive key of Maximus patched UART drives can be extracted by using the task "LiteOn Key V1 (DvdKey)"
& d: r7 j0 D6 n6 j1 I, c The drive check has been removed from LiteOn Key functions. This way we can extract a key from an UART . g; ~! }( y& f3 p
patched drive firmware by Maximus.
: d, R, P! v( h( ^/ S6 T- LiteOn files are now extracted to a destination folder instead of prompting the user for every file name.
$ A6 Q2 C1 u4 m0 f/ l+ H% @+ d- LiteOn key extraction tasks separated per drive version in "LiteOn Key V1 (DvdKey)", "LiteOn Key V2 (FreeKey)" F9 |( f1 r. f9 X8 J
and "LiteOn Key V3 (Tarablinda)") y: |. g; H/ [! c; d, q
- In DosFlash32 and DosFlash64 the number of installed COM ports in the system are now enumerated instead of
9 ^* h. O" g0 O9 ? adding port 1 to 4
7 i1 `* s" ^, S' |5 j/ v3 X- For failing cdb commands the sense code is returned
" l, X( v5 C Y- Geremia's Tarablinda functionality added
' d8 q' Q$ S* X4 d$ t We added all Tarablinda tasks to every DosFlash version. You can extract the key by choosing the task
% l3 L+ E( c% A( w1 {2 k2 q$ I8 l "LiteOn Key V3 (Tarablinda)". For read, write and erase of the flash simply use the standard functions.
& _; A4 M- T! A8 ~ Pay attention that the "LiteOn Erase V1/V2" task is only available for older LiteOns and not for the Slim.$ ^1 A2 L( N: i+ |
You should use "Read Flash", "Write Flash" and "Erase Flash" for the Slim. "LiteOn Key V3 (Tarablinda)"* f& u9 c: \% g3 o: C+ Y
extracts 1 additional file in comparison to Tarablinda v04b, this file is called Xtram.bin and contains
/ L6 V7 S4 `; K* @( g5 `3 i1 }- }" R a dump of the XTRAM8000 area. This can differ in a few bytes from one dump to the next.
% f# ], y! v! V, F- Device Reset in DosFlash16 manual mode is now done automatically, there is no option to turn it off anymore; z9 H' N" B5 G
- Code optimization to work with modern SATA2 controllers added, remember to set SATA controllers to IDE and
3 t$ s S$ ^. R- `- f, _5 T not AHCI mode otherwise Port I/O will not work
0 e( H7 e5 w( N s( W: m- Warning: The read, write and erase of the Slim drive is considered risky in general! So pay attention and9 E G! L4 T; i1 m( {# N
always remember you use DosFlash on your own risk every time! Even during flash read the Slim gets flashed
- i2 s/ |( H7 H: W! V with a patched firmware sector to retrieve the complete dump!" n6 M1 v* E! ]9 v8 r
- We had to change many command line arguments for DosFlash16 Manual Mode, because of the NForce Fix, added( o) \' l M1 i- |$ u, u$ q( Y
Tarablinda support and splitting of LiteOn Key functions. To get a better understanding we added the example
! K; Y9 b% k& t, r! ~7 z! m) ~ section below.; n" F7 D; H& Q% Z% \ L
, ^ R2 K4 A0 f8 u, q, a/ r7 H& `/ W, d
DosFlash16 Manual Mode Examples
5 L: T8 K# u, \0 d---------------------------------
/ T; a" O1 x( z5 d$ A3 L- Extract drive key on a " LDS DG-16D2S 74850C" over UART -> "LiteOn Key V1 (DvdKey)"% J1 _ C( A1 l$ ~3 {( ~
DOSFLASH LITEON K V1 0970 A0 1- X. \; z) \7 H9 {# R
9 ~1 V3 t2 c# u- q9 H
- Extract drive key on a "LDS DG-16D2S 83850C" over SATA -> "LiteOn Key V2 (FreeKey)"
; y9 \& J3 Z$ t: n# S/ Y( M! C DOSFLASH LITEON K V2 0970 A0& j% y9 u6 E( X0 |
! h+ n6 V* u% f% C" Y% F) a. [
- Extract drive key on a "LDS DG-16D4S 9504" over SATA -> "LiteOn Key V3 (Tarablinda)"+ p- Z- @5 g7 Q
DOSFLASH LITEON K V3 0970 A0
t, K$ p$ J5 ^% U9 z+ R7 ~/ q# `3 U: g& j# O1 }+ E: e
- Read firmware on a "LDS DG-16D4S 9504" -> "Read Flash" this is considered risky!) I/ w( ~2 I' C, d f1 i
DOSFLASH R 0970 1 A0 3 0 4 FWOUT.BIN 0
4 Q7 e8 S. [2 I( x2 x% l9 ^
# x5 u: _. \' B: v/ ~- Write firmware on a "LDS DG-16D4S 9504" -> "Write Flash" this is considered risky!
& B5 a! @, M! j, X7 J% O DOSFLASH W 0970 1 A0 3 0 4 FWIN.BIN 0 O- y% _8 B. r3 y% x
* y; P' m3 t0 B. h; h' k& O2 c" W
- Erase firmware on a "LDS DG-16D4S 9504" -> "Erase Flash" this is considered risky!/ m7 U, X; I0 H% y
DOSFLASH E 0970 1 A0 3 0 4 C7 0
' o5 }, y; t; o
# v0 l& \0 z ?* X! n& q o- Erase firmware on a "LDS DG-16D2S 74850C" or a "LDS DG-16D2S 83850C" -> "LiteOn Erase V1/V2"+ k, `% e' ?/ S, \9 u7 K$ }
DOSFLASH LITEON E 0970 A0: t7 @: O# _) V, f8 o5 V
; D4 }* M" N0 |1 ^6 j* t
- Read firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Read Flash". @# h- ^0 F% H3 e6 k
DOSFLASH R 0970 1 A0 2 0 4 FWOUT.BIN 1
) U; w8 F5 C7 {1 X2 u/ x L
7 o0 K% x2 x: V( G6 X# _9 ?- Write firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Write Flash"
2 q* g& Q/ S* k% q% z DOSFLASH W 0970 1 A0 2 0 4 FWIN.BIN 1+ x% b( p; t# z
: l. G2 g ~% g2 z
- Erase firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Erase Flash"
. x( }5 T0 Z2 M! C7 R1 ]- H# ~( P DOSFLASH E 0970 1 A0 2 0 4 C7 1
& R0 Q5 Z+ Z# Y3 m: I
" G* m: w! y3 w9 S7 Q- Verify drive key on a XBOX360 drive, enter the drive key manual8 J; y9 h; R* j
DOSFLASH V 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF
; M8 y$ c9 o/ c6 D$ ^) g0 E5 C
- T J) t; E+ \5 s ^ \; n7 L. Z% P# q- Verify drive key on a XBOX360 drive, load a drive key file
- t9 ~" g3 f7 n) h DOSFLASH V 0970 A0 KEY.BIN
- g" w. {$ Z9 A% a/ v9 n9 E. W9 l+ }$ e" G0 W8 G2 T
- Inject drive key on a XBOX360 drive, enter the drive key manual
% G: i" [" q( R, R5 m DOSFLASH I 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF
- B. ~$ z6 u& I; `+ m
0 e6 z. l& u4 a, m- Inject drive key on a XBOX360 drive, load a drive key file% x6 Y) m. l6 V1 Q+ g8 C* O" r
DOSFLASH I 0970 A0 KEY.BIN. A1 L( C" d2 w8 v
H f( v! K' o- s* @6 \# h
For DosFlash drives on which we can extract the key via UART are considered V1. Drives we get the key over
- X4 O* x7 i' U" _! h& HSATA are considered V2. The new Slim is considered V3 but only firmware version 9504 is supported atm.
/ G' X; q4 ^3 m) v4 S
. B1 Y1 p+ ~/ h$ k! B* u
6 q3 _$ H. b. E z9 i$ VMany thanks to Geremia, Modfreakz, Redline99 and Tiros for their support. Special thanks to Geremia and2 C/ C0 y6 }9 C/ [/ g
Modfreakz for drive sponsoring, testing, coding and much more. It is always a pleasure to work with you% s3 @% ?. m- C) l4 o
professional guys! Respect to Maximus for his UART enable patch. I'm looking forward to your magic Lizard
/ j' f+ d7 G: ^2 d- N1 Ihardware flasher!3 M* C3 Q! ~5 B' G) i
* I, f. Z" c0 ~* d$ A- {6 X7 X
Happy new year 2011!
) |! O6 o& w1 YKai Schtrom8 b% t+ T1 N4 n3 S
X, l% n% [% Z- z3 q************************************************************************************************9 s6 \* U8 E! E( u. S# z
0 T0 a; s; d5 s/ Q0 K
' p6 B- T: g) Q1 _) U7 y; X, ^DosFlash V1.8 Release Date 08.08.2009# i: F/ A9 R3 |5 q! I. c7 X
---------------------------------------% r; z+ W9 ?: ^0 q! a
- now supports LiteOn PLDS DG-16D2S 83850C V2 Geremia/Maximus LiteOn FreeKey method
# x6 Q3 I/ S3 [4 i+ ?$ Z- huge firmware read/write speed increase, especially if run from a floppy disk
7 R- _ i' q2 Z. ~- updated IDE/SATA motherboard chipset list. a- e3 g' \$ {* N- _3 \
- new IDE/SATA detection for Windows and DOS
7 H% y. ?; Q' g- DosFlash.typ embedded in executable file
+ z, y" C* Q5 G, {4 {1 j- LiteOn V1 drive key is now extracted 10 times and compared against each other, q. E& R$ q2 l* I; }
after the extraction a summary is displayed sorted by the most common matches9 J! f; o6 X0 v5 I: K4 ~
- LiteOn V2 drive key is extracted 2 times and compared4 Z! M, Y4 a s6 E: Y
- new BenQ unlock keys added to unlock all known BenQ drive firmwares
& H. p* V, {7 A4 D$ i) x: S- command line parameter "EnableDrives" removed, DosFlash asks the user on
, T4 v& @ `+ j ^" W application close if he wants to enable the drives or not, during the tests it
1 Y2 {' {8 a+ N/ F, V( Z9 H+ v seems that IDE drives have problems with the enable, SATA drives seem to : |2 ]9 a# h1 y1 P8 o/ Z h
work fine
8 P) E% l+ u" @7 W6 Y- new 64-bit DosFlash edition added called DosFlash64, because some driver h% B Y1 z6 k% `, ~+ |+ P
functions don't work as expected in the 32 bit compatibility mode on Windows x64; v4 H! R0 U8 U4 I
- Beta state removed4 Q8 k9 f/ U% a: x. ]# ~
- ready and tested on Windows7 X86 and x64% }& C9 \. y. U9 O: i
+ @: d* B; \! K. Y
) Y D# M! S( {4 dGeremia/Maximus FreeKey method with DosFlash16
2 R1 P3 }( c, [) A/ A: s1 o------------------------------------------------3 E: s- s% R1 I# r7 N
We have added one cmd line parameter for DosFlash16 in manual mode. The COM port
G) f4 ^# L5 ?is simply ignored and can have any value for the V2 drives.
! U: d" Q6 s9 n: d$ {1 q; s+ mUse the following command line to extract your free key from 83850C:
8 l5 z% a% E; V; U% [- DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin enckey.bin! p$ t4 d4 N. q! o, a/ S& F3 H
4 z3 H7 Z% }: b- q: a. X$ X2 J' g
Tips for running DosFlash on Windows 7& K+ A& B6 R6 a/ @
----------------------------------------& y* A- w$ N0 |; O% n' A9 g4 m
# ]) {$ f& c! O" y
Since Windows Vista 64 Bit and upwards it is necessary that every driver is signed. Because6 [7 V- y6 X8 a. {8 r" Y% t7 F
the DosFlash driver will not be signed by MS due to some unknown reason we need to circumvent
. J& N0 \ {, R" y$ s7 [( }this check. You have the following 2 possibilities to do this.
% d% y3 z) h5 u4 o' A9 Z( q2 ]/ h) Z- b. f2 m) {( H/ \' Q# v
Safe Way of Disabling Driver Signature Enforcement
( U- F7 F- m/ m, d4 l1) On Windows 7 bootup press F8 to get to the extended boot options screen
7 ^: V* v# g% I% ]. U8 z, K# L h- y4 \2) Choose "Disable Driver Signature Enforcement"
% o: i* [8 y, x: K3) To start DosFlash right click on it in Windows Explorer and choose
5 }( _ ^* q9 y+ A$ s$ i/ ~* X "Run as administrator" > answer the message box with "Yes"/ _# j: Y/ J; G& p4 J
4) Short after the program started a "rogram Compatibility Assistant" warning message
) n, K4 c7 r/ g! J E is displayed, you can simply ignore this by pressing the "Close" button
- p) c2 ~; |4 W8 g3 U* t1 i+ z( z$ F4 G+ \4 W
Recommended Way of Disabling Driver Signature Enforcement
% o! @; M8 P+ l1) Disable User Account Control (UAC)
% t- X% |( j& o# f8 r; V - go to "Start Menu" > "Control Panel" > "User Accounts and Family Safety" > "User Accounts"
8 q2 J6 P7 q5 A1 P# a2 h - click on "Change User Account Control settings"
4 Z( Z! z [3 t0 U4 ] - set the slider bar to the lowest value (Never notify) > click "OK"
2 W. J: n, m8 \% Y: Z2) Sign the DosFlash driver7 y% y3 L& e) ?5 q& Y9 z
- download the "Driver Signature Enforcement Overrider" (DSEO) from
( v \+ g; D3 u4 j; {. k3 P http://www.ngohq.com/home.php?page=dseo
$ p0 C: J2 M$ H( x. U; |$ p - start DSEO > click "Next" > "Yes" > choose "Sign a System File" > "Next" > enter the path to
& }# r+ ]: ]4 I l2 w3 l D- D! c the used driver (portio32.sys or portio64.sys) > "OK" > "OK") G6 O8 t, {! }' W) n2 E* n: D5 O
3) Disable Driver Signature Enforcement
: c6 b% |! J. Q, P: L) n - start DSEO > click "Next" > "Yes" > choose "Enable Test Mode" > "Next" > "OK"
: c2 ?3 |) n& ~3 r4) Restart the computer
5 R8 z' Z& ~8 ?6 l# s' }
7 F5 r/ j, ]( K V. m+ ^0 ~Keep in mind that with the recommended way the changes will have effect on every reboot without. T) n }$ |& p- e4 B4 N+ u3 Q
doing anything manual. The first way needs to be done over and over again. In addition the second: \; W7 E& Y' R5 U
way can be used to sign every driver that doesn't run natively on Windows 7.
" W1 K! \0 _8 F; R0 d! X, {& t: O. L3 y( ?% ^6 e
For use of the VIA Cards in Windows 7 it is recommended to uninstall the VIA driver. This can be
6 l% V: @) F4 s2 c4 G$ idone like follows: V0 m. _( ?* X$ i2 r) q& B
- start "Device Manager" > expand "Storage controllers" > right click on "VIA RAID Controller" > ' y5 Y2 k3 t. V- @
choose "Uninstall" > "OK"
" D W, p- O& O& m: l! ^3 U& P- rename C:\Windows\inf\vsmraid.inf to vsmraid.inf_6 L$ n' B& U1 _ ?
- rename C:\Windows\inf\vsmraid.PNF to vsmraid.PNF_
7 c! o, g5 @/ I$ C6 i Z4 Q* \/ ^- rename C:\Windows\System32\drivers\vsmraid.sys to vsmraid.sys_3 N2 f! c0 R5 ?, X- w. l1 G
- reboot computer9 T A0 a+ c+ C5 l* q
4 a' K: ^, h# `# L9 Q+ E
* e1 _3 q( w8 p$ A' a% M2 B3 o
Much respect and credits go to Geremia and Maximus for their money saving FreeKey app
) K9 F% w* n& [3 j0 `9 B) a# \and their lightning like decryption speed!
% L. S* f1 P9 p* z( }% J- w$ T; \: N: }% U- F% c
In Dedication To The Birth Of FreeKey On August Fifth 20094 z4 m) O0 h4 [5 `: k0 e
Kai Schtrom$ e- O8 ^, y2 s
a# ]. v% k8 r
) S! n& i" T# ~ y0 g************************************************************************************************
, ?) J7 x# E& S. q
! Q0 B4 }: e) S( ^; y
" W8 B: C- g. u# ^4 p `+ yDosFlash and DosFlash32 V1.7 Beta Release Date 23.12.2008! c6 T9 H5 l- {5 ^
-----------------------------------------------------------
/ f# _5 U! h: d/ Y- now supports LiteOn PLDS DG-16D2S 74850C and Geremia's LiteOn Erase and DvdKey method
, t9 q- }; ?7 s5 c8 y# z' x5 H- G
/ z5 t3 [9 F* J0 }: C" a' S3 C- W' R, j, N
The following only applies to the new XBox360 LiteOn drive PLDS DG-16D2S 74850C.( @6 e2 f0 G- [4 W: h3 x! a4 C: w" \
! x9 D1 c; h' a1 ~7 [+ M
W9 ~' R# ?) D0 e7 fGeremia's DvdKey method with DosFlash16 with the PC's psu0 f! d2 [! f3 m" M4 ~
-----------------------------------------------------------; E" `% g0 M$ j' K: u1 r
- disable CD-ROM boot option in BIOS
" V) w- j+ Q9 q8 M% C- connect LiteOn to your PC's power supply unit and SATA port
; l* K0 E! l5 D% I# j- power up PC, wait until bootup is finished: Z1 k, d4 j5 E
- eject tray of the LiteOn and shutdown PC completely
0 U8 P V4 K# M6 y: H- push the LiteOn tray half in. d* \+ G7 a2 O- J$ ]& R0 V
- power up PC and boot into DOS
( Q+ `1 U; n9 \+ K, K, ^- Q; C- run DosFlash16 in auto mode
0 [& m, ^3 I% T# F. e) [% }- if you read the following:
6 p' c' ?9 T' W, [$ W; S MTK Vendor Intro failed on port 0x????.
4 g9 L4 n4 m) u$ D If you choose to resend the command you should turn the drive off and on3 @+ ^) B3 P) R4 ~" ` u; F! ?
after you pressed "Yes".
: X, X2 M0 M- G7 _ Do you want to resend the command until the drive responds (Y/N)?
P. [& e" W8 X! ?+ f- press 'N' for "No": c2 `6 I4 k( z* W
- choose the number of your LiteOn ATAPI drive
' O9 T! ^& E( S- q8 u4 l# q$ k+ ]! M- enter "LITEON K" to read the drive key1 a% D% ~" Y8 Z8 p
- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
5 }) M+ I4 N" x2 n6 `; ]; _- enter the number of the COM port8 D* C+ i( Q1 i- h! e. O
- if you read the following:; E2 |7 V: ], C4 a
To receive the drive key use Geremia's DvdKey method like follows: V o: c$ d. e! c+ ]% I7 W
- Connect your drive with a serial cable to the COM port8 a' w# {& G; E4 e3 _% `3 x( r
- Eject drive tray
- ?& p k5 ~: ]0 d, k - Power off drive
! N9 I, u# t& F# W, a- ~ B7 F - Push drive tray in until it is half open2 V: W9 R( m* [4 E; F$ s0 W
- Power on drive( C2 S; Y6 t. q
- Press "Yes" if you are ready' T% {8 Z: r5 J; G9 F' b$ c( N
Are you ready (Y/N)?" Y8 J3 c7 C; L: b; X$ ? j B8 w
- simply press 'Yes' without doing anything of the above, because we
9 W8 d2 B: A% q. k2 i7 f already did that before! m/ ]. O1 o7 b5 s7 Y
- after this DosFlash16 displays your DVD-Key and saves your key and identify data
l$ f9 N# D. \- to do the above steps in manual mode use the following command line if your drive# L* b+ q1 S- a, J
is connected to port 0x0970 and serial cable is on COM port 1
3 ?& G3 T9 q4 m' l3 _2 f. \ DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin- b/ e+ {% |0 W4 [2 [+ Z1 i
7 G5 ~) G% p7 K4 f( U) Q+ q: x8 v% [; F" m6 t2 D
Geremia's DvdKey method with DosFlash16 and 2nd psu w+ b% l4 P' z9 X* F3 W
-----------------------------------------------------
3 P- u6 C$ A, f* S- connect a separate power supply unit to the LiteOn, don't turn it on yet: t" p, {" g& ?7 C6 h3 s( Y
- power up PC and boot into DOS! R2 h5 A5 `. Z% y F) C
- turn on the LiteOn psu
i+ K/ d2 _, e) w, @' M- run DosFlash16 in auto mode, n4 ?1 Y& M2 i1 ]2 M2 Z% G
- if you read the following:& K- S. S; }6 [; V$ Y
MTK Vendor Intro failed on port 0x????.
7 l2 B: g, Q; y8 V/ `& t$ a. ]% u If you choose to resend the command you should turn the drive off and on6 k' V/ G% D5 p
after you pressed "Yes".
, E: h7 s, a- \/ o2 M$ Q+ i( @% I Do you want to resend the command until the drive responds (Y/N)?4 \: T+ |+ s; k: u% w( s1 K* `4 g
- press 'N' for "No"
) m+ k! R; f* p$ U$ a8 G- choose the number of your LiteOn ATAPI drive
2 V5 n! x& Q5 ]5 l$ `- enter "LITEON K" to read the drive key
7 @. s( k5 @7 |% h: t: y3 ~- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files4 @3 x9 I# c, G4 g6 t2 H+ q
- enter the number of the COM port
9 J1 {" Q6 H4 H& S( p: j8 v: Z- if you read the following:
2 M% y( v7 t! E" |1 o To receive the drive key use Geremia's DvdKey method like follows:
2 P0 p: j& m. y* M3 F" S' g& \ - Connect your drive with a serial cable to the COM port
/ T; P: P; Y+ a7 e. | - Eject drive tray: ~* N5 ~+ y9 D9 U0 X- f# _
- Power off drive
6 a; N: u+ ~, d/ M5 g; X0 m6 p - Push drive tray in until it is half open
& N9 q* V& q: m& [5 x9 M - Power on drive. r T! \) ]( u, Z8 b5 _& ]- [
- Press "Yes" if you are ready% L. z) i% d2 k& o5 Q; H! l
Are you ready (Y/N)?
4 u. |% C; B/ N9 J9 P2 U: W- do the above and press 'Yes'
! I, `6 u' t5 Y6 X- after this DosFlash16 displays your DVD-Key and saves your key and identify data
" w" H: s6 i ]$ R# p2 ~8 i4 Q3 Q$ i# W4 S5 @- C- T
3 e" u0 ~) f4 O& uGeremia's LiteOn Erase method with DosFlash16 and 2nd psu
" P* P+ r4 ^$ i-----------------------------------------------------------) V8 n5 l |7 B& ]- t1 D9 p+ D
- connect a separate power supply unit to the LiteOn, don't turn it on yet( j$ D, a1 [5 d- l% m% W
- power up PC and boot into DOS( }0 {4 e) h0 h/ n- G2 ^7 h1 |, J$ }
- turn on the LiteOn psu0 Z$ _. t1 N4 W3 r9 b! ~
- run DosFlash16 in auto mode
: v2 r# M; B+ B6 J8 `- if you read the following:
4 A0 [, w$ x* J/ t G MTK Vendor Intro failed on port 0x????.8 g" H4 I+ W# J
If you choose to resend the command you should turn the drive off and on
- t9 c2 y! L- t& k; N after you pressed "Yes".5 u8 C0 R7 `1 `$ \: [: J1 p
Do you want to resend the command until the drive responds (Y/N)?0 i% p1 c, S/ V$ D6 |9 p
- press 'N' for "No"
* H3 J: ?' a1 K" Z; }% A; i- choose the number of your LiteOn ATAPI drive' ]/ H- j; \7 R8 U! L* g. K C9 h
- Warning!!! Keep in mind that you will need the drive key before you erase the flash,
* b9 c; {" i" f) ?5 W4 j without the drive key your XBox360 will not work anymore5 x2 t$ P( q- P1 M. @; v% l
- enter "LITEON E" to erase the flash
M. ^' v9 t3 A- the first time after the LiteOn Erase the drive needs to be repowered to give6 w! }& i& [$ ]5 l
flash chip access, this can be achieved by repowering the drive before another
9 N+ T2 G* R! u% N DosFlash16 start in auto mode or by doing a MTK Vendor Intro Power Brute
. V5 i6 H' R+ E2 y1 N) q& k0 S7 W- in my tests it did not work to power the drive with the PC's psu, because it will/ C: O* y1 n( C
always respond with busy status
$ R/ o" J5 Y9 Y% w- DosFlash16 can now read, write and erase the flash chip like usual
# R7 I2 Q3 x3 \- to do the above steps in manual mode use the following command line if your drive, g0 T$ b8 t/ k, j; {
is connected to port 0x0970
& I' [0 t$ v. n& K) \5 c7 _ DosFlash LITEON E 0970
- d2 e% e" I; G8 i" |: \7 r' K$ N5 z! V2 F7 ?# p4 j
! C; P& v! ]! ^
Geremia's DvdKey method with DosFlash32 with the PC's psu3 P Q" ^) _/ M5 C! {" B# j$ ?
-----------------------------------------------------------9 \+ ?& i. B4 h5 A. q
- disable CD-ROM boot option in BIOS
e4 f6 p% W! r6 K k- connect LiteOn to your PC's power supply unit and SATA port! L$ W% ~* }& i
- power up PC, wait until bootup is finished- e: r- m* S4 U0 K& G$ ]0 q4 m. Z
- eject tray of the LiteOn and shutdown PC completely
9 A- O4 h& ~3 `6 \2 W7 K5 @. w, }- push the LiteOn tray half in8 m6 [4 }( h/ j/ s1 p
- power up PC and boot into Windows
! U8 y6 L3 l% |1 L3 g9 C- run DosFlash32; G5 ~; Z( U9 _
- if you read the following:5 `: n4 F/ R4 p( Z. f6 |
MTK Vendor Intro failed on port 0x????.
* e& p- f4 C; M! } If you choose to resend the command you should turn the drive off and on* C$ s% Q q8 Y6 H, S
after you pressed "Yes".
# F. @) J2 e5 V+ k9 b# W Do you want to resend the command until the drive responds?
0 x; c6 F8 n% k0 }- press 'No'# _) K/ o' p" b8 e
- choose "LiteOn DvdKey" as flashing task: ^ q, K2 h' x% }8 J/ P# x4 Q
- choose the COM port number
' ^; n q4 z4 y2 u4 i3 L- press on "LiteOn DvdKey" button! i. z5 F4 ~1 M$ X
- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
2 g8 u" ^: Q" o* K+ V- if you read the following:- h2 b" O& `/ f% A4 D% B
To receive the drive key use Geremia's DvdKey method like follows:
! V" F5 S( W/ y% X - Connect your drive with a serial cable to the COM port
1 }. e* }0 _+ m& ^ - Eject drive tray
{( w6 L/ m' C3 { - Power off drive
' W( p9 }$ ~" a& u - Push drive tray in until it is half open
2 @5 v4 G: Y* l* c - Power on drive
: O( z# d l8 m$ E9 f - Press "Yes" if you are ready
5 D% v, U- ] O u& A5 @7 U' S Are you ready?. s6 `! W B) `; Z5 V
- simply press 'Yes' without doing anything of the above, because we
6 W" k# N( ?3 g5 c- y9 x( A already did that before) L3 E; }: R9 I& I& Z6 _" T' C
- after this DosFlash32 displays your DVD-Key and saves your key and identify data
- F" y* j; y i+ Y2 d# U3 ]
& m! t; K$ f' G& N5 p% w2 F3 C, p9 H& g6 A. \
Geremia's DvdKey method with DosFlash32 and 2nd psu2 U9 C0 m. D) o/ h! C. w! M0 A7 j
-----------------------------------------------------& D% ^4 p# D U# c: x
- connect a separate power supply unit to the LiteOn, don't turn it on yet& l' L* p0 O: j9 w) ~' L
- power up PC and boot into Windows7 k9 O% E/ ^% v/ B, _8 Z
- turn on the LiteOn psu
0 g$ W% ]: u- V4 }1 z: K/ k) {- run DosFlash32
. _$ L5 _4 B0 ]9 N/ |- if you read the following:, Y( K* b3 m S: v
MTK Vendor Intro failed on port 0x????.
7 _- e" q' T9 K4 L9 j; C) ^5 w If you choose to resend the command you should turn the drive off and on
! Y8 p2 e- y$ h: @' S" T5 } after you pressed "Yes".4 x& g9 z/ h+ {7 g% P
Do you want to resend the command until the drive responds?6 n/ }7 v: t" I- w L1 A/ S
- press 'No'
( i% G- w; O s0 Y+ z# H1 W- choose "LiteOn DvdKey" as flashing task
3 A$ ]3 I" w0 K; k& b9 D4 [- choose the COM port number
4 K! c7 s' g* i% W- press on "LiteOn DvdKey" button3 P1 h" D5 c* T
- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files1 j2 [& P' m: h( M: H! ~3 K/ Z3 S
- if you read the following:6 v' H& K& G0 P( V% M4 A2 I0 q
To receive the drive key use Geremia's DvdKey method like follows:
2 K1 Z9 v8 }( B9 r& p( m - Connect your drive with a serial cable to the COM port% e7 f) a0 s0 M7 N0 @3 B
- Eject drive tray% \) m% E4 J" |; }$ L0 Q: v
- Power off drive' I/ j' E) I- y- _% V8 Q+ }3 R
- Push drive tray in until it is half open+ r* r, D8 F! r/ B; b3 o: ?( l
- Power on drive
* I: v8 M' K9 B' F; O! I4 L2 `& w0 o - Press "Yes" if you are ready
( R5 n' ^4 d( x: d1 m Are you ready?
* n8 t- @5 g9 ^! p2 x- do the above and press 'Yes'
$ c$ S& s9 X, W3 R1 i- after this DosFlash32 displays your DVD-Key and saves your key and identify data5 S# u! c/ n g- W0 q* g
7 X/ t3 P9 I3 F# O4 |' ?; P: G8 b
- q% P6 g3 @0 s4 r$ O
Geremia's LiteOn Erase method with DosFlash32 and 2nd psu
# e% c( S' w% V$ q3 r-----------------------------------------------------------8 p8 h+ P3 o: O* H, M% G' O: J, K
- connect a separate power supply unit to the LiteOn, don't turn it on yet1 N" C( U6 p: \* ^0 M8 S
- power up PC and boot into Windows
: Z$ S* R: x( C( ~0 Y6 G/ G% c: t- turn on the LiteOn psu
, b* k0 g; O9 U3 E- run DosFlash32$ R$ U' L: c- e6 f5 C" L
- if you read the following:9 b& C5 m8 N9 }, m1 [& ^
MTK Vendor Intro failed on port 0x????.
& X5 {4 q. [; x g( I4 R If you choose to resend the command you should turn the drive off and on
/ {5 `2 H0 Z4 T/ f! ]( e6 G7 s after you pressed "Yes".' W9 N7 t" o& V
Do you want to resend the command until the drive responds?
( @: D0 k/ W; K2 |% V. B3 w- press 'No'. [" U% P$ p& O
- the LiteOn flash is not identified. f* F* M+ z o7 [5 U% e
- choose "LiteOn Erase" as flashing task
8 l3 e# t6 S/ h5 R- Warning!!! Keep in mind that you will need the drive key before you erase the flash,4 R+ a5 ]5 {- L( V2 c* `& P* d
without the drive key your XBox360 will not work anymore
, M6 g* v9 u/ j- press on "LiteOn Erase" button
2 f; g# |- e0 j( |- the first time after the LiteOn Erase the drive needs to be repowered to give2 q6 ?+ H+ B, R! n5 z' V# \' Y
flash chip access, this can be achieved by repowering the drive before another( I$ F/ B5 G% M* d) [
DosFlash32 start or by doing a MTK Vendor Intro Power Brute/ f# I$ k+ Z3 T
- in my tests it did not work to power the drive with the PC's psu, because it will6 h- }8 Y C) S; x, D8 w
always respond with busy status, l& I7 ~3 v) N( m* a' N o
- DosFlash32 can now read, write and erase the flash chip like usual2 n; K6 f2 Z) |
% ~; D' d. a$ P1 t3 E& @0 N/ B- v1 |6 {2 ^5 S7 _
Respect to Geremia, Modfreakz, Podger, Redline99 and Tiros." w8 P$ Z% a0 H8 P. H
0 S/ x$ B3 k |; ~/ @$ X9 O; tLike a wise man said: "0x2E is the MTK Intro of Death"
, `7 B/ f" k7 @: gKai Schtrom& h5 z1 H% A1 l# i7 V& k; u! e9 `
" P3 C7 H+ u$ N% K
. E' i6 _/ [' D6 ]************************************************************************************************- ]: y/ Z/ N8 E
; I6 e, h, j+ f; ~; h& e) o' V8 p' x6 v* v
DosFlash and DosFlash32 V1.6 Beta
5 H: t9 ?' l% Q5 \$ ^; d-----------------------------------
7 g1 q9 b: l4 T7 r' Y, X- fixed power brute unlock bug for VIA cards, this can stop your VIA from working8 J( F0 [( @: Q
with the power brute unlocking in Version 1.5) o) _5 C u5 T# \
- for DosFlash16 in auto mode on DOS my VIA card works best if I do a cold boot
( D+ y+ o9 S3 J" O: n and power up the drive short before or with the PC _4 D9 H3 b4 W3 u" h
- for DosFlash32 on Windows my VIA card works best if I power up the drive short
3 ~* T8 I% s) ?0 H4 w8 I before starting DosFlash32% L! `3 t/ }1 n+ B/ Q% ?4 c% A
- for me the VIA works with internal and external connectors on DOS and Windows; X" f: s& P. t) b' T# H$ s
6 ~( q" H; |) E9 {Sorry for the trouble!
' y/ v% ~5 g h2 i( v" `( ?Kai Schtrom
p! K% z5 [( J. }+ c0 }1 V6 b L) f- ~0 Q; w# t0 G% G7 r% M8 X- N: O2 {
) k7 y' ~; z% ~ x************************************************************************************************1 K" y5 I& g, W/ Z2 z' f; X
. K" U! _7 a# t! @. S0 Y% e$ o5 r. W/ }: w/ E
DosFlash and DosFlash32 V1.5 Beta
6 R# R( x( M2 [. d-----------------------------------' k- t# e8 ?9 {+ k9 M
- now supports serial flash chip MT1309E with mediatek status 0x72 like the SH-D163B, SH-D162D,) q# C. f' h N8 p3 n; C* B# |6 g
Asus DVD-E616A3, Asus DVD-E818A3, Sony Optiarc DDU1671S" i7 k: @. o' L( l4 U5 t8 S3 M
- SST25LF020A and SST25LF040A chip support added
7 q! C! i0 Z6 y, i# V$ Z- DosFlash32.exe ported from MFC to plain Windows API, exe size is now 22 KB+ W9 {. Z) y. s
- new port i/o driver, because giveio.sys can't be compiled for 64 Bit Windows* k# V* ^* a6 R- K. D, |2 [
- DosFlash16 changed slighly in manual mode, one parameter is added to support SST25LF020A and
. @" h% Y6 G) P0 o7 d SST25LF040A
' s! ?% W j% w- g8 Z- two new methods of BenQ soft unlock are now possible on all motherboards with only one power( i. _, B0 P: g3 r& P& G2 G
supply unit; G, L4 t0 q. E' @. F' @' ]" t
- 1st method is powered by Geremia's unlock core, thanks for the complete idea, concept and
& l4 f9 `. E' z2 G' ` source to Geremia
/ [- a p( |( l$ A8 O' g4 P' T# J6 W* ~- 2nd method is the Magic28 key send, this only works on BenQ VAD6038 firmware, thanks to
" h. b0 c e/ h5 G. X c4eva and podger for the initial idea! t) [0 r9 X! j5 j8 y$ ~- M
- the two unlock methods are send one after the other if the drive is a possible unlock
; |6 {7 M' Q9 H' W candidate, first the Magic28 command, then Geremia's unlock commands and after that the+ Q6 }* Q1 @7 T3 N/ ?
already known power brute unlock is send to the drive, you can cancel any of these methods
, A5 {+ w" s, D before they are send to the target, this only applies to BenQ drives with a locked flash. {3 U) c E- N6 w* N% M4 m9 j
- DosFlash.typ updated3 S ^! s% }8 E/ }& p
- other minor improvements7 k3 ^% e' H, g: P
- DosFlash32 is now ready for |* n4 P. L& j+ Y0 \: W
- Windows 2000. i. ~7 J- I, w* a
- Windows XP 32 Bit6 ~% w9 R4 Z8 `4 i
- Windows XP 64 Bit% V9 N8 D6 ^# R, m# G' V4 T# Q6 m
- Windows Server 2003 32 Bit
$ C2 H7 Y& P" j3 P) p - Windows Server 2003 64 Bit
2 U" A" O6 G9 ]! z - Windows Vista 32 Bit! \: ?6 p/ U3 r7 o( e) Z# W
- Windows Vista 64 Bit
4 p; A2 y; Q7 d2 [% z4 i. n: U- Warning: Drivers for Windows Vista 64 Bit need to be signed, because we can't afford the/ G3 m5 {9 c0 t, e6 c2 Y- j
money to let portio64.sys sign you need to do the following:6 `1 k3 {" R" E
1) Log on as Administrator& ~" D' ?% z: |. e x
2) Enter the following command in a Dos-Box:
# D7 F. G1 P7 X "bcdedit -set loadoptions DDISABLE_INTEGRITY_CHECKS"
9 P& H: Q4 ?6 l" O& B4 @ (we made sure there are no typos in the line above) 
& _0 ]: X+ Q, G9 ?+ R z 3) Press enter and reboot your PC6 c5 \5 f( G9 v
4) Press F8 key upon initial system boot up
7 A5 M* D. h$ e9 E. p# w( S 5) Choose to disable forced driver signing enforcement for that boot session
& I+ U' ~/ V7 h r) \# T Z1 W6 L0 k7 J7 d
) Z# ]5 |# y) d
The following only applies to drives with a locked BenQ flash.8 h* U8 Z! j& Q/ p* a$ K) D4 |2 v
2 I$ }0 ?0 p$ G0 [
+ i* G" k- j- g! n+ E2 h4 VGeremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with the PC's psu/ H' ~# \2 O! s8 q% G
-----------------------------------------------------------------------------------------
) Q) T. n c# r- disable CD-ROM boot option in BIOS
! R8 I9 j ]3 j* Z, ?- connect BenQ to your PC's power supply unit and SATA port7 i2 r3 H- k4 h. H2 C$ u
- power up PC, wait until bootup is finished+ j! q1 R2 h: Z5 y4 ~
- eject tray of the BenQ and shutdown PC completely
% V9 k# m8 S7 ~+ ~8 R" U9 w- push the BenQ tray half in
B7 s0 |4 T, d- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash32
. L6 d/ c/ y& W# c4 ]/ j6 d- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
; C) D7 H0 p4 z% h) C! G' E! _, P- if you read the following:9 l* {( i+ K8 a) J
MTK Vendor Intro failed on port 0x????. Because there seems; K+ N8 D5 M1 y6 P
to be a BenQ drive connected you should try Geremia's
7 \$ Y$ U) k+ T9 h5 q unlock method.0 x7 {( z/ @8 \. C& F; m7 a4 V
- Eject drive tray2 F' c' R B5 O- u9 R
- Power off drive# x3 d- V- S( ^6 {: X* \) d( ?
- Push drive tray in until it is half open5 p5 N! W3 [9 T
- Power on drive
! }6 w9 |3 {6 _# L$ x) L. { - Press "Yes" if you are ready
6 H- D0 ^$ i1 w Are you ready (Y/N)?! Q$ V& _) X7 Z+ @) r
- simply press 'Yes' without doing anything of the above, because we B2 J% L' w- r& ]5 [6 p
already did that before starting DosFlash16 / DosFlash32
9 [ Y/ Y) Y8 |2 J& u/ ]- the BenQ flash should now be identified! \% i" R/ P7 O+ U6 @) n4 s
- go on like usual$ Z; S! W1 ]) u, F& \
* p$ O" D8 S+ G$ {
0 e3 @& @) O" p
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with 2nd psu
' ^7 c9 z% a2 K0 h------------------------------------------------------------------------------------
7 T' h9 a" c6 F4 P' T4 p- connect a separate power supply unit to the BenQ, don't turn it on yet0 z; r" T, s7 Y2 r
- power up PC and boot into DOS
" W; V. M; D" s5 j- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows# D5 z0 U% [5 L! n
- if you read the following:1 X7 z# p) K/ s, l& r
MTK Vendor Intro failed on port 0x????. Because there seems; r. Y- q" F; _' l( H6 D; G
to be a BenQ drive connected you should try Geremia's, v; ]: K0 l8 Z+ S
unlock method.
2 M5 v" D* t" j$ B$ ]/ o - Eject drive tray
+ z7 W; `+ j; G ] - Power off drive
( E$ [/ A( _: V; M - Push drive tray in until it is half open
7 _: y' |3 G# X7 K, [9 A - Power on drive. t3 {1 G& Z4 q0 ~4 L
- Press "Yes" if you are ready
6 o- v8 I: c, F# K. V$ D Are you ready (Y/N)?
% E. @4 d5 }- M$ S/ q( ]: C j- do the above and press 'Yes'5 w3 Q# i6 Z8 T7 o7 C3 j% w
- the BenQ flash should now be identified2 m8 d1 ?: d0 W$ x( F: q
- go on like usual% v, d6 C+ l4 d# L0 K
9 J1 I a4 H5 h1 X
0 N! q1 J! k! X0 Y2 X7 LMagic28 BenQ unlock with DosFlash16 / DosFlash32 on any motherboard
- F8 R/ T7 ]" h, H, L/ I0 b--------------------------------------------------------------------- S6 |8 J7 J* w8 M; F& O
- connect BenQ to your PC's power supply unit and SATA port! g' ~+ s9 V3 y# u- X4 z5 C
- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash32
3 \ { i8 \( D6 n2 b- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
6 D/ o- W& J) [" U' A" W: A- if you read the following:
2 U# I- `6 F# R$ ~- z MTK Vendor Intro failed on port 0x????. Because there seems
" d; T: v/ a; y2 e to be a BenQ VAD6038 drive connected you should try the4 {4 S0 v% }1 h1 G4 j% w
Magic28 unlock method.
- i4 x7 q! T: z% C$ h/ { Do you want to send the Magic28 command?/ A% S5 v5 r( {
- press 'Yes'
% @, p9 s+ B' ~9 I$ M) m/ W# x- the BenQ flash should now be identified
' u" {( p( x: i1 S0 C0 e* b: R- k- go on like usual
) V( A& b: Y6 C2 A3 i& Q" P6 ^2 L' \. @' G
" x2 x& D- c' [+ k, T' ^
Thanks to Redline99 and Tiros for help and support.2 q( J7 U P* U- F) H
* h( R/ D4 J% l7 M4 T
It's all about DOS!/ F& v# B" Y" |4 I/ G+ M
Thanks guys for the excellent team work!
& ~% O+ K' F; a* Y& h& M6 }Geremia, Modfreakz and Kai Schtrom2 f6 y! c+ _. H" r" ^0 S
. F3 ]! L. a3 a
, y4 i9 K5 _( r% A, s' J- P) K3 C************************************************************************************************9 A3 D( F5 l& o8 G* k
7 @, k( m( s: I1 g( m: I
2 |; n9 z/ _- }1 W) nDosFlash and DosFlash32 V1.4 Beta' u+ o3 D2 h, l! k# b- Q( k3 l4 b" B
-----------------------------------" C8 K4 g* ], R! u0 ]0 N
- DROM6316 flashing support
. N* D+ q6 G7 d3 c; c* A- a flash erase is now always done with a chip erase and not a sector erase command, because9 |3 p+ A# A6 T' L+ i% A( f
the sector erase gives problems for some Winbond flash chips including the DROM6316
, x9 a8 a3 R& a8 S, I+ B- o- DosFlash.typ corrected and updated
4 u4 P1 e6 ]6 t% G- for a detailed explanation on the soft unlock look at the included file SoftUnlockByIriez.txt,
3 g* c' Q8 d% S! t it contains a very good explanation by Iriez from XBS, thanks for that one!
# {4 S! W v+ S7 W) ^+ _! s+ D. z
Thanks to Iriez, Jumba, Redline99 and Tiros for help and support.& [0 \. e. ~, Y4 }$ D6 T
0 o6 u$ S5 J) m6 `0 ~, d9 m
Happy DROM bricking!! }; W$ I9 t+ J" c+ U. H. H
Team Modfreakz and Kai Schtrom
6 Q3 I; D$ c4 V( G; D: e0 [3 ]4 I: N. w9 U/ F
7 d9 D3 W% Z+ f1 A6 H( o h************************************************************************************************& h1 \3 @! N# B$ ~
& K3 ^# F7 U0 V7 d$ K
5 M, {& _) L- ?, T. E, E+ ADosFlash and DosFlash32 V1.3 Beta
* v. s M' g _, g. }-----------------------------------
0 e- Q8 t) f: H1 B' r+ |2 l- BenQ optimization in unlocking the flash chip, it should now be possible to read/write/erase w- S. [: h7 i3 N: {
the flash without any soldering or wire tricks, the drive is polled for the correct mtk! c2 W2 u+ |0 `: U% M1 ? S5 Y& o, ?
unlocking status after power on, this only works for VIA cards and NForce boards atm( o3 W( b- F1 I* n! ~( Y
- DosFlash32 has one additional parameter, if you start it with the parameter "EnableDrives"
$ g. ?: S0 m! ^! b all the DVD-ROMs are enabled in device manager after flashing, this could give BSOD on some
0 X6 d6 E) o( d& m: y+ c9 F systems, therefor you need to create a DosFlash32 link and add that parameter manual to use it2 g2 d$ o+ h& p
- DosFlash16 has one additional parameter "Send ATAPI Device Reset" in manual mode, this could
+ v2 S e* I# I8 x( K: m give better chances for soft flashing on some VIA - motherboard combinations
# a9 n4 N m4 X3 B& D- better support of Intel chipsets, drives can now be flashed if the controller is not set to/ V' _8 R0 x7 P' Y9 t
native mode in the BIOS
) c+ }' p2 |1 p3 N3 M- the following controller list includes vendor and device IDs that are hardcoded to identify v) w* A0 p2 K) a2 F' I5 U
the controller type (IDE or SATA), this is needed if the BIOS uses IDE ports like 0x01F0 or" \: k M7 O: f& Y5 |
0x0170 as SATA and not as IDE channels, this list is NOT related to soft flashing
R8 }# d* l+ V8 M1 k! C3 U- C- the following chipset support is added/ R( @1 q- w/ ~) u! h2 n
- VIA cards' S# p- D; S7 R) }, u
- all VIA cards with a 6420 chipset
2 h! ?3 V3 H4 H# I5 t+ u3 t2 t - IDE Controllers
9 l1 p) U3 y* G' i5 \8 s2 t7 i$ R1 O - NVIDIA nForce 2 IDE Controller: W' ~: v# J+ a# X$ c3 D
- NVIDIA nForce 4 IDE Controller
4 m2 {# h, @+ C# Y1 k1 C - Intel ICH9
+ ] O3 ?9 E& b! j2 a - Intel ICH (i810,i815,i840)& _1 r; W* L% @& U9 s0 `8 s2 K
- Intel ICH0; @# A3 h2 E( I4 b6 f" L( ?
- Intel ICH2M! t( W! |7 D: _$ L! q
- Intel ICH2 (i810E2,i845,850,860)
]9 r- T3 f5 g$ T - Intel C-ICH (i810E2)
' `! r3 `( x6 d; s/ G! p - Intel ICH3M8 D/ r- f# L I( r
- Intel ICH3 (E7500/1)& c6 V% I. s" z3 S9 f
- Intel ICH4 (i845GV,i845E,i852,i855)
; D. ~9 Z9 |" ~' q# {9 s - Intel ICH5: f* Z. n4 x& u& D' n
- Intel ESB (855GME/875P + 6300ESB)
, t! H' B* b" E* S8 [; ^* c0 Z - Intel ICH6 (and 6) (i915)8 c! F4 n' H/ ?; B( F$ i; v* P
- Intel ICH7/7-R (i945, i975)- V @3 R# t* a5 b+ N
- Intel PIIX3 for the 430HX etc
2 q2 h* n7 ?0 |2 ?8 ?. N - Intel PIIX4
" O8 {; `* K0 R9 ? - Intel PIIX4 for the 430TX/440BX/MX chipset* k" t& v' u0 r8 Z+ U. p! O
- Intel PIIX
$ U2 ]6 B m& J. j5 I- Q - SATA Controllers x" \% A! B, k+ u$ n
- NVIDIA nForce 4 SATA Controller
8 k- N! k! [* \* P3 u - NVIDIA nForce 2 SATA Controller
& A- h2 {2 T% f5 _4 G - NVIDIA nForce 3 SATA Controller# E- u4 `) E0 K8 Y S7 L( A" ?8 J( Q. N8 Y
- NVIDIA nForce MCP04 SATA Controller
* \, X) L# D" w - NVIDIA nForce MCP51 SATA Controller
; m2 n! l* r% f3 n2 c) B1 o - NVIDIA nForce MCP55 SATA Controller
% [' m& l" U# Y1 D - NVIDIA nForce MCP61 SATA Controller
; q: ?' n7 T0 b9 s. r6 b; X: x - Intel 82801EB (ICH5)
, j8 h2 @3 N* Y0 L" ` - Intel 6300ESB (ICH5), @) h/ m! U+ @( A3 e* \* v2 G' @' Q
- Intel 82801FB/FW (ICH6/ICH6W)6 N1 F% q, G8 k1 n R
- Intel 82801FR/FRW (ICH6R/ICH6RW)- B" H: x# ?& b
- Intel 82801FBM ICH6M' s$ L. O: ^4 G0 G: n: g- @* y. T
- Intel Enterprise Southbridge 2 (631xESB/632xESB)6 s) U: I! }' ]- d0 x& ?! X
- Intel 82801GB/GR/GH (ICH7, identical to ICH6)
' p `8 I. {' n" g - Intel 2801GBM/GHM (ICH7M, identical to ICH6M)6 @7 w4 J& q* s; x# ?
- Intel SATA Controller IDE (ICH8)9 _9 u( i6 `4 f
- Intel Mobile SATA Controller IDE (ICH8M)5 S' O0 I6 K% c2 O! E) P9 X; {; t
- Intel SATA Controller IDE (ICH9)- ]' s. b2 N/ F" z* [
- Intel SATA Controller IDE (ICH9M)
5 \" h- M* l: g. h, n+ k$ K* B1 E3 U8 b9 R+ {$ `- y( A
& k; ?! e8 ^9 ?The following only applies to a software flash on a locked flash. The methods have been tested/ D/ {& m; L& K- O
with the BenQ and the Sammy. The VCC trick will work on any motherboard, but you need to do 7 m* i6 Z# c1 X |& Y
some soldering and cut traces.
1 `7 e* ?% z& `9 i/ D2 E6 F; R8 k8 m6 a! M* }5 w
E* [' N1 d/ w( @7 r X7 O
Soft Flashing the BenQ in DOS with a VIA card and DosFlash16 in manual mode
, I# X, i2 N& l1 Q( r-----------------------------------------------------------------------------. }! b* E6 i/ o/ A/ |8 j; k
- first you need to know the port addresses of your VIA card, you can get these by starting8 I7 f. A9 E* G' K1 o: o
msinfo32 on Windows XP and looking at the port listing for SCSI devices
2 t# x; Y& y& {3 o7 f* C, K- for the 6421 the 1st port is internal SATA, 2nd is external SATA and 3rd is internal IDE
+ u3 {0 a( F# [, F' C7 _) o- for the 6420 the 1st and 3rd port are internal SATA
M! s: k; b8 \+ p( {- z- you need the starting address e.g. 0xD000 or 0x7000: R" M# K9 J4 H- b& {6 G7 C
- be warned that these addresses can change from computer to computer, they are assigned% k% P1 N9 u( @$ e! Q; i
at bootup, but Windows XP should display the ones you need for flashing in DOS9 G4 I' M9 M& M$ Y% b
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or
( N% O* ?/ `6 D2 Q' }" W Xecuter Connectivity Kit)
5 Z x* x3 J: Y- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
) a) u$ Z* @9 H* n need to power the drive off and on during soft flashing- x) ?* N0 o- @ e+ h$ J; p9 k4 v, I
- cold reboot or reset the computer- `; S% E0 n+ D
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk& a3 G& l3 @8 ~9 i' k* D
- at the prompt type: , O) m% X, X: {' z! n5 \2 v
DosFlash r 7000 1 a0 1 4 a:\orig.bin 0 % g D' K$ I5 V
- instead of port 7000 use the starting address your VIA card uses
$ a& T7 y2 Y4 ]4 d I- press return
+ x# ~) H- ]1 V1 e7 o& W! y# p- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
% p# U! A7 @* _! X. E- after you pressed Yes the drive status is shown on the screen, it's something like 0x7F,, u6 h8 Y/ M; L# S! O- ^1 l- q
this will change during the next few steps3 g# b2 u0 x) ?: `0 Y
- turn on the BenQ psu and wait 2 or more seconds, status changes between 0x51 and 0xD1# K8 z b! e* {* J. y: J* |: K# `
- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1! y4 u( S {/ u! t% X8 I
- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start5 E5 }2 t9 c! `1 U
- this worked only one time after the computer is powered on or resetted for me/ L. z- `) y3 c) [; ^4 j# S- s
- writing and erasing works the same way) z! {7 y1 R. @0 h: r
- for writing type:
0 L n* z- [4 f3 @5 D; x; f DosFlash w 7000 1 a0 1 4 a:\ixtreme.bin 0# O& c, @% t' P6 T
- for erasing type:3 n4 _( K3 \. |
DosFlash e 7000 1 a0 1 4 D8 0 (D8 is the sector erase opcode for the BenQ flash, if you need; S' ^! D* d% H
to erase another drive, lookup the value in the datasheet or DosFlash.typ)8 O6 x$ T O+ {- s9 I: F O
- if you experience any problems try to use 1 as the parameter to the ATAPI Device Reset, cause# x3 O! {3 m; `
the same VIA card will react differently on another motherboard sometimes
$ z2 x$ G S# b$ P" g" D! R$ C2 e; _- }$ d
x. o9 v8 L) E$ {! W; M. X8 ^4 U
Soft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in manuel mode
5 X0 ]9 @0 ^, P9 Y---------------------------------------------------------------------------------------1 u& j1 U. o: Z/ E9 C
- first you need to know the port addresses of your NForce motherboard, you can get these by " g8 s$ u* y1 U7 l
starting msinfo32 on Windows XP and looking at the port listing for IDE devices/ e2 `3 B4 X! v% r* x
- on most motherboards the 1st and 3rd ports are used for SATA7 f8 u+ L& b7 y6 a! e/ s
- you need the starting address e.g. 0x0970 or 0xE900
7 q ~9 \1 F4 @$ n; V k D- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or ! a/ T8 N; e" N5 v% N9 k% p4 x$ o
Xecuter Connectivity Kit), T6 L+ ^/ O: y$ s5 {, r e
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we! X- F$ s/ W+ h
need to power the drive off and on during soft flashing
; \$ e& a1 M0 F( y" F- cold reboot or reset the computer
3 r1 i: ^8 Y$ P5 o- boot from a DOS disk, I used a Windows XP MS-DOS startup disk t* \7 q7 O# u) {
- at the prompt type: 9 C O6 N4 I, ?2 z
DosFlash r 0970 1 a0 1 4 a:\orig.bin 1
9 t+ F, S7 {# Q' q( Q - instead of port 0970 use the starting address your NForce motherboard uses
" h7 G$ m& r, ^" D2 l! q3 J- press return
5 e1 N2 d2 A+ K) E- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
; }+ x6 U& d! W: ^0 L2 T- R- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,% m$ g3 q5 I; u r6 j
this will change during the next few steps0 l. c0 ]* h) p9 M" X5 O0 R
- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start; ~6 I# n0 t3 [- e
- writing and erasing works the same way: k: t% O9 _6 b$ O3 g7 u H
- for writing type:6 t C8 a! A$ E+ t( U# H
DosFlash w 0970 1 a0 1 4 a:\ixtreme.bin 1
1 l: T& h* R# C- k- for erasing type:1 n- m: y' T, A7 z/ c
DosFlash e 0970 1 a0 1 4 D8 1 (D8 is the sector erase opcode for the BenQ flash, if you need6 H# U% V4 `* [. }( v
to erase another drive, lookup the value in the datasheet or DosFlash.typ)3 V) q( R4 b3 ]& y$ o' V
- b" i) h* {4 u. J* V) n& R! q3 U0 y% ~% |# q
Soft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in auto mode
- j' |9 }8 t; C9 Q-------------------------------------------------------------------------------------
_4 N4 j! N% m) ]$ _/ V3 [- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or
3 M9 E1 `: S6 N( M Xecuter Connectivity Kit)$ G2 s3 A% h8 k, ]
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
& F3 E- K" r, o, ^) u* h need to power the drive off and on during soft flashing; o' L7 {& e4 ]. u
- cold reboot or reset the computer9 a9 O7 p M$ d6 Z
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk3 p8 J ^& u5 h5 {' d8 \) w5 f5 V. r0 {
- wait until you are at the cmd prompt/ |. A) M W$ V. M7 K+ y
- turn on the BenQ psu X1 i9 O4 Z( E& r! M% v
- at the prompt type:
9 G5 ^, x; t; e# D% k0 A DosFlash7 K6 e s9 G) m6 n. Z) a: Q
- press return
! j# f7 w5 r1 |- during scann of the BenQ's port DosFlash16 will ask you if you wanna resend the mtk vendor/ Y- F$ K) p! l" M$ \+ R
intro cmd, press Yes/ F) T% V2 Z `) {3 x
- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,9 Y8 H% ?. Z* @ r# B1 b- k1 F; r
this will change during the next few steps
+ I+ k& k0 `) i8 L- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1
& O+ x- |! q/ z" L* t) k$ T. E- turn on the BenQ psu, you should get a good drive status 0x73 and flash access is granted8 } y6 }# @! @% n9 N8 v' w
- you can now continue as usual using DosFlash
" {1 x# D2 Y3 V, @% v7 X/ W, _- writing and erasing works the same way
- A1 E. w% i/ k9 {" w6 T2 B- if the ports are scanned there is the possibility that you'll get the resend question for% r4 r% b, \; m' ]! h& s
other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,$ g7 V/ Q8 B- b
if you know the NEC is at that port you should press No and press Yes only if the port of
: s. \' y# C6 O: p7 _ the BenQ is shown or simply disconnect the NEC0 z/ s6 @+ E/ d& P* O4 ]! d
s) T$ l8 `% z8 ]8 o3 J) y
3 s c2 J- u! W+ C3 VSoft Flashing the BenQ in Windows XP with a VIA card or NForce motherboard and DosFlash32/ i6 y& R, G' d6 M/ @) i# P
-------------------------------------------------------------------------------------------2 X0 R$ G( j$ B3 s
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or
9 H, m/ A% F8 j& O Xecuter Connectivity Kit)$ }8 i( U) u2 w
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we; J0 e: Y" C& }" \0 g# l, j* p$ F
need to power the drive off and on during soft flashing
7 {( D7 L; x( G- cold reboot or reset the computer2 d3 s U \! X% z: i% N) q
- turn on the BenQ psu when you are in Windows XP
. B, m6 c# T+ ]$ T6 ^" x8 T* ^0 M" m- start DosFlash32
7 f% I) Q. l9 }- DosFlash32 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
t% S8 o, q+ U5 Z5 g0 c- turn off the BenQ psu and wait 2 or more seconds$ k% m8 B: n; }, y
- turn on the BenQ psu, the DosFlash32 dialog should show up5 n. F/ J& ~# n* g: U
- the flash should be recognized by DosFlash329 @! e8 c- d' l N% A6 _1 C
- you can now read, write or erase the flash
/ N* N$ x7 s g- you should be able to do the flashing more than one time in Windows, only do the power
: x# h3 G; b) [ c; V1 D1 f' A off/on trick again; `* c! _" e% D3 y
- if the ports are scanned there is the possibility that you'll get the resend question for
* {+ Y9 c( {5 e8 b/ b( s3 ] other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,
: I" v( z# F! ?% `3 b/ r if you know the NEC is at that port you should press No and press Yes only if the port of
) P' V% j& q& s+ ~. ?- P the BenQ is shown or simply disconnect the NEC' j5 [ U* ?% M
4 x" {( L R) m& V
: e7 U9 ?+ d4 q2 I- bMany thanks to jumba for the great idea of BenQ polling!
3 u. G# `3 J DThanks to Iriez, Jumba, Redline99, TeamModfreakz, Tiros and all the IRC people for testing
; ?% b u2 ]4 N d& b4 v+ O& }and support.
, ~$ c9 ]% P3 L" i& F2 z, X% N+ ~# h8 V
Join us on IRC efnet at the channel #dosflash for support.
1 u; z0 p4 d& s5 n
6 ^6 N0 k2 }& O/ f \: z! V8 F7 k- C( L( RDon't brick your BenQ!( F8 y3 h0 ?3 I* l( N- x5 y; M+ \/ }
Kai Schtrom8 Y. {. r* l. n" v
5 j, |) Z; n X1 y, D" Y/ y% v: }( ^
************************************************************************************************* W! |- E6 a, z; c9 i5 [9 A# x
* v) A1 ^) j$ S& ~6 i7 M
) _7 m1 w3 L& i) ^; E" G; aDosFlash and DosFlash32 V1.2 Beta$ U: j8 q; k y- g* w# x2 l1 T: v- i0 a
-----------------------------------1 X( ~- p3 t" m8 K+ {% X" n/ l4 K7 o
- bug fix for BenQ recognition5 N0 ?9 h3 o. E: z/ i7 Q3 j. D
- manufacturer and device id are sometimes 0x00 for a correct installed switch
( u5 b6 U3 W9 _ - this issue is fixed with an additional ATAPI device reset before the mtk vendor intro is sent
) G' [, b2 A# e1 s: E$ `; D4 R3 F3 j0 X" U( V
Thanks to Redline99 who fixed my buggy code by adding one line! . o; s. k. W9 T; r7 h% e/ z' O
3 ]! @8 ^6 z) m$ i7 f. [6 y; e* \1 X+ k) R) Y
************************************************************************************************
% r" r" v" _: q' n# V
, D6 J- r- k2 u# g( L. F; b9 Q/ z2 c0 F- B; k$ C# ?
DosFlash and DosFlash32 V1.1 Beta
7 {5 F1 D0 m$ I' z- f. z1 k-----------------------------------4 ^# s( l' @. l! p- w: W1 @
- DosFlash.typ modified for better BenQ support
3 _4 _ {5 s( c% z- F' _% J- DosFlash16 Flash Manufacturer and Device ID screen output restructured6 t! F' ^: g' W* j$ D' ]6 P
- flash chips are first erased before writing starts2 e5 P! w. v4 r: f8 V
- DosFlash32 no reenable of DVD-ROMs in device manager after flashing, this means you can't see the drive
- _1 W* {' U, a& C+ e and maybe have to activate it manually again in device manager, this could give better compatibility and! i- r6 b( K* q# r C$ z }
hopefully no more blue screens
3 T/ v# ? V9 [ Q. I3 V; ~, R+ B
Many thanks to Jumba, Redline99, TeamModfreakz and Tiros for inspiration and help!1 m; { c( m% h! r, o$ M) c5 J
$ F* N; B C/ ]6 }9 g( N: Q$ }: w& o+ c+ Q
************************************************************************************************
5 y8 U( d4 E9 i- S
% t% @# ?2 q/ {6 D( W, l) f* h+ Z- }( N9 E, i
DosFlash and DosFlash32 V1.0 Beta B+ k0 T* N1 Y6 L
------------------------------------ X5 ]$ U$ ?3 i% Z9 z
DosFlash can be used to read/write/erase the flash chips of most CD/DVD-ROM drives
' u' ^1 Z. B% k2 e& i T5 u% ~* }that have a mediatek chipset installed. DosFlash is for DOS flashing, DosFlash32# w$ F+ |/ Y4 S
for Windows flashing.( l; _; z: a4 n4 Y* r3 C4 b
% P0 O( j4 h$ @: q8 s- E
" _1 C' s; G2 m, l$ d @Features:' Y: p$ L& ]1 I& q1 ~
-----------& {+ G4 s0 v" n6 d: t
- flashes IDE and SATA drives( |1 o% `5 m8 V) G, q
- supports parallel and serial flash chips
. i# D- }- Z& ` H7 [" o" A- flash drives in Windows with direct port access
m! J3 u' z) o6 g- no vendor cdb flashing commands are used; V! N2 e x3 K/ v5 O( {
- tested with the following drives:* R8 o& w, i% m( n8 f) a
- TS-H943A MS25, MS28
/ \& s2 t8 T* v& z8 E) n - SH-D162C/ a7 s' q& V: i w* R, x/ c O
- SH-D163A
) x$ E' h8 R' h9 w- I - and some other drives like Liteon, Hitachi, ...
5 q Z/ x! b y; ]- NEC drives are not supported, cause they have no mediatek chipset installed
' G! k3 T/ p9 x( [
3 e* V4 i! t+ P4 T! D
; Q9 r# G% @" d/ M: zDosFlash, d. v% E! Z/ z, Y9 u
----------7 m9 D2 x! N6 I
DosFlash supports two flashing modes, Auto and Manual. If you type DOSFLASH at a DOS prompt it
8 O2 t3 Q' p& C# F6 Iwill start in Auto mode. All drives and the corresponding flash chips are detected automatically.9 H. d9 c' t/ m$ R- ^/ x- c
If you can't get a flash chip recognized due to a bad flash or other problems you should use the
1 m; j+ F" U- h% m( KManual mode. In Manual mode you can enter all the parameters used for flashing by hand. The
! F% s0 T& Z ~* S" j' zfollowing help screen is displayed if you start DosFlash with a wrong number of parameters:
) s0 O/ @$ X4 I
0 I6 C K" E. J7 n" K
6 n/ H( e$ {1 D& o5 B3 |& MDOSFLASH by Kai Schtrom, 08/05/2007 (Ver 1.0 Beta)
" p5 c+ ~& K) i( J' q) H& rDOSFLASH [R|W|E] [PORT] [PORT TYPE] [DRIVE POS] [FLASH TYPE]) Q1 F( ?( C. d5 }1 t
[FLASH SIZE] [FLASH SECTOR ERASE OPCODE] [FILE NAME]
) {" d$ g* c( I+ l% n. I R: Read FLASH& _, c: N G9 b0 {6 z: s, A- \
W: Write FLASH/ X* e0 p* j' v8 K! |( {
E: Erase FLASH
4 x `3 T% d! m! q4 L' _; T PORT: Port to send command to
0 [: C; U& g% C5 X* z* P PORT TYPE: 0 for IDE, 1 for SATA
3 B3 u+ \. Y+ r5 M/ n/ z$ V DRIVE POS: A0 for Master, B0 for Slave
) k' x- U' a' p FLASH TYPE: 0 for parallel flash, 1 for serial flash" }2 `" F8 x# K/ s) U2 r: ~
FLASH SIZE: size of flash chip in number of banks
1 d+ t) n Q( A; S( jFLASH SECTOR ERASE OPCODE: individual sector erase opcode command byte
3 U; J& Y6 o! X. f# r" F this is only needed for erasing a serial flash
# q4 F* X# h! p$ z( m6 _2 ?. H FILE NAME: name of the file to read/write from/to flash% \# R. [9 ?9 }; r% _2 d
All numbers are intepreted as hex values!
m5 }$ s# G- R7 A4 R
/ P- j& n- y2 k/ U* iExample Usage:6 T& ^. u3 D6 {- d+ h" s
"DOSFLASH R 01F0 0 A0 1 4 C:\flash.bin"+ o9 u% d6 s. g7 Y, H
=> Read serial flash with a size of 4 bank (262144 bytes) from Master Device
8 S! j3 y- q# J/ X, N+ Z% ?9 E3 M on IDE port 0x01F0
- m9 K1 y6 w' ?4 A/ N9 g7 L"DOSFLASH E C000 1 A0 1 4 D8"
9 w# x; X( c* @$ z K' R/ ?=> Erase serial flash with opcode 0xD8 and a size of 4 banks (262144 bytes)& P! X; O- G: D( k0 L# ?4 Y0 z- v8 f
from Master Device on SATA port 0xC000
) o2 F; \5 r+ } ' \ y& \ g& o- ]
$ C! |7 d" p" U& s
Explanation of the Parameters:
$ o2 n3 Z+ D, f% y1 w--------------------------------
$ A9 a4 o0 `5 \1 D7 h+ [. Z
5 V, q" ^4 ?7 ?# g[R|W|E]! s$ B( I; @ l# H, _) G3 y. l
---------
3 ~1 P4 { ^8 H- J: k$ y$ X) c( F- this will set the mode of flashing, it is recommended to first try read on any. v4 W; y6 Z/ `$ Q/ Y# D
drive, if the read will fail, it is highly unlikely that a write or erase will
# t6 s7 {5 j' B: c succeed
7 c' O$ C( Q0 ?/ }
# a' J$ S5 F5 Z& F# h2 K; i% u8 v[PORT]
5 O% D. m% O2 H6 ~1 m% B! ]--------6 W5 q; y6 g: m4 o0 e! H8 F6 P
- the port to which the drive is connected, a port number should always be entered
5 S3 L$ ?3 _: h: m" x: W6 i in hexadecimal and have 4 hex digits, valid ports are: 01F0, 0170, C000, C800
8 D8 A1 d# B' r- this option can be used if your PCI adapter card or on board IDE/SATA ports are
1 ~" j" `* K' J$ L; h not identified by the auto mode
' |. D: I! z2 F) w# h4 {8 Z" P" s: w8 s8 j% ]0 w5 `8 ~# k+ Y
[PORT TYPE]
( R4 v' u a6 j0 b2 J% ]+ `1 \-------------
( A/ {6 A- x- J: E2 [( _+ _- the port type tells DosFlash what type of port is installed on the before entered7 Y6 J* l: W" T+ u
port address; b7 G- `4 ^2 j! u* y) M8 o; |1 S: S
- valid values are 0 for IDE and 1 for SATA
; Z2 g' {$ K/ L& ^7 x2 H( q0 h- make sure you never mix the wrong port with the wrong port type, this could give
& z! Q) V* `" X4 ? strange results or in the worst case a bricked drive0 ~% {, {$ m: }: y+ ~0 D
4 n9 {. D6 j2 l6 N" L& ?
[DRIVE POS]- A6 [4 }/ a& h6 e! T2 [; K1 P+ k/ y# U$ w
-------------
9 V) l* U$ D0 Q" o! g9 j- old style IDE channels have the possibility to connect two drives at one IDE3 t" P5 y7 I$ |( u; Y
channel, the first drive is called the master, the second drives is called the' S: S9 }- k& R6 U) X Z5 K) B0 U
slave
/ r6 V# X) r" Z" I' J- you can select which drive should be flashed on the channel, A0 selects Master,: e9 [& f- i) e
B0 selects Slave
6 q+ \, I7 ~) ~8 d% k- on SATA ports this value is always A0, cause you can only connect one drive to
7 W s' h' ^# z1 { a SATA port, so for SATA you will always type A0 here( g% m5 X' s4 A8 X b& u
- it is not recommended to flash IDE drives with another drive connected to the
2 R" o" ^1 [$ ~2 F% M same IDE channel, this could be risky if something in the Master/Slave selection
: x$ ?$ A1 ~. e" |4 P5 Q; q- ? fails
: \ ^: e5 ^; {& U
4 c) A9 S2 U1 O. J[FLASH TYPE]
" q( d" d5 }- b0 d; O--------------6 Z1 q; k* u1 A. U3 Y0 |5 `
- there are two types of flash chips out for CD/DVD-ROM drives atm
' h& T- Y/ o) i$ }5 m% p+ k- the older type is parallel flash, which is also supported by mtkflash for example3 Z. }) Y1 R( c. g# W) q
- the newer type is serial flash, which is supported by flashers like XSF
( a8 X& ~/ X2 T) ~ ]- the problem here is that no tool is out that can flash serial flash chips on 6 ~, I8 T# v; v) ~
SATA ports
' c. P4 t- L3 I 7 X7 K8 T9 E8 A2 h' L3 i
[FLASH SIZE]
- f, A2 Q! l. \$ i--------------
! W3 F/ N2 k$ i- this is specifies the flash chip size in banks
4 a: B/ B3 T) E# R) {- one bank is always 65.536 bytes in size
) Q: a$ C& A2 s2 n- if you know your drive has a flash chip of 262.144 bytes in size you need to enter 4, a7 X' L7 L1 c+ |& P! V
, ?+ A7 T8 P3 W1 o3 w; h0 B+ L[FLASH SECTOR ERASE OPCODE]
9 l* ^, v4 Y/ z4 A6 G2 {: b-----------------------------
& `3 [' p6 d, W' i7 S' G3 I% \- the opcode used in the flash chips datasheet for erasing" \# D# p6 {5 J
- for serial chips this command can be different from the standard and needs to be* M$ m( v$ b' \6 i
entered for flash erase, I( W% ^0 a- ~$ w
- for parallel flash chips you can enter a dummy cmd byte, the integrated command
( @+ p9 V( H- X6 [+ R should work on all parallel flash chips without a prob
5 m @& y0 H1 ^) _
3 E9 M* m5 i. g4 Z# D a[FILE NAME]
" H: W6 v/ Y1 @-------------8 C$ K- e: C {2 a: I
- name of the file that should be used for flashing. M9 x, F' z% V; f) O, m1 l
- for reading operations this should be the output file& B! p2 a* K6 W& C; I
- for writing operations this should be the input file/ h# \: o. R: r5 O+ n% I' m
5 ]4 D1 Y; O# F& n3 ]# W
" r- I" m, I% w
Hints and Warnings3 c/ v+ m" L" e
--------------------
& s7 a b8 H0 E2 H1 Z- read, write erase TS-H943A MS28 after the firmware stealth has been disabled with Enable0800 disc
( j9 X1 R' T8 G9 X1 m - this only works one time, after the first mtk vendor specific intro cmd is send$ m( Q) u# e" D2 s, c) z
- if the mtk vendor specific outro cmd is send the chip goes back to stealth mode and you need
' E7 p- ?8 v, z6 j again the Enable0800.iso to disable it
8 _3 m' p: `0 F5 `9 h' l' v) v - therefor the mtk vendor specific intro is send at program start to all present devices and the
, l2 j: L. o& | mtk outro is sent at program end
+ w0 @& }- z9 x9 X - if you have a chip manufacturer id of 0x02 and a chip device id of 0x02 for the TS-H943A% r# @& n2 k2 v# O8 k* n
the flash chip is in stealth mode and won't give access to any reading, writing, erasing
( d+ x2 ]/ y k5 j- always have a look at the DataSum generated, this is exactly the DataSum of mtkflash) @9 w o, o& A/ I: M
- the DataSum is calculated as the sum of all bytes of the firmware in a short integer% C& x9 s" g6 t& c
- to make 100% sure that the flash is written right compare that DataSum to a known one3 p# L! V* S4 a
- this tool has not been tested on all drives out there, the typ list is simply copied from well
- v, v$ O; t, [5 ?+ } known programs like mtkflash and XSF
$ J9 P6 x4 P( X2 v2 Z - always try a flash read on a not yet tested drive before doing anything else
& u3 D+ S5 Z. \: ` - if the read doesn't succeed it is highly unlikely that a write or erase will
1 y/ C- t5 K. g/ n+ C2 {8 S6 E- some LiteOn drives seem to have probs to write the firmware correct, this prob seems to be
% |* D* K* ^- ~6 Y# H: ^: X related to windows register flashing, cause even an assembler app can't do this error free
' e1 ^; x) }. Q* Q( N& p4 }3 T - if you get errors on LiteOn drives, write the flash two times in a row, ]+ j* [" H: K3 m
- for direct port I/O in windows the givoio.sys driver is used, this driver is loaded at DosFlash32
5 ]. g, y r5 @7 n start and unloaded at program end, be warned, this driver can possibly make your system unstable,4 e# Q3 f: H4 y7 x5 R- G
it's intention is to let privileged assembler instruction like in and out pass, even in windows,
7 m. X- M; U6 B& G* F- [ if this driver is not used you will not be able to get direct access to port registers
9 L- Q% N7 c# f0 `% M* R2 i5 ~: Y- DosFlash was tested on MS-DOS 6.22 and later, you can easily copy it on a MS-DOS boot disk created
0 B2 N0 ?* @/ f! t5 t0 R2 [ in Windows XP and start DosFlash directly from the disk
- J! C9 j8 f: R" ^1 n- don't forget to also copy the DosFlash.typ file, it has all the informations about flash chips
/ G, {! O& Q W; l+ p) H for auto mode flashing
" v6 h- m6 q9 P% u- DosFlash32 was tested without a prob on Windows XP SP2, you'll need also the typ file for the # @3 p5 J0 ? {- R
win version/ A$ u9 ^6 l8 Q
- DosFlash32 will deactivate all CD-ROMs in device manager at startup, this is better for flashing,
: ^: j" H( w2 V9 o cause Windows seems to poll the drives all the time and this could result in a bad fw file or
" p3 i/ r8 }/ h- B5 d a program hang, the drives are activated again at program end
t( p6 l/ V% T( w. X; n5 h6 k- you should make sure that the flash is not in an erased state at program end, cause device manager
1 x, ]! k/ L0 J" N8 r; Y don't like drives that do not respond to the inquiry command- H1 z8 c- O! x" H3 v, q8 D
- deactivating all CD-ROMs could take a few seconds, so please be patient at program start& x) }4 p3 R9 c p" p" F; I9 W
- DosFlash and DosFlash32 will try to scan for the VIA 6421L Raid Controller card, based on vendor( h* k8 ^% N3 [& V, ^
id 1106 and device id 3249, it doesn't matter if the card driver is installed or not
! J7 I5 q, y* F# e
. f% ^' U' I; \, G' w9 I
0 ^8 M. f* B1 J, K. r$ uMany thanks to Dale Roberts and his Direct Port I/O driver giveio.sys! }0 G5 }; Q6 F* c9 E0 z# Y
8 t3 m( n. C. _8 L; j
Avoid a bad flash!
# t) o' ~9 j( r9 hKai Schtrom |
|
窺視卡
雷達卡
樓主
顯身卡
發表於 2011-8-21 21:08:07
