|
|
ak475671 發表於 2011-8-22 13:03 ![]()
' j+ h! t, t' B% {( x6 j版主你好% L, M3 ?/ k z8 e% t% Y) G
版主知道哪裡有教學嗎使用DOS提KYE的過程不是很了解不知道有沒有教學可以參考的呢. q" H; j0 R5 V7 Q6 B$ U
另外你說他提取 ...
, [6 g( A! |: V; O: g3 ^- j+ E6 CDosFlash ReadMe.txt 說明文件5 X6 U' ]( x3 P7 U1 O
3 {' d, h* A& w' l/ O( g- o& X% ^
DosFlash V1.9 Release Date 01.01.20111 g' ]) l1 K9 f5 A+ X) k6 Y
---------------------------------------$ @7 Y% o. y( c' D8 D. p" U
- SATA and IDE port scan improved in DOS and Windows
K3 V4 m/ B( a2 S( V$ D' U2 C The ports are now enumerated with the CONFIG_ADDRESS and CONFIG_DATA register instead of using interrupts
5 @2 P7 S3 }6 P; g" w' \ in DOS and SetupDixx functions in Windows. This change will detect more ports in Windows than the old
) Y. F3 P6 }" k3 q' p8 K3 } SetupDixx method.$ \2 W1 f: E4 W8 q7 E9 z9 Y+ h
- Settings saved to ini file for DosFlash32 and DosFlash64
. w3 f3 @8 o, o Settings like Port, Position, Task, COM Port, Enable Drives and DvdKey state are now saved to an ini file* _* d) z& h, Y+ R
inside the program folder. If the ini file is not present it is created after the first run. On the first3 ^! h' ?: j, W
startup DosFlash will choose the most common and stable settings.
; E# N, f( Q0 O- EnableDrives option included in dialog as a check box7 H- ?4 T6 F' D* v
Due to high demand we removed the "Enabling CD-/DVD-ROMs" MessageBox on program termination and included
) u0 ]" J0 U O% R% F6 A1 ? a check box "Enable Drives" inside the dialog. For security and more stability this is deactivated on the+ T4 L, a% t7 d
first run. If you enable it the checked state is saved to the ini file.
7 @" n4 t" Z; ?0 Q8 W$ q- enabling drives in Windows caused some hangs from time to time, this is now fixed by a recoded enable
' Q# t# Z! `) x( }3 y; u drives function
8 d8 N& z: L B- port drivers portio32.sys and portio64.sys are now added to the executable and unpacked during runtime: c1 |& ?, v8 u3 h* X$ P& d
- PATA and SATA controllers list updated
q, L3 r" K0 A2 C J) u: M" t- Fix for NForce motherboards in combination with drives like the "Samsung SH-D163C", "LG DH18NS40" or! ~/ e$ v4 B' Z9 O
"LiteOn iHDS118"8 c+ P5 l' @3 F q4 z' j
Some drives have problems with flash identify, read, write and erase. This is clearly related to the
; U! u! s, u3 X7 W' G; i6 Q NVidia NForce chipset. For manual mode in DosFlash16 an additional command line parameter is added called
6 U* Q, r0 |' B* f6 Y8 [" e "NFORCE FIX". This parameter should be set to 1 for NForce chipsets if you experience strange problems.
7 s: P# {9 M m In DosFlash32 and DosFlash64 we added a static control which shows if the NForce Fix is applied or not.7 L$ q' [9 S# c5 Y5 P9 K3 w
Remember there is no need to activate this with every drive. It seems to be a combination between drive: \& o" v! g% |% h* f6 A
and NForce chipset that causes the problem. The fix is automatically applied for DosFlash16 in auto mode,) C- [% d* a! Z- d7 D- k
DosFlash32 and DosFlash64.
; |5 A5 f: G% _- DosFlash32 and DosFlash64 are now DPI Aware for Windows7+ f l+ G5 l, N0 U+ r* b7 @! H" V
- New task Verfiy Key/Inject Key added for verification/injection of drive keys- F6 f' S5 i/ w
All DosFlash versions now have the possibility to validate drive keys against an XBOX360 drive and set7 F, X: o& k* u* \3 A. O2 Q3 S; L( P3 a
the key for an XBOX360 drive. We use the same authentication method like the console to verify a key.
6 p6 l+ Y! `, f& A! q In the Windows versions you have the choice to paste the drive key from the clipboard to our custom hex% s% o) j! M0 d
edit control or load a key file. To add a key simply click right inside the hex edit control and select
: a6 w! M! s% J/ S& [ your choice from the shortcut menu. In DosFlash16 you can enter the key in the format "1A-2B-3C" without) M& V3 y, i& B$ G& Y# w
quotes. Remember that a key has 16 bytes of data. The key file to import should also have 16 bytes of data" U- c* \2 F7 v/ X! g. [2 Z1 \4 C
like the key files exported by LiteOn Key functions.. k5 E7 N m! s4 ?: h
- Removed multiple key extractions for LiteOn Key functions, added Verify Key after extraction
! W( l' a0 u' t- n0 x1 F0 E For LiteOn Key functions we removed the multiple extractions, because the key is now verified immediately
! H, S! j) A* x' \6 F/ ?3 G' D against the XBOX360 drive.
, \4 G0 O* N1 R9 ~- LiteOn Key V1 and V2 now also extract the file Serial.bin and the 2nd inquiry file Inquiry2.bin/ d* L# y' @4 ]8 G5 [; u
We added the file Serial.bin and Inquiry2.bin to LiteOn Key functions. Inquiry2.bin is only generated for
& i5 S4 r l+ \ LiteOn drives V1 and V2.
1 k$ D) s ?1 w; P& q( b- The drive key of Maximus patched UART drives can be extracted by using the task "LiteOn Key V1 (DvdKey)". |8 D C* x2 B3 X& N1 A$ m6 Z
The drive check has been removed from LiteOn Key functions. This way we can extract a key from an UART
0 H/ U: W0 g) p8 K9 a! ^* ^: A$ [) ^ patched drive firmware by Maximus.
$ K5 Z" g8 c6 {+ @& v- LiteOn files are now extracted to a destination folder instead of prompting the user for every file name.
6 _; \5 Y! `4 K# ?: ]# D9 W- LiteOn key extraction tasks separated per drive version in "LiteOn Key V1 (DvdKey)", "LiteOn Key V2 (FreeKey)"
6 L' T3 z1 k0 Y) X and "LiteOn Key V3 (Tarablinda)"
* d# R- U* I r- In DosFlash32 and DosFlash64 the number of installed COM ports in the system are now enumerated instead of
$ S# X* ?: X6 }1 `" Q$ o2 O' } adding port 1 to 4
8 e* S L7 W' C7 @" J- For failing cdb commands the sense code is returned
1 ~2 o; Z$ v0 `3 o# ~- Geremia's Tarablinda functionality added
! i* C0 [$ }) v# @" w We added all Tarablinda tasks to every DosFlash version. You can extract the key by choosing the task% j }/ Y9 m$ v: @* K
"LiteOn Key V3 (Tarablinda)". For read, write and erase of the flash simply use the standard functions.
% w& H) R! J! H Pay attention that the "LiteOn Erase V1/V2" task is only available for older LiteOns and not for the Slim.
/ K( _7 U: P9 F. [ d You should use "Read Flash", "Write Flash" and "Erase Flash" for the Slim. "LiteOn Key V3 (Tarablinda)"8 E; k5 c8 S3 r' U6 ~# s
extracts 1 additional file in comparison to Tarablinda v04b, this file is called Xtram.bin and contains
+ \4 I% O& }, J7 c5 C% ^$ ~0 p a dump of the XTRAM8000 area. This can differ in a few bytes from one dump to the next.- h3 M D. s5 V6 x, M+ E
- Device Reset in DosFlash16 manual mode is now done automatically, there is no option to turn it off anymore
5 o2 B. W9 j& g- Code optimization to work with modern SATA2 controllers added, remember to set SATA controllers to IDE and
, A5 G1 R* ?8 Q8 N$ P s* V9 S! u4 g not AHCI mode otherwise Port I/O will not work9 v8 N( S, l z3 M d" g- Y4 Z
- Warning: The read, write and erase of the Slim drive is considered risky in general! So pay attention and( y. [: N: H3 _+ H% j" S+ W
always remember you use DosFlash on your own risk every time! Even during flash read the Slim gets flashed
* L8 u0 O" ?' h2 \- w- p; a8 | with a patched firmware sector to retrieve the complete dump!
' f: L) x. K: k- We had to change many command line arguments for DosFlash16 Manual Mode, because of the NForce Fix, added
. b9 C/ _0 _8 w Tarablinda support and splitting of LiteOn Key functions. To get a better understanding we added the example5 O6 h1 A+ k3 t8 ~' c/ ?, m
section below.
0 |0 [. }. V: O: I2 ^, C$ p7 b3 D3 n5 `0 ^5 W2 |/ G1 h- Z
: p8 m1 g6 {& R9 p9 P- D
DosFlash16 Manual Mode Examples
+ b: F R$ h/ M$ [7 O, u( l% z- z---------------------------------
3 N- F0 }; g5 {- Extract drive key on a " LDS DG-16D2S 74850C" over UART -> "LiteOn Key V1 (DvdKey)"# e2 R4 T! A0 a& K* J
DOSFLASH LITEON K V1 0970 A0 13 `5 B6 R' ]9 \
1 O$ B( \: x; T! E) H3 l
- Extract drive key on a "LDS DG-16D2S 83850C" over SATA -> "LiteOn Key V2 (FreeKey)"
' w& C2 u& v2 j) {" h DOSFLASH LITEON K V2 0970 A0+ ~0 K: q" e) G7 `+ M+ o- L
6 K' v9 U) T1 b- L/ H- Extract drive key on a "LDS DG-16D4S 9504" over SATA -> "LiteOn Key V3 (Tarablinda)"
/ U+ N& { M5 q1 u4 E) [ DOSFLASH LITEON K V3 0970 A0$ o# [& j6 F5 ?( k4 w0 z7 B
" ^' m, k# Z9 r4 e$ v- Read firmware on a "LDS DG-16D4S 9504" -> "Read Flash" this is considered risky!
4 i* T2 Q& r! y- z- w: t DOSFLASH R 0970 1 A0 3 0 4 FWOUT.BIN 0
" v. J9 W) c9 @. l+ O' `; |1 D3 [) T) q, K" A
- Write firmware on a "LDS DG-16D4S 9504" -> "Write Flash" this is considered risky!
3 h2 j( _& b$ G" ?: I1 H0 p/ _ DOSFLASH W 0970 1 A0 3 0 4 FWIN.BIN 03 l7 d0 T3 m' s/ C; m4 `) f* r
8 K7 G% S- ?$ j# R1 a- Erase firmware on a "LDS DG-16D4S 9504" -> "Erase Flash" this is considered risky!) ^7 v# p( O; X& p! e5 H
DOSFLASH E 0970 1 A0 3 0 4 C7 0
: \3 _; L4 j: _9 y9 b- X% Z- T; u& B6 X( u- C: B
- Erase firmware on a "LDS DG-16D2S 74850C" or a "LDS DG-16D2S 83850C" -> "LiteOn Erase V1/V2"4 d5 f. A$ i( C0 z
DOSFLASH LITEON E 0970 A0
" W( J) W" b' a0 n5 ?+ l, z2 [' h( {$ ]1 S8 I" t! U5 x; Y4 X N
- Read firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Read Flash"% N8 K4 [* Z! Z9 u0 Y/ U
DOSFLASH R 0970 1 A0 2 0 4 FWOUT.BIN 1& M' _$ s. K2 ^
; d7 H; B' I$ N- Write firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Write Flash"
" |- `+ a: j9 J: { DOSFLASH W 0970 1 A0 2 0 4 FWIN.BIN 10 \) I9 \) ]; w! P) d% r
, x+ p$ K" D5 Z% [- Erase firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Erase Flash"
1 Q% ]% K6 J/ O DOSFLASH E 0970 1 A0 2 0 4 C7 1# O# o' f0 y) q% f
$ i& `, u& F& N: ^! J& U- Verify drive key on a XBOX360 drive, enter the drive key manual
+ S7 N0 ^+ D6 _' X. V DOSFLASH V 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF5 C" r \/ [7 B
; l2 { }& e6 j! @: B+ c: S- Verify drive key on a XBOX360 drive, load a drive key file
2 x, U9 g& D$ A1 J! c$ F1 g4 J! N0 {. I DOSFLASH V 0970 A0 KEY.BIN0 i" s+ w% ~6 m& |# Q, \
3 i7 n$ x# C$ w( a, O* a) Q- Inject drive key on a XBOX360 drive, enter the drive key manual
3 G: c4 ?/ i M8 k2 f4 ? DOSFLASH I 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF* f% i" j0 p/ J0 b e) e6 E
" q( |0 M8 L. J# o! r5 ?8 ?0 `3 A- Inject drive key on a XBOX360 drive, load a drive key file
; E: {& |2 c% A DOSFLASH I 0970 A0 KEY.BIN8 f+ a( _5 F+ _ G
: p$ V; E* ]" v" \9 K2 F: Z! |8 S
For DosFlash drives on which we can extract the key via UART are considered V1. Drives we get the key over$ G; D* D5 m& ^( F8 g! b! Q
SATA are considered V2. The new Slim is considered V3 but only firmware version 9504 is supported atm.
* ?: y S0 H+ d* F1 f% i2 J- Q! ]7 w: }5 y
1 B; q5 u8 Y y: ~1 S: ]
Many thanks to Geremia, Modfreakz, Redline99 and Tiros for their support. Special thanks to Geremia and# C, m! E# B4 j, M- w9 u3 w& H
Modfreakz for drive sponsoring, testing, coding and much more. It is always a pleasure to work with you1 A/ d* J' J: A5 f% G5 M) J! }
professional guys! Respect to Maximus for his UART enable patch. I'm looking forward to your magic Lizard
* ?* Z. Z0 c& a/ P; Qhardware flasher!
* w/ T, }1 h8 D5 z! V
8 {$ A% L/ _4 s/ \$ y. |( QHappy new year 2011!) u6 m$ Z; C/ g5 _1 a5 w0 b
Kai Schtrom
* q: s& w( w& v
* r/ o1 t& ?! z+ I************************************************************************************************. x. ^+ j, Z$ v; O
" X K! I& F8 ?# }, [9 A* Z6 ?! [2 r
* M9 }$ |. i5 }7 j i4 b& f
DosFlash V1.8 Release Date 08.08.2009
. E) I3 E' ~) U---------------------------------------
+ m1 {3 x4 J' R3 I. [- now supports LiteOn PLDS DG-16D2S 83850C V2 Geremia/Maximus LiteOn FreeKey method
* _: {9 q# T, e# w1 c; w- huge firmware read/write speed increase, especially if run from a floppy disk
# V- ]! G8 N! v8 l( k8 M- updated IDE/SATA motherboard chipset list0 t- o3 _$ w& w: r! A$ h
- new IDE/SATA detection for Windows and DOS- P: q7 x3 h1 x5 z/ B" f5 y
- DosFlash.typ embedded in executable file
" n" u. _2 e8 X- LiteOn V1 drive key is now extracted 10 times and compared against each other,: A; @; ~$ k! l' O
after the extraction a summary is displayed sorted by the most common matches8 ?* w( \4 ~9 q6 W' M' C8 m
- LiteOn V2 drive key is extracted 2 times and compared
4 c, U% [) l! p) p- new BenQ unlock keys added to unlock all known BenQ drive firmwares' v, s% B7 Q/ _9 N8 T2 ^
- command line parameter "EnableDrives" removed, DosFlash asks the user on
5 }' f6 D' R ~5 H% p application close if he wants to enable the drives or not, during the tests it
5 ~) i9 d: K- Z( O, L* B4 t' d seems that IDE drives have problems with the enable, SATA drives seem to
" u t R, L5 b1 S work fine6 U8 r' `/ N4 n/ k, v: P
- new 64-bit DosFlash edition added called DosFlash64, because some driver
( d( C) d% y1 J& _0 Q functions don't work as expected in the 32 bit compatibility mode on Windows x64
) ]/ }6 ?1 {6 b: R0 w- Beta state removed+ d. R3 E7 S& |5 p( c
- ready and tested on Windows7 X86 and x64
# Z9 {) |6 C( {$ _0 r# c( p x9 M' |7 v& }9 \- X0 q
; n6 D m g% [8 T7 G# FGeremia/Maximus FreeKey method with DosFlash16) N1 G- {% m0 B* L' }" n
------------------------------------------------( ~% Y# C4 w. x" d* q
We have added one cmd line parameter for DosFlash16 in manual mode. The COM port0 f" n- A5 a9 E4 Q5 i+ C
is simply ignored and can have any value for the V2 drives.
- R) z6 D6 D& V6 Y; e8 T' y% a' Q% V; iUse the following command line to extract your free key from 83850C:/ _- c( P0 y) @* @1 l& \6 D5 e
- DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin enckey.bin( ?- e# {6 P, C+ d; d4 ~
" ?# M" |# j6 X
: m3 I/ ^, @ {3 @Tips for running DosFlash on Windows 7! d9 h; b! ]3 `* W
----------------------------------------
$ O) |5 ~5 ~' y" |2 I9 T
3 i' }. I6 A- ~1 s- I' n- @7 ZSince Windows Vista 64 Bit and upwards it is necessary that every driver is signed. Because8 S. v) V# p8 D6 y7 X* {. w9 J
the DosFlash driver will not be signed by MS due to some unknown reason we need to circumvent) t/ H1 V8 r* i5 z
this check. You have the following 2 possibilities to do this.
5 E1 Y; z8 h3 D+ A9 l# q5 R) Q" T0 Z' v- O/ I2 k7 v. R
Safe Way of Disabling Driver Signature Enforcement. c; V' Z' |! u' S g' i' _
1) On Windows 7 bootup press F8 to get to the extended boot options screen
/ A. H4 ]1 c! T2) Choose "Disable Driver Signature Enforcement"- @% }4 g: E& c9 J/ X; C% ?
3) To start DosFlash right click on it in Windows Explorer and choose1 [7 k6 S4 v. H; Y8 [* a2 ?
"Run as administrator" > answer the message box with "Yes"! M2 \+ o1 d" k3 }% W8 T
4) Short after the program started a "rogram Compatibility Assistant" warning message- X# O& G( a% ]5 e# U
is displayed, you can simply ignore this by pressing the "Close" button
; }6 ]( y M/ N* k
6 ~; n9 I+ d, Y5 p; DRecommended Way of Disabling Driver Signature Enforcement
: |: ? N( e- e; b1) Disable User Account Control (UAC)6 m5 U3 I+ Q: G% I# D
- go to "Start Menu" > "Control Panel" > "User Accounts and Family Safety" > "User Accounts"' D$ N' h- v% ?, ~9 r! Y6 l
- click on "Change User Account Control settings"
3 T/ Z7 b6 ]* w4 G! @( d - set the slider bar to the lowest value (Never notify) > click "OK"
U8 s3 j: Z9 C0 N2) Sign the DosFlash driver
6 a; ~( C, U [0 k) I - download the "Driver Signature Enforcement Overrider" (DSEO) from
$ h7 E* Q7 V! x; }' ?; ]) c+ ? http://www.ngohq.com/home.php?page=dseo
& ?( o; y9 U' z4 g9 L- @- k) W - start DSEO > click "Next" > "Yes" > choose "Sign a System File" > "Next" > enter the path to
6 r! x3 |$ K2 K$ V" b z# f9 S the used driver (portio32.sys or portio64.sys) > "OK" > "OK" [9 m7 O1 r2 w: B
3) Disable Driver Signature Enforcement% n- q* C9 n# h6 |
- start DSEO > click "Next" > "Yes" > choose "Enable Test Mode" > "Next" > "OK", s" t3 \! [+ h# m: Z" j
4) Restart the computer& v- M' R }$ M+ \3 S
5 P0 T: L8 [6 Q! v1 z9 u! IKeep in mind that with the recommended way the changes will have effect on every reboot without
7 Y8 Z" I' o* U! Kdoing anything manual. The first way needs to be done over and over again. In addition the second
J( r* d+ l6 b% N# lway can be used to sign every driver that doesn't run natively on Windows 7.- E2 h; u, q3 \+ t/ C( z8 M
/ _8 ~; f# D/ O f/ h
For use of the VIA Cards in Windows 7 it is recommended to uninstall the VIA driver. This can be
( h7 y# z( h+ Z b& Ndone like follows:* k+ R+ c% q+ p4 p Z. \
- start "Device Manager" > expand "Storage controllers" > right click on "VIA RAID Controller" >
+ H$ s5 L; y& e6 y choose "Uninstall" > "OK"
# i1 Q+ O- ~7 B4 M- rename C:\Windows\inf\vsmraid.inf to vsmraid.inf_
2 s9 G6 J2 p% y2 d" e- rename C:\Windows\inf\vsmraid.PNF to vsmraid.PNF_1 n/ c1 \2 W M1 D& P
- rename C:\Windows\System32\drivers\vsmraid.sys to vsmraid.sys_
$ W# j h9 f- Q5 l) X6 L# k& f# X- s- reboot computer
( M- J+ g1 i) S- j$ x$ P% w- G
3 `7 }0 s# P% V: L8 L2 j+ B( [
3 I" q: M/ A% B$ r+ T5 }Much respect and credits go to Geremia and Maximus for their money saving FreeKey app
' L! F# }" x: o8 T" a5 J6 qand their lightning like decryption speed!
+ c- r+ K; |1 Z& r$ E0 C1 ]" s" r4 h+ P- Y& ~) Q c
In Dedication To The Birth Of FreeKey On August Fifth 20098 r: u8 w6 _1 g+ ~
Kai Schtrom* T1 `3 d# S5 D \5 t" c' J* a+ }
5 N Y. {) c. q, J3 F
' E6 `+ A. ~1 J5 k8 m
************************************************************************************************
0 Z9 W# ^: i4 J2 J. g
# L6 R$ ]5 s: U% Q" g% H( _! P
" k- B1 g- _# h5 V, VDosFlash and DosFlash32 V1.7 Beta Release Date 23.12.2008
% r( x8 p' R4 j. C-----------------------------------------------------------
- t0 d, P; H( h. ^6 M- now supports LiteOn PLDS DG-16D2S 74850C and Geremia's LiteOn Erase and DvdKey method# t* H% c& k/ f& l" @
2 R' C. l U0 h7 e- F' _# n; ^# a5 G' P0 s0 d# [9 A! S! {8 z
The following only applies to the new XBox360 LiteOn drive PLDS DG-16D2S 74850C.5 V4 q, X/ y) `5 U& p# n$ A, L" J
; J+ T9 z1 v+ F; I. n2 w, S
4 v5 E' R+ G0 J+ i( D9 d
Geremia's DvdKey method with DosFlash16 with the PC's psu
. h/ d' c; }' o. q* H8 f7 x) x4 N-----------------------------------------------------------
! S! g4 a: Y( o# d- disable CD-ROM boot option in BIOS
) ^( U1 D. X/ A5 Y- connect LiteOn to your PC's power supply unit and SATA port! I& ?5 l- \3 ]$ G" R( m9 F* o
- power up PC, wait until bootup is finished1 l) U6 w. ^: l5 }$ P: X0 C( h
- eject tray of the LiteOn and shutdown PC completely' f1 c0 f$ V4 ~6 ~ z$ [5 M- J0 F
- push the LiteOn tray half in
7 @1 c( V8 @$ T$ R; S% K$ \' f3 |3 U- power up PC and boot into DOS
: H4 J1 ^( q/ T1 a U$ ^( }3 A# d- run DosFlash16 in auto mode1 n# n, ^* H2 o8 z8 d
- if you read the following:
h( N/ f0 _' T: T6 ?4 e0 X MTK Vendor Intro failed on port 0x????.0 _1 ?3 G; x: \: R: Z6 r* Q
If you choose to resend the command you should turn the drive off and on
; N% I( _4 u0 U* b# f1 ^0 o" m8 A after you pressed "Yes".
8 m) t/ w) i D& T0 H/ w" M) B Do you want to resend the command until the drive responds (Y/N)?
9 f- G& ]3 S4 m8 |; s, D( x- press 'N' for "No": o( I- c* d7 ?3 B" J. y' \
- choose the number of your LiteOn ATAPI drive
' Q5 g, ?( R7 n4 @! ~# ^. Q- enter "LITEON K" to read the drive key
: Q0 s/ ~7 n/ b* R- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
, K* _4 L3 h2 C* ?- enter the number of the COM port
7 q# b8 H/ v% c# b- if you read the following:
2 D2 m8 q, T% k6 R g2 a To receive the drive key use Geremia's DvdKey method like follows:: h; r. f7 [# s: E3 }. L9 L e
- Connect your drive with a serial cable to the COM port
$ c l+ B7 a( y0 K9 U - Eject drive tray
- k: d) R$ q1 O; g. z - Power off drive$ B- A) T l2 [3 v% i. B" u- E
- Push drive tray in until it is half open6 l2 h. g$ t. \ n- H
- Power on drive+ K0 c4 j) ~! a3 O3 n
- Press "Yes" if you are ready
) E( V+ ]; r3 I, ~ Are you ready (Y/N)?! q5 Y) o7 e: e# e2 z' ?. I
- simply press 'Yes' without doing anything of the above, because we
$ k1 ]* s: `2 o9 p! @0 _9 u already did that before
- b; Y0 K+ z+ N& V k& I- after this DosFlash16 displays your DVD-Key and saves your key and identify data
1 t0 F/ v$ A; B8 x4 C0 l- to do the above steps in manual mode use the following command line if your drive, `) E. W* r, n* J# N. [7 U5 C1 }- V
is connected to port 0x0970 and serial cable is on COM port 1
* T# ? x0 l' n$ h K3 T DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin
- b0 P7 [ I! ]6 C. S( f- U; |8 Z5 L* e9 Q# ?3 A7 X9 S2 ]. I' H
1 T, Q4 U5 H6 v! F& V& _5 n+ TGeremia's DvdKey method with DosFlash16 and 2nd psu
( e H! Z4 N2 Y1 U" b! A' W-----------------------------------------------------
8 G; Y6 M- [- A# y: S* V- connect a separate power supply unit to the LiteOn, don't turn it on yet) Z- [; r/ V6 x* X- \4 }' }
- power up PC and boot into DOS6 T5 }0 H9 G; ~
- turn on the LiteOn psu
- J8 Y( T2 x- o8 h) k- run DosFlash16 in auto mode2 d+ a& _! U; q7 H6 j2 V
- if you read the following:
$ K' n! `6 c/ I. t1 R& \ MTK Vendor Intro failed on port 0x????.% g1 _0 e8 ]& ~/ F
If you choose to resend the command you should turn the drive off and on$ z4 i+ t* y& ^' ~- Z/ E
after you pressed "Yes".- G! `% |5 ~3 i! T \
Do you want to resend the command until the drive responds (Y/N)?
* J5 H* L* _$ p p3 [4 z- press 'N' for "No"6 A. K. H8 I. R; b
- choose the number of your LiteOn ATAPI drive
9 P" N. N3 D/ @( I- enter "LITEON K" to read the drive key
/ q# ^( c( e2 M# B. ?" X0 `+ f- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
$ U. M: g* b# I0 G; V1 S+ `- enter the number of the COM port
+ B9 g9 T3 H2 T$ P! m# `6 R- if you read the following:
. T( G5 q) S L To receive the drive key use Geremia's DvdKey method like follows:
2 M7 o* X( c6 K - Connect your drive with a serial cable to the COM port
1 U9 r2 z3 j( t( M3 Z+ Y - Eject drive tray
" ~# ]% i( j) a! ?$ I7 E - Power off drive
* M' b# r2 x4 k& Z0 Z+ u - Push drive tray in until it is half open* P+ H4 U* L0 j, P9 C9 E) [, }
- Power on drive
1 c; A3 l6 F" ?3 ~/ H ]! h6 n - Press "Yes" if you are ready% b# k$ C6 H1 s3 q
Are you ready (Y/N)?
% A& n8 Y2 c* o+ d- do the above and press 'Yes'
7 d# H0 ?/ A- X# z4 z- after this DosFlash16 displays your DVD-Key and saves your key and identify data3 n. E) o+ u L
% ?" f: n8 [) M/ E+ ^& m" q. @' C1 e) D6 p% W& e3 Z# D- ~2 ~0 l5 `
Geremia's LiteOn Erase method with DosFlash16 and 2nd psu' B+ d+ G4 U7 \! @
-----------------------------------------------------------" U4 T# s3 U! B' C' i W" N
- connect a separate power supply unit to the LiteOn, don't turn it on yet6 J2 ?8 F8 Y [0 n7 E) [, L
- power up PC and boot into DOS
6 M" ?, y$ A; V5 S7 g% M0 P- turn on the LiteOn psu: @6 j5 J, z4 D7 k+ G8 j8 e" L
- run DosFlash16 in auto mode
% Y% [: ?' p$ B% }! a$ T- if you read the following:
$ T: h! ^3 _% h MTK Vendor Intro failed on port 0x????., G) F7 m9 U( ]) i. v
If you choose to resend the command you should turn the drive off and on
l. M; X" d7 @: x" R% Y after you pressed "Yes"." }& x' ]# Z2 ~5 k6 g- o! d0 Z
Do you want to resend the command until the drive responds (Y/N)?
* {- B- S$ T8 N. m) n- press 'N' for "No"" F6 ~4 `( @7 \; c: H+ @
- choose the number of your LiteOn ATAPI drive
; G* \ E' J4 K- F& \: f7 k2 P- Warning!!! Keep in mind that you will need the drive key before you erase the flash,
: k# H5 H3 t8 U0 }: T& f without the drive key your XBox360 will not work anymore
3 s4 ?9 D# A/ C1 y% L, w- enter "LITEON E" to erase the flash3 ^+ \$ p! O" U, i6 [% X
- the first time after the LiteOn Erase the drive needs to be repowered to give" F' t; Q# }! C: G9 U0 B+ O
flash chip access, this can be achieved by repowering the drive before another
& k! l2 @1 B$ e) V DosFlash16 start in auto mode or by doing a MTK Vendor Intro Power Brute
& g- s3 r& c2 |1 e; i- in my tests it did not work to power the drive with the PC's psu, because it will
8 C$ C: d! R" F) M P9 \ always respond with busy status. S9 ^; v' {6 A+ k8 |
- DosFlash16 can now read, write and erase the flash chip like usual
3 @9 B' c5 P( F8 g& e5 H- to do the above steps in manual mode use the following command line if your drive4 a/ B, l, M6 Z7 }7 @, O6 f
is connected to port 0x09706 ~1 u' l- d& b( x: T. T/ F6 _- p
DosFlash LITEON E 0970
" c7 y0 x. g5 W3 ~4 S+ W- i( T2 X, f1 f( V& M* r
4 t0 r. {( v/ B6 L4 c" g5 r& p `Geremia's DvdKey method with DosFlash32 with the PC's psu, T( @- @% \6 e0 `
-----------------------------------------------------------
" ~0 T4 C$ f: U: w4 E- disable CD-ROM boot option in BIOS
7 h7 |' ~3 s6 K& M6 K+ A: s- connect LiteOn to your PC's power supply unit and SATA port6 C" s, `! G* U' L3 ~
- power up PC, wait until bootup is finished9 ~1 _ e) D z6 K
- eject tray of the LiteOn and shutdown PC completely
6 E( N0 l: a" t0 T- push the LiteOn tray half in
; N9 a1 R/ Y/ T) }- power up PC and boot into Windows
% \" y& u. |0 F4 Q* e% B- run DosFlash32
/ y& W7 n; p; ~" f2 p- if you read the following: c6 s, P: r0 u+ [1 r* I+ A
MTK Vendor Intro failed on port 0x????.
4 G1 t# Y8 p" i8 l- s! D1 O0 V If you choose to resend the command you should turn the drive off and on! T( b0 ]: o5 B
after you pressed "Yes".
- | d) o, f7 r- ]; J Do you want to resend the command until the drive responds?
/ _: `$ |# x) }3 P/ W6 j- press 'No'
7 F8 t$ W/ U( U; s4 ~( c. \2 j6 J: n/ o- choose "LiteOn DvdKey" as flashing task
& B( L8 s1 Q, z$ D* X1 c7 v: w! E- choose the COM port number! @$ u0 X: s8 G6 P3 t7 R9 r
- press on "LiteOn DvdKey" button
& h) M6 e) s; I7 L; o- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files, J+ y% V, \2 d/ P
- if you read the following:
7 Q9 Y2 F& n- p& q To receive the drive key use Geremia's DvdKey method like follows:) b1 {7 E$ H: e# p" r" x
- Connect your drive with a serial cable to the COM port
7 R4 p- s" C3 C+ g# ` - Eject drive tray4 p. P. i( s, [7 w) D n+ e
- Power off drive8 Q. [% {- i; f' R' y# P
- Push drive tray in until it is half open. H3 P: {# c) P& ]8 r& [, @
- Power on drive8 [) _9 [) D- `. @9 J G9 n
- Press "Yes" if you are ready" A; S- Q ?" M- h' ~% I9 x" h+ R% U
Are you ready?
j* A* k# G8 N0 j; s- C& @- simply press 'Yes' without doing anything of the above, because we
# ~# ?3 X) _; v- o4 G; e already did that before0 }# b3 s: G) j& R5 Q- K2 U" s; v
- after this DosFlash32 displays your DVD-Key and saves your key and identify data
( K% m' e4 m$ x/ ?3 R
( H# F* Y( {& D3 [2 e1 \/ J& [1 h& u, u! W
Geremia's DvdKey method with DosFlash32 and 2nd psu
6 d3 [3 A. i# @6 W+ j-----------------------------------------------------6 W3 I3 c# l' J5 v" w5 X
- connect a separate power supply unit to the LiteOn, don't turn it on yet m3 c% s& I% o0 h( ?; ]
- power up PC and boot into Windows& c& f5 J2 g: g+ K$ l1 [$ P
- turn on the LiteOn psu
$ C+ t6 _ N" P9 c3 z3 Q9 `- run DosFlash32
$ B2 r% q T- V, B2 y- if you read the following:
$ ?% i- Q6 j P! \# S* t/ h MTK Vendor Intro failed on port 0x????.
2 e9 N) r+ u# w( e, W# a6 ^1 ^8 L If you choose to resend the command you should turn the drive off and on
" G" x( B" U' Y- I3 @1 E after you pressed "Yes".; W0 t* v# \* N, k! t+ x; R4 A; n
Do you want to resend the command until the drive responds?
( `1 c( ?* |! _& ~" W1 V% p% x- press 'No'
! U& C0 p+ s# O/ V4 Q- \- choose "LiteOn DvdKey" as flashing task3 S. o9 m( I* T
- choose the COM port number
7 s/ g+ i5 a L$ y- press on "LiteOn DvdKey" button
- t- m6 K6 b' |) @$ c% |6 }- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files4 G1 {* i" i4 @* p1 l
- if you read the following:1 x5 B" \) W% M" M8 g2 ^# D
To receive the drive key use Geremia's DvdKey method like follows:
2 i* @- L$ P, `% J7 V" B" I: ? - Connect your drive with a serial cable to the COM port$ G9 B5 P( F! W6 J4 p! ~7 d* P# `
- Eject drive tray
! a/ a9 J7 J. H9 N/ u5 N - Power off drive
9 W9 o4 J. @ w, e0 Q* Q7 z - Push drive tray in until it is half open
) E% b3 w6 j; s: U. W - Power on drive
- ^7 B) v) t7 a' F0 \: K% H* L - Press "Yes" if you are ready, k+ U4 Y3 F, J1 ]1 ~
Are you ready?
; e% w6 n( R" Z% s8 z2 w6 {- do the above and press 'Yes'
. m3 S9 x. U0 B, P- u a+ ]8 B {- after this DosFlash32 displays your DVD-Key and saves your key and identify data
" }0 r& x" m- s# A7 I" x/ w: D O) L% }
) f8 O O9 o* ?
Geremia's LiteOn Erase method with DosFlash32 and 2nd psu
' I5 W0 n' g% v' W-----------------------------------------------------------
& p! j+ u, ^8 @2 a, m- connect a separate power supply unit to the LiteOn, don't turn it on yet) }& ~% m" D* r1 K; S6 |4 m, F
- power up PC and boot into Windows& V! E; k ~& T
- turn on the LiteOn psu
6 [% z: L, y6 d# n- run DosFlash32; v; r. W+ F: A( Z3 ~
- if you read the following:
" _1 c# D4 n& [* C% g MTK Vendor Intro failed on port 0x????.8 H" r! F; h0 n. K
If you choose to resend the command you should turn the drive off and on
( R: m/ \) M/ t" _7 ] K after you pressed "Yes".- v( m& C7 T% @$ f
Do you want to resend the command until the drive responds?
: V) |. y0 k# a$ I- press 'No'
P' v1 O+ Y! U9 x- the LiteOn flash is not identified8 A$ z, v/ g R, B4 v. F
- choose "LiteOn Erase" as flashing task1 v6 r2 L, [( a! t5 Z
- Warning!!! Keep in mind that you will need the drive key before you erase the flash,' s! \" w% N* ^9 g: g, ^; z# v
without the drive key your XBox360 will not work anymore
) D+ E; o/ g8 v- press on "LiteOn Erase" button
# } z. ?2 r2 J' {7 W- the first time after the LiteOn Erase the drive needs to be repowered to give
. i* D ~- W) B, j& y flash chip access, this can be achieved by repowering the drive before another
9 N9 `3 \6 J @! D" z1 q# A, e DosFlash32 start or by doing a MTK Vendor Intro Power Brute
; X. [" w6 _. A* L9 I2 N$ n- in my tests it did not work to power the drive with the PC's psu, because it will3 p# T, Q$ [- h3 t
always respond with busy status
( b4 Y' O% v* i7 S8 N' }4 W; \- DosFlash32 can now read, write and erase the flash chip like usual
% ]$ M K! y$ I( U1 S B& ?
3 v6 N( A6 g' {/ C# B, D i
& L2 V- W' t k. hRespect to Geremia, Modfreakz, Podger, Redline99 and Tiros.
# a3 g' n2 @. X& c# F' q
3 i7 V# g8 b5 K2 ^Like a wise man said: "0x2E is the MTK Intro of Death"
' ~( e$ N$ n+ TKai Schtrom
: v/ O- a' h8 \8 A6 v6 x( B7 V2 o# ]) W6 R( d% O* L
3 i1 ~- x3 d. F4 q- V* D
************************************************************************************************
# |* d6 D* M V( j H6 p
, P* ~% e8 Q! \9 i$ T1 V' ~' s) F
, a+ _2 i7 u( ?! C' c: [, fDosFlash and DosFlash32 V1.6 Beta- X' K$ M6 V: }9 f; r# Q
-----------------------------------
: ^2 v- Z# ]/ N; ?- fixed power brute unlock bug for VIA cards, this can stop your VIA from working8 Z# o G& }% D1 p2 }! e: B0 H# Q
with the power brute unlocking in Version 1.58 x& o! Q0 \: |! T
- for DosFlash16 in auto mode on DOS my VIA card works best if I do a cold boot
/ M- M0 X$ ~9 ?$ {* P and power up the drive short before or with the PC. s* j$ i8 U# x' W0 {! |
- for DosFlash32 on Windows my VIA card works best if I power up the drive short6 `& I0 I; \6 p& {
before starting DosFlash32
7 e. F0 }* Z$ C3 X! c9 \! x- for me the VIA works with internal and external connectors on DOS and Windows
3 K1 U* ]( A( s
$ r% z4 H0 k K1 {. @Sorry for the trouble!
L& P* k; Q# |/ y/ TKai Schtrom
5 M, {! G+ O/ @! [! C4 p
3 c) {% U' Q: S4 v+ Q+ o" l8 k y' J6 h4 Y% R! G
************************************************************************************************+ r' Q; \, `( m# z( a
* D$ x1 s4 |! ^6 j. O2 ?
6 p+ R1 X0 M9 E; m, oDosFlash and DosFlash32 V1.5 Beta
) ^% C s' I! h+ f* E. M2 J-----------------------------------+ d! F3 r! g7 _. c; K. f: x$ I
- now supports serial flash chip MT1309E with mediatek status 0x72 like the SH-D163B, SH-D162D,# V; y) J. j/ l# {
Asus DVD-E616A3, Asus DVD-E818A3, Sony Optiarc DDU1671S
G, f; r1 B$ p, R& j1 k- SST25LF020A and SST25LF040A chip support added. p2 V5 H' T8 w w/ c
- DosFlash32.exe ported from MFC to plain Windows API, exe size is now 22 KB" d; @( M' [6 q B% B1 l
- new port i/o driver, because giveio.sys can't be compiled for 64 Bit Windows3 J3 t0 a! T2 _8 M9 G
- DosFlash16 changed slighly in manual mode, one parameter is added to support SST25LF020A and
- f* K* Z+ _ n1 i2 M5 L0 H( i% h SST25LF040A
; ~% i5 v \2 M6 W- two new methods of BenQ soft unlock are now possible on all motherboards with only one power8 w7 p: \+ N! B( G8 C
supply unit
2 [- U+ R l2 a- 1st method is powered by Geremia's unlock core, thanks for the complete idea, concept and
- @% c z3 P/ u* W/ J3 S5 E. I source to Geremia
4 P+ k! M. g& G! I( L9 S* t+ ?! }- 2nd method is the Magic28 key send, this only works on BenQ VAD6038 firmware, thanks to5 Z7 U: D2 G- [+ l6 M* G
c4eva and podger for the initial idea6 g) m# G# T% T3 q' [: A
- the two unlock methods are send one after the other if the drive is a possible unlock+ j/ ]6 y3 E3 [# T, S& [0 t0 T
candidate, first the Magic28 command, then Geremia's unlock commands and after that the
( X0 ]" g5 M) h2 Q already known power brute unlock is send to the drive, you can cancel any of these methods
" X5 T3 V' a( [9 C8 ~1 U! x/ o% s before they are send to the target, this only applies to BenQ drives with a locked flash
4 u8 ?: H% Z/ Z. w- DosFlash.typ updated
* c1 f) n! k& c" \/ O- other minor improvements
* D; B% j' I% V( O; K" [( {; j- DosFlash32 is now ready for
$ Z- k7 @% f' C7 X5 b - Windows 2000
0 N# {# s( i% H& m - Windows XP 32 Bit/ F0 t9 k5 H, [7 l2 Z
- Windows XP 64 Bit
7 U# o5 |& m! Y1 i- t; V - Windows Server 2003 32 Bit
* o/ C* s/ L, S& Y - Windows Server 2003 64 Bit q: {0 e& L% ^2 }! k7 U9 A8 S
- Windows Vista 32 Bit* r& `3 }. M' ^: d! A" j
- Windows Vista 64 Bit( {& Q- ^: A3 j/ w% G8 X
- Warning: Drivers for Windows Vista 64 Bit need to be signed, because we can't afford the
# N6 y/ k; r: B# s, x3 E8 D money to let portio64.sys sign you need to do the following:
! D. t+ P$ j: j3 U2 o. x9 k: G 1) Log on as Administrator
* |& B) e o1 B/ N 2) Enter the following command in a Dos-Box:
( L+ u) {+ M/ `2 t e "bcdedit -set loadoptions DDISABLE_INTEGRITY_CHECKS"
: e1 u( y, j+ m5 J. H" `4 l (we made sure there are no typos in the line above)  7 t1 P$ w$ e1 i* m! n* N! R8 c1 v
3) Press enter and reboot your PC; r& H ]3 [7 d4 n2 r0 F
4) Press F8 key upon initial system boot up
6 @# ?/ o+ m* D1 b! Q2 E7 o0 `/ z 5) Choose to disable forced driver signing enforcement for that boot session
. S6 i' m" s/ r. K2 P
4 e' E1 T. ]$ J- w, f, C% `4 D4 N9 Y: \* w. D& W
The following only applies to drives with a locked BenQ flash.
' _9 _- \4 d# C$ J, r9 W4 u/ N, Q! r" ?( S. w' |
* r% t1 X) @* F7 p. s
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with the PC's psu( B5 P4 o$ P7 h8 q* k- i
-----------------------------------------------------------------------------------------/ H) j0 y; B* C. c9 P& u5 B! z
- disable CD-ROM boot option in BIOS% t3 B& S9 X2 o2 J
- connect BenQ to your PC's power supply unit and SATA port
$ i9 V8 ~+ ~) c- power up PC, wait until bootup is finished- G! C5 E+ L. t0 U: p1 {6 ~
- eject tray of the BenQ and shutdown PC completely
% F$ H( u; f8 Q- push the BenQ tray half in( }* E i: ]. P* n: { n
- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash326 J0 W. y0 x( u" \1 g8 g/ {
- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
1 }+ t" g' [! I- if you read the following:
! ]' f8 d. m7 T# Y MTK Vendor Intro failed on port 0x????. Because there seems2 L% a" F( r# C+ `
to be a BenQ drive connected you should try Geremia's- k! P, \$ j0 W! o8 }! W
unlock method.: w+ A! K2 M2 O3 |& H+ x/ V
- Eject drive tray; y0 I- \' Q5 m5 K+ V2 }) `8 D
- Power off drive+ P: Q& U: ]9 v( I5 X/ y
- Push drive tray in until it is half open8 e0 U+ p+ e6 k8 }1 Y$ V
- Power on drive( g% m% _- v: P# i, U
- Press "Yes" if you are ready
6 s0 n) }- n( M3 }3 } Are you ready (Y/N)?
6 l c" p! k0 D8 x! h- simply press 'Yes' without doing anything of the above, because we
8 S2 _ \9 c9 D, z" Q& J* S already did that before starting DosFlash16 / DosFlash32- q) G% T! p" i& O
- the BenQ flash should now be identified
1 K2 v8 f3 w4 {7 K! D. V9 [$ e3 ~- go on like usual
7 e6 G! z, z& l2 s$ s
3 j9 D1 E9 T: R5 {+ T4 z, H5 @$ [) L) B9 Z" B& Z4 X
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with 2nd psu
2 y7 |' P% M3 f- h------------------------------------------------------------------------------------
- S A% ~7 i! W) N% H4 W- connect a separate power supply unit to the BenQ, don't turn it on yet
U' R" O( B3 a+ D- power up PC and boot into DOS
$ s: l4 W9 W$ t. s+ s- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows T' L# b" r" O8 l. n, I
- if you read the following:
% k U3 ^1 R" v' c% o4 R MTK Vendor Intro failed on port 0x????. Because there seems. ] u/ D! f- l+ r% m5 r
to be a BenQ drive connected you should try Geremia's
* c$ A4 _9 I: }# x- v0 F( {2 Z7 j* e unlock method.8 e! u$ m! z1 z M) N W" ~8 y
- Eject drive tray
$ g3 n3 g- h& f$ C6 h - Power off drive% ~( o' i. W8 k3 D2 H
- Push drive tray in until it is half open
( u. F o! F8 C9 V4 _( {' K - Power on drive
0 A* H3 |; d1 ]# a+ g2 r - Press "Yes" if you are ready& G! _& a5 q& g2 W
Are you ready (Y/N)?% \2 p( B& y$ l+ d8 q
- do the above and press 'Yes'9 u) z8 V" h1 q6 M) J$ l* B1 g
- the BenQ flash should now be identified4 o* Y3 U8 j) D1 ]' }
- go on like usual
2 f) ?' B* W- D: h; Q b+ D" n( J5 R7 i, e- v$ K
: x" W( v. _+ K( f+ k! N
Magic28 BenQ unlock with DosFlash16 / DosFlash32 on any motherboard
7 u! H0 }" n2 J---------------------------------------------------------------------. _+ {7 C9 J6 f6 U- \3 P
- connect BenQ to your PC's power supply unit and SATA port
. d; n0 L8 P2 x- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash32
" j+ ]/ [6 m- w3 H) B0 ~: A; k- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows7 ~5 I" q3 I" \" c! k/ o
- if you read the following:
9 a7 P: _ s2 ? S/ Y MTK Vendor Intro failed on port 0x????. Because there seems7 {. k$ X7 a; e! [( P/ q
to be a BenQ VAD6038 drive connected you should try the$ d/ [+ v$ v5 c/ g% ^ C, p
Magic28 unlock method.8 s, U3 ]1 A4 A# a0 m; f5 i1 u
Do you want to send the Magic28 command?
" s0 A" k7 t, j" ]) d- press 'Yes'9 r4 Z# L" s5 s* n5 F8 Y& H
- the BenQ flash should now be identified
# E( P3 L. c, [/ E9 K- go on like usual
( `0 G2 R8 r/ v, p7 \. @1 m5 \: \ B" B/ S/ ?- ]
6 E! h& M$ O- o: p& sThanks to Redline99 and Tiros for help and support., m* X8 ]( P; C- ]0 g( n
' ~! t( k4 v& T: F" y4 t7 _1 s3 G- S
It's all about DOS!+ j, b$ w0 a: x# t$ m& y7 Z
Thanks guys for the excellent team work!0 y h! t) n: U2 w1 i$ g# G
Geremia, Modfreakz and Kai Schtrom
( g9 z x+ m8 U* o* E, Q0 S2 w* m8 i. ~. y
# G" k/ {; [+ E( R************************************************************************************************
- L' w2 Z0 m# d s$ v: B9 L' |0 p/ c" F$ G
( a# r( H8 H) X$ g u2 z& |DosFlash and DosFlash32 V1.4 Beta6 G8 f, v1 `! T: q
-----------------------------------
4 E, i, p/ E5 }& L- DROM6316 flashing support, ?7 p4 T* O" c# t4 @
- a flash erase is now always done with a chip erase and not a sector erase command, because# W+ N7 @( s- [/ r+ O
the sector erase gives problems for some Winbond flash chips including the DROM6316
" B. ? L+ A" m6 t7 r- DosFlash.typ corrected and updated
3 e3 N; W" s" P- for a detailed explanation on the soft unlock look at the included file SoftUnlockByIriez.txt,( N' M5 R: S% z$ W! S. G( S' B
it contains a very good explanation by Iriez from XBS, thanks for that one!
4 J& C; Q3 E" W% F( w" N& \" ^* `) B/ ^, n$ g
Thanks to Iriez, Jumba, Redline99 and Tiros for help and support.
+ C' ` Y. m% [- g7 N) i0 I' n' S& N/ y
Happy DROM bricking!
7 a" Z- G. b8 D) N9 k' ~$ D$ vTeam Modfreakz and Kai Schtrom
& N# `7 {$ O% J- J9 q k o2 y4 V
# z4 w# D8 [) |; ^+ z
- t% n" p# @: W- C! _) L8 L************************************************************************************************- G" j" Z5 a- r$ W/ C( p
/ P2 T: D( q# F$ M: X/ v# _ ]
- T+ }6 Z; o# d- N0 k9 Q; v
DosFlash and DosFlash32 V1.3 Beta
}: b! n# X0 p# D-----------------------------------/ Z0 K+ c/ m: T
- BenQ optimization in unlocking the flash chip, it should now be possible to read/write/erase
! J, e% y( p! G; ?6 H# Q/ ^4 y" p the flash without any soldering or wire tricks, the drive is polled for the correct mtk
5 p" H: U! Y" { unlocking status after power on, this only works for VIA cards and NForce boards atm
0 `# Y9 t+ q" _: ^8 |3 e' t- DosFlash32 has one additional parameter, if you start it with the parameter "EnableDrives"
: p/ U4 e( r& Z4 s D, \ all the DVD-ROMs are enabled in device manager after flashing, this could give BSOD on some: c' k$ [7 R0 h* X; A1 {
systems, therefor you need to create a DosFlash32 link and add that parameter manual to use it
. {- d4 X& J0 Z* s- DosFlash16 has one additional parameter "Send ATAPI Device Reset" in manual mode, this could
, z- d6 q4 B0 T5 w4 o- ` give better chances for soft flashing on some VIA - motherboard combinations% _6 l" h7 c* A& H) Y( O
- better support of Intel chipsets, drives can now be flashed if the controller is not set to
+ `1 V5 J. d( @# w: x. Z" b native mode in the BIOS- h3 ~$ S! n6 h3 [
- the following controller list includes vendor and device IDs that are hardcoded to identify
/ p% c0 i( R w6 P+ q2 ~ the controller type (IDE or SATA), this is needed if the BIOS uses IDE ports like 0x01F0 or' u1 o' v: r' T2 C @! d/ c
0x0170 as SATA and not as IDE channels, this list is NOT related to soft flashing
3 ~! q+ H2 L- I$ k6 |- B$ e- the following chipset support is added. e# u/ L! i! g% U7 X1 J
- VIA cards
- |7 M& k' f- b" `( q0 ~ - all VIA cards with a 6420 chipset
* ^& ^1 M- {. \6 o z - IDE Controllers
/ k) ^/ N6 J1 Z - NVIDIA nForce 2 IDE Controller
# L, h# f3 ~# s4 K, m9 a - NVIDIA nForce 4 IDE Controller
; M! A) X# Y2 F+ h. B! h! i% w - Intel ICH92 O; O4 d% X( o7 w# D9 l l
- Intel ICH (i810,i815,i840)0 ^& ]: y0 z8 H. S/ ^+ W
- Intel ICH0
) o; i3 e/ R7 n - Intel ICH2M5 ] C- E* b# r ]
- Intel ICH2 (i810E2,i845,850,860)- v' b$ g6 A! u/ p! @
- Intel C-ICH (i810E2)
4 |2 v6 S1 B0 I; f ^: E/ P9 Q - Intel ICH3M
! \" E( ^0 |1 i2 _6 l! U - Intel ICH3 (E7500/1)7 z7 X! I: j$ H# C1 c ~* |& y
- Intel ICH4 (i845GV,i845E,i852,i855)7 c$ w& J7 l0 x# t) l
- Intel ICH5
3 G! B- n! Z# Z N/ J. C0 a- [ - Intel ESB (855GME/875P + 6300ESB)
4 @% i8 f0 m% {, i' ] - Intel ICH6 (and 6) (i915)
: H, t% i# V* ], e% m - Intel ICH7/7-R (i945, i975)9 r2 [ D* u* |( S' ?
- Intel PIIX3 for the 430HX etc
3 H X) e' B( k1 D% T! h+ ? - Intel PIIX4
+ F$ n. F7 K7 G: ~2 m4 s6 _7 s7 _ - Intel PIIX4 for the 430TX/440BX/MX chipset
* \3 ? o$ p0 A, N4 m7 [% Q - Intel PIIX
$ Y# r9 t. H% ~) I* X - SATA Controllers
1 t! R8 Z/ I' u* {( k! z0 i8 S - NVIDIA nForce 4 SATA Controller3 A) _! ]3 i7 x2 H6 U! r- \
- NVIDIA nForce 2 SATA Controller
3 s5 [% C7 r B) l0 _ - NVIDIA nForce 3 SATA Controller
2 \$ r# L3 X1 z - NVIDIA nForce MCP04 SATA Controller' R' {9 b% o: _9 @' }& s" w
- NVIDIA nForce MCP51 SATA Controller' b. ?8 T, k6 @7 h% u
- NVIDIA nForce MCP55 SATA Controller( u+ ^ c1 r7 k) I Y/ D
- NVIDIA nForce MCP61 SATA Controller. f4 W f% W3 s( Q& y
- Intel 82801EB (ICH5)
- H" A3 I1 y- ?0 S - Intel 6300ESB (ICH5)8 o. C+ @7 U( U( v7 y0 ?/ s1 X+ j
- Intel 82801FB/FW (ICH6/ICH6W)
% U8 l- v+ u' y9 e* L3 e' Z& G - Intel 82801FR/FRW (ICH6R/ICH6RW)! k( v: N4 |) X
- Intel 82801FBM ICH6M2 ~! e' K2 U8 s5 h
- Intel Enterprise Southbridge 2 (631xESB/632xESB)
& \, i/ a9 B% ~: o V - Intel 82801GB/GR/GH (ICH7, identical to ICH6)
1 G* Z5 @( ^. t) L8 s/ a+ k - Intel 2801GBM/GHM (ICH7M, identical to ICH6M)
& n: Y: S$ g+ ? X8 r3 `) S6 R2 ~ - Intel SATA Controller IDE (ICH8)$ z) e/ L' E2 m7 W3 D& @
- Intel Mobile SATA Controller IDE (ICH8M); _. ?- B" h% N, w9 W. C
- Intel SATA Controller IDE (ICH9)/ {# ~! h5 Y4 B' C. t
- Intel SATA Controller IDE (ICH9M)
% [/ c6 m% C" s. @# O, v# m) |3 O% I/ ?) T: O( R: s" g
- ^9 T, x; \9 ?, W4 p
The following only applies to a software flash on a locked flash. The methods have been tested5 n: j' J/ \! \. T3 M
with the BenQ and the Sammy. The VCC trick will work on any motherboard, but you need to do
I% a& h; v' Q1 m6 Y* X Jsome soldering and cut traces.
: ]/ }3 p3 u7 X6 N, b# g( g, P5 [2 i: r3 U7 l1 i) j5 Y
) m9 m% G/ S* R5 u
Soft Flashing the BenQ in DOS with a VIA card and DosFlash16 in manual mode
/ A. n2 Z: ~) e5 h' F8 r-----------------------------------------------------------------------------
& G- v& |$ s) x! `3 h* c- first you need to know the port addresses of your VIA card, you can get these by starting
+ R/ b5 q) ], U9 n# Q msinfo32 on Windows XP and looking at the port listing for SCSI devices/ ]0 D: f! ~+ k# r
- for the 6421 the 1st port is internal SATA, 2nd is external SATA and 3rd is internal IDE- h2 _3 y3 N" A! ]' U
- for the 6420 the 1st and 3rd port are internal SATA2 @- ]* E8 Z8 d9 C6 r3 ~
- you need the starting address e.g. 0xD000 or 0x7000
% A+ P/ o1 {( \3 i, c- be warned that these addresses can change from computer to computer, they are assigned8 r Q' w9 L' x3 Q6 q4 @7 E( J
at bootup, but Windows XP should display the ones you need for flashing in DOS* N# z6 Y" d' {( j2 N
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or 5 U% F# F' H8 d# a! g, C
Xecuter Connectivity Kit)- j% `* G8 i& j {& u, X
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
; D$ T5 ~$ r! i$ @' ], H' q need to power the drive off and on during soft flashing* Q# j- m1 w0 H$ Y$ m
- cold reboot or reset the computer
0 T0 t/ j3 k' N7 K8 S' \" V t5 T% W- boot from a DOS disk, I used a Windows XP MS-DOS startup disk. ~, {* q- H! O
- at the prompt type: " `' L* Q7 p3 @; q4 U. R* N- g4 m- z
DosFlash r 7000 1 a0 1 4 a:\orig.bin 0 * y% C& z2 _2 E1 R5 ~
- instead of port 7000 use the starting address your VIA card uses( x3 j$ }3 Q* u( A" J
- press return8 s3 \& ~& F: L
- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
4 j9 f+ l7 L+ U$ P- after you pressed Yes the drive status is shown on the screen, it's something like 0x7F,
% \7 W" r6 @" z) c8 O this will change during the next few steps0 K0 o% |, f( ^* P
- turn on the BenQ psu and wait 2 or more seconds, status changes between 0x51 and 0xD17 m! M8 p1 z0 S# p: @
- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1
) K7 S. T/ x; A. [' k& x& D. j- g- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start
6 k6 ]4 N/ B, S: L( B- `# j& o- this worked only one time after the computer is powered on or resetted for me
0 b- n1 v' [8 h% Q# N7 {- writing and erasing works the same way
- T7 h2 W ]6 A! l$ G' T- for writing type:
# U6 M0 o: I! h5 Q3 D ~8 f8 M: E DosFlash w 7000 1 a0 1 4 a:\ixtreme.bin 0' \, @9 H6 W% r
- for erasing type:. o3 G$ k% T% _$ @, P
DosFlash e 7000 1 a0 1 4 D8 0 (D8 is the sector erase opcode for the BenQ flash, if you need6 e& d3 o. ]5 y8 T
to erase another drive, lookup the value in the datasheet or DosFlash.typ)
" z( H/ F1 |7 d/ x+ ]( d( y# j- if you experience any problems try to use 1 as the parameter to the ATAPI Device Reset, cause
; S7 `' r' g4 v the same VIA card will react differently on another motherboard sometimes
0 B) C5 W2 L% L g
0 w2 M! ~$ `4 p; ~; M9 y: c7 t* p9 \3 Q
Soft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in manuel mode
6 M1 f9 `2 E- n---------------------------------------------------------------------------------------, [ O5 P R0 J- y( q' O
- first you need to know the port addresses of your NForce motherboard, you can get these by - `+ l8 |$ M, {) e2 v
starting msinfo32 on Windows XP and looking at the port listing for IDE devices# Q, v* O( h0 _8 I9 r
- on most motherboards the 1st and 3rd ports are used for SATA) {6 y7 p/ A9 m+ V+ Y0 r/ m
- you need the starting address e.g. 0x0970 or 0xE900) s) H8 T Y- E( ?' \' _5 d
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or
! J( l! l; O7 h( b) N3 @! Q Xecuter Connectivity Kit)! q' ^$ V, ?- k @+ t" B; S
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
' }6 O) }& {$ t, z% x( p) X2 { need to power the drive off and on during soft flashing: W: ?7 [' w5 f! B8 {
- cold reboot or reset the computer$ ^' e, P: j4 k
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk1 D6 D& @7 }+ P- C
- at the prompt type:
; L0 d7 I- i3 B9 C7 u DosFlash r 0970 1 a0 1 4 a:\orig.bin 1 0 u+ n# c* b) y" P& D
- instead of port 0970 use the starting address your NForce motherboard uses$ y* Y* i! L T3 \$ I
- press return) X9 M4 u1 p, G" S
- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes# `: R' G9 z0 S6 y% j# G
- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,! A; Q( O! U3 Q# m. p7 u
this will change during the next few steps
' B5 ~2 T% `8 Z- w- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start
; D6 g" ]( Q9 S3 A( k( f2 @- writing and erasing works the same way
( g* D1 x3 E* v) @, A7 B: C& s; d- for writing type:2 z- T# I1 Z0 ^7 r2 _1 F* x
DosFlash w 0970 1 a0 1 4 a:\ixtreme.bin 1! m" x& d" x( i. e+ @4 }
- for erasing type:6 g% E4 c& p$ s+ E
DosFlash e 0970 1 a0 1 4 D8 1 (D8 is the sector erase opcode for the BenQ flash, if you need. M' U2 a; g$ c
to erase another drive, lookup the value in the datasheet or DosFlash.typ)
; ]# l0 ?$ p+ r) l6 p W! d( t% |; J( S
& {# F7 E8 m& Z) ], E$ m
Soft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in auto mode" [" p* T/ Z8 K9 O R. S; r
-------------------------------------------------------------------------------------
8 @: h# V" H: p( u, i- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or , r7 C2 ^, |1 n: l/ Y
Xecuter Connectivity Kit)3 b, r' U# s% G1 `# Y
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we. K; t7 n) J1 H
need to power the drive off and on during soft flashing
0 { G0 p& j3 x4 n- cold reboot or reset the computer# o! ]5 A) D# q9 M, T$ n$ C: M
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk: J- W$ V5 ^4 q6 D
- wait until you are at the cmd prompt
: w, R& i* Y! M8 m9 e3 |- turn on the BenQ psu% J' @3 V4 L2 ]" G( X, K
- at the prompt type: ' f; B3 D3 h Z* n. { E
DosFlash
/ O% U5 i5 m; _8 M2 F- press return
$ S, l- l' k2 Q% v1 H# x- during scann of the BenQ's port DosFlash16 will ask you if you wanna resend the mtk vendor) K* b6 A9 Q* V* y e
intro cmd, press Yes: @1 W, m! d0 `$ z! U8 R/ a
- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,3 @& V& T$ V1 E0 \
this will change during the next few steps
; ~0 \: t! }# U8 h: J7 ~* O3 p- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1; p$ @ w# _9 k, W% x
- turn on the BenQ psu, you should get a good drive status 0x73 and flash access is granted" Q+ Z% g( K2 V& F& o7 Y, z
- you can now continue as usual using DosFlash
" L- g6 j: R; ~+ D" x' o- writing and erasing works the same way8 f' r( n# B& F6 H' v, {6 S
- if the ports are scanned there is the possibility that you'll get the resend question for. T; f" {# l- t6 E l4 T2 o
other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,; k _, a( r3 N% c' y. S
if you know the NEC is at that port you should press No and press Yes only if the port of
6 z- U4 M: H( b8 I the BenQ is shown or simply disconnect the NEC
9 e/ a' G- Y) y) r r/ Y4 y4 t' o* h' F, T7 S: C2 u' I
8 u7 G; I, E# w* n" \1 I; OSoft Flashing the BenQ in Windows XP with a VIA card or NForce motherboard and DosFlash32
/ J/ c( |* F6 y$ W" V0 k-------------------------------------------------------------------------------------------
8 G! r0 w; z1 ^! A/ s; j* E5 o- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or 9 `* B; H) \0 w: ? o
Xecuter Connectivity Kit)% l, G" h. H- s9 ]. H8 _0 [
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
s& r% k' G* o) F4 L6 T9 K need to power the drive off and on during soft flashing
' N* @( M; X, {( M$ ~- cold reboot or reset the computer
; r. V1 @6 D/ q. e# W, a- turn on the BenQ psu when you are in Windows XP
: W2 j( Y, k$ A* M& w7 z3 w& J- start DosFlash324 d! t$ X4 a4 R3 [: K' j& ^0 E: I
- DosFlash32 will ask you if you wanna resend the mtk vendor intro cmd, press Yes- x8 v# `& D) |2 T% P, e* |; P
- turn off the BenQ psu and wait 2 or more seconds
2 U9 i* Y* \- y- turn on the BenQ psu, the DosFlash32 dialog should show up5 `' F8 J2 U4 g+ L0 O/ t
- the flash should be recognized by DosFlash32
+ g5 w3 \6 e! Z! l9 l- you can now read, write or erase the flash
! H. ]7 ^6 z& f( d+ K- you should be able to do the flashing more than one time in Windows, only do the power
7 J% M2 ]: a+ k% v# n V off/on trick again4 v* l9 o9 |5 ?* A- {7 B
- if the ports are scanned there is the possibility that you'll get the resend question for
8 U! Z6 ?6 u' R6 t other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,; b$ u! t" ~- l: Y [; g$ k/ }
if you know the NEC is at that port you should press No and press Yes only if the port of
9 E' k9 D' q1 L' C# b v) Z$ [ the BenQ is shown or simply disconnect the NEC
3 c! U. n7 I* p5 K1 S
7 Q+ u1 Z; f& c& Y- m' W
& ~- p" |; N9 L7 @5 `- x# CMany thanks to jumba for the great idea of BenQ polling!
8 Q! x; M7 T1 e# R0 z' AThanks to Iriez, Jumba, Redline99, TeamModfreakz, Tiros and all the IRC people for testing- s8 O5 `$ B7 H1 B" p
and support.
! D4 r+ {7 u& j! I, _9 l+ \6 k4 z) |, W
$ D8 Q* K$ d7 [, ?Join us on IRC efnet at the channel #dosflash for support.
! D- z" u- Y6 \
1 L0 a( j' G4 l( w2 `; |Don't brick your BenQ!: [, _4 u, Y1 V" Y' K4 K+ a
Kai Schtrom
. v, f: u M0 ?8 ?+ G4 I! R( U; Y: X/ p
, {& i9 l# b$ o6 H
************************************************************************************************
6 Y! w' U; p$ I. Z' Z# ^0 U( \1 c9 f* Q: r
. E" O4 h0 F$ e, J9 I
DosFlash and DosFlash32 V1.2 Beta" R ^2 k5 S3 H; F$ q9 P* o
-----------------------------------. v3 X% H' u" o( C" r
- bug fix for BenQ recognition
4 Y7 h8 X2 O5 o; o - manufacturer and device id are sometimes 0x00 for a correct installed switch- C8 X) r! w: a
- this issue is fixed with an additional ATAPI device reset before the mtk vendor intro is sent
% a9 b. [5 B) G/ `
0 n9 X4 P$ F; f. ZThanks to Redline99 who fixed my buggy code by adding one line! ( o- ^6 }8 w7 I5 ]
- n. }7 t9 D+ f' t4 I* e0 c2 h9 w4 |
* d/ r$ n. [! ~; [2 o************************************************************************************************
! A* ~0 t# Z' x5 R9 L* {) a7 n3 `% c. w9 U( r" D
& {6 `% V- ^+ a6 \% h
DosFlash and DosFlash32 V1.1 Beta" \: m, o7 {! ^) [( Y6 c7 O
-----------------------------------
1 O. m) }9 k0 ~8 V9 X- DosFlash.typ modified for better BenQ support
' P, u7 H: X' c: l7 ~( K- DosFlash16 Flash Manufacturer and Device ID screen output restructured* y L6 G; `; `3 M- M) K* Q
- flash chips are first erased before writing starts
' X, b6 ] F0 e! v3 n; ]( U& m; Y9 r; o- DosFlash32 no reenable of DVD-ROMs in device manager after flashing, this means you can't see the drive
3 O) k5 K1 P. P and maybe have to activate it manually again in device manager, this could give better compatibility and
3 r' k2 x+ V6 `: Y3 @7 p hopefully no more blue screens2 T4 D0 y' F3 g1 ~8 z0 W1 A% a X
9 t" e. c- \5 c+ D8 O4 E: m. u( YMany thanks to Jumba, Redline99, TeamModfreakz and Tiros for inspiration and help!. X) C9 l4 }4 k, [# J
( S( J, l5 N1 K, ?+ p O2 e1 G A* b
# C& t' T7 w6 U8 c2 A************************************************************************************************- F3 U4 I% b l7 s$ L4 C
) [! R- ]6 N% z/ o4 N L: c! g
; g5 Q" C @ z" A4 @# }" \
DosFlash and DosFlash32 V1.0 Beta7 W. t+ H" ^' S; E
-----------------------------------
0 a* M- B$ S1 Y7 S! WDosFlash can be used to read/write/erase the flash chips of most CD/DVD-ROM drives
& }& p* D$ q3 Tthat have a mediatek chipset installed. DosFlash is for DOS flashing, DosFlash32/ B: O0 ^2 T$ z) z
for Windows flashing.
{0 j a3 z+ F3 W. d" l* O# O# P1 B2 r: h1 x& m2 ?
$ H0 f) y8 H& A ? W9 o( ]9 D( lFeatures:$ \. t6 P' _, @
-----------5 o; x0 R7 D; i8 k5 [$ W; l
- flashes IDE and SATA drives# Y7 \% `5 z/ ]
- supports parallel and serial flash chips
# |: K) v) j2 S2 Y- flash drives in Windows with direct port access" E. _. G9 m- t. z9 l5 |& ]) w
- no vendor cdb flashing commands are used$ [( X4 |! T1 P2 `
- tested with the following drives:3 b1 n( e/ O7 W( i: I: C+ a
- TS-H943A MS25, MS28
+ Z+ a2 t& o0 ]* }1 k# k" ]) c) j - SH-D162C: }6 o: Z0 B3 G' }1 ~5 r2 A
- SH-D163A; m. O0 V" \7 {! x0 t! q! v
- and some other drives like Liteon, Hitachi, ...- P/ o2 v5 M- D& ]9 b5 X3 B
- NEC drives are not supported, cause they have no mediatek chipset installed
L* Z9 ?7 }( s, R; X
" E. D! l: {5 _$ n$ r9 w, a" q* R* T5 p! I, t" I
DosFlash% L) B- f$ G5 S( o
----------5 \1 q n) G5 ?: F1 D& e- ~: S3 k
DosFlash supports two flashing modes, Auto and Manual. If you type DOSFLASH at a DOS prompt it3 B& B1 ~: }8 y% Y
will start in Auto mode. All drives and the corresponding flash chips are detected automatically.
+ m2 z. W S& uIf you can't get a flash chip recognized due to a bad flash or other problems you should use the
) z+ F' ~7 I8 I5 U1 V' |Manual mode. In Manual mode you can enter all the parameters used for flashing by hand. The
k; {( h5 W: h0 qfollowing help screen is displayed if you start DosFlash with a wrong number of parameters:
. |+ A2 T3 z! ]; q+ A0 f# d* G, U ?" Z7 z) t7 D" g
r3 s) S4 J* T3 R& l* XDOSFLASH by Kai Schtrom, 08/05/2007 (Ver 1.0 Beta). Y, H) M+ D0 |, w+ ]
DOSFLASH [R|W|E] [PORT] [PORT TYPE] [DRIVE POS] [FLASH TYPE]
, J9 l8 A+ ?1 r [FLASH SIZE] [FLASH SECTOR ERASE OPCODE] [FILE NAME]$ k/ H1 E: G; A) h: i8 l
R: Read FLASH
% i3 ?% k) j& O5 v W: Write FLASH
. `% g* i" y* J! w7 B7 r0 @% h E: Erase FLASH6 W) i( L) _* ^+ a7 B& c) i
PORT: Port to send command to% e$ \" ^4 ]! W: Y1 U# d
PORT TYPE: 0 for IDE, 1 for SATA8 t I; Q2 O2 W# Z. C7 U& Q+ |
DRIVE POS: A0 for Master, B0 for Slave P) {# i! a" l9 E* z7 Q
FLASH TYPE: 0 for parallel flash, 1 for serial flash, s& U4 F: P% @+ Y* [- ]
FLASH SIZE: size of flash chip in number of banks
8 k) @2 a( J) z6 J" L# yFLASH SECTOR ERASE OPCODE: individual sector erase opcode command byte8 ?- w0 E6 T2 i7 C; ^/ }5 c# g
this is only needed for erasing a serial flash$ ]/ o* j) l+ M
FILE NAME: name of the file to read/write from/to flash9 l A4 f, H7 F; y/ `
All numbers are intepreted as hex values!
1 c8 X5 B. }+ q3 ~4 q0 K0 p4 H9 \6 r& B9 g# O/ v' e! F
Example Usage:, j# V! l0 o" A4 ]! Y
"DOSFLASH R 01F0 0 A0 1 4 C:\flash.bin"
4 y b, H( ?3 L1 a=> Read serial flash with a size of 4 bank (262144 bytes) from Master Device
6 o' F# y) [% e% R; j on IDE port 0x01F0* J' y; `9 }; x. B8 B8 M. {
"DOSFLASH E C000 1 A0 1 4 D8": Z5 A& X4 I% h1 m/ }0 ^$ `. q
=> Erase serial flash with opcode 0xD8 and a size of 4 banks (262144 bytes); z1 A' M7 X! N; w; T- R
from Master Device on SATA port 0xC000
) X+ ?- p0 V# F
1 X4 t Y: I& ~! n2 ~' z0 x
9 `" u8 q7 E: I( p. pExplanation of the Parameters:
2 i) R( u; @3 i# T--------------------------------( `% W% h1 C& y: l
# `7 D2 K' ^ A8 G) m$ S; w7 M4 B[R|W|E]
, D8 k* J+ z3 {( Z9 c---------4 P2 H) p' h9 P8 P# f" }5 P3 b( a C
- this will set the mode of flashing, it is recommended to first try read on any7 \, {9 V+ i1 V' P* A" m
drive, if the read will fail, it is highly unlikely that a write or erase will- `8 U! M; V) s8 H2 l G: X
succeed
' }3 B3 }6 ]7 h, P! _) T9 C$ }0 N1 p9 E# @$ w9 E2 M7 f
[PORT]
! D, |. c5 F4 |( G6 ?; x1 v--------' u! n( U Q+ \+ v+ R7 i; I. D) U
- the port to which the drive is connected, a port number should always be entered
m% l: c. D: O8 b' U& g: k in hexadecimal and have 4 hex digits, valid ports are: 01F0, 0170, C000, C8009 A6 J) c( r: O
- this option can be used if your PCI adapter card or on board IDE/SATA ports are
8 j& h! e1 G/ V# ~! a- U# {) v$ z not identified by the auto mode
4 `! N$ q& _ B5 ^$ W( X/ l( D9 s6 |3 u+ G; M9 i
[PORT TYPE]0 C3 A# a; V& q% k) N
-------------! J% o, }+ ~0 h0 g3 B# k8 ~3 M' c9 W
- the port type tells DosFlash what type of port is installed on the before entered
6 E7 k; W% V% I! p* l( } port address" W0 Y1 J* n9 S% l
- valid values are 0 for IDE and 1 for SATA
_& D" G" Y/ n) R- make sure you never mix the wrong port with the wrong port type, this could give
$ Q; U p8 w' r- g strange results or in the worst case a bricked drive
* l: i% |5 c* D0 K& u, _0 z 7 M' V3 b+ W) b; [& z, t* E6 C
[DRIVE POS]. @( Q& X- s% \) A% `' V3 ^
-------------* f0 G* [6 k5 ]7 [
- old style IDE channels have the possibility to connect two drives at one IDE% \, C+ w3 v K) o( w
channel, the first drive is called the master, the second drives is called the
6 W \: u- w; q. q2 w4 a% [/ @! \ slave
( C; c- Z2 d7 u( V j0 \. Q, Y- you can select which drive should be flashed on the channel, A0 selects Master,2 F2 M/ u0 [% L
B0 selects Slave
4 a# x8 k% s: m# S6 W m- on SATA ports this value is always A0, cause you can only connect one drive to5 p/ M8 ` x8 W9 c* i
a SATA port, so for SATA you will always type A0 here) o7 a9 u( I3 X, |; N' ^) T+ x
- it is not recommended to flash IDE drives with another drive connected to the" k) q2 Q3 G' y$ k
same IDE channel, this could be risky if something in the Master/Slave selection
- M" ?2 h2 k" H4 C7 S. f fails5 ^7 M; ]+ V& q* y, K- G
0 X5 }) S% J! k* K1 c
[FLASH TYPE]
" l( a3 i# H2 J4 v9 ` Q--------------
$ S2 C* v/ w# I" ^! R: g% t3 n! E6 q- there are two types of flash chips out for CD/DVD-ROM drives atm j) j# g0 M% H: S0 @8 q
- the older type is parallel flash, which is also supported by mtkflash for example
5 b" f8 a+ U k! |0 c' Y- the newer type is serial flash, which is supported by flashers like XSF$ i: P8 K" L' E& T& B |) Z8 `
- the problem here is that no tool is out that can flash serial flash chips on 0 x4 ?4 y* l$ h7 T3 f
SATA ports
/ l0 S9 Z. o; A& R7 k ; U2 d; j8 D. y
[FLASH SIZE], h! q+ C* s7 [
--------------( R R6 q5 h! h8 a0 G
- this is specifies the flash chip size in banks" }6 A/ @6 {7 S2 ]. `/ h
- one bank is always 65.536 bytes in size" j# j( C. o% W% F8 k' k) [
- if you know your drive has a flash chip of 262.144 bytes in size you need to enter 4
$ t5 x9 D6 l7 W! D4 r7 r/ i* e4 T6 u( V$ a
[FLASH SECTOR ERASE OPCODE], z7 Q# N3 y; K1 X6 o# H
-----------------------------
/ r7 U9 k5 L% J+ |/ {! C- the opcode used in the flash chips datasheet for erasing. V( m1 I7 D9 v
- for serial chips this command can be different from the standard and needs to be. D$ n# j V7 W
entered for flash erase: b& W. M) J/ `" B# R X, `
- for parallel flash chips you can enter a dummy cmd byte, the integrated command
( k8 Q6 Y7 }0 S7 E& ?, } should work on all parallel flash chips without a prob
; i9 O5 @; ^& y, u) ^2 m
+ R2 \4 ~2 _! ]$ J; h* w[FILE NAME]! F) q& \% O/ s+ `) `; q! x
-------------
: D/ t c0 J5 u* K$ s- name of the file that should be used for flashing" w/ V; S# B. d# C
- for reading operations this should be the output file
( f v& G [/ I- for writing operations this should be the input file! J2 ?6 R& @6 T% N% l$ x9 U& E
, W2 a) |# T) j! `
$ X" V0 E" {1 R+ {
Hints and Warnings. E# \4 r/ B! H# y7 L
--------------------" e* B. Q* |# b0 c8 [
- read, write erase TS-H943A MS28 after the firmware stealth has been disabled with Enable0800 disc
& j% A! c: a/ E# _ - this only works one time, after the first mtk vendor specific intro cmd is send3 x& y$ l, @" X4 v, Z( ^
- if the mtk vendor specific outro cmd is send the chip goes back to stealth mode and you need7 @9 U+ ^* R' V9 c8 g }6 H
again the Enable0800.iso to disable it. a; H0 E) e4 h% o
- therefor the mtk vendor specific intro is send at program start to all present devices and the
5 B: T8 U5 ~ G" G mtk outro is sent at program end: g. _/ B7 R& m8 j' Q
- if you have a chip manufacturer id of 0x02 and a chip device id of 0x02 for the TS-H943A! `$ @6 B; w" v
the flash chip is in stealth mode and won't give access to any reading, writing, erasing
/ L4 R5 {; J! d; l4 N: d2 n3 I- J- always have a look at the DataSum generated, this is exactly the DataSum of mtkflash
. N0 h/ X, j8 ]/ n, q3 ?% s - the DataSum is calculated as the sum of all bytes of the firmware in a short integer! m% W) X% U9 Q( r& U4 `' |9 \% v! j
- to make 100% sure that the flash is written right compare that DataSum to a known one1 A0 B+ u, U! o( m ~: J
- this tool has not been tested on all drives out there, the typ list is simply copied from well
: d# Y0 X4 X; M: U& [ known programs like mtkflash and XSF9 z, y2 j! T ^3 s. E H* S
- always try a flash read on a not yet tested drive before doing anything else2 ~ c! ^4 p$ g9 r& t; C$ {/ k" f$ c
- if the read doesn't succeed it is highly unlikely that a write or erase will
& s9 G( C5 Q! |. O" y- some LiteOn drives seem to have probs to write the firmware correct, this prob seems to be
i4 d/ b4 S" O0 ^6 G( Q. _ Z related to windows register flashing, cause even an assembler app can't do this error free
3 _3 z5 I! [, r$ i e - if you get errors on LiteOn drives, write the flash two times in a row
, I! b+ q# a: e0 m- for direct port I/O in windows the givoio.sys driver is used, this driver is loaded at DosFlash32
5 r( o; ]. F& X0 C; O5 q1 u start and unloaded at program end, be warned, this driver can possibly make your system unstable,5 ^2 E& U" O( H! a" J2 z3 x6 n3 X
it's intention is to let privileged assembler instruction like in and out pass, even in windows,
, c; h+ E( f; R1 V% p; r if this driver is not used you will not be able to get direct access to port registers
3 F; V- ^/ `& h0 N# m- DosFlash was tested on MS-DOS 6.22 and later, you can easily copy it on a MS-DOS boot disk created) d0 a( I/ t5 J2 K' x) k
in Windows XP and start DosFlash directly from the disk
4 q! Q8 I0 S7 k9 p q) s& I: g2 U- don't forget to also copy the DosFlash.typ file, it has all the informations about flash chips5 D) f# S0 @9 I, @( ]
for auto mode flashing; y. v& w# m* k6 X
- DosFlash32 was tested without a prob on Windows XP SP2, you'll need also the typ file for the
, x% j, y, @0 D win version1 H8 N9 L$ `+ }4 l7 ~4 B8 a( c
- DosFlash32 will deactivate all CD-ROMs in device manager at startup, this is better for flashing,( w" p& s: _5 W1 V( ~! S; P1 v
cause Windows seems to poll the drives all the time and this could result in a bad fw file or
4 ^; p( y. T- j, o a program hang, the drives are activated again at program end
( F& Q4 x/ v/ x% |: s8 c, H& f g8 h- you should make sure that the flash is not in an erased state at program end, cause device manager" p7 b1 v& U! M( G3 b+ @. Y4 Y1 L8 E
don't like drives that do not respond to the inquiry command$ j G1 j+ y! E1 T# q! V
- deactivating all CD-ROMs could take a few seconds, so please be patient at program start
, s7 K# r- r& y3 u- `- DosFlash and DosFlash32 will try to scan for the VIA 6421L Raid Controller card, based on vendor
! }4 {( x0 j9 s# p9 U id 1106 and device id 3249, it doesn't matter if the card driver is installed or not
9 W. P* G$ l. t0 t9 \. z' `' @0 R- V- g! h
$ t" s- Q' K. J9 r
Many thanks to Dale Roberts and his Direct Port I/O driver giveio.sys!
g \8 P6 E; G- n9 T4 X2 d' a6 E# s1 E z! P, V1 j
Avoid a bad flash!
8 N0 S% Q& r$ H4 e7 S% |Kai Schtrom |
|
窺視卡
雷達卡
發表於 2011-8-12 20:21:50
收藏
分享
支持
反對
提升卡
置頂卡
沉默卡
喧囂卡
變色卡
搶沙發
千斤頂
顯身卡
發表於 2011-8-25 12:18:27
樓主