|
|
ak475671 發表於 2011-8-22 13:03 ![]()
, m. c& h2 `' L5 h7 _版主你好1 i j* e0 r. n y! a U
版主知道哪裡有教學嗎使用DOS提KYE的過程不是很了解不知道有沒有教學可以參考的呢
. q- _) {7 [6 m5 t6 ?另外你說他提取 ...
. h+ G8 g. l; T, iDosFlash ReadMe.txt 說明文件
& l# V7 v5 M/ z& C$ c0 Q9 }2 {9 U# Y& R
DosFlash V1.9 Release Date 01.01.2011" W( f! K' j' v8 U; K
---------------------------------------
3 B1 D3 S" b/ s' q- k) {& p- SATA and IDE port scan improved in DOS and Windows5 J) e% e0 w [- L/ t
The ports are now enumerated with the CONFIG_ADDRESS and CONFIG_DATA register instead of using interrupts1 l3 m% ~8 X/ M2 E
in DOS and SetupDixx functions in Windows. This change will detect more ports in Windows than the old $ E" @5 e5 ^* N) h: ~% v* v
SetupDixx method.: ~ x9 y% d8 ?( i% h; A
- Settings saved to ini file for DosFlash32 and DosFlash64: b8 E9 I9 y+ x+ S! k/ k1 `: K
Settings like Port, Position, Task, COM Port, Enable Drives and DvdKey state are now saved to an ini file
6 P2 D# j& c- t2 G F; m1 P$ X9 T inside the program folder. If the ini file is not present it is created after the first run. On the first
& U# ?, ?( Q8 ^! ~# S/ ?9 i( _ startup DosFlash will choose the most common and stable settings.
* ?4 W3 o: \6 X, t. _! [ P- EnableDrives option included in dialog as a check box0 t' q/ U" B E/ e
Due to high demand we removed the "Enabling CD-/DVD-ROMs" MessageBox on program termination and included) A. Y7 ]' d% ?- D1 ?, I9 x( E
a check box "Enable Drives" inside the dialog. For security and more stability this is deactivated on the4 T: Q3 H6 B9 O0 C- ?6 @
first run. If you enable it the checked state is saved to the ini file.
& [- b/ q! g, X* Y) r. {- enabling drives in Windows caused some hangs from time to time, this is now fixed by a recoded enable+ }! u6 q$ U7 C$ f8 G
drives function: k3 a2 W5 h# I* {+ v
- port drivers portio32.sys and portio64.sys are now added to the executable and unpacked during runtime1 J6 A/ G+ h) ]/ @ M& P
- PATA and SATA controllers list updated
" A$ s% g; I* u- ]; n' t$ ?- Fix for NForce motherboards in combination with drives like the "Samsung SH-D163C", "LG DH18NS40" or& A) O. E$ X1 r) x: d: f
"LiteOn iHDS118"
# U- X1 M5 N3 U, f- r( e' A Some drives have problems with flash identify, read, write and erase. This is clearly related to the
) F& y' m: o. F2 ?. E NVidia NForce chipset. For manual mode in DosFlash16 an additional command line parameter is added called
( f% J8 a' R3 g9 t "NFORCE FIX". This parameter should be set to 1 for NForce chipsets if you experience strange problems.% ?+ X s( L5 v" @: ]5 Z
In DosFlash32 and DosFlash64 we added a static control which shows if the NForce Fix is applied or not.
! _1 m3 \, O) _, [ Remember there is no need to activate this with every drive. It seems to be a combination between drive8 s C2 u: [3 L2 J0 L" L
and NForce chipset that causes the problem. The fix is automatically applied for DosFlash16 in auto mode,, Q7 n& }3 S- i+ w1 c- `, x' B
DosFlash32 and DosFlash64.4 {% o2 r* e0 H. \7 K
- DosFlash32 and DosFlash64 are now DPI Aware for Windows7
4 M4 s' \" L7 `! g+ N9 a6 ?- New task Verfiy Key/Inject Key added for verification/injection of drive keys
6 L9 N6 U+ m% o" s R; G All DosFlash versions now have the possibility to validate drive keys against an XBOX360 drive and set
9 T) h/ b7 n1 o2 h the key for an XBOX360 drive. We use the same authentication method like the console to verify a key.& `# G9 Q- _$ G! J
In the Windows versions you have the choice to paste the drive key from the clipboard to our custom hex" _% D8 y* {! _. g. P/ N+ h" M3 w
edit control or load a key file. To add a key simply click right inside the hex edit control and select/ v! \1 E( f$ i; [
your choice from the shortcut menu. In DosFlash16 you can enter the key in the format "1A-2B-3C" without! g2 k$ a" I @* I6 l8 V
quotes. Remember that a key has 16 bytes of data. The key file to import should also have 16 bytes of data/ `+ i, d/ {9 D3 `# C& j# G4 O
like the key files exported by LiteOn Key functions.
& M ~8 }; n! K8 H9 a: v- Removed multiple key extractions for LiteOn Key functions, added Verify Key after extraction# P! G# P6 x/ O& W
For LiteOn Key functions we removed the multiple extractions, because the key is now verified immediately, Z: O. ]7 u4 y1 C
against the XBOX360 drive.# T1 c9 p+ @$ m: X3 L7 [( d+ N4 ^
- LiteOn Key V1 and V2 now also extract the file Serial.bin and the 2nd inquiry file Inquiry2.bin6 j$ ^! K1 O# k& E1 I% k# S) t
We added the file Serial.bin and Inquiry2.bin to LiteOn Key functions. Inquiry2.bin is only generated for
# Q" |9 u- H. x [( f8 j LiteOn drives V1 and V2.
- A1 _$ X% H6 W- K- The drive key of Maximus patched UART drives can be extracted by using the task "LiteOn Key V1 (DvdKey)"
$ f9 G# h$ J8 o+ _5 o7 T& S. ^; z6 U The drive check has been removed from LiteOn Key functions. This way we can extract a key from an UART
' f+ K' V& `7 P. M( ?& c1 `7 n6 a patched drive firmware by Maximus.
: h) s( ^5 S6 l! M1 ]" p Y( ~# a- LiteOn files are now extracted to a destination folder instead of prompting the user for every file name.
1 z* Z4 w+ ?; {' k- LiteOn key extraction tasks separated per drive version in "LiteOn Key V1 (DvdKey)", "LiteOn Key V2 (FreeKey)"
& V: S) y9 W* t+ [! ` and "LiteOn Key V3 (Tarablinda)"
- F" D. z0 S( D) Y1 `- In DosFlash32 and DosFlash64 the number of installed COM ports in the system are now enumerated instead of. q* W2 n. s! C+ }! T' B
adding port 1 to 45 Y9 @% l8 {3 Z1 J. J+ E0 T
- For failing cdb commands the sense code is returned, |6 M6 E) X6 {6 x) F
- Geremia's Tarablinda functionality added
6 X- Z- T" `" b, O" i We added all Tarablinda tasks to every DosFlash version. You can extract the key by choosing the task
2 c2 H" }& z1 j$ y3 ]9 R4 M "LiteOn Key V3 (Tarablinda)". For read, write and erase of the flash simply use the standard functions.
0 n T3 J3 J p# @0 o' ~ Pay attention that the "LiteOn Erase V1/V2" task is only available for older LiteOns and not for the Slim.
S7 q2 N* l5 S; A You should use "Read Flash", "Write Flash" and "Erase Flash" for the Slim. "LiteOn Key V3 (Tarablinda)"8 |' ?9 z0 ?/ {' z, D( V- l- G0 w
extracts 1 additional file in comparison to Tarablinda v04b, this file is called Xtram.bin and contains
* B) G, S6 Z4 _ a dump of the XTRAM8000 area. This can differ in a few bytes from one dump to the next.
( _. `; [# p5 E7 k9 a. ?+ [5 O- Device Reset in DosFlash16 manual mode is now done automatically, there is no option to turn it off anymore
) X; C; R8 `* @- Code optimization to work with modern SATA2 controllers added, remember to set SATA controllers to IDE and. _: i5 C/ q, }6 ?" f N& W
not AHCI mode otherwise Port I/O will not work
$ f2 h: z' ]3 R c2 L- Warning: The read, write and erase of the Slim drive is considered risky in general! So pay attention and& \8 K' w0 {' K$ a
always remember you use DosFlash on your own risk every time! Even during flash read the Slim gets flashed
' w8 p, u+ @* U with a patched firmware sector to retrieve the complete dump!
6 i0 g; l5 g$ k" U- We had to change many command line arguments for DosFlash16 Manual Mode, because of the NForce Fix, added
0 C8 y b, f8 s Tarablinda support and splitting of LiteOn Key functions. To get a better understanding we added the example
7 r! d! s, N( ^+ f section below.
% n& s; X0 g4 h. u+ J0 C; [2 j( `" N4 H4 V' ^- |
6 M. ^3 |0 a& e
DosFlash16 Manual Mode Examples
; L4 g% k- Z2 p0 v---------------------------------$ ]' `; V0 t) U
- Extract drive key on a " LDS DG-16D2S 74850C" over UART -> "LiteOn Key V1 (DvdKey)"
& Z# F3 `9 m% @! P. J @. [4 K% A DOSFLASH LITEON K V1 0970 A0 1 {$ t& f9 E7 W# s+ \1 s/ M% s
- G! ^5 R) w5 _' ^' X; c+ z/ ~$ x- Extract drive key on a "LDS DG-16D2S 83850C" over SATA -> "LiteOn Key V2 (FreeKey)"* R$ i7 D' j8 U2 l4 E: y
DOSFLASH LITEON K V2 0970 A01 n# G' \5 v" ?( W0 ^0 z/ N' a. ?
( l, e" a6 r2 H3 x" w* U+ s! `- Extract drive key on a "LDS DG-16D4S 9504" over SATA -> "LiteOn Key V3 (Tarablinda)"9 g" B' y" N( s. c+ g& Y9 W; [
DOSFLASH LITEON K V3 0970 A0; ^7 V R4 Z) v s! h3 }
' I2 t4 d- \( S6 p, n4 T
- Read firmware on a "LDS DG-16D4S 9504" -> "Read Flash" this is considered risky!0 w$ G! B+ C! ^ l
DOSFLASH R 0970 1 A0 3 0 4 FWOUT.BIN 0
& o4 k3 M- i6 N* Y1 Q$ u$ }, m! R9 m3 G* e
- Write firmware on a "LDS DG-16D4S 9504" -> "Write Flash" this is considered risky!
* P, l; [9 i3 ~7 i4 x5 D6 a4 H" X DOSFLASH W 0970 1 A0 3 0 4 FWIN.BIN 09 S4 d- W/ |) ]1 u6 ~+ q g$ r/ N
" B1 V6 O3 g& p
- Erase firmware on a "LDS DG-16D4S 9504" -> "Erase Flash" this is considered risky!& Y0 \& u& a& g' ^# t% R5 z
DOSFLASH E 0970 1 A0 3 0 4 C7 0
! V, t- X; T" [% m
5 N1 y+ p: p) B& }- Erase firmware on a "LDS DG-16D2S 74850C" or a "LDS DG-16D2S 83850C" -> "LiteOn Erase V1/V2"
q1 a+ w1 p: `+ _ DOSFLASH LITEON E 0970 A0" s6 g. z7 Y6 K: c
4 ~; P2 d" c3 c* ?- Read firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Read Flash"
4 |5 J& |4 Z* {6 w7 ~- e DOSFLASH R 0970 1 A0 2 0 4 FWOUT.BIN 1
" e+ d7 u6 u( c+ |- S0 }
# y7 h2 a( ]5 e) e0 e- Write firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Write Flash"
( k) g4 P# o0 Y DOSFLASH W 0970 1 A0 2 0 4 FWIN.BIN 1
! J: S6 E. q7 J9 U- {" h
* E4 v) P+ i. V% r U7 C# Z- N! u- Erase firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Erase Flash") ~1 E" x, G) ^4 q0 Y& B
DOSFLASH E 0970 1 A0 2 0 4 C7 1
6 z1 Y$ A: h& v$ |8 u4 j0 S- C
# X5 i4 j6 t; m6 _$ C0 q4 d- Verify drive key on a XBOX360 drive, enter the drive key manual
. x, N& g* c" X& | DOSFLASH V 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF
* n# p3 Z# \ G% z, H4 }) m9 X( D& p6 |
- Verify drive key on a XBOX360 drive, load a drive key file/ e: s/ A0 w& q2 B
DOSFLASH V 0970 A0 KEY.BIN# o% ~! |+ N$ }: i
2 F0 `2 r) A! Q; z e8 k' n, r- Inject drive key on a XBOX360 drive, enter the drive key manual: x8 f N0 _' g, L) D* |) k" m7 q, k
DOSFLASH I 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF
# c1 ^& [: r: C. U3 A
3 D t% q: x9 `& Q3 T' l5 l- Inject drive key on a XBOX360 drive, load a drive key file
* f5 r1 a8 n d/ p; E DOSFLASH I 0970 A0 KEY.BIN
9 w/ ]: K% v# l/ N+ O: _7 J' Y5 W0 S t" H
For DosFlash drives on which we can extract the key via UART are considered V1. Drives we get the key over* o- R, t, f" c% ` ^0 \; K+ D! E
SATA are considered V2. The new Slim is considered V3 but only firmware version 9504 is supported atm.* h7 A" F$ p$ a. i, v7 J# ]. h
6 [9 f' ?6 P4 m% @9 K
' E# L4 x+ r9 _, wMany thanks to Geremia, Modfreakz, Redline99 and Tiros for their support. Special thanks to Geremia and
/ x% h) U! f, b% S, G" ZModfreakz for drive sponsoring, testing, coding and much more. It is always a pleasure to work with you4 r& |) N/ [: |8 E: Y8 b: M
professional guys! Respect to Maximus for his UART enable patch. I'm looking forward to your magic Lizard
+ Q# @0 h' U5 m% y' g; x8 lhardware flasher!
( ^5 b. V3 v% x" I+ \7 {) D, i y" ~0 T
Happy new year 2011!
# y* |9 j* A9 CKai Schtrom
' ^7 V. b4 P% g3 i3 a) I- G2 Z, ^5 Q: v
************************************************************************************************4 E/ E w% B" s4 D7 V: l
+ q. U8 z3 N5 w/ W2 V% R& X+ N' u/ `7 ^7 b$ W' i& F- c$ ^8 V
DosFlash V1.8 Release Date 08.08.20095 J, C! j* t+ x; K8 \
---------------------------------------
8 x* r0 W4 P1 [' e3 G- now supports LiteOn PLDS DG-16D2S 83850C V2 Geremia/Maximus LiteOn FreeKey method2 b/ Q1 |* e* s+ n% p# V- [/ S
- huge firmware read/write speed increase, especially if run from a floppy disk
$ b& o6 z+ D' g9 _5 b- updated IDE/SATA motherboard chipset list& Y, p' m6 O( h
- new IDE/SATA detection for Windows and DOS. x& }1 Q3 @3 u
- DosFlash.typ embedded in executable file
! y8 k, R# O* G4 {' O4 @- LiteOn V1 drive key is now extracted 10 times and compared against each other,
8 S2 a! N! @& c( w after the extraction a summary is displayed sorted by the most common matches
' C( W) u3 e$ w. e/ }9 Z8 {- LiteOn V2 drive key is extracted 2 times and compared
# C& ^* P/ ?4 C, W5 O- new BenQ unlock keys added to unlock all known BenQ drive firmwares
2 B6 {& k A! d5 [8 ?- command line parameter "EnableDrives" removed, DosFlash asks the user on
. \! _8 R l& j, E application close if he wants to enable the drives or not, during the tests it) |9 h, c. `! v
seems that IDE drives have problems with the enable, SATA drives seem to
3 {9 u8 c. H" Q1 R" T- k% ] work fine: q; ^! H+ g) W4 u
- new 64-bit DosFlash edition added called DosFlash64, because some driver0 A5 V$ ?1 |. F2 L% K- w
functions don't work as expected in the 32 bit compatibility mode on Windows x64+ D, D. \; A c+ h5 ?; s$ m
- Beta state removed4 J) E- N' [ v& X/ v9 H
- ready and tested on Windows7 X86 and x64! v, U, D4 C ^" O6 ]: l# Y) k
' ~" R; h' Q3 k3 w0 V8 }/ g! O4 g* H5 u7 J# C' z: X, [0 k+ s# U
Geremia/Maximus FreeKey method with DosFlash16
" {4 u" ^9 B& j5 c0 k5 D------------------------------------------------
5 v6 G5 i" l: A' cWe have added one cmd line parameter for DosFlash16 in manual mode. The COM port( K8 o$ j! e4 u8 I+ e1 ^
is simply ignored and can have any value for the V2 drives.2 z0 W3 T" q. \( F4 s9 N/ V5 K
Use the following command line to extract your free key from 83850C:" f# x0 C: m! M/ G* z
- DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin enckey.bin
7 Y; g/ @0 Z4 H8 ~$ d& w! b; p* i; r% O. C: I6 O
0 {7 j4 z) Q2 i
Tips for running DosFlash on Windows 7
) h% V" R4 A& j9 ?7 N" V----------------------------------------- \: [3 j; V/ r* j6 R8 c# ]- _ s/ g3 i
. n5 U0 M; `0 I5 q
Since Windows Vista 64 Bit and upwards it is necessary that every driver is signed. Because" c/ Z1 s0 N u: V
the DosFlash driver will not be signed by MS due to some unknown reason we need to circumvent
# [, N4 ]3 ?# k! q3 bthis check. You have the following 2 possibilities to do this.0 f8 c+ e! u. M
# t) y/ m2 _, i, _5 jSafe Way of Disabling Driver Signature Enforcement8 O$ p; K! E/ A2 W
1) On Windows 7 bootup press F8 to get to the extended boot options screen
; m1 J' h1 J3 z8 u! h2) Choose "Disable Driver Signature Enforcement"
; X1 E8 ^" z& g1 n4 c% _3) To start DosFlash right click on it in Windows Explorer and choose) U6 {0 h2 o* w. N/ `5 U
"Run as administrator" > answer the message box with "Yes"
# Y; a, U- ~) M! o* P: P7 |0 l4) Short after the program started a "rogram Compatibility Assistant" warning message- t6 k* o/ |5 M* V4 ]' k2 q3 K
is displayed, you can simply ignore this by pressing the "Close" button, l. H1 }6 g- Y( i3 ?. \. N- H
" r* b: L/ m( cRecommended Way of Disabling Driver Signature Enforcement
! t- C; A# [) v/ X1) Disable User Account Control (UAC)- p3 a: U0 @0 R) x2 m, S4 S
- go to "Start Menu" > "Control Panel" > "User Accounts and Family Safety" > "User Accounts"" H, t! A: a; B1 x
- click on "Change User Account Control settings"
( G# ?: }/ _2 l& Y - set the slider bar to the lowest value (Never notify) > click "OK"
4 ^' V3 T7 w# O) C" W4 V$ ?2) Sign the DosFlash driver
! i" b; X* k3 G2 N- U4 s s - download the "Driver Signature Enforcement Overrider" (DSEO) from2 h1 T) O8 ^; [
http://www.ngohq.com/home.php?page=dseo
: r) h: [' T) @- M$ ~3 o, Q - start DSEO > click "Next" > "Yes" > choose "Sign a System File" > "Next" > enter the path to
' W( W4 H6 E1 d9 v4 y7 L- h0 s the used driver (portio32.sys or portio64.sys) > "OK" > "OK"
, |! q# v, Z; k# y5 f6 q3) Disable Driver Signature Enforcement
# F0 T3 u5 u# r4 I' W. T - start DSEO > click "Next" > "Yes" > choose "Enable Test Mode" > "Next" > "OK"
/ m& _, r+ b+ [+ o" ^4) Restart the computer
1 J! D- ?( V' t' }) ] X$ ~& @( e, l, [' A7 w& z
Keep in mind that with the recommended way the changes will have effect on every reboot without
4 P0 D2 ~; |5 O5 a% m% N) R' E( vdoing anything manual. The first way needs to be done over and over again. In addition the second$ i5 Z+ c7 v& P; P6 v! T
way can be used to sign every driver that doesn't run natively on Windows 7. a. I0 T; A. }8 M
3 H6 D0 ]- w) ^" r3 U4 yFor use of the VIA Cards in Windows 7 it is recommended to uninstall the VIA driver. This can be7 v9 D% U. ]* f3 n
done like follows:
* G7 W5 M3 t, l1 j1 G. L9 N7 S- start "Device Manager" > expand "Storage controllers" > right click on "VIA RAID Controller" >
; k& b) E& }- {, W8 r& K choose "Uninstall" > "OK"
. }8 s5 a8 D8 o, e- D- X7 k m- rename C:\Windows\inf\vsmraid.inf to vsmraid.inf_
* B. }4 V) H* n3 {9 S! Q- rename C:\Windows\inf\vsmraid.PNF to vsmraid.PNF_
+ j* v+ \6 b j/ j9 n& N- rename C:\Windows\System32\drivers\vsmraid.sys to vsmraid.sys_
5 R. g: @# ?' G# S6 O2 C0 U1 f- reboot computer3 ]9 M w0 j6 q" [
4 e# D" j* v- ~3 E; Q% x' j/ h
0 y E8 D: R, N1 ^ LMuch respect and credits go to Geremia and Maximus for their money saving FreeKey app7 P: O# ?9 n# x5 h
and their lightning like decryption speed!
" x1 q" W/ U4 i) q6 j2 E* Y6 w& A" D6 X5 ?! q5 k' f$ Z5 F( j
In Dedication To The Birth Of FreeKey On August Fifth 2009
+ q/ h* |- `8 _3 J/ |, b1 C I$ ]7 x# r- LKai Schtrom
0 E8 ^7 i, q `0 `; y" w, x% m5 H$ H$ v/ z+ y/ Z8 H! |
8 S1 _. J8 Q' F s, k
************************************************************************************************
3 J3 q5 M. @. H
# v! A1 S1 c1 O6 i P" R ` |
: |& i8 x" Y2 X3 t4 k t' DDosFlash and DosFlash32 V1.7 Beta Release Date 23.12.2008; g$ K. C0 h* w3 ^* Y
-----------------------------------------------------------$ {0 ]: l! O" U: e4 s# V
- now supports LiteOn PLDS DG-16D2S 74850C and Geremia's LiteOn Erase and DvdKey method+ S- _0 C2 S" b% e6 Y$ |) p
: M# ]7 b- J8 W4 ]% N
3 a6 E, U; ^# a- Q H$ |
The following only applies to the new XBox360 LiteOn drive PLDS DG-16D2S 74850C.
$ l# `" o# Y: r% }1 t8 s" M- J' P5 M( _( a
; O! D! Q2 e8 [! r% [Geremia's DvdKey method with DosFlash16 with the PC's psu" g- g% C7 `8 L: }" s
-----------------------------------------------------------
' |1 O3 A5 @/ J3 s; l; Q- U- disable CD-ROM boot option in BIOS9 i K! w1 ~7 j5 o* S6 `
- connect LiteOn to your PC's power supply unit and SATA port
8 O) J4 P7 l$ q) ]- power up PC, wait until bootup is finished2 P1 H" E! ~+ y& d% w
- eject tray of the LiteOn and shutdown PC completely
, X* M4 Q% b% x4 ~$ V% A- push the LiteOn tray half in
* v# E# I4 r) \. d4 X) G4 I r- power up PC and boot into DOS
2 x0 H% g( Y, e# p1 W' Z- run DosFlash16 in auto mode
$ X& e8 ~4 [! P% v2 [2 k- if you read the following:- ?" t- `0 r3 X* K' U* `' |' x
MTK Vendor Intro failed on port 0x????.
[' _0 S% F) I/ k) y/ } If you choose to resend the command you should turn the drive off and on7 m2 u- a4 |3 R$ j9 W6 Z
after you pressed "Yes".
, [* p% Z& ~ ?3 T' c3 I* f+ a Do you want to resend the command until the drive responds (Y/N)?/ p4 Q0 N3 b8 n$ M( P* Q
- press 'N' for "No"
7 R4 V) v% K8 Q- choose the number of your LiteOn ATAPI drive% b* [9 v* L6 i& G& K
- enter "LITEON K" to read the drive key7 K7 |; p( z6 s
- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
T' B5 P8 [: d! s+ R$ M, Y- enter the number of the COM port
( i# v7 A1 [. X# x K- if you read the following:. b% O! K( ?! v3 h
To receive the drive key use Geremia's DvdKey method like follows:
f! a3 y% ^% B6 e - Connect your drive with a serial cable to the COM port
$ q8 V: f$ A5 @) v7 j. I( S - Eject drive tray
?/ K0 h3 H1 N' R& q: v' g - Power off drive- F. _0 `- `. R
- Push drive tray in until it is half open! Q6 a; ?" w/ t6 ^$ U
- Power on drive
+ g1 @5 W4 Z6 D! f) g5 U - Press "Yes" if you are ready
, W* f: p) c$ k" L+ D6 l Are you ready (Y/N)?8 V/ f1 `# N9 q4 k% B6 E+ u
- simply press 'Yes' without doing anything of the above, because we
. S: C* ^0 r1 M. A; V0 d already did that before7 u+ A5 L* N) Q) m+ s$ a% Q8 U
- after this DosFlash16 displays your DVD-Key and saves your key and identify data
& i# O$ l' ?& N* z5 k/ N( N- to do the above steps in manual mode use the following command line if your drive
/ Y% Z3 b( T+ F+ g" @! `1 R is connected to port 0x0970 and serial cable is on COM port 1
3 x1 b- }0 k' W* j DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin
: F7 }0 \' v' Z2 I3 P. ~
& j1 l. ^, j8 N6 ]9 w8 n5 o/ O/ E5 e& ~- G0 E* ~! a7 n
Geremia's DvdKey method with DosFlash16 and 2nd psu
9 m, J) b% I; B5 y8 v9 B, K-----------------------------------------------------
( U' }( j% H# ?5 K' y4 M( C- connect a separate power supply unit to the LiteOn, don't turn it on yet' S1 y) H0 r: s2 e) k5 z
- power up PC and boot into DOS
1 O, w! L& Y$ G p' x: o' i- turn on the LiteOn psu- C( }6 e1 P4 K3 F! t& M S p( R
- run DosFlash16 in auto mode
% Z; C( d! D7 X4 {. l& d& p- if you read the following:
$ D- |9 a9 N; m MTK Vendor Intro failed on port 0x????.
$ B8 `1 h( ?9 R. j7 c! S* U+ K If you choose to resend the command you should turn the drive off and on, _5 i+ ^! S6 p- |+ Z1 K E
after you pressed "Yes".! L9 V! f* y1 M& W; Y
Do you want to resend the command until the drive responds (Y/N)?
. N \/ m; c8 v- N' m0 [$ x0 I% f- press 'N' for "No"! i q% K( d$ g p3 Y6 S
- choose the number of your LiteOn ATAPI drive
, ?- Z7 r I9 K. f0 p& M' s+ s7 O- enter "LITEON K" to read the drive key
" m. o8 M, h2 |/ d/ |- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files2 H+ E( ]7 w+ e8 g
- enter the number of the COM port
# E8 c; t6 Z" v8 p1 k1 x- if you read the following:6 A- C/ w& X; X
To receive the drive key use Geremia's DvdKey method like follows:
+ l' Q# Q/ q* s - Connect your drive with a serial cable to the COM port
# q: D3 x& h0 d+ a - Eject drive tray2 ~. K+ f% L$ F- c6 N. I) Q
- Power off drive
4 \' p! b% H+ t" {* ] - Push drive tray in until it is half open& {+ d6 G6 U A, z9 B8 G$ Z
- Power on drive% z* r- U7 t0 m$ Y" _
- Press "Yes" if you are ready
1 B6 q* ?: g, D% _# G$ }; { Are you ready (Y/N)?/ X2 K% t5 d# q# k
- do the above and press 'Yes'
% M+ A0 H! G" n) o: a' o/ R, ?$ {/ o- after this DosFlash16 displays your DVD-Key and saves your key and identify data$ l3 r- Y9 w6 B7 r0 q- j5 Q" p
! h Y ]9 a2 X# a. g. o7 T7 [" O
1 b; a2 r! N8 HGeremia's LiteOn Erase method with DosFlash16 and 2nd psu
2 d1 l: \7 V7 w- ?4 H& q1 C-----------------------------------------------------------
* v$ Y0 e8 k- R. @! {- connect a separate power supply unit to the LiteOn, don't turn it on yet
! u9 L8 _7 I, e/ ^! I- q- power up PC and boot into DOS9 m* F/ v0 ?% e2 C1 s6 H- ^
- turn on the LiteOn psu
) {$ v- t* v; {( f7 Z- run DosFlash16 in auto mode
4 x1 r4 i9 Q0 t' t- if you read the following:
# e7 J% i9 k F( Z$ O: E8 Z3 g MTK Vendor Intro failed on port 0x????.
! c) f& j8 f. k9 D, l If you choose to resend the command you should turn the drive off and on
7 o. F- |5 o, d) \2 b after you pressed "Yes".. f! h9 d' h& i* d- n/ Z. P% x
Do you want to resend the command until the drive responds (Y/N)?
, b! Z" W O5 x$ E7 w; q0 c# P- press 'N' for "No"8 c( R8 z) h9 x9 x3 `* f
- choose the number of your LiteOn ATAPI drive3 D8 F5 f3 @; |/ V) c# x
- Warning!!! Keep in mind that you will need the drive key before you erase the flash,
4 Y3 I/ m! R. ?# P without the drive key your XBox360 will not work anymore, R! B2 r4 i" f; r
- enter "LITEON E" to erase the flash
! K- }) H* X% d3 O- the first time after the LiteOn Erase the drive needs to be repowered to give0 Q% @5 r3 _5 | k! \9 N
flash chip access, this can be achieved by repowering the drive before another
! k8 x; K! C& k DosFlash16 start in auto mode or by doing a MTK Vendor Intro Power Brute+ ?$ U. \5 U4 r% s& W
- in my tests it did not work to power the drive with the PC's psu, because it will
3 \3 X5 |) A N, T always respond with busy status
+ H& Q/ E$ ^2 r- DosFlash16 can now read, write and erase the flash chip like usual' c$ |' c1 L; ^, `1 y3 j7 \' ` q
- to do the above steps in manual mode use the following command line if your drive
- M# K' J2 U) N5 j: N is connected to port 0x0970
& w( e! X9 ]$ C0 }; R( r5 g DosFlash LITEON E 09703 h: k V7 ^8 l* I- G1 x& \% V
6 w/ }' B; o) ^7 i4 p; u' G
9 S/ x, y: C' D4 H$ r" `3 y1 T6 yGeremia's DvdKey method with DosFlash32 with the PC's psu
c; M8 }! k1 \# V-----------------------------------------------------------
9 r5 M9 k H9 {' [+ E% _+ M; _' w- disable CD-ROM boot option in BIOS# z( [* N+ q1 Z- P- k
- connect LiteOn to your PC's power supply unit and SATA port
7 v2 B7 Y$ ]- V' F6 [- power up PC, wait until bootup is finished! |8 m6 {9 i v! L) @8 y
- eject tray of the LiteOn and shutdown PC completely; O" W+ Q. J% A" ^
- push the LiteOn tray half in
: s+ L c4 k: x) [6 T; Z- power up PC and boot into Windows
" P4 |" u3 K' m' K0 d/ t- run DosFlash325 r, x/ }; k) D: q1 f5 {
- if you read the following:
6 ?0 V7 |0 M% l2 K0 t& X$ m1 o MTK Vendor Intro failed on port 0x????.
; j6 A: y0 p8 g$ Z* y4 ^ If you choose to resend the command you should turn the drive off and on
" g+ E3 {4 m- ]9 p after you pressed "Yes".
+ W: a }3 L2 \ Do you want to resend the command until the drive responds?. O) M8 m) ~: |! e8 u F$ a
- press 'No'
8 W: ^8 Y; s. N8 v# X B: {) k- choose "LiteOn DvdKey" as flashing task6 R$ D9 b0 Z7 `5 @" U
- choose the COM port number2 f. ^( k+ I0 O9 p. d
- press on "LiteOn DvdKey" button
2 i! A. y6 n& |2 ^- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
9 J3 L9 l' ~" R) v- if you read the following:' r- F7 |/ e: U. L7 ~
To receive the drive key use Geremia's DvdKey method like follows:% m9 R% b4 o2 Q" n7 t! b
- Connect your drive with a serial cable to the COM port
; X1 C1 o! N, D2 L - Eject drive tray
: f7 v/ ^$ Z2 H, }# {9 [* j6 b - Power off drive, U. t0 w( f/ u% J3 Y
- Push drive tray in until it is half open. H, O4 K3 j3 O; h* K* j. C1 G
- Power on drive
! j/ H( H) G4 d3 t5 l* b0 a - Press "Yes" if you are ready' W2 ]. ?5 d6 W
Are you ready?
+ E! T* H( p" h- d. p- simply press 'Yes' without doing anything of the above, because we. y8 J4 e3 X& m7 p8 l
already did that before0 m5 Z3 ^6 ^# ~. \4 R" P3 l' w
- after this DosFlash32 displays your DVD-Key and saves your key and identify data% H4 G: i0 e; \" h
3 V' G. v" {$ h, ^4 B% J& \
; I6 Z) A/ O1 L: v0 K0 o
Geremia's DvdKey method with DosFlash32 and 2nd psu
0 P6 N3 f* c0 m- H' Y-----------------------------------------------------* l& ]8 x, ?- @! x" \, h1 R
- connect a separate power supply unit to the LiteOn, don't turn it on yet X: [3 e7 I( x' t- X3 q
- power up PC and boot into Windows5 E/ S2 q: M4 l" w; P$ _2 s8 C- K- ^9 l
- turn on the LiteOn psu
/ P2 ^5 g$ r+ |" }- run DosFlash32
# b: u/ b) L) y1 {' e- if you read the following:
0 G! M! O0 G4 H7 n. |6 S MTK Vendor Intro failed on port 0x????.) K$ `& d# |# R; @. _4 r) `
If you choose to resend the command you should turn the drive off and on9 e- T% H0 K9 e7 l5 `. Z( f
after you pressed "Yes".
' r0 u, g- \3 n Do you want to resend the command until the drive responds?3 M3 h3 g( }! G* w0 q) _
- press 'No'5 X! \2 T. N* i( d8 S$ `
- choose "LiteOn DvdKey" as flashing task
7 D0 g' `& s# l2 P- choose the COM port number* ^6 G3 O" c& U; X ]& o# w, J
- press on "LiteOn DvdKey" button6 j! j3 _) e. T7 S3 [
- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files, c/ K6 q, F$ o1 g, s+ x9 ]
- if you read the following:
' |7 V" g0 |: H To receive the drive key use Geremia's DvdKey method like follows:) R% j M7 s7 }: d9 u
- Connect your drive with a serial cable to the COM port
0 W* f$ V& r* h# g$ z8 m - Eject drive tray- Y+ c# S# E2 D3 ~4 C
- Power off drive
$ R6 D6 M' i. `; M$ \ - Push drive tray in until it is half open
% c) E% p S% I9 f7 }; x% _/ U - Power on drive" s; O5 _9 \4 g6 K, m# X- Y) d
- Press "Yes" if you are ready3 v) C; m# e( ]1 {: a) J
Are you ready?
. s* z8 R$ Q' R2 p; s, e `- do the above and press 'Yes'
6 I: l9 W; B- w- after this DosFlash32 displays your DVD-Key and saves your key and identify data
- @. c1 d; {8 C+ U5 ~) J) q/ k, i. s* o1 }
+ H, d$ O4 h' T5 w* z
Geremia's LiteOn Erase method with DosFlash32 and 2nd psu
$ o. P9 f% s: C" i# T-----------------------------------------------------------
/ O p( D& V- e8 [4 [ @$ }$ Y- connect a separate power supply unit to the LiteOn, don't turn it on yet
3 c) y# r. W" F# x" x+ |1 J- power up PC and boot into Windows
3 i: w$ q/ r2 H& |( _ j, y& [- turn on the LiteOn psu% q# S9 Z; O/ |( w8 ?
- run DosFlash323 ^8 k" o6 P6 ?) Z$ f" R* R
- if you read the following:
9 ^. S+ e0 V5 A MTK Vendor Intro failed on port 0x????.& F* u. `. j& I1 {
If you choose to resend the command you should turn the drive off and on
8 E4 u Q" B/ _5 K) z after you pressed "Yes".: x1 }$ J% D0 g# N, ^; U
Do you want to resend the command until the drive responds?
. _; I6 P5 {2 w( @( o* _) H- press 'No'
& y i" i- T" o' w. E0 o& P- the LiteOn flash is not identified
! Y/ W6 L; J& I* S ]- choose "LiteOn Erase" as flashing task
7 V3 J7 ? A' n5 J/ K5 }; W- Warning!!! Keep in mind that you will need the drive key before you erase the flash," v- K9 z2 ~ A, H. f7 \# f
without the drive key your XBox360 will not work anymore
- ]4 V( d: L4 Y6 X- press on "LiteOn Erase" button
7 n, ]* a9 K. b" P( q- the first time after the LiteOn Erase the drive needs to be repowered to give
9 O% D) N- ~: \" V# _) A0 m) s1 D1 P flash chip access, this can be achieved by repowering the drive before another3 }$ D0 E" Z4 {
DosFlash32 start or by doing a MTK Vendor Intro Power Brute
* Z. ]+ L) \7 u5 `! M. y- in my tests it did not work to power the drive with the PC's psu, because it will" L7 [; [, L3 N* p
always respond with busy status5 n y2 h3 X3 L/ S& E6 t3 S
- DosFlash32 can now read, write and erase the flash chip like usual( y9 h+ D0 G* C& P q' J
2 ~( R0 ?2 u! P1 [8 c) w
|$ }7 c1 t: h0 J! h$ xRespect to Geremia, Modfreakz, Podger, Redline99 and Tiros.
& @/ O: O+ D, d& l
) |: @3 H! [( t9 l) Y, vLike a wise man said: "0x2E is the MTK Intro of Death"
- G: `! p) Z# U' s8 {, M# T; jKai Schtrom
& s$ O/ v q* o6 \) y) `- \
- R4 E% e) g3 A+ C: k
( u q, ^% F+ H************************************************************************************************: C' T K' R9 F0 S
* i6 @' L" }, p
0 G7 i7 x- m( o0 c- rDosFlash and DosFlash32 V1.6 Beta- a3 f/ J7 ~ L/ }
-----------------------------------0 t2 T! `0 |# y7 H9 S* U- D$ Z
- fixed power brute unlock bug for VIA cards, this can stop your VIA from working
8 L+ ^2 Z* ?' f; A$ h2 K% m with the power brute unlocking in Version 1.5, q0 m' O0 w0 ` v
- for DosFlash16 in auto mode on DOS my VIA card works best if I do a cold boot
9 K2 }# Q" g% q/ @, t: }, t and power up the drive short before or with the PC
3 C" ^; B" ^: j% Y4 F8 p, N5 h W- for DosFlash32 on Windows my VIA card works best if I power up the drive short
( c. A& y( J& e( _+ ? before starting DosFlash32# R, S9 s/ m% a% \! V; M
- for me the VIA works with internal and external connectors on DOS and Windows
$ d$ Z1 L2 v6 `8 J
) S" D( L5 a% N$ zSorry for the trouble!4 D; |! K* o2 _
Kai Schtrom+ v1 T) P8 z* j" o! W$ T
9 r+ q( `3 a3 }1 s, b! F6 W
) w; H# _* @4 e/ E5 v5 L
************************************************************************************************
. u( v! l$ Q( u6 \, O6 i" u( `7 v! Y0 s. h
9 \% ?6 u H" V/ O( U0 X; h
DosFlash and DosFlash32 V1.5 Beta8 y% S( S: C9 T, |$ I
-----------------------------------8 T8 W1 y" |+ L9 @, Q0 g4 a5 b
- now supports serial flash chip MT1309E with mediatek status 0x72 like the SH-D163B, SH-D162D,
" b* H% C; b- L Asus DVD-E616A3, Asus DVD-E818A3, Sony Optiarc DDU1671S# r4 ?3 x5 }, i! U o
- SST25LF020A and SST25LF040A chip support added
+ \ W: j: J; c, k- DosFlash32.exe ported from MFC to plain Windows API, exe size is now 22 KB
|3 ?: o) H0 j$ K* T/ p3 S+ S/ @- new port i/o driver, because giveio.sys can't be compiled for 64 Bit Windows9 X1 \2 F; f7 C9 r) p/ I$ s
- DosFlash16 changed slighly in manual mode, one parameter is added to support SST25LF020A and( S+ ?7 r4 S$ t% ~! F
SST25LF040A7 }$ a( k" j$ B: v" N
- two new methods of BenQ soft unlock are now possible on all motherboards with only one power4 F5 U* Y9 E: K# B3 I8 S8 [
supply unit
7 U4 F7 c# t, a; ?8 t; a- 1st method is powered by Geremia's unlock core, thanks for the complete idea, concept and
4 i1 T7 C: z/ r1 D+ H' x ^ source to Geremia O* ?7 h! p2 D/ C+ k
- 2nd method is the Magic28 key send, this only works on BenQ VAD6038 firmware, thanks to- w8 r3 y* U! K: o; q, [# A. H
c4eva and podger for the initial idea
8 t6 `- i/ l% ]+ }, i- the two unlock methods are send one after the other if the drive is a possible unlock: h6 c, |" H2 l
candidate, first the Magic28 command, then Geremia's unlock commands and after that the; }2 W* d1 e# T) r0 b
already known power brute unlock is send to the drive, you can cancel any of these methods+ i/ \/ b8 q, O6 j1 ~9 V+ R
before they are send to the target, this only applies to BenQ drives with a locked flash( `1 ]/ M6 X4 P" W
- DosFlash.typ updated
. m" F; C! A p* H6 K0 b- other minor improvements
$ H6 e( Y0 t! a7 `- Y& X0 B- DosFlash32 is now ready for
! i" q- q& ~) I( a - Windows 2000
+ n0 C3 z. W% o; {3 B3 i - Windows XP 32 Bit
3 P& D4 F0 \5 I. D+ Z8 z- v - Windows XP 64 Bit: C4 ]1 S& z7 m
- Windows Server 2003 32 Bit
. z* G, }0 k& r4 H: L" Z - Windows Server 2003 64 Bit
) x* {& v4 s% I5 P - Windows Vista 32 Bit# T& `, k. {5 L# R' R5 Y
- Windows Vista 64 Bit9 B7 ~8 A) Q7 k# @
- Warning: Drivers for Windows Vista 64 Bit need to be signed, because we can't afford the7 M& F; m' F& L# r* d* J( M$ h
money to let portio64.sys sign you need to do the following:+ P3 i/ F1 b3 p9 {* L
1) Log on as Administrator/ P$ J) ], t% Z% ?4 I$ t0 _
2) Enter the following command in a Dos-Box:
; E% W, }5 ?; r" X "bcdedit -set loadoptions DDISABLE_INTEGRITY_CHECKS"
6 V' Y$ V! I5 w4 a1 P6 I7 O6 M* K (we made sure there are no typos in the line above)  ( N5 @7 h) S1 f
3) Press enter and reboot your PC
8 Y/ X3 w4 o- K# }3 i 4) Press F8 key upon initial system boot up
9 q7 {9 }/ d+ E" c1 n 5) Choose to disable forced driver signing enforcement for that boot session8 T5 c2 u" V+ @ w5 c6 m$ p; s; m
& N1 y3 J2 k- Q/ P. M3 a; c$ M
& P; S6 G% O; s0 V1 u& wThe following only applies to drives with a locked BenQ flash., p! P! Z9 Z* U1 z5 s
; d+ M1 j8 ]/ j5 T0 L' Z! \/ A% r, r' }; D9 \- m1 G# w \/ `6 a
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with the PC's psu: g( w& O$ K8 _1 N5 q q o
----------------------------------------------------------------------------------------- N0 Q! c# l6 `) I4 g
- disable CD-ROM boot option in BIOS
2 l2 \3 ~% s4 W8 Q- connect BenQ to your PC's power supply unit and SATA port) o- j6 Z- \* t! c
- power up PC, wait until bootup is finished
# j+ Y: {1 v$ H$ n) ]* \+ k; y- eject tray of the BenQ and shutdown PC completely0 i$ u. [, i2 s, e# P. g
- push the BenQ tray half in8 F( D3 T2 {9 c$ |, w7 \) D
- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash32
U0 N+ n2 Q' E) ^- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows1 h. p0 V/ P) g1 p
- if you read the following:
# p& r6 ?# E/ |0 _+ n MTK Vendor Intro failed on port 0x????. Because there seems7 t! l/ z% l) A* t- V
to be a BenQ drive connected you should try Geremia's% Y3 d* g+ R& Q/ c, _& L; F0 \
unlock method.* \# @/ U; F, x4 z1 S, i# J
- Eject drive tray9 X' Y" S( E% X9 ?
- Power off drive+ _& q3 w9 x. L6 v- g
- Push drive tray in until it is half open
; h" U; s$ _4 s& | - Power on drive
% ?- ]8 q0 P' S. U7 Y# h - Press "Yes" if you are ready2 z5 K0 U7 {( t% A' P( c1 b
Are you ready (Y/N)?$ y& G5 C$ a9 `; B8 z5 K F8 m- S2 `
- simply press 'Yes' without doing anything of the above, because we; t* U* R2 T8 c1 i, [# }+ ~
already did that before starting DosFlash16 / DosFlash32
0 [- i4 r) w- D- the BenQ flash should now be identified' L7 s% A( [1 ^; F% P4 p
- go on like usual9 {, {0 I% s0 v; E& i" I1 o
% ^9 J( X7 P: e' R- B$ F
4 U$ e( j$ u( ]" E% }9 d- @
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with 2nd psu
* Z: a' e7 |+ U5 h------------------------------------------------------------------------------------: q6 \6 A$ X1 t1 D3 c
- connect a separate power supply unit to the BenQ, don't turn it on yet( P* s0 }* n" x1 s
- power up PC and boot into DOS h+ ]0 Y: {7 F5 p/ ^. b7 ~
- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
3 ~1 U2 x1 J) _* T$ F- if you read the following:0 z N7 Y- R0 l: L! w1 ~4 |4 g
MTK Vendor Intro failed on port 0x????. Because there seems
/ e5 L9 B# |3 ` to be a BenQ drive connected you should try Geremia's
/ c6 g4 e1 K* `% r unlock method.5 v5 N0 @% N, S/ c
- Eject drive tray
5 T `( A0 ~8 o - Power off drive
% Z6 a& x# ]6 t - Push drive tray in until it is half open- G- ^7 a& y8 C' C
- Power on drive: L6 |+ [: P* Z9 S7 O
- Press "Yes" if you are ready
. \: S. l7 x, |! y ? Are you ready (Y/N)?
. X9 }, ]( H% w8 j1 o- do the above and press 'Yes'' L. T$ _( V# F% V$ L+ }2 b) K6 M! \
- the BenQ flash should now be identified: u4 ^2 Y1 w5 H8 @9 j
- go on like usual
8 i2 ~# @4 ]" T( l* @1 H9 y* A
w& Q) ^; S; \% o2 ^+ v/ N# R+ [4 {1 H- h3 z
Magic28 BenQ unlock with DosFlash16 / DosFlash32 on any motherboard
2 G6 |# {& Q0 k* I5 ~. P! B---------------------------------------------------------------------( @2 d4 D$ \! o% s
- connect BenQ to your PC's power supply unit and SATA port
. n. V1 t" w$ `6 C- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash32
! U6 N, `0 P7 V% }9 n) M8 O8 [- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows Q$ K. c$ |1 t* E: k. k
- if you read the following:
5 a; m' G3 |& @ j# k9 P7 A" e: p MTK Vendor Intro failed on port 0x????. Because there seems
1 d: d: c: _+ ~( l- x( `2 H to be a BenQ VAD6038 drive connected you should try the
/ r7 t {. Y& V+ O# j+ T Magic28 unlock method., O5 O$ o9 y" k8 h) d
Do you want to send the Magic28 command?) }2 s- P+ \3 ]6 {+ A" m5 O7 f" _
- press 'Yes'
: d; y Z4 E& a; U( F2 I+ T# q# [7 ~, l- the BenQ flash should now be identified/ U, {& r+ J( }; b* h' [7 V$ j, W
- go on like usual( P5 ?: q2 C: Z2 s; |& b
9 a' p( N! E3 X" [4 q2 \, R6 O
2 U5 }5 y9 p+ ]* u/ Z6 u: w3 ~Thanks to Redline99 and Tiros for help and support.' k& W! b& T# T2 H
3 d4 I& q, v2 @" u8 K7 w+ F
It's all about DOS!6 r: _# C% |8 f& N4 z
Thanks guys for the excellent team work!! R9 C1 u1 w% N( B3 y) A. M" R
Geremia, Modfreakz and Kai Schtrom$ w# |' X- s4 _& b. U6 y8 d' {% u' i
4 C( T- h8 ~+ G, m4 L* Q6 L( v/ {2 u- ]
************************************************************************************************7 q; T2 ?- R5 U4 ^2 H/ v
" s x$ I. Q4 A6 T( Y* C" R
& i( G7 a( M1 J) f
DosFlash and DosFlash32 V1.4 Beta, `+ \/ z- @7 b- S5 h8 X
-----------------------------------2 y; N+ @7 f9 c0 w
- DROM6316 flashing support
4 B$ v4 R) G0 n: d9 O" ^4 A- a flash erase is now always done with a chip erase and not a sector erase command, because
8 O2 J1 P; ~1 M6 N the sector erase gives problems for some Winbond flash chips including the DROM63167 {: G6 J" _. u' ^, @
- DosFlash.typ corrected and updated; T' P: M% g) ? Y8 o2 x4 V; o$ [" V
- for a detailed explanation on the soft unlock look at the included file SoftUnlockByIriez.txt,& a6 }2 e g/ x, {
it contains a very good explanation by Iriez from XBS, thanks for that one!8 _+ c, k1 Q1 {# I. W' A
3 I4 E0 d3 e6 T
Thanks to Iriez, Jumba, Redline99 and Tiros for help and support.; \0 Y% N; y* O& b
S c& e# T6 a9 {
Happy DROM bricking!
, v! @" R/ v t* }! e7 C! pTeam Modfreakz and Kai Schtrom+ Z' o9 C' f% P$ T* E8 i- g
; ^0 r) z/ m6 g9 D; L2 i9 x) P9 j+ K
************************************************************************************************
7 e4 T5 e1 n6 ]. L7 e* q% j; s/ W' e a i& u9 \
& ?% m* \8 |: I4 k
DosFlash and DosFlash32 V1.3 Beta
& Q0 _, t' F5 S-----------------------------------
% o8 U5 I1 ^8 x- BenQ optimization in unlocking the flash chip, it should now be possible to read/write/erase
8 x( K4 |; H+ O7 A; ~ the flash without any soldering or wire tricks, the drive is polled for the correct mtk
* p) E8 _% B& f, ~0 ]! Z4 H8 o: O unlocking status after power on, this only works for VIA cards and NForce boards atm
/ {* C; W& |& i; L* T- DosFlash32 has one additional parameter, if you start it with the parameter "EnableDrives"
N0 `% c8 G, M1 m! @ all the DVD-ROMs are enabled in device manager after flashing, this could give BSOD on some/ U0 m& s' T0 e& q4 m7 ~% y
systems, therefor you need to create a DosFlash32 link and add that parameter manual to use it Y3 h# q) x8 y, M- D; l, ~
- DosFlash16 has one additional parameter "Send ATAPI Device Reset" in manual mode, this could
6 h! b3 Z6 ]7 x2 m give better chances for soft flashing on some VIA - motherboard combinations6 d: e$ y0 a4 Y) H0 g2 d6 @# @7 q+ ]
- better support of Intel chipsets, drives can now be flashed if the controller is not set to' A+ I3 E3 d3 u5 I1 \* @
native mode in the BIOS! W5 F" N. G- u9 L8 ]( I3 _* O1 T
- the following controller list includes vendor and device IDs that are hardcoded to identify
$ j. ~ B- f; g2 n5 N) I the controller type (IDE or SATA), this is needed if the BIOS uses IDE ports like 0x01F0 or, }# t" k# Z! ?9 P
0x0170 as SATA and not as IDE channels, this list is NOT related to soft flashing
. A" n7 j( U8 n0 S# W- the following chipset support is added
1 e7 Z0 t! C9 T* Q+ Q( P" H( j - VIA cards* t: K( M& o/ Z, p q
- all VIA cards with a 6420 chipset$ F) I6 P& v) |, v% x
- IDE Controllers
5 h! s7 t3 B8 Y9 G x/ [+ T - NVIDIA nForce 2 IDE Controller
) \, L" |' V ], V - NVIDIA nForce 4 IDE Controller
! c1 p( C! n4 n8 j8 J - Intel ICH9
* g9 ~1 n. n% g/ c3 ` - Intel ICH (i810,i815,i840)5 q- ~* G6 W5 {7 |
- Intel ICH0
1 j @1 B) J7 Q2 w' Y! s; U" e9 V - Intel ICH2M
+ s# e8 c7 r2 I7 | - Intel ICH2 (i810E2,i845,850,860)/ g# J2 [* O6 {# {# P
- Intel C-ICH (i810E2)( _; D! W5 x' d0 G& p* ~4 Y
- Intel ICH3M
/ Q; Q0 i, H* d' K1 b# h9 j1 W7 h - Intel ICH3 (E7500/1)& o7 i% x5 f4 c, ?7 v
- Intel ICH4 (i845GV,i845E,i852,i855)
@8 f: S, G2 G6 f+ [1 z - Intel ICH5
( Q+ }* r' a4 k6 v1 U$ z2 e/ ` - Intel ESB (855GME/875P + 6300ESB)
3 T! s2 H8 H4 F - Intel ICH6 (and 6) (i915)! c# [2 [; e5 L! A$ g' V- U0 c
- Intel ICH7/7-R (i945, i975)0 Z& ?# F" \# C2 C! c
- Intel PIIX3 for the 430HX etc
% {9 a9 c4 H. F. D; ?0 o - Intel PIIX4
) F2 t" f- R' h - Intel PIIX4 for the 430TX/440BX/MX chipset1 M3 c: s4 e' }9 k+ g
- Intel PIIX3 n% Q" A+ ~6 |8 v& N* Z5 O
- SATA Controllers
# x# w' S2 E5 T" U - NVIDIA nForce 4 SATA Controller% G. \& f! n \1 s
- NVIDIA nForce 2 SATA Controller
1 c$ h5 P+ q# l: }$ G - NVIDIA nForce 3 SATA Controller
) V. h8 v9 v+ }$ w X - NVIDIA nForce MCP04 SATA Controller
! \ u- g- \( ]& T- H5 J& i+ j$ h! B - NVIDIA nForce MCP51 SATA Controller: P$ d8 Q: ` ?
- NVIDIA nForce MCP55 SATA Controller
' c( ^. _6 N$ ]! ^ - NVIDIA nForce MCP61 SATA Controller
! F [5 h/ ^7 j - Intel 82801EB (ICH5)
$ ~ W" q+ h+ [ - Intel 6300ESB (ICH5)
1 m) f1 o% ?, n0 Y2 H8 ? - Intel 82801FB/FW (ICH6/ICH6W)! I! P/ o! g# h# W5 z( Q
- Intel 82801FR/FRW (ICH6R/ICH6RW)1 ~5 j/ ~4 s `% C9 e3 n
- Intel 82801FBM ICH6M) I" F- C8 C/ @
- Intel Enterprise Southbridge 2 (631xESB/632xESB) i Q6 O1 F/ r8 h
- Intel 82801GB/GR/GH (ICH7, identical to ICH6) X1 q- ~4 K& ~
- Intel 2801GBM/GHM (ICH7M, identical to ICH6M)+ b7 y8 W. q& B2 `1 |
- Intel SATA Controller IDE (ICH8)( ]' _6 f9 ~1 V2 ^
- Intel Mobile SATA Controller IDE (ICH8M)
1 S9 t# q: I' B- M2 H, C! Q' X - Intel SATA Controller IDE (ICH9): C4 b' z& p1 I/ w
- Intel SATA Controller IDE (ICH9M)( r% v7 ^% Y) v1 |5 g
3 B0 X, B7 S0 j$ Y" f ?
0 _) y4 P3 U. K j* \4 r2 E4 KThe following only applies to a software flash on a locked flash. The methods have been tested
' q* W8 c7 T$ g$ ywith the BenQ and the Sammy. The VCC trick will work on any motherboard, but you need to do
, @. p2 d/ b5 H2 ]( ~7 X$ d7 w# U( Ksome soldering and cut traces.
9 E' z6 ~/ Y1 u$ Q+ x o
- E$ [5 x5 x+ h) M9 u; L7 o
4 Z( n1 ]: ^5 a6 |* X% n' t9 ySoft Flashing the BenQ in DOS with a VIA card and DosFlash16 in manual mode
4 a) n8 E' f* U% k0 x: R-----------------------------------------------------------------------------
' `4 C2 {+ ?6 O& U- first you need to know the port addresses of your VIA card, you can get these by starting
$ B( N8 n! ]% M+ U4 W msinfo32 on Windows XP and looking at the port listing for SCSI devices0 b: r6 W7 z! u3 a4 B9 v
- for the 6421 the 1st port is internal SATA, 2nd is external SATA and 3rd is internal IDE! g3 V( ?1 g; P! Q
- for the 6420 the 1st and 3rd port are internal SATA7 ]9 a# U. d. R1 T' N" K% X. c
- you need the starting address e.g. 0xD000 or 0x7000
' \- m/ s# i) A* p) @- be warned that these addresses can change from computer to computer, they are assigned
2 V& ?- _3 u# Z5 R* x, ~8 { at bootup, but Windows XP should display the ones you need for flashing in DOS: l5 e" q( N; A( O4 C& ?
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or 0 K( r" {: u8 _" s% }! r
Xecuter Connectivity Kit)3 K+ o" a) s% i2 }
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we9 I/ X( s' r* ]# Q' e* v
need to power the drive off and on during soft flashing
! i$ u& s5 r( ~5 S7 Q! U- cold reboot or reset the computer, t3 F; k8 ~* Z y3 E0 l
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk+ g2 r/ u1 ]$ G
- at the prompt type:
* G8 O7 y$ C: B1 m) C$ t* _0 Q DosFlash r 7000 1 a0 1 4 a:\orig.bin 0 2 x0 u5 w. ^/ d0 w& L, t# ]
- instead of port 7000 use the starting address your VIA card uses; {: q$ T) y. d( c0 D' U6 J2 s
- press return
D7 @$ O/ Z u2 a, ~- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
2 s. s) j4 E0 b6 F- after you pressed Yes the drive status is shown on the screen, it's something like 0x7F,
2 e0 V; P& ^! L( v9 W" ^! U this will change during the next few steps
+ r6 N4 A" n8 { R/ Z0 Y- turn on the BenQ psu and wait 2 or more seconds, status changes between 0x51 and 0xD16 H! U! L% B! ~2 {9 ]0 G* Y
- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1
$ l! P4 r. @6 b4 \) ?% [- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start h8 Y4 m! E a) ~* }1 a, H
- this worked only one time after the computer is powered on or resetted for me
0 U4 \0 n6 | O- L- writing and erasing works the same way) F" M" q$ y6 J3 v
- for writing type:; l C+ U0 }% Q4 a A
DosFlash w 7000 1 a0 1 4 a:\ixtreme.bin 0, D8 i0 k6 b8 Z2 o1 O) S) T
- for erasing type:0 p& {. F% \; X4 i7 H7 x7 Y
DosFlash e 7000 1 a0 1 4 D8 0 (D8 is the sector erase opcode for the BenQ flash, if you need
* ^2 i, |+ W0 C) P$ r to erase another drive, lookup the value in the datasheet or DosFlash.typ)
+ V: e" @; V% r/ u" K# M0 v& ?- if you experience any problems try to use 1 as the parameter to the ATAPI Device Reset, cause
- M" [5 X2 D$ b" |( g: i5 K the same VIA card will react differently on another motherboard sometimes2 M0 f2 h# z. H# Z' e U
8 M. ]5 W& G4 y% d! J( x$ B/ ]2 G6 G! J8 l) u
Soft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in manuel mode
0 h9 ^) c4 v- @( H# ^0 x4 }---------------------------------------------------------------------------------------& l1 S; G# p% L5 {: q7 O R0 F
- first you need to know the port addresses of your NForce motherboard, you can get these by
, ~8 u9 Y: v6 t i6 Q7 a) @. y2 {: X starting msinfo32 on Windows XP and looking at the port listing for IDE devices
" g# D* Z `' m' r( J- on most motherboards the 1st and 3rd ports are used for SATA
, j5 h2 }& k. G/ b+ ]+ f- you need the starting address e.g. 0x0970 or 0xE9000 u, ~& n9 e3 B {2 D
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or 4 ?" @- A# W+ d! G, x1 Q$ `" H! @6 Y5 F
Xecuter Connectivity Kit)
- t0 {4 f) t8 C/ ^3 K* I- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we+ _1 l% K) \9 K0 D. g% v
need to power the drive off and on during soft flashing1 F) I' ~ S4 S
- cold reboot or reset the computer; W. K$ }, V" Q( x
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk( F- x! F, t& {! B$ o- f
- at the prompt type: : M$ a& L) L9 S& i1 [
DosFlash r 0970 1 a0 1 4 a:\orig.bin 1
2 ~" d* ^5 \1 J$ b0 _( C3 E* }! M - instead of port 0970 use the starting address your NForce motherboard uses0 j- `, Q; {. a& j! L9 q" A
- press return
3 ~; A4 t5 `, m# q: q% K4 L# v- A- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
6 g* X$ F$ U- v3 G2 W* m* G i- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1, f4 {& n. E& [+ Q# K* c7 e0 l
this will change during the next few steps+ B0 n7 p$ s+ I o3 G
- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start- v% U/ L2 M6 ]8 {+ ?- j O
- writing and erasing works the same way
& Y0 i& a; [) o4 G0 m* y- for writing type:# N0 N [ x) U4 M( M$ b# o
DosFlash w 0970 1 a0 1 4 a:\ixtreme.bin 1
+ k' z2 ]8 d5 v( x9 W5 v- for erasing type:
2 R' \- K2 c/ g- R/ z DosFlash e 0970 1 a0 1 4 D8 1 (D8 is the sector erase opcode for the BenQ flash, if you need: n% A: j, r: |/ U5 v C$ d
to erase another drive, lookup the value in the datasheet or DosFlash.typ)/ {) b- i+ ~+ k
/ h' f) }( }) l3 S/ G/ ]
5 ^$ S/ N! ?; E, bSoft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in auto mode, w4 m8 c( i7 a- N+ o! y- B0 C& B
-------------------------------------------------------------------------------------9 [1 [: x! ?5 S6 \
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or 6 i$ k$ a1 G4 M1 k2 R0 d7 }
Xecuter Connectivity Kit) n+ D* d* h6 ~% |
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
' ]) _* C, O, I, [) C; T need to power the drive off and on during soft flashing* W8 _$ T- d) j2 S* K5 H# q
- cold reboot or reset the computer/ D4 D4 u. a1 `% j" f
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk
y) D! M2 J) J+ a- wait until you are at the cmd prompt0 Q" M# r5 X* q! J7 O
- turn on the BenQ psu: J; t+ z5 A; `" e$ }" X
- at the prompt type: / m: E' t; u. B5 E: v
DosFlash
6 D5 l1 |7 ^7 ?* J- press return
& e- X( t W$ i% r- during scann of the BenQ's port DosFlash16 will ask you if you wanna resend the mtk vendor
6 d, U n# G( z1 N) B intro cmd, press Yes) c: [* I0 |5 a: W$ A* Q }* O+ V0 y
- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,+ Y# g7 i9 a2 `) t. D; r$ b
this will change during the next few steps
3 ]8 i, L A; W- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1
' r5 d' A2 q Z7 I0 I* H3 Z: q6 m- turn on the BenQ psu, you should get a good drive status 0x73 and flash access is granted( d. q* f, |$ l; }8 H
- you can now continue as usual using DosFlash" B0 y# {. _! M$ Q* U
- writing and erasing works the same way
" x m: Q+ b* V7 z3 m2 g- if the ports are scanned there is the possibility that you'll get the resend question for
- m+ Z t' K$ {2 S0 G: @ other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,5 L7 r" T3 l4 M3 E
if you know the NEC is at that port you should press No and press Yes only if the port of
1 P e- h" W7 L/ l, { the BenQ is shown or simply disconnect the NEC
3 d" m- g+ q" S' s& ~9 O: P+ {1 `; x5 n
1 b. C2 m9 k+ T4 P1 ^! {Soft Flashing the BenQ in Windows XP with a VIA card or NForce motherboard and DosFlash32/ ?2 Q' I! Z# L
-------------------------------------------------------------------------------------------" J& x% o2 p7 C
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or $ r8 |' Y: ~) ~# a
Xecuter Connectivity Kit)8 g* ^1 `# k5 R
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
/ e1 Q! D. k% N4 W1 `5 d need to power the drive off and on during soft flashing
! E- _' j+ S8 z% J- cold reboot or reset the computer. _7 t: T: S& {, N! f9 f
- turn on the BenQ psu when you are in Windows XP9 q" U4 {9 S* [1 _8 V0 |2 M
- start DosFlash32
" t% j# c' u% x# F0 R" I% K$ p- DosFlash32 will ask you if you wanna resend the mtk vendor intro cmd, press Yes* S1 |; K5 o( u( Z% w# m! s2 q8 r
- turn off the BenQ psu and wait 2 or more seconds$ a. ?2 v" d" J, ^! \- }; M7 K* ], j
- turn on the BenQ psu, the DosFlash32 dialog should show up
+ p) x) U* T) s9 S0 V- the flash should be recognized by DosFlash329 }2 d9 }" M7 g* E0 k9 d+ i
- you can now read, write or erase the flash
. [. C" p/ F% m) e! ?1 `- you should be able to do the flashing more than one time in Windows, only do the power
" l: b( i$ N3 E* j7 A) x( t off/on trick again
: \# S) E, {4 ]; ^( z+ Z" h: D- if the ports are scanned there is the possibility that you'll get the resend question for, i' E% K Y$ X6 o5 i, g* ^
other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,
/ I2 X& \. _7 ?, ~ if you know the NEC is at that port you should press No and press Yes only if the port of3 W6 M1 k6 z2 {( G% x2 P! ?
the BenQ is shown or simply disconnect the NEC1 g v3 U! ^4 L2 r
- u0 |7 n `$ G1 B8 P" }1 m
3 z7 _" @6 v( v; K- B: W/ fMany thanks to jumba for the great idea of BenQ polling!9 s! k, {1 A% c1 _6 C. e2 u2 ]4 z
Thanks to Iriez, Jumba, Redline99, TeamModfreakz, Tiros and all the IRC people for testing( ^* ~- j/ p. n' H: ]8 r
and support./ y$ Q' D- X: |1 S0 F6 v' k
/ P4 l+ K9 C( p; M! A, Z- ~Join us on IRC efnet at the channel #dosflash for support., t' N `9 Q9 g Z
$ ~& \4 P# T% h9 }* ~& ?
Don't brick your BenQ!
3 d8 ~' L1 g2 c1 t' D/ XKai Schtrom) I0 u* I8 N* ~; Y9 l
) h1 g* {, O6 W
; H8 M8 {3 a6 f3 i4 j/ R2 x1 A1 y************************************************************************************************
" D6 n2 V: V/ j. m. {* m$ t) L; C- v' v( |( B8 w3 C: B1 W8 i N
3 f! M& s: k p P5 D6 ^
DosFlash and DosFlash32 V1.2 Beta. ?8 ~2 {0 j' V
-----------------------------------4 m+ ^' s# R/ ~ z6 z7 N% _
- bug fix for BenQ recognition% n% [# @9 X' r; @& _
- manufacturer and device id are sometimes 0x00 for a correct installed switch
5 j( V: l2 H3 Z. e# p3 G - this issue is fixed with an additional ATAPI device reset before the mtk vendor intro is sent. Z T" L9 a: N% c
" D2 c, }* A& O( t
Thanks to Redline99 who fixed my buggy code by adding one line!
K* d5 p! D' b
; r2 k( n- d# }( B; k; h, t: j/ W9 e. W
************************************************************************************************9 M+ x E( H% c( g) K8 R
; D7 I2 g) n- |6 m2 |7 `
- \! {: J% B' i5 \" {* E* \
DosFlash and DosFlash32 V1.1 Beta
& o0 i8 S# U. c. W& m-----------------------------------
8 \) E. \" q% |# ]3 ~2 b7 r- DosFlash.typ modified for better BenQ support
4 P" a1 J' a2 u5 B0 ~- DosFlash16 Flash Manufacturer and Device ID screen output restructured
2 d; ?- P; |5 i4 N( J- flash chips are first erased before writing starts# H5 N4 @- ^( v2 ]* g2 N" }
- DosFlash32 no reenable of DVD-ROMs in device manager after flashing, this means you can't see the drive0 J/ W* M ^) O% r
and maybe have to activate it manually again in device manager, this could give better compatibility and
0 s/ \' H+ d% G0 S4 V hopefully no more blue screens0 z* s6 I$ q& p. ~6 \
a6 X8 J' B) o0 PMany thanks to Jumba, Redline99, TeamModfreakz and Tiros for inspiration and help!2 w+ ^1 A! ]" x# C2 ~
9 U0 W1 j, _8 j' K1 v: W0 N7 g3 @8 c
4 N0 l; g' \8 y************************************************************************************************
! }6 v K7 R* T+ r; R, _7 i3 H4 e5 I
! R' D0 {* s. ^+ d7 l3 J4 m. p" L1 b, B
DosFlash and DosFlash32 V1.0 Beta
$ k) ]) c) a% c5 R) c! O-----------------------------------
6 ^5 @" ?6 m9 W1 T" EDosFlash can be used to read/write/erase the flash chips of most CD/DVD-ROM drives) u, @! J0 R1 W
that have a mediatek chipset installed. DosFlash is for DOS flashing, DosFlash32( Z7 E! J, E. T; F6 ~! T
for Windows flashing.. K; i2 T* H" d* Z& }, i6 t' R% p( \
* |* g( i) y2 T5 B+ K# z! y7 W3 G% x# J" q) |! N2 I
Features:% w- K% O. N: Z# {3 a3 v+ t
-----------
; i {$ a' {" p+ j t- flashes IDE and SATA drives2 k0 r7 V5 @# H
- supports parallel and serial flash chips o8 B5 {& d9 Y( G- C. K0 ^5 E
- flash drives in Windows with direct port access$ l# z/ j+ u- ]6 V0 g" c8 F
- no vendor cdb flashing commands are used
' m& I D2 {) S" o* d) T- tested with the following drives:9 M9 @. H6 F8 u( b
- TS-H943A MS25, MS28- l: H/ l6 z" L* e( B! q6 Y
- SH-D162C
% _8 o* |3 u9 y# ~; v - SH-D163A
, B J- C8 _* c. ^0 M' O - and some other drives like Liteon, Hitachi, ...
! I3 h7 b/ S, q0 g- NEC drives are not supported, cause they have no mediatek chipset installed) J. l- N4 o K! U% a
+ c6 S+ M" h9 B8 r2 I
4 k/ `2 _0 b" Y4 J0 k; n; R% h& TDosFlash8 L: _+ _$ ~! U9 {5 ^
----------* d/ a+ q- m) R4 P9 c7 W
DosFlash supports two flashing modes, Auto and Manual. If you type DOSFLASH at a DOS prompt it
1 H! s' m$ E9 dwill start in Auto mode. All drives and the corresponding flash chips are detected automatically." c) F% ?. g& ~3 k3 v* b
If you can't get a flash chip recognized due to a bad flash or other problems you should use the6 K+ I3 \9 y7 v# d
Manual mode. In Manual mode you can enter all the parameters used for flashing by hand. The
8 V E7 s4 ~! x- ^( Lfollowing help screen is displayed if you start DosFlash with a wrong number of parameters:. I' R6 n) v# z
/ ^2 |) V! ~0 z, R2 U& P# A, w
0 Q' { ?0 ^0 W( W) l( z0 lDOSFLASH by Kai Schtrom, 08/05/2007 (Ver 1.0 Beta)
0 U4 n+ X8 s) B2 t+ G' o ]4 qDOSFLASH [R|W|E] [PORT] [PORT TYPE] [DRIVE POS] [FLASH TYPE]
& a# ~7 n! h9 y/ n) V [FLASH SIZE] [FLASH SECTOR ERASE OPCODE] [FILE NAME]1 s2 ~0 I) [5 {" o& W
R: Read FLASH
/ o: M0 c0 j+ S/ e+ c/ C: J W: Write FLASH- h# @7 b) p, C6 G3 K
E: Erase FLASH& o: }) M- m. ^0 P; }5 E" O! \
PORT: Port to send command to6 Q( v" d5 c5 |/ P+ B1 y
PORT TYPE: 0 for IDE, 1 for SATA/ {6 k" [; A: K" ?
DRIVE POS: A0 for Master, B0 for Slave7 Q0 |' n& d2 V: B5 J4 {
FLASH TYPE: 0 for parallel flash, 1 for serial flash
9 t" M4 ^6 I' G8 h& V8 L FLASH SIZE: size of flash chip in number of banks* D9 Q- j0 H; g. o9 a& ?% P& a
FLASH SECTOR ERASE OPCODE: individual sector erase opcode command byte6 E+ b$ g" `" F7 s3 U. o f
this is only needed for erasing a serial flash
. U6 r4 E, F0 W* e5 c: Z FILE NAME: name of the file to read/write from/to flash {7 l+ G. E; G' O
All numbers are intepreted as hex values!. c# U: W5 N- k3 N q4 G6 n; b
4 l& Z/ Y0 c8 vExample Usage:& A x8 u0 } V& I2 i
"DOSFLASH R 01F0 0 A0 1 4 C:\flash.bin"
- D5 B4 f; A2 i* U3 _( S+ W=> Read serial flash with a size of 4 bank (262144 bytes) from Master Device
( S7 P+ K( K% M$ F! I+ e6 P on IDE port 0x01F00 m/ {) `9 s# a2 z6 r
"DOSFLASH E C000 1 A0 1 4 D8"
, m: N' ~. j2 K( T( _=> Erase serial flash with opcode 0xD8 and a size of 4 banks (262144 bytes)
% G# N* }- f' H from Master Device on SATA port 0xC0009 E6 P! g3 R. f# }, v
" m" s0 y s1 d8 B' h
( y* Q q4 a( R* m+ L* B# n+ pExplanation of the Parameters:
% g3 w$ r# d2 @8 L--------------------------------, @& r8 J( p! n# o
8 w2 i& k" r6 `. F# K) G[R|W|E]% c+ c, p7 P0 _! ]1 X
---------
; y5 r) g# s: r- this will set the mode of flashing, it is recommended to first try read on any
( N* e6 V% @+ r+ G6 N7 y drive, if the read will fail, it is highly unlikely that a write or erase will
, V2 g3 U% w; |. J# k succeed
# Q0 t( v7 C2 n5 v' F" C
$ s* M3 [3 C7 D[PORT]2 Z; E' j' X; ~2 V2 e2 a2 ?
--------6 A1 s" W+ Q4 o6 h! k! Z+ x
- the port to which the drive is connected, a port number should always be entered1 w1 N( B8 \8 c- G$ F& k
in hexadecimal and have 4 hex digits, valid ports are: 01F0, 0170, C000, C800& P& \% `- @# r" ~- y
- this option can be used if your PCI adapter card or on board IDE/SATA ports are" m6 B$ P( f" o. M
not identified by the auto mode
. W3 B6 q. [ K" d, w5 l+ Y: y- f$ f" Z* ?1 x1 Y$ n, n
[PORT TYPE]) @" n# V' g A$ f3 j
-------------3 H0 H2 F1 U6 o+ V- Q
- the port type tells DosFlash what type of port is installed on the before entered
3 q; V( ?3 }' Y% I9 w% o$ l+ @ port address
% \2 e6 L1 y& B" b( o- F' t- valid values are 0 for IDE and 1 for SATA8 p/ `. l& T+ E2 S
- make sure you never mix the wrong port with the wrong port type, this could give5 L7 K V% m, X
strange results or in the worst case a bricked drive: s }6 `7 z A: Z( }% N
' X. u3 u! O, u1 a9 u! v5 l[DRIVE POS]
2 ]" [% e. i1 E7 p7 B' C+ F( D& o-------------
: V b% j! b# T/ B( u# r- old style IDE channels have the possibility to connect two drives at one IDE/ C& Y& h) c; S# D: D
channel, the first drive is called the master, the second drives is called the
$ ^- b! B8 V+ s+ G4 w4 R slave
; A5 n' j. T6 h: k6 L6 Q4 C, I- you can select which drive should be flashed on the channel, A0 selects Master,
' h! C: p: P* k3 E' K( c4 U B0 selects Slave
H2 l5 }) r6 j- on SATA ports this value is always A0, cause you can only connect one drive to- p" w% V1 ~5 P9 B( o
a SATA port, so for SATA you will always type A0 here
4 @# [; Y) D: v% q; U! q- it is not recommended to flash IDE drives with another drive connected to the
" Q5 s2 i V; s2 f same IDE channel, this could be risky if something in the Master/Slave selection
" |+ V5 V7 o3 g5 e/ `, V4 _ fails5 p' H5 l) g! i8 y" v, i2 c. b' i
3 ~+ h3 U$ M% J( U, n[FLASH TYPE]4 \: ?, j) t+ m9 o
--------------
8 z6 d! }7 p8 s0 q9 n; B- there are two types of flash chips out for CD/DVD-ROM drives atm5 C& P4 u, l: e5 Q
- the older type is parallel flash, which is also supported by mtkflash for example
+ s* @1 ~: D6 N" S; v$ ]- the newer type is serial flash, which is supported by flashers like XSF
8 W( H& s# z1 K: h* o0 s- the problem here is that no tool is out that can flash serial flash chips on ( y. c5 D! h1 x" P/ |
SATA ports, v& z' d6 N: J5 K9 k1 U
! B; ]4 Z% I/ p1 B. U$ y[FLASH SIZE]
s& @6 n" P: }& |--------------5 _( p# m, E2 w' D) g! ^0 H
- this is specifies the flash chip size in banks
% r/ M1 u7 e4 @7 T* N4 e- one bank is always 65.536 bytes in size
( v( h( c7 k% _! O" ]/ s- if you know your drive has a flash chip of 262.144 bytes in size you need to enter 4; i5 T, s0 r3 f" V* l
3 b" u$ E. _! l- B- J9 c[FLASH SECTOR ERASE OPCODE]: |7 R8 w8 Z( u' M" @+ J% Z9 k* M
-----------------------------
' Z6 ?. q) N- l1 y+ }6 f# N- the opcode used in the flash chips datasheet for erasing
) Y/ t7 q/ A7 t- for serial chips this command can be different from the standard and needs to be
+ g' }% t/ A( g- v entered for flash erase
, J& z# q4 |7 r7 h/ K/ P- for parallel flash chips you can enter a dummy cmd byte, the integrated command
, l4 [, q3 \: T9 m# M should work on all parallel flash chips without a prob
. q+ F7 ?4 M `) W7 z5 T 0 w0 c! I f; T
[FILE NAME]
: I& I8 q8 i; H R/ ]2 u-------------& F5 F, H# z$ o4 Z) f# Q
- name of the file that should be used for flashing
% G) C' O" `7 w( w0 p- for reading operations this should be the output file& R" p% c/ m7 H; q7 d
- for writing operations this should be the input file
- K2 D) [% j2 E( }/ ^, X
' Q' S" `& U1 ?
. f6 D X8 Q3 o0 o2 l3 ^Hints and Warnings
3 q" t5 G' V2 [5 ~5 N--------------------
3 A) h% S2 U; g% G/ y- k- read, write erase TS-H943A MS28 after the firmware stealth has been disabled with Enable0800 disc% p: C, l4 @1 z5 I9 Q
- this only works one time, after the first mtk vendor specific intro cmd is send+ x+ M3 b. _% |. Y( n; j
- if the mtk vendor specific outro cmd is send the chip goes back to stealth mode and you need
8 N/ m9 R* e: `0 ?, D* S1 o again the Enable0800.iso to disable it+ Y# H/ c' y" B- G
- therefor the mtk vendor specific intro is send at program start to all present devices and the2 B, c/ E# j. {+ {0 F
mtk outro is sent at program end. T/ t( M s; B9 f
- if you have a chip manufacturer id of 0x02 and a chip device id of 0x02 for the TS-H943A
6 s4 B7 x* f4 p9 ?2 H the flash chip is in stealth mode and won't give access to any reading, writing, erasing) z$ @. h) T. F! r$ O+ o
- always have a look at the DataSum generated, this is exactly the DataSum of mtkflash
7 y* c( I# I; ~/ w - the DataSum is calculated as the sum of all bytes of the firmware in a short integer! J/ P `4 m4 D1 [' {4 j
- to make 100% sure that the flash is written right compare that DataSum to a known one
& H$ n. K9 h, K2 c8 {$ e& B, z- this tool has not been tested on all drives out there, the typ list is simply copied from well
. e+ x/ u5 e! @3 `% f+ M known programs like mtkflash and XSF
) \4 H, ^' G! ]3 w7 w& A; _ - always try a flash read on a not yet tested drive before doing anything else
( W& U- V( @) B' A - if the read doesn't succeed it is highly unlikely that a write or erase will5 }+ `2 L1 \: Q, Z; `$ d
- some LiteOn drives seem to have probs to write the firmware correct, this prob seems to be
7 l$ Y% D( H+ P2 u# A related to windows register flashing, cause even an assembler app can't do this error free
+ ]' \3 M! K8 G1 Q! N) k4 n( J1 H - if you get errors on LiteOn drives, write the flash two times in a row
) ~( \. y2 H a: {8 Q- for direct port I/O in windows the givoio.sys driver is used, this driver is loaded at DosFlash32; @0 c, G8 [3 }- w2 q
start and unloaded at program end, be warned, this driver can possibly make your system unstable,
2 a) [: b0 P+ {1 [ it's intention is to let privileged assembler instruction like in and out pass, even in windows,
% U: E) O; ]% X if this driver is not used you will not be able to get direct access to port registers5 W- _2 u+ O8 Y' Z: k/ ]& ?- }# @. e
- DosFlash was tested on MS-DOS 6.22 and later, you can easily copy it on a MS-DOS boot disk created& r8 C$ H! D8 J/ c. E0 l
in Windows XP and start DosFlash directly from the disk
4 c3 H% s$ H7 L& F) ~" R6 o- don't forget to also copy the DosFlash.typ file, it has all the informations about flash chips8 q: z; F$ T1 H0 @
for auto mode flashing6 d9 K& i" a0 N
- DosFlash32 was tested without a prob on Windows XP SP2, you'll need also the typ file for the
5 w* c: \& I" P, e2 Y win version0 Y6 h+ [! ~( f: Q3 ^ b1 }
- DosFlash32 will deactivate all CD-ROMs in device manager at startup, this is better for flashing,
+ W) ]; G" K/ o6 u8 F cause Windows seems to poll the drives all the time and this could result in a bad fw file or
- L8 h5 j# ? w2 Y+ D a program hang, the drives are activated again at program end. G* a9 B, F0 l1 Q+ ]5 p
- you should make sure that the flash is not in an erased state at program end, cause device manager
`- Y$ Y, g' F6 C' p$ ~9 J; a2 g don't like drives that do not respond to the inquiry command
9 i0 v3 ?2 I' S- deactivating all CD-ROMs could take a few seconds, so please be patient at program start/ D. ?4 i0 n. n: q! f8 Q! X8 R
- DosFlash and DosFlash32 will try to scan for the VIA 6421L Raid Controller card, based on vendor
* C- M# b# Y7 b, \0 Y( e, ] id 1106 and device id 3249, it doesn't matter if the card driver is installed or not/ {/ J% V; P- j7 _- M
/ l, [; e0 P% H- F! N
0 T/ Q5 M# y! I# q7 K3 mMany thanks to Dale Roberts and his Direct Port I/O driver giveio.sys!
/ |0 Y: a5 t1 `" n5 \5 ^# l" x. r3 g/ R, v
Avoid a bad flash!
: {- e4 z7 X7 @7 i$ }. M+ PKai Schtrom |
|
窺視卡
雷達卡
樓主
顯身卡
發表於 2011-8-21 21:08:07
