|
|
ak475671 發表於 2011-8-22 13:03 ![]() % g; _$ G0 o: |$ y
版主你好
) P, @3 Z6 E) B8 X' j版主知道哪裡有教學嗎使用DOS提KYE的過程不是很了解不知道有沒有教學可以參考的呢
: @2 [2 k7 z6 ?! E! L另外你說他提取 ...
8 C x; R6 w1 c& F# N5 O }, w" @( tDosFlash ReadMe.txt 說明文件
& K: \% f8 h1 I$ W c0 u T1 {& H8 E7 a) K7 n2 l% }8 f8 r' u$ F& L
DosFlash V1.9 Release Date 01.01.2011
. z: c: O4 m, k+ A- F/ z5 ^' [1 f---------------------------------------
2 j1 a+ ~2 }; I- SATA and IDE port scan improved in DOS and Windows
/ m& X! y4 J7 ]8 Z& s# I* d8 T The ports are now enumerated with the CONFIG_ADDRESS and CONFIG_DATA register instead of using interrupts1 _+ H2 V* m7 R$ U! _
in DOS and SetupDixx functions in Windows. This change will detect more ports in Windows than the old + S) N& C; D/ D8 W" D* l# }
SetupDixx method.
M0 j2 l/ i6 X! q- Settings saved to ini file for DosFlash32 and DosFlash647 f4 u( r+ m3 K. Q
Settings like Port, Position, Task, COM Port, Enable Drives and DvdKey state are now saved to an ini file
" l, [1 ?: q' f; d inside the program folder. If the ini file is not present it is created after the first run. On the first
' z4 j) ^# C0 |4 h0 _3 g startup DosFlash will choose the most common and stable settings.
. \! V2 @, C8 p! Z+ |9 n- EnableDrives option included in dialog as a check box
1 }) o' [. s2 D+ h: W! G Due to high demand we removed the "Enabling CD-/DVD-ROMs" MessageBox on program termination and included, s0 ]1 i+ s' y z- f1 W9 F5 P
a check box "Enable Drives" inside the dialog. For security and more stability this is deactivated on the
/ s7 a' S" }( S% r first run. If you enable it the checked state is saved to the ini file.
$ Z1 B! M. n9 {# i2 O- enabling drives in Windows caused some hangs from time to time, this is now fixed by a recoded enable
# H! H1 k9 h* A+ \' M$ D drives function/ y t+ e" } P* M6 Y
- port drivers portio32.sys and portio64.sys are now added to the executable and unpacked during runtime
6 {: Y N2 Z7 Z& Y, B$ H0 L- PATA and SATA controllers list updated
3 }( G) Y9 q$ i1 J- Fix for NForce motherboards in combination with drives like the "Samsung SH-D163C", "LG DH18NS40" or
6 J5 R5 P9 f" ^9 M9 {3 e8 X6 T "LiteOn iHDS118"* ~5 t% y: c: S$ s' R
Some drives have problems with flash identify, read, write and erase. This is clearly related to the; m0 n- }+ M1 E% z/ [9 ? f$ O) ]
NVidia NForce chipset. For manual mode in DosFlash16 an additional command line parameter is added called+ _( k# ]( T1 j5 I6 F! ]
"NFORCE FIX". This parameter should be set to 1 for NForce chipsets if you experience strange problems.
) `) f" Z2 L" J7 t, [, i: M% q! _ In DosFlash32 and DosFlash64 we added a static control which shows if the NForce Fix is applied or not.
0 H' ?2 I5 W/ H7 Q$ U% r Remember there is no need to activate this with every drive. It seems to be a combination between drive
7 [2 z, W' b g. ~ and NForce chipset that causes the problem. The fix is automatically applied for DosFlash16 in auto mode,
9 y0 x3 o4 ]8 s6 T, I DosFlash32 and DosFlash64.+ [% w, b% S. S0 w* s- N
- DosFlash32 and DosFlash64 are now DPI Aware for Windows7( V; B% n8 N. \1 d1 U. T
- New task Verfiy Key/Inject Key added for verification/injection of drive keys
; f, n5 X8 P5 h0 f# W; k) P( u All DosFlash versions now have the possibility to validate drive keys against an XBOX360 drive and set
5 r6 S! Y/ m* O ]0 C6 ` the key for an XBOX360 drive. We use the same authentication method like the console to verify a key.6 m5 O: q6 a. t% |5 {" D8 [+ i8 b1 Z
In the Windows versions you have the choice to paste the drive key from the clipboard to our custom hex* {+ [) O' B' N) L
edit control or load a key file. To add a key simply click right inside the hex edit control and select, i' ]6 y: @) f; M
your choice from the shortcut menu. In DosFlash16 you can enter the key in the format "1A-2B-3C" without6 F+ g% w# `$ Z0 r2 C! j8 K8 w
quotes. Remember that a key has 16 bytes of data. The key file to import should also have 16 bytes of data. g6 h% R9 U6 X( h3 H0 g' n" a
like the key files exported by LiteOn Key functions.
; I/ c( h$ Z+ w/ H# a- Removed multiple key extractions for LiteOn Key functions, added Verify Key after extraction
5 u4 G0 O# E/ j6 i8 `0 C8 c For LiteOn Key functions we removed the multiple extractions, because the key is now verified immediately
8 \7 S) z B; ^ against the XBOX360 drive.
1 z2 c+ w" t# o a* F- LiteOn Key V1 and V2 now also extract the file Serial.bin and the 2nd inquiry file Inquiry2.bin
/ i# k$ v: D5 t% z+ t# [ We added the file Serial.bin and Inquiry2.bin to LiteOn Key functions. Inquiry2.bin is only generated for( j9 A$ A+ H$ O
LiteOn drives V1 and V2.
+ F4 t& U8 y, A4 a) |! O- The drive key of Maximus patched UART drives can be extracted by using the task "LiteOn Key V1 (DvdKey)"1 o' v- y- b" \( q8 ]0 h
The drive check has been removed from LiteOn Key functions. This way we can extract a key from an UART
" Z5 i+ k( p" {3 L0 [# i% @ patched drive firmware by Maximus.
: @) E3 a$ V" R( E+ ?( P- LiteOn files are now extracted to a destination folder instead of prompting the user for every file name.) M# Q* ? v& Z! r) p2 }
- LiteOn key extraction tasks separated per drive version in "LiteOn Key V1 (DvdKey)", "LiteOn Key V2 (FreeKey)"5 R2 v6 a# u! C/ B+ J; s7 ?
and "LiteOn Key V3 (Tarablinda)"" s c) h$ f: m
- In DosFlash32 and DosFlash64 the number of installed COM ports in the system are now enumerated instead of
! r' \ D! b; W adding port 1 to 4
* T! ]# ~4 i! C& ?3 q5 m- For failing cdb commands the sense code is returned
4 Z' e% M8 D% d% f. |& ?3 F- Geremia's Tarablinda functionality added0 Q6 r+ |- I) n6 k+ I
We added all Tarablinda tasks to every DosFlash version. You can extract the key by choosing the task$ j j# B# M4 d: N0 d
"LiteOn Key V3 (Tarablinda)". For read, write and erase of the flash simply use the standard functions.# a( q3 l6 ~/ m+ h4 q1 o
Pay attention that the "LiteOn Erase V1/V2" task is only available for older LiteOns and not for the Slim.1 Y% N: F d) y; F; |; n! I2 v( n
You should use "Read Flash", "Write Flash" and "Erase Flash" for the Slim. "LiteOn Key V3 (Tarablinda)"
; L- p/ d' g. Y/ ?! V extracts 1 additional file in comparison to Tarablinda v04b, this file is called Xtram.bin and contains
) Q; Q6 D( w& [% s a dump of the XTRAM8000 area. This can differ in a few bytes from one dump to the next.
& Y7 Z3 i2 `/ U& A3 [. D- U- V- N- Device Reset in DosFlash16 manual mode is now done automatically, there is no option to turn it off anymore
! @- [/ P1 g! I; e2 s2 H" M- Code optimization to work with modern SATA2 controllers added, remember to set SATA controllers to IDE and4 _7 @) K* f# S( Q3 r7 p# O
not AHCI mode otherwise Port I/O will not work2 A% B4 Z( d) R% c
- Warning: The read, write and erase of the Slim drive is considered risky in general! So pay attention and
5 u0 s8 F' r& J3 Y$ D always remember you use DosFlash on your own risk every time! Even during flash read the Slim gets flashed
5 {' v! m5 m9 l2 \ with a patched firmware sector to retrieve the complete dump!0 j6 p/ n2 ]* Q' \8 c/ { `4 @$ x X% \9 f u
- We had to change many command line arguments for DosFlash16 Manual Mode, because of the NForce Fix, added b2 e2 B6 J1 V
Tarablinda support and splitting of LiteOn Key functions. To get a better understanding we added the example
* K6 M! B: h3 _; ]7 @6 ]6 O section below.; Z0 D/ `" t- J l) c1 U2 ~
* N( e+ _3 ?, W; l( Z' k( Y
; J0 N1 z- y& Y$ {0 i/ JDosFlash16 Manual Mode Examples
' O W' b: M3 e7 z3 L* P5 Q+ D2 E---------------------------------
- ` V n9 ]; V4 B: C2 B2 J) a4 s- Extract drive key on a " LDS DG-16D2S 74850C" over UART -> "LiteOn Key V1 (DvdKey)"( n, c! U2 b5 I' i* t1 z6 |% c* q% ~
DOSFLASH LITEON K V1 0970 A0 1
2 E" f+ @; D( h
6 N) |) \2 M( V6 _0 G. C o- Extract drive key on a "LDS DG-16D2S 83850C" over SATA -> "LiteOn Key V2 (FreeKey)"
+ U. T: q; E$ E DOSFLASH LITEON K V2 0970 A0
$ j+ B9 e5 N1 t7 d# w$ Y% ~( Y
( p. {+ h, d5 f' J$ ?5 k3 K0 y- Extract drive key on a "LDS DG-16D4S 9504" over SATA -> "LiteOn Key V3 (Tarablinda)"
6 U t- a0 g$ f DOSFLASH LITEON K V3 0970 A0
9 f& _3 v$ k" [& A* D: L, ?1 F$ y1 V$ c/ P' a3 m: c* l4 r' B" A
- Read firmware on a "LDS DG-16D4S 9504" -> "Read Flash" this is considered risky!
4 [: F+ I: b4 k0 d7 H+ l DOSFLASH R 0970 1 A0 3 0 4 FWOUT.BIN 0
`& l! r: U6 P
7 @# A9 Q0 J9 m; d# o- Write firmware on a "LDS DG-16D4S 9504" -> "Write Flash" this is considered risky!
$ B% B. @( k$ w DOSFLASH W 0970 1 A0 3 0 4 FWIN.BIN 0! Q5 b! @, _' \: I3 y6 Q
9 a% Y. n/ f/ o0 D4 N- Erase firmware on a "LDS DG-16D4S 9504" -> "Erase Flash" this is considered risky!+ E7 W) c) k) x# O9 f& j+ L, L- x$ w
DOSFLASH E 0970 1 A0 3 0 4 C7 0
! V3 w$ d G- r. C* U* N' p
) F' \4 q% i% N6 X- Erase firmware on a "LDS DG-16D2S 74850C" or a "LDS DG-16D2S 83850C" -> "LiteOn Erase V1/V2"
& ?; [4 s B% _' @. a DOSFLASH LITEON E 0970 A0" v( F: c+ ~ s% D! W- t
( f2 |( H. i" R _
- Read firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Read Flash"
: z0 M1 @8 Q7 C DOSFLASH R 0970 1 A0 2 0 4 FWOUT.BIN 1
x# N: H9 C' E$ t( b0 m+ w/ p
$ K( ?! P3 s4 p6 i- Write firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Write Flash"
6 k O4 W) v2 Z! I1 ]' C DOSFLASH W 0970 1 A0 2 0 4 FWIN.BIN 13 w( ]+ e# _9 x B$ D9 o
8 X9 r+ i+ [+ s- Erase firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Erase Flash"
5 V- B, K* ?% D' |! p3 ^2 t DOSFLASH E 0970 1 A0 2 0 4 C7 1
: y1 f& Z6 m, E% E3 t4 j T1 _8 Q) D5 H( q3 H2 x: j! [
- Verify drive key on a XBOX360 drive, enter the drive key manual. m% i% M& a1 b- ~8 E, L7 G
DOSFLASH V 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF. k: \1 @0 E( s! i2 n
! v6 Z& n A" J# V8 I* t
- Verify drive key on a XBOX360 drive, load a drive key file
8 u1 j2 i$ t* x DOSFLASH V 0970 A0 KEY.BIN+ a4 O( S! d4 C5 v, }% J6 E! }
/ s4 W$ \/ y! H
- Inject drive key on a XBOX360 drive, enter the drive key manual0 a& `9 ^) z4 D; F& p$ Z+ m
DOSFLASH I 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF
; _6 y! t+ O# q! n# `
3 y) v4 S: R. w' g- Inject drive key on a XBOX360 drive, load a drive key file
+ _2 t6 R* S' q: _2 ` DOSFLASH I 0970 A0 KEY.BIN2 f, P' o7 K. a6 Q# D
1 \' l j3 f5 q/ @" M
For DosFlash drives on which we can extract the key via UART are considered V1. Drives we get the key over
8 c) Y" o4 x, |, l5 L+ H2 ySATA are considered V2. The new Slim is considered V3 but only firmware version 9504 is supported atm.
' @' B$ ?, ^2 n/ ~ K2 @! }7 ]" F) [* t& J( A0 N
" L4 V# K% b; Z% G$ cMany thanks to Geremia, Modfreakz, Redline99 and Tiros for their support. Special thanks to Geremia and4 m. W# B$ n `: G
Modfreakz for drive sponsoring, testing, coding and much more. It is always a pleasure to work with you( |4 \3 m" z$ N: `! A
professional guys! Respect to Maximus for his UART enable patch. I'm looking forward to your magic Lizard8 \$ I/ k2 R- |+ t4 K! E) h" m
hardware flasher!9 Y. E& T. i& c
0 t/ B4 ^, i/ D. Z
Happy new year 2011!6 i' G7 C- ]1 c6 }
Kai Schtrom
6 `3 b, ^0 @6 N+ A) @& e3 `
; ?" ?+ D: \& i6 i* m3 B: l2 G& E************************************************************************************************
8 I. k; P4 y8 \/ j( O1 i z+ o8 F! {8 M# u! L) b6 S
- O7 Q/ p* M! k0 i& [: ?
DosFlash V1.8 Release Date 08.08.2009/ p$ m. k+ F; ^0 c
---------------------------------------
1 B2 }# S, c$ K5 I: c- now supports LiteOn PLDS DG-16D2S 83850C V2 Geremia/Maximus LiteOn FreeKey method& Q# |9 W8 p/ H8 A U% n$ y
- huge firmware read/write speed increase, especially if run from a floppy disk
" m7 e8 ^) T6 a4 f- updated IDE/SATA motherboard chipset list) e, v! L( Q) V, D: Z( ?. X
- new IDE/SATA detection for Windows and DOS
7 x/ U( h p$ E" y- DosFlash.typ embedded in executable file
8 U2 ^# K+ }7 g2 `) w y, r# R+ s- LiteOn V1 drive key is now extracted 10 times and compared against each other,
" W0 o$ i" z A8 F! S2 R+ N+ u) o# S& \ after the extraction a summary is displayed sorted by the most common matches
* L6 \- i* d& F- D# O( @5 ^- LiteOn V2 drive key is extracted 2 times and compared
8 f& `4 |- M/ m4 @- new BenQ unlock keys added to unlock all known BenQ drive firmwares
8 c) w# o+ t; S5 v1 Z/ `% c S& Q- command line parameter "EnableDrives" removed, DosFlash asks the user on
@# @' J8 V4 h. H! Z* u application close if he wants to enable the drives or not, during the tests it
. d6 _0 M6 t# g# m0 w8 ] seems that IDE drives have problems with the enable, SATA drives seem to # R. \& q- i0 ~- }/ i6 E
work fine
5 N( N7 y: G e6 A; | ]' _/ ?- new 64-bit DosFlash edition added called DosFlash64, because some driver0 h4 B7 F% Z+ Y* @* z' D
functions don't work as expected in the 32 bit compatibility mode on Windows x64
" _" `" `# k- t! {! S- Beta state removed
I) D }$ D3 u8 Y- ready and tested on Windows7 X86 and x64
& y% m1 t3 C; V& l2 s( ?# q. u/ o1 u1 S' u* ^ O4 h
6 q. Q* D+ g3 P0 nGeremia/Maximus FreeKey method with DosFlash16
; A6 R9 w$ E- |" Y: z: @% [! Q6 k/ w( V E------------------------------------------------
( ?6 `& q5 W8 _3 f" WWe have added one cmd line parameter for DosFlash16 in manual mode. The COM port
0 Y2 i1 o0 _! m0 |# Wis simply ignored and can have any value for the V2 drives.
& P* B$ F4 o$ s* G# Z0 gUse the following command line to extract your free key from 83850C:! U9 P) r% u* k7 }' x( F) d
- DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin enckey.bin8 |" _; }1 b3 H
2 s& ` f1 R6 ~0 I% S5 b: u, W
6 M7 N* k$ r+ y2 m0 @3 y7 G
Tips for running DosFlash on Windows 74 O9 ^ ^& V$ k3 D* z* ^, w
----------------------------------------/ [& A4 D, L5 f: D/ W+ ]- z, O8 h' q
1 D7 d# o' w& J2 |% @& i7 TSince Windows Vista 64 Bit and upwards it is necessary that every driver is signed. Because
7 f, t9 M4 `! O4 g) B% X2 _/ }8 Kthe DosFlash driver will not be signed by MS due to some unknown reason we need to circumvent
+ S3 O6 ~1 V, e8 r2 {this check. You have the following 2 possibilities to do this.
9 Y* @7 a H3 q
$ Y4 k) ]" R$ j- e2 zSafe Way of Disabling Driver Signature Enforcement
; f4 K( V4 E* w/ i# ?% f1) On Windows 7 bootup press F8 to get to the extended boot options screen
2 {& P$ Q% f3 J7 _+ i. M2) Choose "Disable Driver Signature Enforcement"
5 D$ w0 a" ^: G* x3) To start DosFlash right click on it in Windows Explorer and choose/ F3 ~! [& o1 a( a+ L T( d
"Run as administrator" > answer the message box with "Yes"
( K5 N$ }0 T& c# q I4) Short after the program started a "rogram Compatibility Assistant" warning message
! M0 x2 w# y; ^: c/ R2 E is displayed, you can simply ignore this by pressing the "Close" button* C) m& t4 v" m+ X7 Q
& r$ g! y" Z: D" \# Q0 SRecommended Way of Disabling Driver Signature Enforcement
4 o0 ~$ H( l6 @7 W1) Disable User Account Control (UAC)- \( Z: ?% b& l8 q0 Q) K3 C
- go to "Start Menu" > "Control Panel" > "User Accounts and Family Safety" > "User Accounts"3 I* ^" l$ C7 o% z3 O4 T
- click on "Change User Account Control settings"0 X0 V; i t" u+ K6 b9 V
- set the slider bar to the lowest value (Never notify) > click "OK"
$ Y' {# a D% x" I: Q2) Sign the DosFlash driver8 U5 J! K) M9 F# Q4 H" m8 q
- download the "Driver Signature Enforcement Overrider" (DSEO) from* n- R1 S$ d9 m* ^
http://www.ngohq.com/home.php?page=dseo
, a% {+ c7 O1 ?! _1 Q2 p - start DSEO > click "Next" > "Yes" > choose "Sign a System File" > "Next" > enter the path to
, ?9 h& D" p: W5 `! r9 Q1 ]7 q* T the used driver (portio32.sys or portio64.sys) > "OK" > "OK"
" q* Z7 W# Q0 [4 x+ r6 ^& q3) Disable Driver Signature Enforcement
, ?" q' O! i, p - start DSEO > click "Next" > "Yes" > choose "Enable Test Mode" > "Next" > "OK"( ?2 P& d6 L5 A# S6 _' y
4) Restart the computer4 U+ u$ E0 @/ E4 |, `! j7 E& h
+ W+ O" `2 m' _
Keep in mind that with the recommended way the changes will have effect on every reboot without
: ~) ]2 W/ }7 q5 y$ B( Kdoing anything manual. The first way needs to be done over and over again. In addition the second
" K" D; P' K, s8 _way can be used to sign every driver that doesn't run natively on Windows 7.
8 ?1 @ |* E2 e9 f. I: I2 U( e6 P0 V% e5 l' ?: o& u
For use of the VIA Cards in Windows 7 it is recommended to uninstall the VIA driver. This can be
: w1 h4 `6 W7 edone like follows:( r( V9 Q9 M9 A F$ [$ T8 q( U' C
- start "Device Manager" > expand "Storage controllers" > right click on "VIA RAID Controller" > " I) i3 W8 v& s k
choose "Uninstall" > "OK"
: F6 h" f% W7 _$ a3 r6 c- rename C:\Windows\inf\vsmraid.inf to vsmraid.inf_
6 k$ ?0 X2 b6 C1 L, T- rename C:\Windows\inf\vsmraid.PNF to vsmraid.PNF_+ M5 t0 o/ [! m5 m1 x! i
- rename C:\Windows\System32\drivers\vsmraid.sys to vsmraid.sys_
, O" f/ `2 Q# F- reboot computer4 |& |3 I) b" V$ z
( F0 _0 X. {4 U2 t, }
3 q- e7 o; d3 U( p, K( w: j/ N9 mMuch respect and credits go to Geremia and Maximus for their money saving FreeKey app7 u8 ~0 w2 n4 V8 h+ W8 l
and their lightning like decryption speed!+ o* k. _# J' n* b) @+ t
) ?! D( E& J, W5 K3 E- QIn Dedication To The Birth Of FreeKey On August Fifth 2009
; t8 W/ t8 Q& hKai Schtrom$ `5 v: t( `3 }% h
4 l4 b# O( k5 z) Z9 n9 X1 |
8 D j' @1 u O k6 o************************************************************************************************4 b1 C* X7 n* } e2 v" v
1 S f% B/ V J! f; u6 B/ r/ L# S2 h
2 C1 I/ V/ g5 v; XDosFlash and DosFlash32 V1.7 Beta Release Date 23.12.2008
: g/ `" m5 ]- B4 d# {-----------------------------------------------------------; d! B, H7 N! m+ G. x
- now supports LiteOn PLDS DG-16D2S 74850C and Geremia's LiteOn Erase and DvdKey method: |, }- B6 X* S
$ X0 G9 N, t! L z' x$ [
% d& }( S% e6 i! |- Q% g
The following only applies to the new XBox360 LiteOn drive PLDS DG-16D2S 74850C.; G) k" v0 ?5 f% d' h
y, M' u7 X/ q# ~
; b: _! S) d) O/ j6 c; j- d- tGeremia's DvdKey method with DosFlash16 with the PC's psu
4 j+ H& p; i6 U/ a- t# X5 |-----------------------------------------------------------
6 J8 t, Y$ x6 w+ R% s4 S# k7 c; }- disable CD-ROM boot option in BIOS
2 ~1 j; ?' n7 j/ d: ]- connect LiteOn to your PC's power supply unit and SATA port; A' J7 R! q7 u3 I0 B$ g: z
- power up PC, wait until bootup is finished- `. L" [2 r# j" P
- eject tray of the LiteOn and shutdown PC completely6 [ A; p! X! r! A7 y+ T2 V( m
- push the LiteOn tray half in$ R- h! c- O) M( ^, u9 v& G: T
- power up PC and boot into DOS- r" \% m y- {7 L
- run DosFlash16 in auto mode* p n: S' Y) M4 _8 E
- if you read the following:
+ Q( M# |* Z# u3 A" J$ B MTK Vendor Intro failed on port 0x????.
% q1 g0 H/ N: `4 u! ^4 s4 T4 [ i If you choose to resend the command you should turn the drive off and on
; A" r3 F7 ]' t) t after you pressed "Yes".6 |6 Y- v7 W8 N# a
Do you want to resend the command until the drive responds (Y/N)?
& }) Q2 Q& i5 C c# V& i9 T1 M) z- press 'N' for "No"- x5 f: P/ ?4 y3 S+ M* o
- choose the number of your LiteOn ATAPI drive
6 x' B) O' y0 I- enter "LITEON K" to read the drive key( ^ L( u0 `' d
- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
) D2 q! `4 B7 Q5 X6 u- enter the number of the COM port4 o+ V: I! _1 ~, Y0 [
- if you read the following:
! B, M3 X6 d" \" ]5 c To receive the drive key use Geremia's DvdKey method like follows:
+ q7 s3 h, c; }" K - Connect your drive with a serial cable to the COM port
7 W+ `) S- `6 Y( R) m+ k" | - Eject drive tray' p, S- g( F! Y
- Power off drive7 F, S$ [. K# z4 h5 e! z7 p
- Push drive tray in until it is half open7 ~- k7 ~( c' V9 V. W
- Power on drive6 @- s# O5 c3 Q* h9 ^' x- u0 L% l1 y- C
- Press "Yes" if you are ready
! Q! \5 y+ W( y7 U0 ^ Are you ready (Y/N)?5 n3 F2 j+ s, x& V5 m! D" v
- simply press 'Yes' without doing anything of the above, because we
2 X2 G( }2 ?3 o, P already did that before
7 X' }. t0 I/ P" N. A* G- after this DosFlash16 displays your DVD-Key and saves your key and identify data
2 o. m; y. D% g. F- to do the above steps in manual mode use the following command line if your drive- ?2 x0 b8 m! Q
is connected to port 0x0970 and serial cable is on COM port 15 B# y2 r- n; `) v
DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin5 e0 \. r# x6 Q* \, v
$ c W3 q- e# O; U) N1 o
I: ~9 `1 d( ]
Geremia's DvdKey method with DosFlash16 and 2nd psu
2 i9 n" [5 x/ q F- `-----------------------------------------------------7 a4 _# ~$ W+ O: X% O4 P. z
- connect a separate power supply unit to the LiteOn, don't turn it on yet
4 o" _6 A# N$ ~5 f) i% L! k+ c1 n- power up PC and boot into DOS
0 w1 Y& ~1 g5 {- turn on the LiteOn psu
3 [7 t& i# e& [8 q. Y- run DosFlash16 in auto mode! y2 u4 a0 v& ?- N% p# _
- if you read the following:8 S/ [' N' ]! a% h5 G$ O
MTK Vendor Intro failed on port 0x????." u! u/ D1 y% L0 e7 A# [/ v
If you choose to resend the command you should turn the drive off and on2 C/ h$ h/ m2 n0 e# \
after you pressed "Yes".
/ |. N4 a1 N3 S4 |/ ^/ {1 G' b Do you want to resend the command until the drive responds (Y/N)?) V3 _' K: a' W- I
- press 'N' for "No"
( Y( C; I! h4 s7 X( r) ^- choose the number of your LiteOn ATAPI drive
# C! p. X7 d3 W/ X, c- enter "LITEON K" to read the drive key
) ~- n. }$ f: D- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
Y5 e" ` G! z z- F- enter the number of the COM port4 [1 p# G, ]/ B" A( T! a* o9 k5 D
- if you read the following:! t: v5 s$ U" L$ n" ~
To receive the drive key use Geremia's DvdKey method like follows:
, r( ]1 A9 F/ Y( N' `3 J - Connect your drive with a serial cable to the COM port
7 `; b U9 }, \& L- G% O. ` - Eject drive tray% ^; ^: _ G& M, h
- Power off drive& I2 I/ b( r2 d8 `! E
- Push drive tray in until it is half open9 u- V6 s$ b* R( W0 E# w# T
- Power on drive+ j' J- R6 J$ B9 ~# [
- Press "Yes" if you are ready4 b: S/ g* W/ F) L
Are you ready (Y/N)?3 A: V5 q# ?( h( Q+ {7 e
- do the above and press 'Yes'
" D! u* s6 o7 q1 h" ]+ V0 v# E' @- after this DosFlash16 displays your DVD-Key and saves your key and identify data
* y( z9 U& n( x1 v) q3 R9 E( X/ @: [* V; A6 E8 i
' r" m1 V& S* R
Geremia's LiteOn Erase method with DosFlash16 and 2nd psu
4 ?- ~/ w) \2 `9 C! I& v9 l& T-----------------------------------------------------------# n" M+ h% S8 n+ `5 E' e5 N
- connect a separate power supply unit to the LiteOn, don't turn it on yet
5 F3 O) x8 C1 h' I3 a- power up PC and boot into DOS
; l, h1 p# c @/ ^2 ~! W8 a, V- turn on the LiteOn psu2 h6 O9 E0 R Q6 s# o! B1 n
- run DosFlash16 in auto mode
- `( V4 g( p. m1 ?1 P C e( z- if you read the following:
' `) O6 A7 E! |: c$ f) e& i3 m* i MTK Vendor Intro failed on port 0x????.5 k6 p) K" b3 c2 I
If you choose to resend the command you should turn the drive off and on5 {. @4 s' v8 `
after you pressed "Yes".
5 j1 N6 g$ @( y$ `5 w9 e! A* j Do you want to resend the command until the drive responds (Y/N)?
: {+ v7 N E8 z- press 'N' for "No": h& ?- ]1 x; q
- choose the number of your LiteOn ATAPI drive" t8 {, n1 P- Z3 w1 O- z! {
- Warning!!! Keep in mind that you will need the drive key before you erase the flash,; F4 G8 ]6 C/ J; d0 B5 y* W
without the drive key your XBox360 will not work anymore( l. k1 F- O9 M/ `6 C
- enter "LITEON E" to erase the flash
0 \% L# U" X# F0 e/ V7 l; z8 O- the first time after the LiteOn Erase the drive needs to be repowered to give1 s) Y- x4 b7 z; ? j
flash chip access, this can be achieved by repowering the drive before another
* [9 g2 t; i. Y" S1 F; v DosFlash16 start in auto mode or by doing a MTK Vendor Intro Power Brute
/ q8 i0 i5 \) e- in my tests it did not work to power the drive with the PC's psu, because it will( R3 c1 \* I, t' t- O
always respond with busy status1 c( m; a4 c' Y8 D3 Z
- DosFlash16 can now read, write and erase the flash chip like usual+ A/ e4 I" q9 t- Q, h
- to do the above steps in manual mode use the following command line if your drive0 u8 k- K& \3 G2 o
is connected to port 0x0970
) A; I6 q* k8 E8 z DosFlash LITEON E 09700 x: Q: o1 C* r8 a/ e
) Q" L3 S' C( s3 u) [0 Z1 ?
2 e6 \5 Y2 W6 `
Geremia's DvdKey method with DosFlash32 with the PC's psu
) W' F9 V/ P2 X4 S# L7 C-----------------------------------------------------------, l% [0 M3 f8 o Q3 R
- disable CD-ROM boot option in BIOS1 h: R; m [1 f; u
- connect LiteOn to your PC's power supply unit and SATA port( f! s* \, g) l9 z: t
- power up PC, wait until bootup is finished/ i+ \6 d% f* M& U; T% P
- eject tray of the LiteOn and shutdown PC completely
5 @1 ^% f# G3 X( Y1 ]% C% s- push the LiteOn tray half in
5 y, t- |1 K1 x- power up PC and boot into Windows
/ t" n# ~/ G2 J& c3 ? E+ s! V- run DosFlash326 y$ n7 V! h7 u) V$ C% j
- if you read the following:
. K3 @1 u* s3 b- B; A# O, _9 j MTK Vendor Intro failed on port 0x????.' i/ w7 m# a/ b/ a9 F
If you choose to resend the command you should turn the drive off and on& K& D1 ]4 X) R+ K* ~: N
after you pressed "Yes".
6 ~: [8 Y: h3 ~0 f5 V- y Do you want to resend the command until the drive responds?7 C4 \$ {( T9 s9 U" ]% Q1 |
- press 'No'; C4 O' P( k- I1 o
- choose "LiteOn DvdKey" as flashing task
/ @ M$ f! O( w) ~7 ^' a- choose the COM port number
' a& v+ G1 w* I; m- press on "LiteOn DvdKey" button
+ Z$ j+ c6 n2 \# G# l+ b- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files; f# B4 G* Q# I% }1 p3 x7 n% o
- if you read the following:6 j" F. S& r/ y
To receive the drive key use Geremia's DvdKey method like follows:
( q% s; @ L) I( P8 W/ { - Connect your drive with a serial cable to the COM port" C$ K7 N' i& l. g; w7 U. Q
- Eject drive tray. G3 c4 W$ R% `4 J
- Power off drive
' R2 Y2 q5 s( D9 E7 x* l - Push drive tray in until it is half open
4 x8 m+ Q7 t% K# M( m4 } t - Power on drive
Z$ m% G8 D3 ` G/ L- t+ w - Press "Yes" if you are ready
, g7 D) e, d' d3 G; {4 f Are you ready?
( j+ i& }8 }8 k0 r; i, Q- simply press 'Yes' without doing anything of the above, because we4 `* B1 e6 w4 k, J/ {3 `
already did that before& V' t2 @4 |* R8 S
- after this DosFlash32 displays your DVD-Key and saves your key and identify data# o ~0 L; P" ~$ a
1 y# Z; G: ?( V( K( z
% [* u6 _; q1 xGeremia's DvdKey method with DosFlash32 and 2nd psu5 Q8 g$ c4 w- `$ g' T
-----------------------------------------------------9 s, w$ X4 K2 z
- connect a separate power supply unit to the LiteOn, don't turn it on yet/ d7 Q( G- [* m% ]% m% i
- power up PC and boot into Windows, \0 l0 v# r' t! ?
- turn on the LiteOn psu
/ M! A/ w# W3 e) Q- run DosFlash32
. h4 l5 A: x1 n4 y- if you read the following:: Q- w& {$ v/ O- y$ [( A) t
MTK Vendor Intro failed on port 0x????.9 k4 @1 E9 m9 ]" C! R
If you choose to resend the command you should turn the drive off and on( V* H1 N& s& P y$ _3 D4 s
after you pressed "Yes".
& J9 X. j' T# M( u, b Do you want to resend the command until the drive responds?/ D/ i) K& [4 f7 u2 }2 S
- press 'No'
$ ?) N- M1 {+ z) w) {/ |- choose "LiteOn DvdKey" as flashing task
% _6 v# a! l4 ?6 K) {- m- choose the COM port number
: M' S. @& Y5 j6 A! x% f- press on "LiteOn DvdKey" button
- `4 U4 `( K8 V3 X- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files& k; ?2 A( A5 O" R1 h& F
- if you read the following:
$ B4 Y& D7 @# o To receive the drive key use Geremia's DvdKey method like follows:
, H2 [# \- j8 r - Connect your drive with a serial cable to the COM port2 ?: _2 r# I8 t- G6 y
- Eject drive tray
4 d% q- A- V0 \- C1 U) h: Z - Power off drive2 w O0 I/ a4 s5 u" s% A
- Push drive tray in until it is half open
% \; `: j( s# x. g- Y0 d6 r: P - Power on drive. W% l/ k: |! Q' L: }4 ^+ c3 d4 a
- Press "Yes" if you are ready6 I- {! h) \$ f7 m C
Are you ready?$ X. p* x# G2 g2 \8 G
- do the above and press 'Yes'
( t2 n( a6 r+ G- after this DosFlash32 displays your DVD-Key and saves your key and identify data4 ` ]/ W* }/ s
! K6 U5 r4 s) S5 w$ D! J7 R- C
) W+ I8 u1 }7 P. MGeremia's LiteOn Erase method with DosFlash32 and 2nd psu
7 R* B3 j) M; y' x6 J! L* j-----------------------------------------------------------# p! v0 G. ?7 s; U
- connect a separate power supply unit to the LiteOn, don't turn it on yet
* d8 q9 Z+ N8 C- power up PC and boot into Windows+ C6 b0 ]0 M5 M3 I
- turn on the LiteOn psu8 ^& d, q! W4 q" f- z& g2 B% N
- run DosFlash324 E1 J5 R. A; n
- if you read the following:2 A$ W. O' ?" X
MTK Vendor Intro failed on port 0x????.
, L" ^2 ^9 b* Q( S6 V$ | If you choose to resend the command you should turn the drive off and on
7 x% W# i. @8 S after you pressed "Yes".) `1 `$ m: a8 I7 J, v1 V* R
Do you want to resend the command until the drive responds?
; v, ~: _) V7 E, V4 K' o- press 'No'* K- w+ M9 f* B N. d- `
- the LiteOn flash is not identified' H" Q8 l% V7 ^" C x! u) D
- choose "LiteOn Erase" as flashing task
) P0 c0 p1 e" }* B. B6 x! K) D, l- Warning!!! Keep in mind that you will need the drive key before you erase the flash,
) A( m4 ^2 g/ a$ A without the drive key your XBox360 will not work anymore( O# H+ v- q+ l6 Y
- press on "LiteOn Erase" button
) H; Y! U) s+ t& b5 U+ {* Q. K- the first time after the LiteOn Erase the drive needs to be repowered to give3 R! Z V8 i, @# v( I) O2 f
flash chip access, this can be achieved by repowering the drive before another% e; T& X2 e8 A. l9 ]- S' k4 w# H
DosFlash32 start or by doing a MTK Vendor Intro Power Brute1 H; ~; Z% P9 x- S. m( a
- in my tests it did not work to power the drive with the PC's psu, because it will
* z" h; d" O3 X# m+ f* M U- r always respond with busy status8 f1 l) z/ s, u) e3 }
- DosFlash32 can now read, write and erase the flash chip like usual3 {$ F; A- A# ]7 U% I
# H6 D# q/ h W: t( P R+ j
l- w- N ] h/ WRespect to Geremia, Modfreakz, Podger, Redline99 and Tiros.# P, ^. B; U* V( J
! ^; |# C/ a Z9 s2 Z( P
Like a wise man said: "0x2E is the MTK Intro of Death"
2 K" `2 e6 |8 ?Kai Schtrom
' E$ c4 w6 \4 r: \) {2 h+ b5 x0 i* A: |3 W4 G+ q
8 E) j( p3 `( @% d( i4 U; `************************************************************************************************
H# w6 K2 u* h
3 j3 R7 S" j( l5 A% m7 A/ N
( q& l4 |6 V. ~DosFlash and DosFlash32 V1.6 Beta2 ~ s9 Q1 |6 C" \' Y
-----------------------------------0 ?* s2 Q) o4 |1 q
- fixed power brute unlock bug for VIA cards, this can stop your VIA from working
6 V" y# W% t& t7 V- ` with the power brute unlocking in Version 1.5
1 A1 Y+ I% P5 f, l! \8 k( X' D- for DosFlash16 in auto mode on DOS my VIA card works best if I do a cold boot
7 Z, }" u! g% J' x: D$ s3 g" D and power up the drive short before or with the PC
4 E9 i* x5 x9 l4 T. r- for DosFlash32 on Windows my VIA card works best if I power up the drive short
6 o! B. F2 s9 E/ V) q) j before starting DosFlash32
8 h4 i2 f. b6 \( i- for me the VIA works with internal and external connectors on DOS and Windows9 {6 \8 o* G7 z. r; Y1 L0 J/ C
, O# A5 a6 D4 i( |/ e7 X) GSorry for the trouble!
- l4 o' ]2 {# [/ L |( ]Kai Schtrom
) u$ G3 O5 {9 G- a
0 q1 e+ |1 w4 b+ o& m- _$ A
6 H+ f! L) f! i7 O4 j0 t, |, Q/ y************************************************************************************************7 ^ [1 Q+ X* `6 ^- F$ p) b
" b5 @. a# O/ Z) h2 Q. W K0 Z k; b0 F$ ^
DosFlash and DosFlash32 V1.5 Beta$ s8 @% ~6 {0 Z
-----------------------------------% S* ^) y) ~! B% @/ l
- now supports serial flash chip MT1309E with mediatek status 0x72 like the SH-D163B, SH-D162D,3 t# i, |+ b2 _4 L* W
Asus DVD-E616A3, Asus DVD-E818A3, Sony Optiarc DDU1671S
5 l: u2 w. `5 o( o1 n4 M! u- SST25LF020A and SST25LF040A chip support added ^% T/ Z, d5 x1 m3 a7 X
- DosFlash32.exe ported from MFC to plain Windows API, exe size is now 22 KB
0 ^* C) Z* R! l, X, ]- new port i/o driver, because giveio.sys can't be compiled for 64 Bit Windows5 p& S3 q6 E( F ^
- DosFlash16 changed slighly in manual mode, one parameter is added to support SST25LF020A and; x9 Q1 n! \! N6 W- \
SST25LF040A+ [: g* F/ o. T8 }& ?# d1 ~
- two new methods of BenQ soft unlock are now possible on all motherboards with only one power g- A* b7 J# j% c
supply unit
$ p% C7 D7 A& o1 K4 u& @+ V6 E- 1st method is powered by Geremia's unlock core, thanks for the complete idea, concept and, D4 d" ]! [+ J& T# O" a2 S
source to Geremia9 s4 l5 g% [* o7 i8 [
- 2nd method is the Magic28 key send, this only works on BenQ VAD6038 firmware, thanks to
; J! R3 X5 h8 R' k c4eva and podger for the initial idea
5 F7 C: k. P# e4 J" G- the two unlock methods are send one after the other if the drive is a possible unlock
{! N6 {, H# ~, {( |* _2 d$ | candidate, first the Magic28 command, then Geremia's unlock commands and after that the
) n% R4 Y+ s+ r# s. P& o already known power brute unlock is send to the drive, you can cancel any of these methods
1 }2 _- N3 g1 T before they are send to the target, this only applies to BenQ drives with a locked flash
/ `; k% t, A8 F- DosFlash.typ updated
% A# k. x1 |( b2 h- other minor improvements
' @! H k6 `: m% @2 s" v- DosFlash32 is now ready for
9 ]# [# D+ Q8 S7 E/ s D! K9 _7 w - Windows 2000
) |* J7 z6 n }3 i/ | - Windows XP 32 Bit
% I3 c2 ]+ c- i, F, R - Windows XP 64 Bit
. U: ~; m' f% _* t: C8 I g2 q - Windows Server 2003 32 Bit Z: n1 F1 V0 X' k2 C: G4 B
- Windows Server 2003 64 Bit5 X5 b* a. f3 _ R# w8 [3 K
- Windows Vista 32 Bit
. @3 `1 c' Y" Z; E& N' o - Windows Vista 64 Bit; Y6 f1 `. G/ D5 y
- Warning: Drivers for Windows Vista 64 Bit need to be signed, because we can't afford the
7 K2 S' ]; l. t9 g6 M4 ^7 r7 f& Q money to let portio64.sys sign you need to do the following:
' ?; ?! G' W6 s 1) Log on as Administrator8 v! a; x! C z' X0 e, K, r
2) Enter the following command in a Dos-Box:
7 u: S1 P! V7 G! ~" _4 q "bcdedit -set loadoptions DDISABLE_INTEGRITY_CHECKS"! v4 k: S$ |- ]3 l" E
(we made sure there are no typos in the line above)  " x. V: z& |+ R9 {( b1 h
3) Press enter and reboot your PC
- S: U2 n P5 |# K' H' t 4) Press F8 key upon initial system boot up
4 A5 {6 v6 v/ r& Z2 v# S 5) Choose to disable forced driver signing enforcement for that boot session' l/ L1 C; E9 U/ `
) w# q6 ~6 @6 E' p; ~$ h0 A/ c o0 p) z+ M
The following only applies to drives with a locked BenQ flash.4 f2 y6 ]5 \; a
0 k- q0 w( R# h3 _3 L- O1 _* Y3 i4 h! K4 v
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with the PC's psu
7 v! u. f3 @# K( `* i$ N+ w-----------------------------------------------------------------------------------------
, J7 x0 G+ j; m7 x1 Q6 w- O- disable CD-ROM boot option in BIOS
9 b2 N( x' z! L- connect BenQ to your PC's power supply unit and SATA port6 @) _9 G5 n8 u* X( [. @
- power up PC, wait until bootup is finished+ [6 M3 d: V3 v4 O5 U5 [
- eject tray of the BenQ and shutdown PC completely
8 g( F/ y, S+ p" r, y9 `; A- push the BenQ tray half in
- @0 X- u8 P8 R0 p) f- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash32
4 e2 C7 Y1 M! d- n" M; T" |- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
6 J, ~2 u7 R) F/ r- if you read the following:
0 z8 W, |7 |! l |$ G1 _ MTK Vendor Intro failed on port 0x????. Because there seems. g' V2 F. T* ^* D; a
to be a BenQ drive connected you should try Geremia's
# C; C# i: x+ Y( M unlock method.8 |% j7 W1 ~2 U! ~( ~8 B
- Eject drive tray j! ~! w, x5 f3 N6 A( _* f
- Power off drive
5 Z2 C1 q# L" {* [4 N8 z - Push drive tray in until it is half open* e) Z: e: o. h
- Power on drive
* _9 V1 m/ Z+ Y$ x& @ - Press "Yes" if you are ready0 H( x u2 n0 u' D: _" f, I
Are you ready (Y/N)?
& X5 j) v2 t) c- simply press 'Yes' without doing anything of the above, because we
6 a v8 n0 f! d6 h. q, A8 W already did that before starting DosFlash16 / DosFlash32
+ \' q4 P7 r1 G6 I) i& A* {% q3 r. J4 R- the BenQ flash should now be identified
: n: _' K, L: c( H- go on like usual e! @* y' I; i9 A. F. z
8 r& ?, Z* i9 u2 I. \ d& p& |' y1 w, v0 z
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with 2nd psu
: o# I! J8 r; F------------------------------------------------------------------------------------
& ]# I, w2 X7 O) p q: C9 x- connect a separate power supply unit to the BenQ, don't turn it on yet
* |0 O" |/ Z) `9 B# l- power up PC and boot into DOS1 A) Y" A* L+ B
- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
* B4 y4 \2 s, O5 d/ b* I- if you read the following: B0 y7 ~# z. @/ m
MTK Vendor Intro failed on port 0x????. Because there seems
3 C. Y2 k# N9 h$ i to be a BenQ drive connected you should try Geremia's
# F* K8 d" C& @9 l: \: z7 C unlock method.6 |# n- \6 q2 O/ W4 h3 M) f5 u
- Eject drive tray% v$ e5 o( K5 ?
- Power off drive, t( B7 F0 Y* x7 s( {
- Push drive tray in until it is half open
$ G9 P, r+ C( I. T7 G4 }8 {/ C - Power on drive! E& i5 A' e1 L- s: U) L
- Press "Yes" if you are ready2 R1 U9 A# h" i( |1 P
Are you ready (Y/N)?( B3 r4 P7 I* n1 s' [1 [
- do the above and press 'Yes', a o, v8 r* f4 ~1 s/ i _: A" x) |
- the BenQ flash should now be identified) X, M4 j( B/ ?- n- C
- go on like usual; K7 |- f+ G5 O: J$ s6 u3 P3 X
$ L* b8 l- `4 u( w, D& y/ w
' U& K. x( U1 [9 c. L1 \+ M2 f) yMagic28 BenQ unlock with DosFlash16 / DosFlash32 on any motherboard
+ v/ g |5 i ]- t---------------------------------------------------------------------
$ f: R- A _8 j3 D- connect BenQ to your PC's power supply unit and SATA port3 e% q7 r: u b! l
- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash326 y! \8 u+ I: F3 E! R
- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
4 B* N, p8 v- s( S2 l3 I- if you read the following:5 ?1 W1 U) }# ~' ?
MTK Vendor Intro failed on port 0x????. Because there seems
. Q# z S X$ ^. ^1 @ to be a BenQ VAD6038 drive connected you should try the( o! c+ t. t, p0 a
Magic28 unlock method.
! U* o, N5 W* A! A Do you want to send the Magic28 command?2 V( R' v, W5 u) l I
- press 'Yes'
7 d0 f! @" J2 n9 e9 `8 i/ P! G- the BenQ flash should now be identified% e: P; y2 c+ A: h ?5 O8 x
- go on like usual
- ]+ @2 x) y: E0 p6 O4 g
* ?" X4 \' H! C% M* @; h' G$ ?% d2 v8 G" }- I9 C
Thanks to Redline99 and Tiros for help and support.
: u$ ?( `/ }3 K! y8 e- O; T: D4 B* f# N% o1 v: w
It's all about DOS!* i6 v$ o( i) s+ Z+ O8 M
Thanks guys for the excellent team work!$ p/ e' S- Z. O2 G
Geremia, Modfreakz and Kai Schtrom
/ m* |+ y1 g/ t3 t+ D# z/ e$ f- J
- ^0 Z4 }& k+ r) p( h# C$ ?, S! \3 P% ]: L
************************************************************************************************2 @5 A/ V, q$ h
( p' T8 ]& j+ E9 F2 o* X! S: F4 z/ T% t/ Z [: S+ R1 I
DosFlash and DosFlash32 V1.4 Beta
: @/ s$ m$ j/ B( Q! M9 B-----------------------------------* @6 l8 X- G. {3 w
- DROM6316 flashing support
, a& Y( R( f$ a% x3 d- a flash erase is now always done with a chip erase and not a sector erase command, because
/ y- L# E3 W6 n( e+ N# f! m the sector erase gives problems for some Winbond flash chips including the DROM6316
# b* f2 }% h7 `- DosFlash.typ corrected and updated" y5 J' N: @, r1 o; V- F
- for a detailed explanation on the soft unlock look at the included file SoftUnlockByIriez.txt,1 }# `! {6 n5 ?& B
it contains a very good explanation by Iriez from XBS, thanks for that one!
0 I4 U" Y% F* F( |+ A! a8 b9 z l* H4 R9 B
Thanks to Iriez, Jumba, Redline99 and Tiros for help and support.5 ?6 W7 c2 s, v9 G
h: G6 u+ z' J b+ p
Happy DROM bricking!
/ l: j; \% C/ a* o7 }! ] y7 ~Team Modfreakz and Kai Schtrom
6 ~1 \9 N b. y; ?8 q) A% P- R
& p3 N7 q) \2 k$ V3 R. v$ l+ G7 i3 b- I$ O5 @' A
************************************************************************************************4 g) l2 p c! s( G: |$ _/ S
: l5 r# \/ C# B( u
# Y! [3 y% e1 c( i) Z
DosFlash and DosFlash32 V1.3 Beta
: g0 b- u' G/ s-----------------------------------
. j ]3 J! F( r; C& l1 N! S- BenQ optimization in unlocking the flash chip, it should now be possible to read/write/erase/ Z$ N3 ^1 I! p+ a8 }( x! t
the flash without any soldering or wire tricks, the drive is polled for the correct mtk( q& D$ h6 D% h# j4 k
unlocking status after power on, this only works for VIA cards and NForce boards atm
4 Q5 ~8 ^& R0 w* l+ b- DosFlash32 has one additional parameter, if you start it with the parameter "EnableDrives"1 }& s( \) S( c
all the DVD-ROMs are enabled in device manager after flashing, this could give BSOD on some4 Q2 w# A2 J4 i+ u1 x1 s3 X
systems, therefor you need to create a DosFlash32 link and add that parameter manual to use it- L! {2 t, f1 |1 ^
- DosFlash16 has one additional parameter "Send ATAPI Device Reset" in manual mode, this could3 c/ q) v: ]0 A( l8 y: c
give better chances for soft flashing on some VIA - motherboard combinations
$ o( }; b2 J# v, b f- better support of Intel chipsets, drives can now be flashed if the controller is not set to
! v) D1 ` y9 H native mode in the BIOS
) }2 U( S+ M' x, L; U) W- the following controller list includes vendor and device IDs that are hardcoded to identify( ^# q6 `* }" s7 Q9 H
the controller type (IDE or SATA), this is needed if the BIOS uses IDE ports like 0x01F0 or1 d- Z" H0 z' h( w
0x0170 as SATA and not as IDE channels, this list is NOT related to soft flashing
$ C) b l% A g) {- the following chipset support is added
6 z. N4 ]9 N* x" m2 o9 e - VIA cards5 |9 m& J6 u$ E. K0 ^5 c1 A
- all VIA cards with a 6420 chipset
3 i- J1 _4 }6 R/ ^6 P; w, a - IDE Controllers
) j g! B. L$ G: q: \$ ? p. o+ K - NVIDIA nForce 2 IDE Controller; A7 }8 b7 {+ a+ j; r
- NVIDIA nForce 4 IDE Controller
/ h/ X) { a( A: n1 W - Intel ICH9
. i7 F9 V# |, i7 F! @$ A - Intel ICH (i810,i815,i840)
. r( @# h, Q2 |1 f$ W C2 z4 g - Intel ICH0 Q+ w/ r# B; e/ f5 m! }
- Intel ICH2M- f1 G l: p" f3 Q0 ^7 {+ @& _
- Intel ICH2 (i810E2,i845,850,860)
s9 a* H' G. I( f8 | - Intel C-ICH (i810E2)9 N/ }" d8 F; ~" G/ g: I+ `) y" P, n
- Intel ICH3M
: v- ]% k. n2 m! q* T - Intel ICH3 (E7500/1)+ h% d5 z4 E0 B9 s2 o9 y5 v. w1 l8 [
- Intel ICH4 (i845GV,i845E,i852,i855). _- C- X* J# A+ F& L
- Intel ICH5" H3 P% R: k1 b8 S2 Y( M
- Intel ESB (855GME/875P + 6300ESB)9 t- n+ p9 W G% L* W
- Intel ICH6 (and 6) (i915)
$ u0 W4 l1 v* t4 L5 v - Intel ICH7/7-R (i945, i975)7 E( |% J! R" O. G) R, {, \
- Intel PIIX3 for the 430HX etc7 r/ J/ J# h/ H' a! K
- Intel PIIX4
/ e; b" `1 H! Q3 \- Z; a - Intel PIIX4 for the 430TX/440BX/MX chipset! Z3 q) t0 X+ g4 A) H' U1 J% e
- Intel PIIX
' d# F% {1 |0 r1 b" q1 s% J - SATA Controllers3 n2 I% u( [0 b k# Q" p
- NVIDIA nForce 4 SATA Controller, U7 a* M; U' n8 [: V- S7 B! x
- NVIDIA nForce 2 SATA Controller
9 E8 r: ~: t1 W4 r/ J7 q [3 V - NVIDIA nForce 3 SATA Controller
" r$ e3 f2 O- {& L# k1 s; ] - NVIDIA nForce MCP04 SATA Controller3 ?$ \% v: ~7 ^; i% v c
- NVIDIA nForce MCP51 SATA Controller
6 D' r* x( j9 v, z - NVIDIA nForce MCP55 SATA Controller" r6 _" }- f( X F2 f+ f7 W
- NVIDIA nForce MCP61 SATA Controller( ~7 b8 }4 H0 b( o- m4 u) F
- Intel 82801EB (ICH5)
0 Z! H/ R& |/ | - Intel 6300ESB (ICH5)
1 f( v. i1 }, f& f$ n; f+ k+ [$ a - Intel 82801FB/FW (ICH6/ICH6W)
2 _3 r2 _& z4 U - Intel 82801FR/FRW (ICH6R/ICH6RW)
+ h. y! f( O& g0 L* l5 P - Intel 82801FBM ICH6M
) i2 Y% |7 s3 _6 `# A3 z - Intel Enterprise Southbridge 2 (631xESB/632xESB)
! G9 ?: a1 C/ S7 Y) y5 x5 [. f - Intel 82801GB/GR/GH (ICH7, identical to ICH6), D" B4 \6 L+ S/ C5 l
- Intel 2801GBM/GHM (ICH7M, identical to ICH6M)
+ e8 j' M% Q f3 U3 ~4 q - Intel SATA Controller IDE (ICH8)
+ f" s+ y( T1 ^# B; J - Intel Mobile SATA Controller IDE (ICH8M)- {# D+ U8 d$ Q7 r
- Intel SATA Controller IDE (ICH9)
/ `: y/ D% ?. o* M# J: B - Intel SATA Controller IDE (ICH9M)' v Q& f2 T1 n* Q
7 s* y3 u$ @3 x3 E$ n: f5 h' i% ~1 l4 ?
The following only applies to a software flash on a locked flash. The methods have been tested2 M2 ^: B4 Z) {
with the BenQ and the Sammy. The VCC trick will work on any motherboard, but you need to do
2 r) K( q$ k8 Rsome soldering and cut traces.% N' R9 O5 q1 b$ ? a
& M5 R4 Q' N7 Z2 d! C$ R
/ H3 @) k8 s- W6 ^1 LSoft Flashing the BenQ in DOS with a VIA card and DosFlash16 in manual mode" `/ ^, R5 Y( z9 j$ S# W
-----------------------------------------------------------------------------3 b% e7 Z6 \" L. b m4 C
- first you need to know the port addresses of your VIA card, you can get these by starting, l# O) T$ H5 {6 k: x6 t8 o
msinfo32 on Windows XP and looking at the port listing for SCSI devices$ K( o' k* j' Q
- for the 6421 the 1st port is internal SATA, 2nd is external SATA and 3rd is internal IDE
; h; ~# S5 p; e3 h1 f* z+ }- for the 6420 the 1st and 3rd port are internal SATA0 t) b! M# k+ C$ I2 i* u- V
- you need the starting address e.g. 0xD000 or 0x7000
8 p+ Q, k X+ k8 R- be warned that these addresses can change from computer to computer, they are assigned: L8 J& o/ b ^4 E
at bootup, but Windows XP should display the ones you need for flashing in DOS' i1 N( z' |4 Q: p
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or 8 Z# E+ g% B T6 i
Xecuter Connectivity Kit)' L% Q: A4 O9 }# E8 L
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we4 [# L& q8 O- j! N* U8 s
need to power the drive off and on during soft flashing2 \* O( _$ U3 b5 {, y' Y! P/ F
- cold reboot or reset the computer
O) H5 @4 L0 X# W- boot from a DOS disk, I used a Windows XP MS-DOS startup disk) H$ o( t, I' ^1 b: g" L; S0 R
- at the prompt type:
% b( l4 p7 I# p$ P Q% a1 o* J. P DosFlash r 7000 1 a0 1 4 a:\orig.bin 0
1 ~5 K1 p2 V, V5 Z/ x* z. F - instead of port 7000 use the starting address your VIA card uses
) E$ f+ y/ ?% w, d0 I' z; V- press return p: f5 ?% a, u1 S0 R/ \% [* _4 S, Z1 H. g
- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
4 c& k; `+ V, | J; M8 J& k- after you pressed Yes the drive status is shown on the screen, it's something like 0x7F,
: }! K7 `/ a# d9 F this will change during the next few steps8 Y; z, B4 c- V; J- L, B2 Y
- turn on the BenQ psu and wait 2 or more seconds, status changes between 0x51 and 0xD1
7 G& v5 j2 U* F! R5 k- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1# ]( j. h% \( U& E+ x; J2 ?& j) m
- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start6 i2 d0 e7 o* @
- this worked only one time after the computer is powered on or resetted for me" ~# \4 ?4 C; X. F3 z; Z7 A, T1 Z$ d
- writing and erasing works the same way
! a/ l8 O) ^" U5 F6 f- for writing type:
$ p/ y1 v' |3 `1 {* q9 \1 v/ V DosFlash w 7000 1 a0 1 4 a:\ixtreme.bin 06 V5 m; g0 a' Q' ~3 b( d* r
- for erasing type:7 R6 l' o; \9 U: M
DosFlash e 7000 1 a0 1 4 D8 0 (D8 is the sector erase opcode for the BenQ flash, if you need: e+ [9 ~3 o, H$ I& V# M G
to erase another drive, lookup the value in the datasheet or DosFlash.typ)
; x: c; u. F$ ?" ?. ^, ?- if you experience any problems try to use 1 as the parameter to the ATAPI Device Reset, cause0 D$ q* C/ Y$ h" w( u( |( Q( m
the same VIA card will react differently on another motherboard sometimes) W* Y9 v2 A% w: T
8 p `8 b9 P8 ]; x9 v; @8 b# [
1 h5 M* T/ u( R7 v, pSoft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in manuel mode
}! g+ L9 U, @. {---------------------------------------------------------------------------------------4 N' B3 s) ^2 n: `
- first you need to know the port addresses of your NForce motherboard, you can get these by ; Q8 b7 Z1 n9 E2 W- X$ P/ T
starting msinfo32 on Windows XP and looking at the port listing for IDE devices
# ]& w7 H9 g4 s9 P; r0 u8 }. g- on most motherboards the 1st and 3rd ports are used for SATA/ Y$ A7 L! l5 l# L7 |$ w
- you need the starting address e.g. 0x0970 or 0xE9001 N7 E& n" }" U/ \2 ?
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or 8 c- }7 U* i) j3 ?
Xecuter Connectivity Kit)8 ^8 `) ~! S1 D3 o
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
+ k- @* L% F; G5 Z- P. `- o need to power the drive off and on during soft flashing7 y5 e# d$ A5 v/ R5 |- N; L Q
- cold reboot or reset the computer4 F" P' t9 j0 Z0 A
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk) C* u4 G+ c! j
- at the prompt type:
% R( R- f! L% O# U+ U9 M DosFlash r 0970 1 a0 1 4 a:\orig.bin 1
; k3 }/ e5 \& c! F - instead of port 0970 use the starting address your NForce motherboard uses' W6 y0 |2 u- r, \# g: A, X
- press return& P8 z B2 E( P/ a: O8 d, n% B
- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes! f; O6 |9 X7 H9 ~1 R' ^6 r
- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,
3 a: }' o$ n& k7 l4 B f: t* b/ L3 [0 e this will change during the next few steps! n+ A0 s8 ^, G+ p* g) L+ O5 w4 J) G
- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start
1 B: {* ?! o; M. ], T' t- writing and erasing works the same way
1 R" u3 R+ h9 U& e- for writing type:" G- x) v, {, y
DosFlash w 0970 1 a0 1 4 a:\ixtreme.bin 1+ _* W* v/ ^( d4 K4 j0 R2 t
- for erasing type:
) \6 [- I0 ]/ G; s: U( I$ r/ ]3 A DosFlash e 0970 1 a0 1 4 D8 1 (D8 is the sector erase opcode for the BenQ flash, if you need* x9 Y+ ^( H0 S3 T$ J9 v" I: B
to erase another drive, lookup the value in the datasheet or DosFlash.typ)' x3 D/ ~. K4 ?3 c; y; e9 v" j% d
6 F' j" ^. A( @& [8 j h* c
/ y0 l" j, V1 l" [6 A" @3 v$ pSoft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in auto mode
7 F5 C& W; v$ {0 o4 N( e-------------------------------------------------------------------------------------
% ?( t7 h& \( C. ]5 E: g1 x( b- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or 4 d# l4 S& C1 v: x9 ?
Xecuter Connectivity Kit)3 J& b# c( }+ N
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
0 O6 U7 D4 C: i need to power the drive off and on during soft flashing+ k: l& o1 N! } W+ D) b' k. b
- cold reboot or reset the computer
6 x/ ?+ l3 i, }- boot from a DOS disk, I used a Windows XP MS-DOS startup disk/ H6 H! [) e1 Z+ @: b1 ^, G; g
- wait until you are at the cmd prompt
0 D! e- d8 F) Z2 x' L- turn on the BenQ psu
9 B( b8 D# b5 R5 n+ P r1 [- at the prompt type: ! W6 z4 {' I+ @7 h% v& i
DosFlash# T0 r2 s. F. O- t9 }
- press return$ h" { u- J0 s- l5 ]& N
- during scann of the BenQ's port DosFlash16 will ask you if you wanna resend the mtk vendor
) [% z0 J, \5 V8 S3 I( [" c* |' i! ^% h3 h intro cmd, press Yes( K; L1 I# N/ O5 G: h! O
- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,1 M- G" w: `& D# g$ X$ G% c
this will change during the next few steps5 ]2 a! {/ v' ]# o) T3 u
- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1
8 i" J6 Z7 x" }: G- turn on the BenQ psu, you should get a good drive status 0x73 and flash access is granted
4 W( l7 |9 D: P0 l- you can now continue as usual using DosFlash
8 n# m/ F, }) K# V- writing and erasing works the same way. x; J9 {0 n0 M' o; z P# T: h9 Z
- if the ports are scanned there is the possibility that you'll get the resend question for+ U' i, \2 ~* h0 p
other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,
2 r8 B; d$ G6 ^+ R* ^% C+ v if you know the NEC is at that port you should press No and press Yes only if the port of& F0 x# y6 y1 ?, l& u. p! _
the BenQ is shown or simply disconnect the NEC4 `, d3 D r6 H8 y. W7 o3 m
6 ~1 _: j3 ^6 p$ r+ B V7 a
: B5 ~1 A! t& {, gSoft Flashing the BenQ in Windows XP with a VIA card or NForce motherboard and DosFlash32
- }& b7 s; l. v. [; E-------------------------------------------------------------------------------------------4 R' _6 `0 c% }% ~8 `
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or ! U$ r0 A9 ?0 {5 `0 Z
Xecuter Connectivity Kit), [# h5 {0 K# D* n
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we6 H* b7 E$ R3 d% l* x* D" ?
need to power the drive off and on during soft flashing" F, n3 K1 X' k3 F8 R$ w
- cold reboot or reset the computer' |7 w5 J+ ^* L- Q
- turn on the BenQ psu when you are in Windows XP9 w/ c# n7 p& Y% y9 ^
- start DosFlash328 j& Y, D; l7 J! B6 ~& @( Z
- DosFlash32 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
! _1 u3 D! \" ^8 ^9 A |( t- turn off the BenQ psu and wait 2 or more seconds
$ P. d) F* a6 X) T% O8 X- turn on the BenQ psu, the DosFlash32 dialog should show up
7 z6 r" c1 R8 D; M& ~* J3 Z3 q- the flash should be recognized by DosFlash32
7 }$ ?) H* p2 u9 ?4 j: T- you can now read, write or erase the flash
) }. M, `1 _' R9 M, C. S- you should be able to do the flashing more than one time in Windows, only do the power / E. ~1 v" u) f6 n0 o2 h2 ~
off/on trick again* g. R" ?5 L" @5 f: S6 f( z u& C0 J& V
- if the ports are scanned there is the possibility that you'll get the resend question for) l( j, D; U. q- n& r- C
other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,, O4 }7 E8 d( B
if you know the NEC is at that port you should press No and press Yes only if the port of3 }, M9 D. s0 S- J* E
the BenQ is shown or simply disconnect the NEC
1 w1 _( N0 p9 k3 @! t$ K) m- X U5 ?/ o4 S
& k0 p$ ~9 v3 y2 [ }Many thanks to jumba for the great idea of BenQ polling!
% Y3 O& O" J- SThanks to Iriez, Jumba, Redline99, TeamModfreakz, Tiros and all the IRC people for testing
/ M0 K0 W0 ]- c8 Sand support.
; x! Z% C- K- M) B& @0 b; E& g4 H% g" N
Join us on IRC efnet at the channel #dosflash for support.
5 G1 @& p* x$ U) @% b' _2 B
2 V! Y! X: L! TDon't brick your BenQ!* g, q* p' s" k4 v, ]& E
Kai Schtrom" b' }' m" L# K1 y3 Y
3 l# _7 l5 ]; ] w: [* g! ^; ?9 l6 \* @7 c, x: K3 q
************************************************************************************************* b( ]3 L" e8 Y/ r4 |& C4 h* f# o
; G! ^( I/ l* |0 W/ {4 ^5 L0 _ u5 c8 E2 y/ ?1 c C: }
DosFlash and DosFlash32 V1.2 Beta0 v3 P2 K0 H) o, B' j" T% U
-----------------------------------5 U9 d( g# K, L- X8 y- b7 X( Q
- bug fix for BenQ recognition+ @' Z/ K* g4 [5 R; X
- manufacturer and device id are sometimes 0x00 for a correct installed switch
- a j, E$ [1 _( H o. x o - this issue is fixed with an additional ATAPI device reset before the mtk vendor intro is sent1 [& K6 |/ e/ X/ e/ f* H
0 c6 E! _: f2 l5 y# j! hThanks to Redline99 who fixed my buggy code by adding one line! , A, R# U/ t* N) {
, Z' Z6 R3 {; l! }
5 D6 T3 y8 [2 `* \************************************************************************************************
+ D: e6 ~; s5 P% z7 V5 u- i4 R" B% i/ c$ S% I8 w' {( c7 F. y8 ?! J. O
0 D+ \7 P" o: J# |$ J+ I U
DosFlash and DosFlash32 V1.1 Beta
% L4 j% G6 l F7 a5 d7 x! w, g-----------------------------------
. T9 `( X P& d6 \* F- DosFlash.typ modified for better BenQ support / U& i4 u8 t; z7 w0 b, x
- DosFlash16 Flash Manufacturer and Device ID screen output restructured
! ]. W- G+ F: G5 u. G& s- flash chips are first erased before writing starts" r; u# D4 D3 T
- DosFlash32 no reenable of DVD-ROMs in device manager after flashing, this means you can't see the drive9 p- |8 W' U+ T7 Q" S) e
and maybe have to activate it manually again in device manager, this could give better compatibility and2 P6 i( X1 |, z5 B; A
hopefully no more blue screens
6 h$ Y- K, Q" E5 p3 z w+ F O4 F! C A1 M% ^2 S1 t
Many thanks to Jumba, Redline99, TeamModfreakz and Tiros for inspiration and help!
4 r4 T! E. k+ k- z# Y! h( S, A+ J' ~8 v6 M" S
. G0 U5 Z; U% g' v% w( ?( _6 j
************************************************************************************************
( t# | h& |( K+ e
2 D2 k) h$ i, z2 T; i# M
% @' H; _# v' Z. _! @/ G5 v- [3 v' ^DosFlash and DosFlash32 V1.0 Beta: q5 L, ?9 H* H" }' R9 H
-----------------------------------
0 Y; I# O o* w; X% DDosFlash can be used to read/write/erase the flash chips of most CD/DVD-ROM drives
, }) a, H u- q. pthat have a mediatek chipset installed. DosFlash is for DOS flashing, DosFlash32
7 j3 f: u/ v! _$ D. C9 b. g6 xfor Windows flashing.2 m, w5 U6 l9 q) y1 a( S
, I5 y7 x# ~' r" y3 F; W! t
1 S2 C" q0 f" V+ yFeatures:
! a/ ^+ R# X6 B8 D: O! C0 x1 L-----------
) W& {0 { t/ Q8 y8 C- flashes IDE and SATA drives* Y t; G- \) z% Z. E
- supports parallel and serial flash chips
6 u4 `$ w2 K, D! i! j/ u- flash drives in Windows with direct port access" D3 l4 ?" \( w* }5 u j
- no vendor cdb flashing commands are used
& d6 w9 E9 q! N: S# n- tested with the following drives:
! G4 r% B5 E% G - TS-H943A MS25, MS28
6 a. T2 g( a; d% I' S9 o - SH-D162C
! }4 Q/ G* P( Y3 B! R3 Y - SH-D163A- N: N$ p) k. ^ q& ?
- and some other drives like Liteon, Hitachi, ...
6 q) l9 y- \/ m" T& X- NEC drives are not supported, cause they have no mediatek chipset installed
2 Y$ }0 u b, y+ X 8 ?5 w& X# N: \+ {; i0 K
* ^; S" S( M: v# M4 s1 k) J( nDosFlash" I) [$ L7 X6 z& ^
----------
: O" s7 ?! i! V5 F g3 wDosFlash supports two flashing modes, Auto and Manual. If you type DOSFLASH at a DOS prompt it6 y/ D$ i H+ S6 Z& h% D" C
will start in Auto mode. All drives and the corresponding flash chips are detected automatically.3 I0 ]: Z: K( P6 l- \7 o) f! \0 D
If you can't get a flash chip recognized due to a bad flash or other problems you should use the
- F; r# W: f5 P( i# r7 wManual mode. In Manual mode you can enter all the parameters used for flashing by hand. The% H3 O6 ?8 j/ v, J
following help screen is displayed if you start DosFlash with a wrong number of parameters:/ o; b q, [7 S( k+ O
6 M. A/ K8 j+ H
8 N' X2 O% c) i/ s3 }1 y- ^DOSFLASH by Kai Schtrom, 08/05/2007 (Ver 1.0 Beta)
9 Q& c. U/ p! m1 V& n; `' { _8 mDOSFLASH [R|W|E] [PORT] [PORT TYPE] [DRIVE POS] [FLASH TYPE]
5 ~; G1 }3 s8 i7 V {! F0 P [FLASH SIZE] [FLASH SECTOR ERASE OPCODE] [FILE NAME]
3 d( E( P3 ^# D3 C R: Read FLASH
5 ]8 j# p; r8 Y: p" V/ c1 t W: Write FLASH" g$ Q; C, }/ M# \1 N, D
E: Erase FLASH: U1 d8 [% u. K; A! H9 g j
PORT: Port to send command to) {5 T* M: l& {% V1 i
PORT TYPE: 0 for IDE, 1 for SATA2 \0 ^& K* \% N6 _2 x' K
DRIVE POS: A0 for Master, B0 for Slave
, D, b7 h' u5 w FLASH TYPE: 0 for parallel flash, 1 for serial flash
; `" H% j4 }+ v# z FLASH SIZE: size of flash chip in number of banks
|( l$ S0 a; r" \/ lFLASH SECTOR ERASE OPCODE: individual sector erase opcode command byte
. ~- @3 u/ i6 k this is only needed for erasing a serial flash6 K6 t, C1 m5 l- u/ B0 F5 Z( j
FILE NAME: name of the file to read/write from/to flash' P% M5 D) O- A2 L
All numbers are intepreted as hex values!* R* |0 q% z. n) ?3 q, Q
4 V& {9 j- T1 f% YExample Usage:
' h6 r" P* k/ \9 M q6 K6 r4 n"DOSFLASH R 01F0 0 A0 1 4 C:\flash.bin"$ Z0 p+ o9 C1 i- ^
=> Read serial flash with a size of 4 bank (262144 bytes) from Master Device
7 K7 u/ g1 a. Y* c( E0 n- Q/ A* h5 H on IDE port 0x01F0
3 z0 j% x* Y9 L1 d# d"DOSFLASH E C000 1 A0 1 4 D8"
3 I# S" C3 T4 f7 {0 S=> Erase serial flash with opcode 0xD8 and a size of 4 banks (262144 bytes)
! y) P# g+ j- j A! R/ g from Master Device on SATA port 0xC000
) i- Y+ d- q8 Y% S2 G1 X& A 6 J7 U+ V8 Y( d' a" |! n% X
8 h0 z0 q- N9 F. d( E+ kExplanation of the Parameters:
0 B9 q. s! u# E. S# N( k3 Z( {5 C--------------------------------
/ e1 g; D( \) q8 N; R4 O8 G8 T4 M
5 {8 n( F- }! y: Q[R|W|E]
" X9 K0 D# k% E: q$ A% G: v---------0 s" n% a) y5 K' T
- this will set the mode of flashing, it is recommended to first try read on any
8 G& b& B# x, x3 l9 ` drive, if the read will fail, it is highly unlikely that a write or erase will
8 W# `7 e5 O( `. Z& D succeed
/ C O7 M- [" X- S+ n% H' V) F. ]4 l7 _* L- s, L
[PORT]
6 X/ Y% b4 O. t8 _, ?--------8 U: d0 e2 m5 w5 j
- the port to which the drive is connected, a port number should always be entered
5 n6 N$ w* ], |2 D! I4 M in hexadecimal and have 4 hex digits, valid ports are: 01F0, 0170, C000, C800
8 w* L7 V0 E, T& e5 J) o- this option can be used if your PCI adapter card or on board IDE/SATA ports are* a/ V2 }9 |! h/ S' t; x
not identified by the auto mode; ?% c. x7 ^: u/ e- X. E$ L
0 U6 l: {, }/ f) t. D5 e[PORT TYPE]8 Y% H! ]" d/ A0 A: d
-------------
0 W* }2 l% ?6 r- the port type tells DosFlash what type of port is installed on the before entered/ G* N5 O! D( \4 {/ W
port address8 J$ C: s6 J7 H6 d: W G
- valid values are 0 for IDE and 1 for SATA
5 W$ t: U }7 h, J- p, k: S! C- make sure you never mix the wrong port with the wrong port type, this could give3 s8 q0 p8 n, u; K# |5 T- A
strange results or in the worst case a bricked drive3 z1 ]' [) l% v; g
! M5 M. s- _5 X3 |% @[DRIVE POS]7 @; H( G& ?5 ~, A) d; v
-------------& r L' k' b% X# ~0 M
- old style IDE channels have the possibility to connect two drives at one IDE
, T7 r* e& Y$ Z$ \% e# v4 J6 R6 S channel, the first drive is called the master, the second drives is called the$ c; J+ h. ]% s, }6 ~4 I. I
slave. k1 `6 n0 L7 Y6 T+ t# u! ]
- you can select which drive should be flashed on the channel, A0 selects Master,
) h& r: N# `5 I: r B0 selects Slave
* U& m) \8 Y$ Z0 u- on SATA ports this value is always A0, cause you can only connect one drive to
) v+ I5 P2 ?" a$ y9 `* W: p- G: x a SATA port, so for SATA you will always type A0 here
6 [$ K( W2 ]; D: Q- it is not recommended to flash IDE drives with another drive connected to the
: `" W5 M; b8 @0 P, n same IDE channel, this could be risky if something in the Master/Slave selection6 O* K X4 I: x
fails# ~3 D/ a3 l; D6 f: ^; M9 [5 I
/ S( g4 R# j0 `/ ?5 }[FLASH TYPE]) ~! E( A, v! @
--------------
8 f. z* x \$ o- there are two types of flash chips out for CD/DVD-ROM drives atm
6 ? U4 d! Q6 o* C; A! ?: ? m1 l- the older type is parallel flash, which is also supported by mtkflash for example
/ `$ j2 d" E! I2 ?+ c& g4 d- the newer type is serial flash, which is supported by flashers like XSF* X& N# X" a" b* {
- the problem here is that no tool is out that can flash serial flash chips on
E0 d7 x3 i4 v7 P6 ^0 Z SATA ports% m8 }0 H! x4 N& G, \. z
. v# Q# f2 G a, Q0 Y! K9 ~
[FLASH SIZE]
2 i2 z# t$ q/ u& x--------------' Y5 G$ t$ h% p# C* h$ E
- this is specifies the flash chip size in banks8 b' l; l) a6 Z& g
- one bank is always 65.536 bytes in size
& X: x2 \) ]- q. Y* H" s. i3 V* e- if you know your drive has a flash chip of 262.144 bytes in size you need to enter 4
% `; t/ A) j& t8 ^# ?" e
( J. z1 l; E6 j[FLASH SECTOR ERASE OPCODE], H. I j2 b5 b7 W1 ?" s; H
-----------------------------: w# ]- w2 J& N$ l8 o
- the opcode used in the flash chips datasheet for erasing7 ] _ g2 y/ M ?- Q
- for serial chips this command can be different from the standard and needs to be: @2 E, @" N( D+ R7 j5 U
entered for flash erase
; _1 R- i; K, J1 ]5 s) S9 B- for parallel flash chips you can enter a dummy cmd byte, the integrated command7 S- E4 R; K; p2 U+ m
should work on all parallel flash chips without a prob3 R/ v$ j, L0 Z
7 U0 u) m6 [5 i9 ?[FILE NAME]1 H4 i, Y) Q+ [$ A+ o
-------------8 C( S& @9 a- m0 d4 s: K
- name of the file that should be used for flashing
! O+ ~' I; I$ o2 G. Q: L+ C& E" u- for reading operations this should be the output file- n* x4 H- o" E( \: W
- for writing operations this should be the input file
: ]- L" V& X, D, B1 a
) l# r& J/ s- F# M1 r: @
) O; N' k# t8 G& R' T9 W8 YHints and Warnings+ }4 U0 i: B& B" n2 t5 @
--------------------
l: J8 M% O- o9 D( o- read, write erase TS-H943A MS28 after the firmware stealth has been disabled with Enable0800 disc
% W% F' N0 @1 H# _6 g - this only works one time, after the first mtk vendor specific intro cmd is send
- u& B* N M. ?& L: p3 H - if the mtk vendor specific outro cmd is send the chip goes back to stealth mode and you need
0 H% O X' C2 a0 {. T( x5 G& z again the Enable0800.iso to disable it3 u. m" ~+ Y( k& k- b
- therefor the mtk vendor specific intro is send at program start to all present devices and the/ ?+ ?0 ^ [( j) M9 D# S- O
mtk outro is sent at program end! N2 K7 Z! Z2 ]
- if you have a chip manufacturer id of 0x02 and a chip device id of 0x02 for the TS-H943A1 O7 z2 l G, e- |7 K( V# v
the flash chip is in stealth mode and won't give access to any reading, writing, erasing* ?( u9 h# _6 \% P9 l2 p& s
- always have a look at the DataSum generated, this is exactly the DataSum of mtkflash
( G$ F) G2 y: R* E - the DataSum is calculated as the sum of all bytes of the firmware in a short integer
* n! C+ r4 ~- ]$ v& W8 ]$ B - to make 100% sure that the flash is written right compare that DataSum to a known one
G" x; B) P! b) x* z9 e- this tool has not been tested on all drives out there, the typ list is simply copied from well2 S3 E. b5 z9 ]7 c+ N" c
known programs like mtkflash and XSF
, [' h5 J: [4 V' ?1 K - always try a flash read on a not yet tested drive before doing anything else
# |3 L/ ^) v- K' c* w' Z B, V3 P, A - if the read doesn't succeed it is highly unlikely that a write or erase will+ M+ v2 r1 ~9 ]% P n
- some LiteOn drives seem to have probs to write the firmware correct, this prob seems to be+ e# R; Q. F2 i0 T* i8 Y' ?. U
related to windows register flashing, cause even an assembler app can't do this error free: s" \& u3 Q/ k3 ~/ t: M
- if you get errors on LiteOn drives, write the flash two times in a row. n; S" L4 B- B0 S, {
- for direct port I/O in windows the givoio.sys driver is used, this driver is loaded at DosFlash32$ L/ |# Q5 q9 o9 [" K9 X
start and unloaded at program end, be warned, this driver can possibly make your system unstable,
L9 j8 D& D4 D. j it's intention is to let privileged assembler instruction like in and out pass, even in windows,
5 ]8 n) n/ ?5 Z* ~ if this driver is not used you will not be able to get direct access to port registers5 @8 l( |8 k5 a. O0 G* Q
- DosFlash was tested on MS-DOS 6.22 and later, you can easily copy it on a MS-DOS boot disk created
' L# M5 \/ m- Q1 a; a in Windows XP and start DosFlash directly from the disk
" j8 f. q. z; S: o- don't forget to also copy the DosFlash.typ file, it has all the informations about flash chips9 n/ V0 a7 I: a5 N, S
for auto mode flashing
2 @. F6 W% i# ]5 J6 Y: w v. m! s- DosFlash32 was tested without a prob on Windows XP SP2, you'll need also the typ file for the ' b3 }$ p' t0 ^8 z' y1 d6 Q
win version c6 Y6 V( z) i& G6 E% p
- DosFlash32 will deactivate all CD-ROMs in device manager at startup, this is better for flashing,0 o/ v2 ?) O( P. ~- d* P8 t Z
cause Windows seems to poll the drives all the time and this could result in a bad fw file or
! N/ @/ R0 i8 f- t a program hang, the drives are activated again at program end: L! O9 A1 u! U8 p) c' _1 D
- you should make sure that the flash is not in an erased state at program end, cause device manager
+ c- y) e8 |7 y6 I8 i B don't like drives that do not respond to the inquiry command3 r2 M" y- I' @9 Y2 o N
- deactivating all CD-ROMs could take a few seconds, so please be patient at program start$ |/ h8 q: p% T) N
- DosFlash and DosFlash32 will try to scan for the VIA 6421L Raid Controller card, based on vendor
, E! ]8 T5 I* x2 b. p- E id 1106 and device id 3249, it doesn't matter if the card driver is installed or not* ~5 |1 T; B7 |! A% n! R' j
5 _. y# `' Z+ {& j
1 [6 o$ `2 D3 S* Q, o
Many thanks to Dale Roberts and his Direct Port I/O driver giveio.sys!
3 x' w4 u" {3 O( w1 k0 D1 y! J# `7 z6 ~, D& ^- M2 v9 L* W
Avoid a bad flash!) X$ k7 X1 H- X
Kai Schtrom |
|
窺視卡
雷達卡
樓主
顯身卡
發表於 2011-8-21 21:08:07
