|
|
ak475671 發表於 2011-8-22 13:03 ![]() ! _: q) x& z5 F- T8 V5 i
版主你好
m. G* n! A- R6 c g$ ^$ v版主知道哪裡有教學嗎使用DOS提KYE的過程不是很了解不知道有沒有教學可以參考的呢
3 N! m$ m$ ]3 N8 c0 h& V5 d另外你說他提取 ...
# j4 p# ~! X9 a, Y3 c2 }( EDosFlash ReadMe.txt 說明文件1 {9 z1 U7 O8 w$ x! B; i' z- l
( A" K' N8 E' X& oDosFlash V1.9 Release Date 01.01.2011- x' Z4 D1 k4 N9 _5 [9 |1 C
---------------------------------------
* t D% D/ u* V& J% {- SATA and IDE port scan improved in DOS and Windows
( d2 d7 J5 ^9 x1 j4 T The ports are now enumerated with the CONFIG_ADDRESS and CONFIG_DATA register instead of using interrupts
- l% W; G @: B8 l7 u1 z7 l5 i in DOS and SetupDixx functions in Windows. This change will detect more ports in Windows than the old 8 i+ ?0 p" O9 m9 K
SetupDixx method.
4 B+ N* c6 W! r" W' w4 F8 f E1 J- Settings saved to ini file for DosFlash32 and DosFlash64
' i4 {. A' N2 d B Settings like Port, Position, Task, COM Port, Enable Drives and DvdKey state are now saved to an ini file
0 g; x$ p; [1 D! T8 t inside the program folder. If the ini file is not present it is created after the first run. On the first
5 ]: Q. ]9 N' h% v( |. M startup DosFlash will choose the most common and stable settings.0 @: q+ X9 I" S
- EnableDrives option included in dialog as a check box9 q3 m0 o6 ~5 E2 y/ _8 y
Due to high demand we removed the "Enabling CD-/DVD-ROMs" MessageBox on program termination and included/ P( i( ?) I1 [! O. A
a check box "Enable Drives" inside the dialog. For security and more stability this is deactivated on the k/ S$ h/ y7 {- R% r* h
first run. If you enable it the checked state is saved to the ini file.
8 {2 i: a; N+ r6 l) k8 r9 A7 u- p- enabling drives in Windows caused some hangs from time to time, this is now fixed by a recoded enable
0 U6 v/ h1 \" s) P/ y/ i7 [$ v. E drives function
5 X3 K; q Z- U5 z9 q- port drivers portio32.sys and portio64.sys are now added to the executable and unpacked during runtime4 R7 y, r. J% l/ x1 W3 L' Q$ _8 y" Q2 a
- PATA and SATA controllers list updated6 G, _) S2 i8 S# h5 G Q7 |2 h, S* H
- Fix for NForce motherboards in combination with drives like the "Samsung SH-D163C", "LG DH18NS40" or
1 I3 M7 [' v9 K' S5 V "LiteOn iHDS118"
3 m7 |2 X' z9 }& i Some drives have problems with flash identify, read, write and erase. This is clearly related to the
6 y8 j- g1 ~3 ^& Z, e" O3 n ?# R; U* f1 y NVidia NForce chipset. For manual mode in DosFlash16 an additional command line parameter is added called* v) U. R+ d2 {- {; d- W
"NFORCE FIX". This parameter should be set to 1 for NForce chipsets if you experience strange problems.+ s0 z: A) y! _5 V, [/ B
In DosFlash32 and DosFlash64 we added a static control which shows if the NForce Fix is applied or not.
6 h2 c2 P3 A2 T Remember there is no need to activate this with every drive. It seems to be a combination between drive
3 x$ u) h8 ?4 q$ e9 I2 [* J and NForce chipset that causes the problem. The fix is automatically applied for DosFlash16 in auto mode," k; \8 b1 t/ R
DosFlash32 and DosFlash64./ c) e6 _" q8 ~( i3 g
- DosFlash32 and DosFlash64 are now DPI Aware for Windows7
/ }9 K/ J- I% q. Y$ \6 A- New task Verfiy Key/Inject Key added for verification/injection of drive keys
3 |2 s' D, P" i All DosFlash versions now have the possibility to validate drive keys against an XBOX360 drive and set
8 a* ]7 I/ @/ _/ U* h( m the key for an XBOX360 drive. We use the same authentication method like the console to verify a key.. P5 w! w9 w" r( M/ i \0 L
In the Windows versions you have the choice to paste the drive key from the clipboard to our custom hex" s" V% \# ]0 _2 N0 V3 O8 X( r8 K
edit control or load a key file. To add a key simply click right inside the hex edit control and select
; h' u2 E* D! Q; K6 D- T your choice from the shortcut menu. In DosFlash16 you can enter the key in the format "1A-2B-3C" without8 A% D3 P% L4 t
quotes. Remember that a key has 16 bytes of data. The key file to import should also have 16 bytes of data
/ l& P8 F6 Z6 @9 b' `; S& s& o like the key files exported by LiteOn Key functions.6 \7 j6 H7 \ I0 \# N2 d4 l
- Removed multiple key extractions for LiteOn Key functions, added Verify Key after extraction
; `% X/ u/ P& g% ^. Z For LiteOn Key functions we removed the multiple extractions, because the key is now verified immediately
& d( x G" [9 P& @3 X" d against the XBOX360 drive.
3 {' V+ M# U& t \4 @, t# v- LiteOn Key V1 and V2 now also extract the file Serial.bin and the 2nd inquiry file Inquiry2.bin4 P3 C" R5 q) }
We added the file Serial.bin and Inquiry2.bin to LiteOn Key functions. Inquiry2.bin is only generated for4 d7 q; O4 e. r& G3 Q0 l7 D j
LiteOn drives V1 and V2.
# @! g6 A2 y8 ?5 M; a% o3 }- The drive key of Maximus patched UART drives can be extracted by using the task "LiteOn Key V1 (DvdKey)"( }0 ~: m* W# U/ A
The drive check has been removed from LiteOn Key functions. This way we can extract a key from an UART ; x4 n7 _1 \6 ~" n& q; W: V8 O
patched drive firmware by Maximus.
; X5 f; l6 X3 k/ m' i ]1 M- LiteOn files are now extracted to a destination folder instead of prompting the user for every file name.
3 P/ s& V% S+ i" |- LiteOn key extraction tasks separated per drive version in "LiteOn Key V1 (DvdKey)", "LiteOn Key V2 (FreeKey)"% f7 Z) M1 q! ?* f# @! g3 J
and "LiteOn Key V3 (Tarablinda)"
) K' @6 ?$ X5 H7 z1 k& m1 z- In DosFlash32 and DosFlash64 the number of installed COM ports in the system are now enumerated instead of
8 L# C$ a- i2 ~ adding port 1 to 4
( h" g1 G& B/ p. W; Y0 W I- For failing cdb commands the sense code is returned
& ?, A V6 x% Q2 V/ t+ P& F- Geremia's Tarablinda functionality added( A! N1 x; h5 P. ?6 t8 N5 L
We added all Tarablinda tasks to every DosFlash version. You can extract the key by choosing the task, m1 D- b k- @3 C
"LiteOn Key V3 (Tarablinda)". For read, write and erase of the flash simply use the standard functions.
0 r% X# k' h8 ?2 N6 P) \0 }% T Pay attention that the "LiteOn Erase V1/V2" task is only available for older LiteOns and not for the Slim.
7 C+ Y$ r: l8 m2 ?) v You should use "Read Flash", "Write Flash" and "Erase Flash" for the Slim. "LiteOn Key V3 (Tarablinda)"1 K+ \! Z- ^ C9 ]( r
extracts 1 additional file in comparison to Tarablinda v04b, this file is called Xtram.bin and contains
E% ~- j8 Z2 n2 P a dump of the XTRAM8000 area. This can differ in a few bytes from one dump to the next.3 ]' @; J; c( X) d
- Device Reset in DosFlash16 manual mode is now done automatically, there is no option to turn it off anymore1 w% c7 @8 S& |% @% o6 m1 |
- Code optimization to work with modern SATA2 controllers added, remember to set SATA controllers to IDE and
% Y& B* ^* Y7 Z& r not AHCI mode otherwise Port I/O will not work% r8 Q6 e. F! z0 J
- Warning: The read, write and erase of the Slim drive is considered risky in general! So pay attention and! W$ B# m, {/ H3 y3 @* ?# A
always remember you use DosFlash on your own risk every time! Even during flash read the Slim gets flashed
3 d. |1 {7 B$ e) i* R with a patched firmware sector to retrieve the complete dump!
1 r+ b/ X8 }0 q4 @- We had to change many command line arguments for DosFlash16 Manual Mode, because of the NForce Fix, added9 M5 |. |* T9 V0 _0 Z5 Y
Tarablinda support and splitting of LiteOn Key functions. To get a better understanding we added the example
6 g, A/ { D0 _* { section below.. ?: k) `& \9 W: R6 ~
8 {6 ~6 Z" D2 _+ y$ e, s' P" B4 i- g
: U' i$ |2 F/ h/ Y
DosFlash16 Manual Mode Examples- j9 @- }5 V3 X Z
---------------------------------
% j, `! s6 ]$ B% u: {- G- Extract drive key on a " LDS DG-16D2S 74850C" over UART -> "LiteOn Key V1 (DvdKey)"
. Q( l* N- @! H. H DOSFLASH LITEON K V1 0970 A0 1+ ~ D8 K1 P% Z0 j" y! m
9 j: o( _- f/ \! s f3 _; q- Extract drive key on a "LDS DG-16D2S 83850C" over SATA -> "LiteOn Key V2 (FreeKey)"
5 v; Y1 H% b% P" r DOSFLASH LITEON K V2 0970 A0
E, u; K: K' v; v" z* z9 B
: m0 Z+ E& \9 H3 z/ |- Extract drive key on a "LDS DG-16D4S 9504" over SATA -> "LiteOn Key V3 (Tarablinda)"2 c3 B& N$ d! k2 H5 F4 i
DOSFLASH LITEON K V3 0970 A0+ l5 F6 f, u# \% A
$ x" i: U$ x9 f& N! Z, s$ j- Read firmware on a "LDS DG-16D4S 9504" -> "Read Flash" this is considered risky!2 h- @2 n `; W' w3 P
DOSFLASH R 0970 1 A0 3 0 4 FWOUT.BIN 07 p: L. p. @9 Y$ o; \/ v$ H
! e* B) w8 N, ^8 _( L4 U7 z6 x- Write firmware on a "LDS DG-16D4S 9504" -> "Write Flash" this is considered risky!" u" i3 ^8 @& w# U/ { ]% M7 f
DOSFLASH W 0970 1 A0 3 0 4 FWIN.BIN 0' t, d7 }& e3 w2 S# x
# K& V: J) d$ @! Z/ {
- Erase firmware on a "LDS DG-16D4S 9504" -> "Erase Flash" this is considered risky!% c% s& W) w, V2 i2 y9 B# x& T# k
DOSFLASH E 0970 1 A0 3 0 4 C7 0& F! q" _& Q! U
1 ` a2 g0 `& L+ B0 g9 S- Erase firmware on a "LDS DG-16D2S 74850C" or a "LDS DG-16D2S 83850C" -> "LiteOn Erase V1/V2"
$ g- k6 n: n5 T7 d2 a DOSFLASH LITEON E 0970 A0
3 H! N* g% j6 O1 {$ P" ]: R4 b
: b! S8 K9 }* E @- Read firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Read Flash"7 `5 m! L3 p( m& w
DOSFLASH R 0970 1 A0 2 0 4 FWOUT.BIN 1% \, W ?9 Q o$ t8 P
3 O% Z! r3 e [- Write firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Write Flash"" d& A; R, L5 y& n
DOSFLASH W 0970 1 A0 2 0 4 FWIN.BIN 1* B" C& A6 }' E9 K \
. ]% J# y7 q: s l" _1 B: q- Erase firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Erase Flash"
/ }7 K! T' s- R0 B" a7 j DOSFLASH E 0970 1 A0 2 0 4 C7 1, a" P& e R6 v5 q+ u
% q% C" e* U- l$ z7 u
- Verify drive key on a XBOX360 drive, enter the drive key manual
" H+ X/ p0 n/ |6 j+ b" x DOSFLASH V 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF9 L) T& v$ o1 q0 }5 N4 D; k5 w
* ]4 s' v9 j# L- Verify drive key on a XBOX360 drive, load a drive key file
" N$ `3 a) Y) D7 m" `4 s+ @ DOSFLASH V 0970 A0 KEY.BIN
; X6 E# j8 |, B: m+ \& p B8 c
, Y0 x- c' g5 Q' O, S6 E3 T- Inject drive key on a XBOX360 drive, enter the drive key manual
) d* p3 S+ M7 q1 X/ ~3 g0 S DOSFLASH I 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF
5 S* J, B# H4 h) H* D1 B' r
0 O) J$ t0 Y) I: W' J& @- Inject drive key on a XBOX360 drive, load a drive key file
0 `8 `" ^' I T5 w% G# j DOSFLASH I 0970 A0 KEY.BIN
* I$ }1 i$ |2 ]! H( m6 K5 ^# R" c J% p- G, S7 _% p
For DosFlash drives on which we can extract the key via UART are considered V1. Drives we get the key over* E# L$ W) @6 P7 ]- U
SATA are considered V2. The new Slim is considered V3 but only firmware version 9504 is supported atm.+ _+ \6 t$ V+ a1 E3 r" u1 j9 X
- h8 o3 E* ~ f% E9 G
" m+ r$ w$ V7 Z R/ l4 z
Many thanks to Geremia, Modfreakz, Redline99 and Tiros for their support. Special thanks to Geremia and
! g) m6 w* b5 k( |3 kModfreakz for drive sponsoring, testing, coding and much more. It is always a pleasure to work with you1 d% Q- e' s4 Z3 ~- w
professional guys! Respect to Maximus for his UART enable patch. I'm looking forward to your magic Lizard [5 M1 y! _# U9 d7 t
hardware flasher!# J' V, Q$ W3 X* d9 u1 ^
. s0 e! c. X1 l7 z+ x/ C
Happy new year 2011!7 T7 _. v1 `2 Z
Kai Schtrom- A! \) g* M' M7 T/ s8 W8 }' ~! u
# g: V' g8 c! n/ V7 J
************************************************************************************************; l/ `, Y' N6 Z' [) d7 e
5 e, w6 ] {5 P" @- c0 G
. ]5 Z! l, v; O7 u7 g# y
DosFlash V1.8 Release Date 08.08.20099 D* ] s+ \7 k1 V
---------------------------------------& N i$ ]: o# w& p! S1 u
- now supports LiteOn PLDS DG-16D2S 83850C V2 Geremia/Maximus LiteOn FreeKey method
' p1 R0 c' Y: M" T* w/ T- huge firmware read/write speed increase, especially if run from a floppy disk
( d# c" }: ^6 C# Y3 D- updated IDE/SATA motherboard chipset list
* b" Q2 z/ ~8 ]5 g1 b6 ^6 y- new IDE/SATA detection for Windows and DOS
' _' q$ J2 }7 _! x6 m- DosFlash.typ embedded in executable file
% J# F/ \: u) I0 q4 @/ |- LiteOn V1 drive key is now extracted 10 times and compared against each other,
& @5 V- w i1 ^" n) r: B# ^# v4 _3 W0 A after the extraction a summary is displayed sorted by the most common matches4 d+ Z; B' P. j
- LiteOn V2 drive key is extracted 2 times and compared
" i a6 y( U' X* I& X- new BenQ unlock keys added to unlock all known BenQ drive firmwares4 N' ]3 C0 ]' B3 Q2 p
- command line parameter "EnableDrives" removed, DosFlash asks the user on
. O" u+ |8 ?1 b8 X+ H! v( y+ G application close if he wants to enable the drives or not, during the tests it5 J( j& x5 o7 x- o' E: [
seems that IDE drives have problems with the enable, SATA drives seem to % ~; D; I/ H0 h& x W/ C- x+ q
work fine% H3 Z7 ~7 N3 [, R' x# O7 _
- new 64-bit DosFlash edition added called DosFlash64, because some driver
# L H( F' [* c6 W+ b functions don't work as expected in the 32 bit compatibility mode on Windows x64+ P/ |" G* H0 j/ S+ S0 J4 y$ y
- Beta state removed# v: G7 Y' ~9 e$ v
- ready and tested on Windows7 X86 and x64
4 j# x1 z0 N2 g9 w0 V' `+ H7 V' a# x- }) A
& ?- V" k) Q' i9 E2 a3 o4 }. h$ H7 DGeremia/Maximus FreeKey method with DosFlash162 F/ n% {+ ]0 ^/ l7 y" J. q6 s
------------------------------------------------
9 L* ~ S, n! v" NWe have added one cmd line parameter for DosFlash16 in manual mode. The COM port. R6 @1 a' @5 ~ ^3 A5 j' L+ |3 P
is simply ignored and can have any value for the V2 drives.
1 I+ g0 s1 ^ H7 {+ h1 jUse the following command line to extract your free key from 83850C:
- U, J5 n" B6 ^- DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin enckey.bin
+ w% ~# P6 q3 I1 \( w5 R
3 q+ A. [. h/ l& `5 e% s! n- N: z4 k. Q& A% n4 x
Tips for running DosFlash on Windows 7
$ _: ]) _: U H* d; D- D----------------------------------------
1 I ~. J3 n2 s' S4 m; E; @2 o7 z0 K$ y0 S
Since Windows Vista 64 Bit and upwards it is necessary that every driver is signed. Because
0 m- Y8 ?" i- b% y) tthe DosFlash driver will not be signed by MS due to some unknown reason we need to circumvent
# l6 m2 n+ N- G9 l2 {) {/ Ithis check. You have the following 2 possibilities to do this.1 X5 D5 ^0 `" r& [& t5 z. {" V, y, C
7 V4 W7 G6 W' Z; s iSafe Way of Disabling Driver Signature Enforcement
- Z! M$ V2 Z1 V3 \1) On Windows 7 bootup press F8 to get to the extended boot options screen; D; g5 W" x7 e
2) Choose "Disable Driver Signature Enforcement"% D- O3 }2 [; X
3) To start DosFlash right click on it in Windows Explorer and choose: N" L% x; ?, k' |* s
"Run as administrator" > answer the message box with "Yes"% ~! J! R' g1 G" i v, W
4) Short after the program started a "rogram Compatibility Assistant" warning message# P" y" K- ?+ J. I% I
is displayed, you can simply ignore this by pressing the "Close" button
, L# m/ J$ P# H0 d: v2 a2 l s, z9 l& N8 k9 e5 y! V6 P' E' n
Recommended Way of Disabling Driver Signature Enforcement
. \8 C- y# ~' g& X1) Disable User Account Control (UAC) k9 A6 o, {' d- {3 O# X! V7 l) Z
- go to "Start Menu" > "Control Panel" > "User Accounts and Family Safety" > "User Accounts"
# P! ^- U: _2 a/ V( f" B - click on "Change User Account Control settings"$ H7 ^6 h" [$ |1 g
- set the slider bar to the lowest value (Never notify) > click "OK"
; x/ l8 b& L3 x0 p$ O3 A5 M" f2) Sign the DosFlash driver) S7 T+ l- k! ?) N$ |: g8 O" h; y" |
- download the "Driver Signature Enforcement Overrider" (DSEO) from, V A2 p' |5 r
http://www.ngohq.com/home.php?page=dseo
* q7 [6 K* s0 h3 `9 |% U - start DSEO > click "Next" > "Yes" > choose "Sign a System File" > "Next" > enter the path to) A M* Y1 i2 i; M6 \& r% g' a
the used driver (portio32.sys or portio64.sys) > "OK" > "OK"
/ V1 Q& z! y- h0 A* ~& G3) Disable Driver Signature Enforcement: k3 K& x2 g9 R0 U8 k# J
- start DSEO > click "Next" > "Yes" > choose "Enable Test Mode" > "Next" > "OK"
! B8 Y( M& p" W6 ?. Y$ d4) Restart the computer2 E. e( }: N8 g2 {
# W/ ]# V5 V* i0 g
Keep in mind that with the recommended way the changes will have effect on every reboot without$ N8 b/ p7 n+ w! Z
doing anything manual. The first way needs to be done over and over again. In addition the second
- m+ ?2 X, n1 hway can be used to sign every driver that doesn't run natively on Windows 7.
' m( }% r3 B& T$ r7 N: h; ^. I3 C$ v* w/ ?. a1 j! b
For use of the VIA Cards in Windows 7 it is recommended to uninstall the VIA driver. This can be
4 N/ k( _( N+ A9 s3 i; Y1 w( e$ Pdone like follows:
' A% k3 h, s/ U; n% m- start "Device Manager" > expand "Storage controllers" > right click on "VIA RAID Controller" >
+ c& k* m, P7 @ B choose "Uninstall" > "OK"+ l8 ^! g; y7 f- G
- rename C:\Windows\inf\vsmraid.inf to vsmraid.inf_
7 X: I9 X( }. f- rename C:\Windows\inf\vsmraid.PNF to vsmraid.PNF_
7 ], Y; q5 j1 V W3 b1 F/ l- rename C:\Windows\System32\drivers\vsmraid.sys to vsmraid.sys_ U# Q4 j- ]( n4 A. g
- reboot computer5 ] k* k9 \* }0 D& ~
2 i3 M; h; H9 `! P' O
' @! P( [2 Q2 C# V! k/ l6 U% ?
Much respect and credits go to Geremia and Maximus for their money saving FreeKey app
& }9 R- @2 ]0 w: Eand their lightning like decryption speed!3 Q8 p% K4 z& x5 T) R2 G7 |! S& @
! j8 Y/ n1 x Y1 O: O7 B& f8 p; f5 Y& y
In Dedication To The Birth Of FreeKey On August Fifth 20092 z, i4 E( ^& K h' Y: |8 }
Kai Schtrom
0 T; l! E* y) q) p3 S9 v: Q* W. O
& h5 a4 s! Y; r# s$ X3 s. B' Z* \1 K. _
************************************************************************************************% V! F9 q. {$ m
% g. S* U& X9 D5 O7 J5 W
. n: F9 R3 d {9 L; }DosFlash and DosFlash32 V1.7 Beta Release Date 23.12.2008
( N" w$ z1 `" v2 T& U7 U------------------------------------------------------------ @" c" U3 F+ X6 A) r5 o
- now supports LiteOn PLDS DG-16D2S 74850C and Geremia's LiteOn Erase and DvdKey method
# }! F( K! ^1 x: r' @+ n7 Z7 \& O% n. G- }# s( u
* E6 k2 P0 u5 n
The following only applies to the new XBox360 LiteOn drive PLDS DG-16D2S 74850C.0 y& f$ V9 U" `
% e5 I9 o4 a8 A2 n4 ^
5 A# I7 N& \5 X" o: q( BGeremia's DvdKey method with DosFlash16 with the PC's psu
. ]& u6 l1 d& R2 W. l% P-----------------------------------------------------------/ m" V# }) J% y( v$ q, S j, K
- disable CD-ROM boot option in BIOS
0 J+ r" X9 H, a8 G- connect LiteOn to your PC's power supply unit and SATA port
" ^8 |2 c# |$ B0 ?7 v- power up PC, wait until bootup is finished
5 E" J7 A1 \% m! m4 V- eject tray of the LiteOn and shutdown PC completely
" t. g' S/ H [' E% G3 a- push the LiteOn tray half in
) t" F& Y# H: H$ j8 G& U' T- power up PC and boot into DOS6 ^8 u8 ]3 m7 f$ |2 P
- run DosFlash16 in auto mode' C; A4 O k2 ~0 g6 C7 k. D
- if you read the following:1 p. }* V! R7 Y! U- I/ H/ o
MTK Vendor Intro failed on port 0x????.
2 U8 W0 X" P) h% P$ b f If you choose to resend the command you should turn the drive off and on! t$ {. J$ p1 i T6 ]" R( l
after you pressed "Yes".
; U A8 S" ?7 M% x, T- s Do you want to resend the command until the drive responds (Y/N)?- W1 Q& ?9 t! s1 y$ e
- press 'N' for "No"
$ z# Y% [' a8 u( y2 M- q6 j! v- choose the number of your LiteOn ATAPI drive
: X+ F% q/ I' H T4 R: |- enter "LITEON K" to read the drive key
( [# l' s+ S1 }2 }1 q) H- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
) `3 u' D/ k/ L2 i- enter the number of the COM port
% m( `4 Y+ R o' j1 i* x- if you read the following:
6 t i: ?$ S2 Z1 a# l To receive the drive key use Geremia's DvdKey method like follows:
' c4 g1 M/ T& P8 ]! n. J: |) O% q - Connect your drive with a serial cable to the COM port T5 C/ R, e* r, r( r* m3 W
- Eject drive tray
/ i' P4 B w0 ~1 c. A% p - Power off drive) B- x- ^: a! Y5 O8 D; Z
- Push drive tray in until it is half open- p. X& o. q) `. |! H4 u/ V
- Power on drive. }+ A: i" p& l( k; S7 Y
- Press "Yes" if you are ready1 _5 Y1 L. @; S! a
Are you ready (Y/N)?
1 f/ ~, `# M ^, U) ^- simply press 'Yes' without doing anything of the above, because we7 l, H9 _" w7 b/ _1 h3 C7 H% a
already did that before
. s/ e, `( w8 D- after this DosFlash16 displays your DVD-Key and saves your key and identify data
1 `. j) Z* x5 U; |5 T4 @2 v7 `- to do the above steps in manual mode use the following command line if your drive3 n( t# O4 k9 b0 }6 X$ c: Y% D
is connected to port 0x0970 and serial cable is on COM port 1, U/ n- q8 C u8 @: x
DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin0 j) o' I6 @0 S7 n( B
. X) `( l' S9 ~ ^; c. r7 V
E6 x: T% `' c+ |: ?- G
Geremia's DvdKey method with DosFlash16 and 2nd psu
1 `9 ?( k5 D' Y9 _3 c% J-----------------------------------------------------
) e/ ~( r# B* O6 C+ l, u4 ^2 a) y/ X* _- connect a separate power supply unit to the LiteOn, don't turn it on yet; z6 J& ?' U/ h& p0 d6 N/ Q
- power up PC and boot into DOS E% R1 L3 c3 l$ l
- turn on the LiteOn psu$ {8 I8 r7 k4 z' }$ M2 [3 M
- run DosFlash16 in auto mode
4 b1 I& ^) T# d3 C/ G0 S: V1 k- if you read the following:, M( P! K( ^4 X
MTK Vendor Intro failed on port 0x????.
2 J7 H5 q e( Q5 \ If you choose to resend the command you should turn the drive off and on1 [1 ^- t, d k U7 [" A- I8 D
after you pressed "Yes".
/ a/ c) U4 f4 E- [- L( v Do you want to resend the command until the drive responds (Y/N)?
( J9 Q# u6 Y4 o' C1 ]- press 'N' for "No"
$ R, l2 y- Q( n# W. K: y- choose the number of your LiteOn ATAPI drive3 \6 f8 O7 o/ e$ d+ `; m, \
- enter "LITEON K" to read the drive key, _" A t$ R6 t! d t; T/ H
- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files& [' b1 g% Z1 ^, M( _
- enter the number of the COM port7 G5 c1 j3 ^! J' i1 |1 z! T9 G
- if you read the following:4 J5 \1 T! q& J E
To receive the drive key use Geremia's DvdKey method like follows:
% Q0 x$ e1 P1 @# z - Connect your drive with a serial cable to the COM port
# k8 H3 g0 `) z, T; B - Eject drive tray
% Z3 w2 h* o' _3 {+ G - Power off drive3 T0 K' a) Y( O2 m+ C8 {4 o
- Push drive tray in until it is half open
6 S9 T" {# w5 }& o/ z. b$ \4 E b4 ?$ x9 C - Power on drive, J; a" u1 n8 f( `3 ` d
- Press "Yes" if you are ready
& l' f$ }8 L6 Q1 e Are you ready (Y/N)?! u- [' a4 T+ k1 p8 Z' t$ c9 v
- do the above and press 'Yes': `, j2 e8 ?8 y* @ Z; @
- after this DosFlash16 displays your DVD-Key and saves your key and identify data( T/ v5 g: |% v$ r& @
4 H) ]" ~- p/ l+ E3 V
3 j$ n$ B# ]/ K I( o) F8 m' ]Geremia's LiteOn Erase method with DosFlash16 and 2nd psu
' \; R% w3 i3 ]+ n; G& I j9 R-----------------------------------------------------------
7 E o C) A; u4 s' {! k6 h. M- connect a separate power supply unit to the LiteOn, don't turn it on yet
2 J8 L( C) Q$ j7 E- power up PC and boot into DOS2 Q) g! K8 _9 h9 j5 q
- turn on the LiteOn psu
. f" j7 b ]0 d' L- run DosFlash16 in auto mode2 C/ D! d# [' E2 R
- if you read the following:
7 F' y7 V1 P: x' x$ N" ^- E MTK Vendor Intro failed on port 0x????.! h$ U0 w/ I2 {7 i7 ^' ^
If you choose to resend the command you should turn the drive off and on8 X7 ]6 k) K( [7 }6 C% l7 ~$ q
after you pressed "Yes".; M6 _$ l1 c" U6 k( V8 e
Do you want to resend the command until the drive responds (Y/N)?
1 U3 V) ~3 a3 l* [- \2 G y4 _4 u- press 'N' for "No"" Z5 a: v2 V" ^% o3 J9 I8 k* M- W
- choose the number of your LiteOn ATAPI drive; o9 b6 @( F- R3 N+ ~' U
- Warning!!! Keep in mind that you will need the drive key before you erase the flash,
+ } z7 V4 H0 e5 m: r7 F without the drive key your XBox360 will not work anymore+ e4 \2 P( q6 f' B
- enter "LITEON E" to erase the flash
7 p) b7 A$ o: F( c5 R$ Y0 u- the first time after the LiteOn Erase the drive needs to be repowered to give4 a% j3 g/ U0 j5 T8 D1 g" I
flash chip access, this can be achieved by repowering the drive before another
' l) E x) `. _) X( W DosFlash16 start in auto mode or by doing a MTK Vendor Intro Power Brute
( a! d' p' p/ H0 C( p, y% E- E- in my tests it did not work to power the drive with the PC's psu, because it will
}3 I; L3 K( p6 B* v always respond with busy status
4 I3 P* X/ k5 c* C2 _6 c- DosFlash16 can now read, write and erase the flash chip like usual: e }) ?! J! z- f
- to do the above steps in manual mode use the following command line if your drive N- y% M3 {7 p+ m# b4 O* w7 B
is connected to port 0x09700 d) h2 u3 x7 n
DosFlash LITEON E 09707 U' _' t, v; s& s; x/ `
$ ?4 b# y% Y( h/ q: @
' L, C- }. a6 w2 @& v+ T+ R6 _
Geremia's DvdKey method with DosFlash32 with the PC's psu
! _- r. `9 ]4 c* N/ P) S-----------------------------------------------------------2 l+ |: ]0 {, o, \" s
- disable CD-ROM boot option in BIOS
3 {0 E' r2 c c+ O7 c- connect LiteOn to your PC's power supply unit and SATA port/ O, Q& D# W; Q& i
- power up PC, wait until bootup is finished5 u3 I. x$ L# o( N- q" ]' H
- eject tray of the LiteOn and shutdown PC completely
% F |$ T2 f# }/ I- push the LiteOn tray half in1 M7 j+ \* n; L) y; c5 f& J) [: i
- power up PC and boot into Windows: g7 |/ g& D1 G. a+ l; p* r0 `; d
- run DosFlash32
* P4 i# k9 A4 \, u7 C- if you read the following:
. b# [, i. z1 H0 W1 a% `' w MTK Vendor Intro failed on port 0x????.4 L# w/ F- ?% v8 z) Q5 K
If you choose to resend the command you should turn the drive off and on3 D$ q" G! p* D+ I3 L5 K
after you pressed "Yes".0 F d+ _" A) T! R0 o3 O
Do you want to resend the command until the drive responds?
M* _0 |: A# B I- press 'No'
6 W; G8 `3 `8 O4 @- choose "LiteOn DvdKey" as flashing task
9 v N0 i' \! ?4 [8 Y/ F F- choose the COM port number
: q: j. D2 A% p0 k- press on "LiteOn DvdKey" button9 v3 j" I8 P# h, c4 g8 N$ j1 u
- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
" k7 V' B5 ~! J/ ` @- if you read the following:
. u/ k( Y% y. i& r, d! x7 L+ h A To receive the drive key use Geremia's DvdKey method like follows:
4 _* A7 i+ F6 K6 C4 R" E - Connect your drive with a serial cable to the COM port( s4 ~1 U& A C; _
- Eject drive tray# `3 a; H* f( k9 |+ m: E+ L2 C
- Power off drive4 }' s; @; H6 V5 f3 Y! |/ B6 r, O
- Push drive tray in until it is half open
1 {. s! b2 ~8 j7 Y- x+ [7 _- E - Power on drive* J% Z, Z+ i1 q w" P. ^/ ?0 l
- Press "Yes" if you are ready% Y3 N, @4 p2 h$ p8 W
Are you ready?
2 J' f T- z" [- simply press 'Yes' without doing anything of the above, because we/ c! T& h8 ]3 t$ A& _
already did that before5 i: _1 Q) G0 q# {% E. e( u8 ]
- after this DosFlash32 displays your DVD-Key and saves your key and identify data
" K* M8 M; e; J9 W0 {* ^0 t+ {
8 g5 j% O/ a! C' _! |. q# j+ Z0 A! n' @9 ]! l
Geremia's DvdKey method with DosFlash32 and 2nd psu
; u- d: z# e3 T( W-----------------------------------------------------! N/ A" K. Q" A1 d6 Q
- connect a separate power supply unit to the LiteOn, don't turn it on yet
: ~' v; z; [: }( a- power up PC and boot into Windows
0 U+ {" R8 H- @9 g; N, A6 A4 k9 m- turn on the LiteOn psu
5 u- t' p9 t9 g- run DosFlash32
7 i" p( J% p% x- if you read the following:- U, b i1 R! O7 f: \" t
MTK Vendor Intro failed on port 0x????.4 M& _' z) @6 ~4 @, \% }! O
If you choose to resend the command you should turn the drive off and on. f9 c. R2 ?8 k2 Z) ^0 `, g6 \+ _
after you pressed "Yes"." f$ \5 W7 b% ~. m7 @1 B- @# k" }' I
Do you want to resend the command until the drive responds?4 O& j' Y0 i; F, ^# p# F( A
- press 'No'
, Q, v# c) B0 d' _& l& \- choose "LiteOn DvdKey" as flashing task* P; X+ `. |7 n# g
- choose the COM port number
, q& ]% {3 C7 Y9 y, }- press on "LiteOn DvdKey" button
" }0 l7 V# P. s7 M- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
+ P' `" n/ J0 `; i, d% d$ q- if you read the following:
0 Q1 T! S" P0 s! |! U/ k To receive the drive key use Geremia's DvdKey method like follows:
1 J$ `# Z. G% ]4 h$ R6 m - Connect your drive with a serial cable to the COM port& b5 U8 V. }. } D6 H! i5 p4 b3 R
- Eject drive tray
* f9 e% ^% R: e& j" ]1 p - Power off drive
/ e4 s2 G; h: W! m/ l - Push drive tray in until it is half open
( O' N# Q. V) T. k* @; v - Power on drive+ x( C6 {/ [/ l, N6 |9 G& t& z0 f; M
- Press "Yes" if you are ready
1 e% X2 W" n1 s9 b0 E6 J- `$ D( V Are you ready?4 G O: L- Z( Z: v+ e7 I: O T
- do the above and press 'Yes'- g, O# d; j! @/ Z
- after this DosFlash32 displays your DVD-Key and saves your key and identify data' i6 G: k0 J' e9 b
0 l) U1 Z: m1 r2 F
' H- ^% c p7 B/ t2 \2 P) FGeremia's LiteOn Erase method with DosFlash32 and 2nd psu
2 P# r( s; s% f; H% t# _-----------------------------------------------------------, E5 f( n: z0 [% S! |0 v. y. ^# W% F
- connect a separate power supply unit to the LiteOn, don't turn it on yet2 N5 M# e' f( w! x' M& n' r
- power up PC and boot into Windows% @# W# e0 a# q) R
- turn on the LiteOn psu, z/ b; V* n/ {2 n. V
- run DosFlash32
* @- i4 I% V& Y9 W: Y! c1 K- if you read the following:6 Y5 m. w2 S, b
MTK Vendor Intro failed on port 0x????.
3 ]" E" i, D/ |$ {, I2 C' F If you choose to resend the command you should turn the drive off and on( H# B5 `# I% n. Q5 Q9 |* E; j7 S
after you pressed "Yes".7 F) `; i/ W( `- m% l ~! K
Do you want to resend the command until the drive responds?
, I* ^4 Y5 s. t' k; r$ w- press 'No'
5 M' Z, }5 ~! S+ J M9 `- the LiteOn flash is not identified
! m0 J% U" m1 E# ~2 x- choose "LiteOn Erase" as flashing task: ~( i% U5 [/ k
- Warning!!! Keep in mind that you will need the drive key before you erase the flash,6 m5 r& B9 {; t" v$ Q
without the drive key your XBox360 will not work anymore
/ r2 ]& Y h" {, D5 Q" q- press on "LiteOn Erase" button) z8 r; H9 J1 m1 G
- the first time after the LiteOn Erase the drive needs to be repowered to give- {4 ]5 U: H, U% U+ g5 F. U* M
flash chip access, this can be achieved by repowering the drive before another' b4 T* F+ L, w3 O% b8 |% k
DosFlash32 start or by doing a MTK Vendor Intro Power Brute0 {( g2 r9 ~' F3 M! P0 i+ Y
- in my tests it did not work to power the drive with the PC's psu, because it will
; X. z& s3 O4 \, s$ q& E5 z9 V' V9 o6 t always respond with busy status
1 c% ^4 _- |( R, }5 f/ g* {- DosFlash32 can now read, write and erase the flash chip like usual
* h" q; I7 `' L9 Z* c& e3 c6 y$ A1 e
" j" r2 H; z7 s; @0 z( r
Respect to Geremia, Modfreakz, Podger, Redline99 and Tiros.$ k6 r% ]- _& `" q4 {
8 S. ]. ~( E( {- _: m, m* q
Like a wise man said: "0x2E is the MTK Intro of Death"
7 L6 G& R( ^) Q4 B& e/ IKai Schtrom
0 A6 ~3 e) }" u" Y; B1 S |
6 \% L+ C4 R Y/ ^" @7 r: {( ?
6 @- M, P1 [7 a' v# r************************************************************************************************8 [" i) Z5 V: Y' I
8 p6 ^9 |: o6 O' l" z
5 O# h9 r4 K( ]% {# MDosFlash and DosFlash32 V1.6 Beta
" |1 F) M5 s& K) M8 D4 k+ s' i-----------------------------------# c( K. |2 ^( G: I) O
- fixed power brute unlock bug for VIA cards, this can stop your VIA from working
; B% Y+ I9 A7 Z4 Y" j( ~* ? \ with the power brute unlocking in Version 1.53 T4 F# B$ ?) ^# A
- for DosFlash16 in auto mode on DOS my VIA card works best if I do a cold boot
, n' \5 G/ L! j) p and power up the drive short before or with the PC
1 V7 c5 V) D* _- for DosFlash32 on Windows my VIA card works best if I power up the drive short; a1 s- }" k4 E+ k4 k. N8 q- A
before starting DosFlash32
3 N6 O. ^- B0 K* V2 r; e* ]- for me the VIA works with internal and external connectors on DOS and Windows2 E7 m9 d0 J+ v; X& i/ t
/ a7 J; ?: [* A2 d; i0 ]" C9 {
Sorry for the trouble!( S! \6 b) Z* P7 v
Kai Schtrom
$ Y! q# }& X8 b0 O; d- h! A
2 q. G2 B! g) ]5 Q
1 T. m; j& y- b7 }& _& E6 s************************************************************************************************; _" K( D4 \ N2 h8 c+ T
3 |9 J6 J8 l1 _
1 L7 j- ~- [. [1 C* q. DDosFlash and DosFlash32 V1.5 Beta6 S' ~# o7 I1 L; K: K
-----------------------------------: l/ z# ?( {1 p V+ T/ ^
- now supports serial flash chip MT1309E with mediatek status 0x72 like the SH-D163B, SH-D162D,
/ | F4 S5 S# l \4 z9 T Asus DVD-E616A3, Asus DVD-E818A3, Sony Optiarc DDU1671S
/ U) j. l* k0 K5 K, ^' g" \- SST25LF020A and SST25LF040A chip support added
5 `5 q& Z+ M* A1 f I- DosFlash32.exe ported from MFC to plain Windows API, exe size is now 22 KB7 F8 P% Y" y2 S( \$ c
- new port i/o driver, because giveio.sys can't be compiled for 64 Bit Windows
/ V; q$ H3 _# j0 p- DosFlash16 changed slighly in manual mode, one parameter is added to support SST25LF020A and
9 F# {6 l8 }5 \ SST25LF040A
6 \, c2 R, R- Z0 ?" G( `- two new methods of BenQ soft unlock are now possible on all motherboards with only one power2 m" y3 ?% p+ L5 g# N; N, N% ~
supply unit
/ o! m* n1 Y' ] J1 ~- 1st method is powered by Geremia's unlock core, thanks for the complete idea, concept and
; C3 i8 L8 f. H4 G, ^& F, T source to Geremia- ?" V' u) n( Z" M& `- t- p6 }
- 2nd method is the Magic28 key send, this only works on BenQ VAD6038 firmware, thanks to8 T8 a2 o0 q' {4 u" E
c4eva and podger for the initial idea
! Y* T" M" i, H# ~5 v" C/ a, t- the two unlock methods are send one after the other if the drive is a possible unlock6 v4 x0 m( f- K1 z |0 a6 C
candidate, first the Magic28 command, then Geremia's unlock commands and after that the
' P1 j8 z d! e: R" _2 H% L/ a' u5 t already known power brute unlock is send to the drive, you can cancel any of these methods' R+ q1 D4 |9 j1 s! n
before they are send to the target, this only applies to BenQ drives with a locked flash
1 N& v9 @ p2 F& x0 A- DosFlash.typ updated s& v4 ?5 n% P, W: x, f6 ~
- other minor improvements" ~" F3 z5 |, |* F2 @. ]
- DosFlash32 is now ready for1 q5 @, Y9 x5 _/ e1 ^8 x& z8 K$ ?
- Windows 2000
# u! z9 C( _; U3 W4 c! } - Windows XP 32 Bit, R( q6 I- v5 F. \4 {
- Windows XP 64 Bit, g9 I; D+ x; K! L* }3 L
- Windows Server 2003 32 Bit
: r9 k& C* X g1 C; I/ Q" D5 ? - Windows Server 2003 64 Bit" z& z, t* c2 f( }2 ~
- Windows Vista 32 Bit
$ ]7 n0 I( H3 D M& A: Y$ G - Windows Vista 64 Bit
1 ?- P N* l: p8 ?8 N u& a- Warning: Drivers for Windows Vista 64 Bit need to be signed, because we can't afford the$ K8 F! l7 I9 a7 O5 w
money to let portio64.sys sign you need to do the following:
, y4 V8 M( }9 c9 V; x3 v 1) Log on as Administrator0 t7 u7 R3 b/ e
2) Enter the following command in a Dos-Box:
3 \% K+ ?, [2 R" f* j "bcdedit -set loadoptions DDISABLE_INTEGRITY_CHECKS"0 W' N- p" U* Y9 Q* i# a
(we made sure there are no typos in the line above) 
; E7 R; ]5 n$ w 3) Press enter and reboot your PC
- s q* K4 G5 X0 l& U5 L: E 4) Press F8 key upon initial system boot up
% K4 m( B+ i0 G( J7 r 5) Choose to disable forced driver signing enforcement for that boot session
" ^2 B- m/ c3 O8 V+ ?; {- l4 v
- g& [3 L+ [7 C' z0 j) t6 V3 K. e9 d! {0 D6 }( B
The following only applies to drives with a locked BenQ flash.
* t- ^8 x0 @' }) L% z1 x, e1 d! t V
# h% D; q$ O7 [! K7 {1 d U$ U9 Q4 F% W+ C: `* g
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with the PC's psu
7 R0 A# { [; k-----------------------------------------------------------------------------------------
9 e/ k* ]6 L+ J# _2 t' F- disable CD-ROM boot option in BIOS$ [. p2 w$ @& N: C. }& t
- connect BenQ to your PC's power supply unit and SATA port
2 t# M% X, y6 U9 [) G: S- power up PC, wait until bootup is finished& c. b. `6 A% K: q! w* p" K2 f- x
- eject tray of the BenQ and shutdown PC completely: ?) m4 V* }; W! s" w+ o
- push the BenQ tray half in
% g; P' C0 x1 x W6 R- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash32
! r' M1 [9 z0 o0 e- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
1 i* K1 d9 x) d: n- if you read the following:/ z$ k7 i R9 A+ w
MTK Vendor Intro failed on port 0x????. Because there seems
" u4 E7 a6 {7 A8 \ to be a BenQ drive connected you should try Geremia's3 f/ q4 \; T2 [9 `
unlock method.) u9 @! G5 V) n3 ^* V' x
- Eject drive tray4 Z* A6 U: y7 D2 h
- Power off drive
8 f4 R% p5 ?# Y( L- u& R7 ?( H - Push drive tray in until it is half open$ u, v! Y* m1 K3 R+ ?
- Power on drive
5 C! Y A: K8 n4 M' T0 ^6 ^ - Press "Yes" if you are ready
' u/ E& E$ [% y1 q8 F Are you ready (Y/N)?
, }' E2 {- a9 S0 |- simply press 'Yes' without doing anything of the above, because we- y4 y: f! ^" ]# T* G( d, B
already did that before starting DosFlash16 / DosFlash32* l* b) G0 L6 |
- the BenQ flash should now be identified1 T% r( k6 B$ c
- go on like usual! T0 m& ? W6 y! W. E n
2 P2 k) E4 k1 {* u* b2 _# x% z/ k8 t4 u' |
' T' B( I7 |' i. TGeremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with 2nd psu% [4 z/ k& l$ F5 ^; d1 |) Y+ }
------------------------------------------------------------------------------------9 k: r- @! m+ B2 a
- connect a separate power supply unit to the BenQ, don't turn it on yet
! `0 B1 `1 P' w% G- power up PC and boot into DOS- C1 F" F4 h1 k. x. Z: I
- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows8 i$ b" B: B3 O7 ?' b; l; ^
- if you read the following:; C c# z: s0 Z9 P5 {
MTK Vendor Intro failed on port 0x????. Because there seems
3 A0 n) l, n2 E2 a8 o8 v4 K0 r+ n& r- y1 a! a to be a BenQ drive connected you should try Geremia's+ D0 z% J; K V9 ]( O2 Z
unlock method.; u( q' k7 C; g4 F
- Eject drive tray! Z. k9 @4 m% V0 w! a7 i7 f7 A" G
- Power off drive
$ l0 e+ w8 {0 m, W - Push drive tray in until it is half open
, i* T- A8 y) Y2 e! M$ @- b" v - Power on drive
& f$ o5 V( C9 I- I0 f- u2 ?8 H( h - Press "Yes" if you are ready' c+ p9 _5 C0 O
Are you ready (Y/N)?+ D! p" B- \* T) i# J
- do the above and press 'Yes'
9 ?9 h2 p6 F4 K# ^- the BenQ flash should now be identified
# ]# r) ]' U! `5 {% \( J$ ]) D- go on like usual0 [9 {0 t- h( k3 e! ]9 P8 Z- V
( T: j3 p! p8 G3 C7 o# D
' n5 J1 e: O- h9 j( {, \Magic28 BenQ unlock with DosFlash16 / DosFlash32 on any motherboard5 R% @9 J* k' |" ^5 o
---------------------------------------------------------------------
1 Z# v3 K9 e: z6 |6 X* m! N- connect BenQ to your PC's power supply unit and SATA port( l- L/ V1 Y3 z
- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash321 a# X- {& d' k1 g% G
- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
' R9 a; Y P' n$ k- if you read the following:# e7 E4 O3 E' q3 x* u* ?% D O
MTK Vendor Intro failed on port 0x????. Because there seems7 _7 ~, u+ t" Z
to be a BenQ VAD6038 drive connected you should try the( S { a8 v# X
Magic28 unlock method.
/ @8 Q- E4 Z8 g! D, c+ ] Do you want to send the Magic28 command?5 s* q0 S: P. z' H' F
- press 'Yes'1 l- a4 t; c0 V! ~. o5 G- u
- the BenQ flash should now be identified
+ H" ]1 d# D( l. u7 }- go on like usual, Y+ w# v2 X! d
9 z% ~( v/ S9 U1 C* i6 H8 H! Y# f/ ]1 \( K P! [8 o
Thanks to Redline99 and Tiros for help and support.3 C v" K4 w3 c( `- |
* w! I. a" N' n2 f: i: WIt's all about DOS!$ y& X2 c0 p! N! ~( G* o
Thanks guys for the excellent team work!
2 ?! Y8 o# L9 ]- g4 r- s( TGeremia, Modfreakz and Kai Schtrom7 ~- w' K- I# c2 p
8 b/ `( r$ E1 m. B6 W1 b& ]8 y3 o2 J- x) Z
************************************************************************************************% v5 v# T6 G+ n6 W. s/ C
$ s% C' D4 }( {
( i% V ], e# i9 Z
DosFlash and DosFlash32 V1.4 Beta
! ~- q1 d2 ^ W$ \- w: P; s4 `-----------------------------------0 z. i5 V- j1 @) M: Z; C
- DROM6316 flashing support
6 G% _$ n6 }0 j- [- a flash erase is now always done with a chip erase and not a sector erase command, because
6 c/ D/ N6 P5 X0 x the sector erase gives problems for some Winbond flash chips including the DROM6316
6 ~" S0 @. e* o. g, z- DosFlash.typ corrected and updated7 K8 O; c( b% ~8 D
- for a detailed explanation on the soft unlock look at the included file SoftUnlockByIriez.txt,
: ]" i% Q1 P4 f it contains a very good explanation by Iriez from XBS, thanks for that one!
' p( f! x N: f0 C8 H3 p4 P" k- x2 P+ s6 x6 ]; ?, A
Thanks to Iriez, Jumba, Redline99 and Tiros for help and support.9 E; h5 e; A k$ I/ n; S* G" p% b
5 d) j \$ Y' K L. g3 K, m4 O+ X
Happy DROM bricking!, F2 ^: D* n* v7 d3 s) A
Team Modfreakz and Kai Schtrom
; W0 H4 y$ r! U0 f+ n- Y. H
# W, a+ r" \$ { ?' Z" v4 g
. u9 r3 m0 t7 E% Z) q0 ?) m" S" g/ u************************************************************************************************
9 `( u9 w/ J% V5 F$ e/ e0 t/ n2 u% ~& t8 i; L# v
0 I; H( p6 |. B% E
DosFlash and DosFlash32 V1.3 Beta/ Z/ p0 e( j6 h6 _; q
-----------------------------------" Q R' C" t% O w6 _6 u' B u2 v
- BenQ optimization in unlocking the flash chip, it should now be possible to read/write/erase
) @. J1 U" D6 e2 [& O3 }$ b' n4 W) O the flash without any soldering or wire tricks, the drive is polled for the correct mtk
0 c0 ]6 t/ b# f/ B( A unlocking status after power on, this only works for VIA cards and NForce boards atm
! c; L" g* q7 s& Y2 _- DosFlash32 has one additional parameter, if you start it with the parameter "EnableDrives"5 c' p( C6 W$ I
all the DVD-ROMs are enabled in device manager after flashing, this could give BSOD on some. r1 _1 h; N$ Q* o+ u1 M; N
systems, therefor you need to create a DosFlash32 link and add that parameter manual to use it1 T6 o; z( T" n, m( Q
- DosFlash16 has one additional parameter "Send ATAPI Device Reset" in manual mode, this could" M" X' Z L' V9 s
give better chances for soft flashing on some VIA - motherboard combinations
% F. Z _2 P% O' L+ ]- better support of Intel chipsets, drives can now be flashed if the controller is not set to- M- Z/ Q' ?. j6 f2 U/ U5 j
native mode in the BIOS. A5 _$ h$ q0 B& k' \4 X% `. C' [: C
- the following controller list includes vendor and device IDs that are hardcoded to identify
3 k- q7 }' i e7 c6 a& f the controller type (IDE or SATA), this is needed if the BIOS uses IDE ports like 0x01F0 or
4 W! z9 w5 @ P. k/ { 0x0170 as SATA and not as IDE channels, this list is NOT related to soft flashing
2 T5 z# A/ b+ u, X, f$ e' P- the following chipset support is added
@4 E7 P" u/ N+ M. j - VIA cards
" s5 \: t& f- r+ _8 _3 D4 y - all VIA cards with a 6420 chipset! o, [5 z% ~% w1 f x4 P. |" J& d
- IDE Controllers
* m+ x( n @2 N2 e# k! j - NVIDIA nForce 2 IDE Controller3 m" T4 y9 L, y
- NVIDIA nForce 4 IDE Controller# h8 p3 R6 ~0 \7 X, m, X5 f
- Intel ICH9
- D' a: A- V4 i - Intel ICH (i810,i815,i840)% r$ t8 E' U3 y- \6 x
- Intel ICH0
. M& [7 y" \! E! X# _/ r# v+ f - Intel ICH2M
M+ q2 d6 ~- p" `9 K# m - Intel ICH2 (i810E2,i845,850,860)8 N; [: P" v1 T( q0 |
- Intel C-ICH (i810E2)
& J* E( k& T8 K, h4 X% o& c( f - Intel ICH3M
2 ^0 E. N. s4 M9 n6 t& }9 _( l - Intel ICH3 (E7500/1)7 g$ ?& _2 t- V' L, f9 D5 R
- Intel ICH4 (i845GV,i845E,i852,i855)
8 d3 A: c$ u$ K) F( H+ c6 R - Intel ICH5! u4 b$ Z# h4 E% R4 @
- Intel ESB (855GME/875P + 6300ESB)
3 r8 `& o9 W: c+ s( O0 r - Intel ICH6 (and 6) (i915): N: n, \! C( p) F
- Intel ICH7/7-R (i945, i975)
$ a0 l |$ F- {$ \3 t - Intel PIIX3 for the 430HX etc
6 \! B5 ?, T+ h/ ?$ T - Intel PIIX4
# q# h1 Z9 L9 H( E6 [% m/ U$ ~ - Intel PIIX4 for the 430TX/440BX/MX chipset
! k7 T+ R% l2 c. r0 g - Intel PIIX9 V j/ [" R2 P, { h3 Y9 ?0 w
- SATA Controllers
z3 R- i- ?. | - NVIDIA nForce 4 SATA Controller
& p" q* H$ p3 V& }' ~ - NVIDIA nForce 2 SATA Controller
1 V b; [3 {$ C# x0 M - NVIDIA nForce 3 SATA Controller
1 x! j! j1 d3 k6 l* \3 ? - NVIDIA nForce MCP04 SATA Controller
9 P3 i/ a& F# ?) a - NVIDIA nForce MCP51 SATA Controller
2 a0 a' z7 Y) q2 w: H* @ - NVIDIA nForce MCP55 SATA Controller
. Q. j: V: H' b! D Q" E - NVIDIA nForce MCP61 SATA Controller/ o5 o: f: h; E9 a
- Intel 82801EB (ICH5)& H" O) Z# b4 D6 J4 W
- Intel 6300ESB (ICH5)
/ M! P4 M8 B. P$ b - Intel 82801FB/FW (ICH6/ICH6W)( D+ N' b D: _0 `+ g3 r: v" z8 b
- Intel 82801FR/FRW (ICH6R/ICH6RW)1 A6 d t& v& g4 A
- Intel 82801FBM ICH6M3 u: }- I6 p' d
- Intel Enterprise Southbridge 2 (631xESB/632xESB)/ ?/ o. \8 s {- f9 r9 l
- Intel 82801GB/GR/GH (ICH7, identical to ICH6)* R3 ?: ^( ^' y! V( l# U
- Intel 2801GBM/GHM (ICH7M, identical to ICH6M)
% d; |% \& L, E& s4 D - Intel SATA Controller IDE (ICH8)
8 j+ s) a5 Y/ p. c - Intel Mobile SATA Controller IDE (ICH8M)
: p6 Y" v8 h! y" n1 q - Intel SATA Controller IDE (ICH9)7 [- C( Z) _. }+ P5 N
- Intel SATA Controller IDE (ICH9M)
+ {/ t Z. Y# V, F! x' V# |/ A3 y+ L0 N) \ p
/ A, ~7 @6 O! }% V# z+ t- s
The following only applies to a software flash on a locked flash. The methods have been tested) v4 {' h6 \1 Z
with the BenQ and the Sammy. The VCC trick will work on any motherboard, but you need to do
- `; n; V$ m0 x3 zsome soldering and cut traces.
" A3 [0 i8 K( ?6 F2 V- \6 z* l# k0 v- b
4 H2 V; b8 l0 o; i4 }Soft Flashing the BenQ in DOS with a VIA card and DosFlash16 in manual mode
+ i0 n' n5 R4 [4 X# d7 ^+ V-----------------------------------------------------------------------------" M" w+ C; t1 T! F( Y# q
- first you need to know the port addresses of your VIA card, you can get these by starting8 ]9 e0 x: W2 c
msinfo32 on Windows XP and looking at the port listing for SCSI devices
: v* L# a+ l0 c/ H8 r$ C- for the 6421 the 1st port is internal SATA, 2nd is external SATA and 3rd is internal IDE
# U3 O0 q3 l) q- for the 6420 the 1st and 3rd port are internal SATA
6 Q/ ~! R- w- _) E- you need the starting address e.g. 0xD000 or 0x7000
p2 ?) s1 R7 k. [8 t$ j- be warned that these addresses can change from computer to computer, they are assigned
/ c. w4 [' a x! b% x9 z at bootup, but Windows XP should display the ones you need for flashing in DOS
6 T2 J% [2 \$ @! L u1 q) F P) a- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or ! p3 n8 ^* b/ z- Z& d5 S# w3 l
Xecuter Connectivity Kit)
7 q" d$ r; T% N- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
6 E. b: f# N' A$ U+ n0 @1 Z need to power the drive off and on during soft flashing5 o5 L: g$ y' U, q
- cold reboot or reset the computer
+ M# h! _0 |0 l7 \+ U( i) t, d- boot from a DOS disk, I used a Windows XP MS-DOS startup disk9 H+ S R- F- t: d
- at the prompt type:
5 e9 B! k+ J% C+ q+ T( P DosFlash r 7000 1 a0 1 4 a:\orig.bin 0 1 ~4 h8 T; c# N: y( R
- instead of port 7000 use the starting address your VIA card uses
# ?) ], ]( H: N* k- press return
0 |, _5 ]0 H" D) R7 N0 X* Q- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes$ o% g% Y! ?) z7 [
- after you pressed Yes the drive status is shown on the screen, it's something like 0x7F,
: l- m C" | K! @! G this will change during the next few steps' y4 i. {# e- y5 ~$ y2 `* Q1 |
- turn on the BenQ psu and wait 2 or more seconds, status changes between 0x51 and 0xD1
$ \+ \9 t7 H E7 M- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1
, C+ w9 f& M- b( u8 W" }- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start5 O# n, z6 J Y
- this worked only one time after the computer is powered on or resetted for me+ ^" M- [0 b4 c* @& X
- writing and erasing works the same way
+ K! i% ^+ a: A+ G l0 k: E- J, |- for writing type:& u- K4 v( X7 e# Q
DosFlash w 7000 1 a0 1 4 a:\ixtreme.bin 0
2 ]1 m8 O; ~5 B7 C& P7 V- for erasing type:3 S& @8 n' _( b# J4 x
DosFlash e 7000 1 a0 1 4 D8 0 (D8 is the sector erase opcode for the BenQ flash, if you need
0 R! [; Z4 g5 S. e: `: @ to erase another drive, lookup the value in the datasheet or DosFlash.typ)- |( V9 i$ ~7 M1 g3 ^* I& Q
- if you experience any problems try to use 1 as the parameter to the ATAPI Device Reset, cause, ?+ ^' a8 T; A! U1 O( k0 ^
the same VIA card will react differently on another motherboard sometimes
; t2 P2 b; ]' r6 i
* M2 Y2 k. T7 h8 X. z; g$ a: w4 z: }1 b3 S6 ]7 k
Soft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in manuel mode
1 M6 f- }4 `( U& _; t: H' f---------------------------------------------------------------------------------------7 x. q& R0 B2 A( E5 g' `' d# n
- first you need to know the port addresses of your NForce motherboard, you can get these by
$ N4 k% ^; s9 D' X starting msinfo32 on Windows XP and looking at the port listing for IDE devices
4 e% V2 D: r8 O; R- on most motherboards the 1st and 3rd ports are used for SATA2 E6 h9 |+ c3 P/ m" s: }5 p# ]
- you need the starting address e.g. 0x0970 or 0xE900
) p% b& L. d+ b+ h/ _- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or # C2 h, e8 z3 z5 k9 K# U6 D+ K0 i3 [! c
Xecuter Connectivity Kit)* t0 _) x+ U4 u$ F! m
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we) U# U& A8 ^- q! d. k- p6 g
need to power the drive off and on during soft flashing
& J/ k* K, L/ S1 r a$ V- cold reboot or reset the computer# ]1 V# J. |: K. p6 B3 x6 Q
- boot from a DOS disk, I used a Windows XP MS-DOS startup disk
7 g7 R" P; e" d. s2 t# H- at the prompt type:
# f9 o E) Z/ ^, w6 @" ]3 x8 b DosFlash r 0970 1 a0 1 4 a:\orig.bin 1
) n! x7 V0 S* F' G/ @4 o - instead of port 0970 use the starting address your NForce motherboard uses- ]3 [/ ^& |9 X! n9 G
- press return$ K- U& u* V6 D$ y" P" s
- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
( p6 V& ^0 W7 F$ F% K7 L- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,% \ H6 \; g4 U& W1 S+ V0 g) f4 Z( x
this will change during the next few steps
5 C: T7 v* V! g- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start& ^8 Q/ }* @6 H& C, C
- writing and erasing works the same way
! E7 E4 G2 T% i5 F+ X3 k- J* c- for writing type:: j" b4 ]+ C8 X5 y. n, p
DosFlash w 0970 1 a0 1 4 a:\ixtreme.bin 17 d& \; O S( B9 I- U3 G; \
- for erasing type:* ~) E) W; X+ z5 {
DosFlash e 0970 1 a0 1 4 D8 1 (D8 is the sector erase opcode for the BenQ flash, if you need
8 ]4 |2 C8 Q# X* | to erase another drive, lookup the value in the datasheet or DosFlash.typ)( \6 G& U x$ L+ H2 q
5 f* y( t# R0 B. C* W( {3 ~
7 }5 D7 A# a# P3 {Soft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in auto mode5 ^: d3 w" P+ b! F C3 r' `
-------------------------------------------------------------------------------------7 t6 j. P* G5 v$ m
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or
0 G4 p0 G D N# I" F0 w5 c5 ~. s- j Xecuter Connectivity Kit)( o( Z$ N/ Y9 n& i5 Z+ {
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we+ g/ O5 F: j" k J5 w
need to power the drive off and on during soft flashing9 k9 U- ?6 _6 E' X' I
- cold reboot or reset the computer
" D4 [) [1 @, X/ A7 Q- boot from a DOS disk, I used a Windows XP MS-DOS startup disk" Y( x7 C6 Q4 B9 ^
- wait until you are at the cmd prompt! r8 P/ i1 }: u* ]8 s4 W
- turn on the BenQ psu
6 B* J' V9 a# D1 x4 \( F0 j- at the prompt type:
$ M& ~. s+ }! @/ g- u DosFlash
' _0 B- C r/ v" Z5 S& l$ D. _' O- press return( L' W0 B& g1 r* H0 ~
- during scann of the BenQ's port DosFlash16 will ask you if you wanna resend the mtk vendor4 \4 K9 e3 x$ L8 x- m3 p( N1 y, T
intro cmd, press Yes
1 ^& ?5 F, p9 Q& f6 |- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,
+ n- J& r7 }$ v+ ]* L) y* C4 @1 I0 b this will change during the next few steps
; a. L- `; \9 M* @. G- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1
1 s$ @, I8 f3 t0 v! Y5 c- turn on the BenQ psu, you should get a good drive status 0x73 and flash access is granted
: o; c0 F! z y' W8 I& E$ S- you can now continue as usual using DosFlash: [7 j' b6 ~) w& M
- writing and erasing works the same way
4 Z( u; m# I9 ]# p5 ]; }- if the ports are scanned there is the possibility that you'll get the resend question for
3 H a8 V9 h! h/ C2 w% G other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,
( q( h( }! P& C4 i1 o" \' X if you know the NEC is at that port you should press No and press Yes only if the port of; R; i9 E: f* _* H: V" S4 E
the BenQ is shown or simply disconnect the NEC
5 n9 \4 I" ?) {/ K6 [3 @
) n% ^/ l S5 H _
: G& c7 z+ w+ @! h+ |/ h3 y' nSoft Flashing the BenQ in Windows XP with a VIA card or NForce motherboard and DosFlash32
$ J4 X3 q# i9 H2 }1 t+ u: i: V-------------------------------------------------------------------------------------------, y. {2 l ]: P6 t/ c
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or
" z3 C% x- I1 u- ~/ R9 V Xecuter Connectivity Kit)
% B& H$ |) a# K$ W! g0 r- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
3 U0 t. ]' l. t2 z: H need to power the drive off and on during soft flashing3 B5 @( |% U8 O% E
- cold reboot or reset the computer# [" w M# C5 e$ T. d( ? C, t
- turn on the BenQ psu when you are in Windows XP& @ G/ c% r) h" T# j
- start DosFlash32
/ d. U f& m9 l* l1 \- DosFlash32 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
9 m J' G% m; x1 D+ _$ Z- turn off the BenQ psu and wait 2 or more seconds
) m& L8 N5 x s- turn on the BenQ psu, the DosFlash32 dialog should show up7 u: M9 [3 R9 G0 f1 s
- the flash should be recognized by DosFlash327 I' j( Z% y9 {. D9 ^
- you can now read, write or erase the flash
# z4 V4 _% m8 t1 E% G% l3 r# j/ _- you should be able to do the flashing more than one time in Windows, only do the power
4 w9 }' A: ^9 U off/on trick again
$ {6 H6 U0 [3 z0 _0 d* L& L- if the ports are scanned there is the possibility that you'll get the resend question for. }# i- I! r; j& Z
other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,
" G A% V8 ^: [4 ` if you know the NEC is at that port you should press No and press Yes only if the port of8 C v3 M' n3 F1 |4 A9 S6 c& H! Z% B
the BenQ is shown or simply disconnect the NEC
$ F6 b, m7 H$ n( d3 }" G1 e$ _/ t) X. ~; V. N0 l( {0 O
* g% S7 n$ l& Q% l% M) r( qMany thanks to jumba for the great idea of BenQ polling!8 w$ y8 @; z% w; h- ^( T0 f
Thanks to Iriez, Jumba, Redline99, TeamModfreakz, Tiros and all the IRC people for testing" T a5 H; m/ ^$ t' G: B
and support.
) I2 x# I" a9 @
4 _' [2 n4 d7 D& M% mJoin us on IRC efnet at the channel #dosflash for support.4 u. L( X8 h m0 {0 U! A6 C
( C! ]4 {& v: u/ M2 [# ^
Don't brick your BenQ!
S H6 D$ |9 V' o1 X# o0 h* R" T# DKai Schtrom
6 e! e- |9 x4 H2 P/ n+ C% x
+ I) b1 O$ u5 E: H. C: {. S1 x3 c7 b6 ?
5 o" c: j; d% X/ W3 `; b************************************************************************************************4 |% A, S, X" v9 N" j
& W9 |; f" ^6 [" L' E' U' Z } [
DosFlash and DosFlash32 V1.2 Beta
* y5 b k9 B" \7 w-----------------------------------
$ Z B/ u' r, g g- m$ r; d) ^' P- bug fix for BenQ recognition) | T7 J- S3 k4 n2 v7 }
- manufacturer and device id are sometimes 0x00 for a correct installed switch
% g0 a! v' y5 Q' x* G% _ - this issue is fixed with an additional ATAPI device reset before the mtk vendor intro is sent
8 L. x. Y7 _3 q9 Z7 {) [8 Q9 A% O0 O9 `2 f$ O
Thanks to Redline99 who fixed my buggy code by adding one line! 3 @ m5 d* i; W j
0 U% \% c, k4 U; U) o3 j1 N
# _- y( h3 A, U0 w5 g1 \
************************************************************************************************1 T* Y2 O- y% ]: c' P$ K: C& L; L1 W
0 T2 p: n/ b; S: q) ]; Y' N2 f; x
6 z# Q. B3 a" f6 W
DosFlash and DosFlash32 V1.1 Beta
, K! S7 t6 Q' A5 M4 F" O-----------------------------------$ ?% j4 V- p+ T/ P" F4 U( t
- DosFlash.typ modified for better BenQ support $ V* ]& m9 V& @5 {& c- x
- DosFlash16 Flash Manufacturer and Device ID screen output restructured
" q7 \5 V: H& ~- G$ d1 M+ Y- L0 y* G# n- flash chips are first erased before writing starts" P A, g$ n' \- ^ G
- DosFlash32 no reenable of DVD-ROMs in device manager after flashing, this means you can't see the drive
" @/ I( z9 J% ?4 x! y# r& s) p and maybe have to activate it manually again in device manager, this could give better compatibility and
# M, f& k) _+ o: U' i& p hopefully no more blue screens7 d; r! n7 ^$ [ |8 i8 W
/ y: t/ G' u- g( F4 M( qMany thanks to Jumba, Redline99, TeamModfreakz and Tiros for inspiration and help!9 F9 s0 g% m( }3 p
) o( a5 {, X9 f/ R4 }
0 m0 {+ V2 d2 F5 G3 Z# y* t
************************************************************************************************* C$ S# W) ~; d) T3 O, w
" j: X* ]5 v* N8 y: I
" H2 f' s ^+ d0 CDosFlash and DosFlash32 V1.0 Beta* o( C9 Z2 H7 b" r
-----------------------------------
0 p5 @* j" b5 z+ T9 WDosFlash can be used to read/write/erase the flash chips of most CD/DVD-ROM drives
L0 d7 Z. X& L, f: \# e. i. R- ?that have a mediatek chipset installed. DosFlash is for DOS flashing, DosFlash32# g3 s3 S( \0 A6 {% E2 Q2 F$ [1 P
for Windows flashing.6 r. ]& r" W* g) [+ G, I' Q, p8 z
% E& A# {: C2 U0 ?+ h$ ~7 l* A0 F" @- p) J: q1 J
Features:
! g3 z( E6 u- M* g I" H-----------
* f0 r# y) ]2 b' l- flashes IDE and SATA drives/ J8 ^- a T' @/ L* E) M$ R
- supports parallel and serial flash chips
2 @* E- K* A9 o; e7 A% I- flash drives in Windows with direct port access- `8 I$ L+ R8 W6 V% q! N
- no vendor cdb flashing commands are used
+ t' P4 Z0 k1 ` c8 U, G- tested with the following drives:
. @, V. o. ]# g; H3 I - TS-H943A MS25, MS28
- M, L, E# L5 j5 X - SH-D162C
3 d E- d( I+ w' `* }0 m - SH-D163A
5 u; k. W; y& i! M$ R0 ?" p. a6 n9 e# ]# x - and some other drives like Liteon, Hitachi, ...
* p7 O, k, q. u1 p( h( T7 Y- NEC drives are not supported, cause they have no mediatek chipset installed
& z0 p8 x/ {. g2 n! l y3 `0 J$ w3 _) ~* m2 i. R8 K
( T) x3 L+ |1 uDosFlash
8 a2 z' b; J4 d: j9 x" p7 Z! `' y---------- d+ I1 G# Y& c* E1 M+ N
DosFlash supports two flashing modes, Auto and Manual. If you type DOSFLASH at a DOS prompt it! s/ w) N+ w8 t5 J
will start in Auto mode. All drives and the corresponding flash chips are detected automatically.
4 a7 [- `3 g! Q6 HIf you can't get a flash chip recognized due to a bad flash or other problems you should use the5 N* I# K3 b; R* [
Manual mode. In Manual mode you can enter all the parameters used for flashing by hand. The# t$ q) m H; ^9 Z @( M4 O, K9 v/ O
following help screen is displayed if you start DosFlash with a wrong number of parameters:
) g- b J. N7 B2 m+ w6 B1 M+ b6 S- Y/ s$ s, l% S* g
( z3 `( \% Q. [/ k9 \
DOSFLASH by Kai Schtrom, 08/05/2007 (Ver 1.0 Beta)- c7 D: p4 X6 F6 ^7 `: X G0 d
DOSFLASH [R|W|E] [PORT] [PORT TYPE] [DRIVE POS] [FLASH TYPE]# r% B/ @. y) f6 h+ N7 U6 |+ `
[FLASH SIZE] [FLASH SECTOR ERASE OPCODE] [FILE NAME]) L6 e* c G% }
R: Read FLASH! g7 s* \, l$ M; E, W. M
W: Write FLASH1 V) ]) E5 c! _
E: Erase FLASH1 e/ V! N( L1 H8 Q3 N
PORT: Port to send command to
2 f- r0 [1 k9 H* o/ E3 F6 {& e. | PORT TYPE: 0 for IDE, 1 for SATA
2 z: ^$ @7 W' L2 a DRIVE POS: A0 for Master, B0 for Slave
/ E" g; g/ H* x, w* p FLASH TYPE: 0 for parallel flash, 1 for serial flash
. t! r& I( P1 l# ] FLASH SIZE: size of flash chip in number of banks
0 _/ |- y8 l: I/ `. u) LFLASH SECTOR ERASE OPCODE: individual sector erase opcode command byte
8 B# I$ ?6 |; I0 \ this is only needed for erasing a serial flash/ ^8 Y: Q+ Y0 g' {" F
FILE NAME: name of the file to read/write from/to flash+ a7 n5 g. L& s- l5 c+ O! B! r. `
All numbers are intepreted as hex values!2 i. C7 z* M- p! O) {7 @/ k6 l
1 J/ h7 b) o+ C+ }9 p+ P
Example Usage:, {7 {7 j2 N% w" f0 X+ i
"DOSFLASH R 01F0 0 A0 1 4 C:\flash.bin"
& L2 m! M; B$ O=> Read serial flash with a size of 4 bank (262144 bytes) from Master Device' @+ r" ]# w4 G+ g
on IDE port 0x01F0- v& ?; @4 t) u; L% G6 l
"DOSFLASH E C000 1 A0 1 4 D8") b2 O- U- p7 G+ j! z/ w4 J
=> Erase serial flash with opcode 0xD8 and a size of 4 banks (262144 bytes)( i; f2 D0 L/ i; }. r
from Master Device on SATA port 0xC000
+ B& x4 d9 H* E' l' t0 W( [ / m5 H7 Q6 n k3 i
7 R% x5 o# j5 z, @; N8 aExplanation of the Parameters:
2 R: Y! o" p, h9 ^ N9 X1 K$ ]--------------------------------
6 r; G# n" a! H- F' _: q9 k( I. @' w6 S: L/ z
[R|W|E]1 N1 m# q( ~, V7 }+ _" \ K
---------
4 u/ m" H' z& b: e- this will set the mode of flashing, it is recommended to first try read on any
5 x7 y1 M( k) v/ @% | drive, if the read will fail, it is highly unlikely that a write or erase will" l1 i- c* S7 j4 M) {8 J8 L
succeed
5 L2 N; B8 v. f" [1 A3 w, u* ~4 ]
[PORT]
- W8 r2 `/ ~; H7 k) D* v5 A7 ?0 N--------/ T/ B7 w+ R0 o' Y o$ C2 X
- the port to which the drive is connected, a port number should always be entered
: ]) O3 J7 E/ I1 H: H d in hexadecimal and have 4 hex digits, valid ports are: 01F0, 0170, C000, C800
( Z! ^. Y+ H+ R6 d- this option can be used if your PCI adapter card or on board IDE/SATA ports are
/ M7 C5 p M6 c! F not identified by the auto mode7 U0 ~6 M3 n+ S+ N/ ]; P( k1 H
* A6 X; V! y* w4 X[PORT TYPE]: h3 u3 @* R i# d
-------------
) r; |0 X* t) D( n- the port type tells DosFlash what type of port is installed on the before entered
- R: O7 V }* f3 F( K4 O l port address
2 w* v& [; t# b, g- a! |- valid values are 0 for IDE and 1 for SATA
, ~8 q' Y3 g& Z+ K t- make sure you never mix the wrong port with the wrong port type, this could give
* m) U1 g8 y( q3 U* f; K strange results or in the worst case a bricked drive* M# K. V$ u' Q5 [$ P9 o
& n5 K, }: j4 |* J7 `' ?[DRIVE POS]
L7 O9 h/ a& ?" c7 a-------------
8 z) V0 l# }# e: K- _4 s: O- old style IDE channels have the possibility to connect two drives at one IDE4 m: C9 I8 R" l, t$ t. w
channel, the first drive is called the master, the second drives is called the
. w, v2 K# u8 w0 M1 X slave2 t4 S ^9 a6 J* [0 z- c% k
- you can select which drive should be flashed on the channel, A0 selects Master,
$ {) [9 z& R0 [6 D: n# R B0 selects Slave9 g3 Q8 o) Z) X5 B" @( W
- on SATA ports this value is always A0, cause you can only connect one drive to
1 k. f- m" m- o a SATA port, so for SATA you will always type A0 here% j( Y2 S* w1 s* _$ |( j9 {
- it is not recommended to flash IDE drives with another drive connected to the
4 f) b2 z) t- e' }. T2 [& z same IDE channel, this could be risky if something in the Master/Slave selection: F. L& E L9 |8 t
fails
8 J- }1 y% v' T! U+ ?8 R( `
+ m2 g% R8 S, U# E[FLASH TYPE]" W$ t1 W+ U% V; ? ~
--------------
2 O6 M/ U: `6 E( S7 Y$ ~% R# E5 L" h- there are two types of flash chips out for CD/DVD-ROM drives atm! l/ F. g# a' B$ B& I0 P
- the older type is parallel flash, which is also supported by mtkflash for example
# D! ~) f$ o1 s5 H& c5 ~- the newer type is serial flash, which is supported by flashers like XSF
/ {) |8 X" `- y' K- the problem here is that no tool is out that can flash serial flash chips on ) u' k& e3 r- q. \+ i2 Q* x; ] [+ N
SATA ports- j4 v, B" e% B8 U2 }
# F; e) q9 |/ u, S8 x0 ]# I[FLASH SIZE]
- j0 c9 P3 D3 N% ~; W' ^--------------+ q$ F9 R" D4 l% E/ L8 J2 U" x; ^
- this is specifies the flash chip size in banks+ }/ p! ?6 v7 Y7 u; v
- one bank is always 65.536 bytes in size/ Y( S: G/ r1 v7 @' s+ f: E6 u
- if you know your drive has a flash chip of 262.144 bytes in size you need to enter 4+ ]: d5 |8 |6 S
$ _! ~/ B# S7 B) |5 n' P
[FLASH SECTOR ERASE OPCODE]
, U. x* B" _9 `0 ?# _" J9 T' W-----------------------------
3 M. ]# z1 N2 k) R- the opcode used in the flash chips datasheet for erasing* D4 M- j& Z k
- for serial chips this command can be different from the standard and needs to be
; c3 w, K0 u- a) q" q4 ` entered for flash erase
5 ]# U6 R- _) W: ?- for parallel flash chips you can enter a dummy cmd byte, the integrated command
8 J" C+ P" P: ?* S8 `5 I8 k! w3 X( R should work on all parallel flash chips without a prob8 z0 g* E+ D/ w3 K* Z
, _( b4 B6 X6 j o2 \' E( A
[FILE NAME]/ O1 b9 U o2 o; K3 ~/ o: ?. X5 h
-------------
! E8 ]1 B6 ~5 r7 k- name of the file that should be used for flashing9 d8 S0 D- f& c, M$ S
- for reading operations this should be the output file
" J8 v8 ^ Y+ A3 h6 h7 ~) V5 l- for writing operations this should be the input file/ Y) N8 K, m# x) A; a4 n/ K* s
$ d7 p! n. m# z" x x! n& _6 {% v; [; d
Hints and Warnings4 E. o: T4 e! ]; t3 d
--------------------+ n6 H7 L+ k4 E
- read, write erase TS-H943A MS28 after the firmware stealth has been disabled with Enable0800 disc
; O. y, G3 A6 e0 R - this only works one time, after the first mtk vendor specific intro cmd is send
% t+ w! f. ~- c4 o$ N6 e - if the mtk vendor specific outro cmd is send the chip goes back to stealth mode and you need
; q1 w: |$ _/ [0 R2 y again the Enable0800.iso to disable it) I- l* S6 G& q6 H1 f/ }/ \
- therefor the mtk vendor specific intro is send at program start to all present devices and the
E1 {3 {" r R9 p! }/ G# @ mtk outro is sent at program end
" X9 o0 j- }- H0 T - if you have a chip manufacturer id of 0x02 and a chip device id of 0x02 for the TS-H943A
2 R: a- ~7 P% b, J- u the flash chip is in stealth mode and won't give access to any reading, writing, erasing
8 r8 U ~" i8 i( x- always have a look at the DataSum generated, this is exactly the DataSum of mtkflash
& W) a6 |8 ?, C( J# T! r - the DataSum is calculated as the sum of all bytes of the firmware in a short integer
- Q. ~+ E5 _; i4 Y. b, d9 a - to make 100% sure that the flash is written right compare that DataSum to a known one& l" O% a5 C/ b! v
- this tool has not been tested on all drives out there, the typ list is simply copied from well2 u' n+ O: y/ s0 i3 c
known programs like mtkflash and XSF" t" N: t( p, f* c
- always try a flash read on a not yet tested drive before doing anything else
$ K! A0 |( e2 ? - if the read doesn't succeed it is highly unlikely that a write or erase will
: w4 d+ U5 m+ K4 S- some LiteOn drives seem to have probs to write the firmware correct, this prob seems to be: V e8 l; d3 ~! r8 U7 g- K3 w5 a
related to windows register flashing, cause even an assembler app can't do this error free
' {$ o0 @! w9 _$ ` - if you get errors on LiteOn drives, write the flash two times in a row
9 t: z1 Q5 J+ l5 C; i" {( s- for direct port I/O in windows the givoio.sys driver is used, this driver is loaded at DosFlash32
1 `2 x. d2 o. e. R1 C: E) o start and unloaded at program end, be warned, this driver can possibly make your system unstable,
) i. y; ?+ W! b& ^' h3 F* f! q$ [ it's intention is to let privileged assembler instruction like in and out pass, even in windows,& Y. Z {) P2 y2 P
if this driver is not used you will not be able to get direct access to port registers
/ n; q1 n, U* |5 K+ ^& w- DosFlash was tested on MS-DOS 6.22 and later, you can easily copy it on a MS-DOS boot disk created
( ^+ w' l! j+ x" _- j& s% D8 J8 @+ r in Windows XP and start DosFlash directly from the disk
1 o( q" s0 B' ~! h3 \ B- don't forget to also copy the DosFlash.typ file, it has all the informations about flash chips _; D- o0 E/ L* {/ Z! N0 m6 i
for auto mode flashing
6 h2 m% Z" _4 g- DosFlash32 was tested without a prob on Windows XP SP2, you'll need also the typ file for the
* q' Q: w% ?9 ]$ Q win version
0 e4 S1 b7 o3 B- DosFlash32 will deactivate all CD-ROMs in device manager at startup, this is better for flashing,
& g/ m& M8 d7 S) r; T7 l5 R cause Windows seems to poll the drives all the time and this could result in a bad fw file or3 W( O0 o; C) i$ ^* i7 s5 {
a program hang, the drives are activated again at program end
" f0 ^# ~6 V+ X( X- you should make sure that the flash is not in an erased state at program end, cause device manager+ V" d6 B, p# Q, q1 l( Q( p1 h- e
don't like drives that do not respond to the inquiry command
" @; v$ K% J- M+ X) E! b- deactivating all CD-ROMs could take a few seconds, so please be patient at program start
9 a) o* R: Q8 X$ t5 Y- DosFlash and DosFlash32 will try to scan for the VIA 6421L Raid Controller card, based on vendor
1 }2 Y0 d# w9 `( w id 1106 and device id 3249, it doesn't matter if the card driver is installed or not! p5 `' o8 `6 ~$ R
8 ^1 [8 z+ r5 a8 Y$ g! X k4 A
. L- F& k8 X8 J9 AMany thanks to Dale Roberts and his Direct Port I/O driver giveio.sys!9 R- H9 M9 Q! ^ o" K3 `
" R+ Y! q/ g8 g' H" u+ k7 j/ z
Avoid a bad flash!0 p/ U* n5 F2 o
Kai Schtrom |
|
窺視卡
雷達卡
樓主
顯身卡
發表於 2011-8-21 21:08:07
