|
|
ak475671 發表於 2011-8-22 13:03 ![]()
$ h6 g5 k; c2 f版主你好# U' {/ b1 h0 I- F' {/ V6 V9 F) I
版主知道哪裡有教學嗎使用DOS提KYE的過程不是很了解不知道有沒有教學可以參考的呢
4 Z8 c) d3 `0 B& S4 o另外你說他提取 ...
. e4 L' h( O( ~$ G, z' wDosFlash ReadMe.txt 說明文件
2 l% E. P8 h _. G. H5 J! L+ d P4 W" d. {5 x! i' T9 K$ f
DosFlash V1.9 Release Date 01.01.2011
% `8 v, y( o9 b6 r( B---------------------------------------
8 n+ ~" l+ L, x2 F7 g0 W+ [; R- SATA and IDE port scan improved in DOS and Windows7 m) S C) v, A% j
The ports are now enumerated with the CONFIG_ADDRESS and CONFIG_DATA register instead of using interrupts8 a p, E+ f% \9 l. K
in DOS and SetupDixx functions in Windows. This change will detect more ports in Windows than the old 2 X. |6 r/ }2 g1 r! c. S
SetupDixx method.; j2 Z* @3 [$ |" n, Z4 O) f
- Settings saved to ini file for DosFlash32 and DosFlash645 i2 C9 p2 l( X2 T+ C1 d1 y
Settings like Port, Position, Task, COM Port, Enable Drives and DvdKey state are now saved to an ini file
' A/ _2 f- C2 i$ x; e inside the program folder. If the ini file is not present it is created after the first run. On the first
2 z* a4 d% C" N( G4 t startup DosFlash will choose the most common and stable settings.2 i! i! F: A# {0 {8 {7 `
- EnableDrives option included in dialog as a check box
. d2 ?: S' d& `0 k/ p Due to high demand we removed the "Enabling CD-/DVD-ROMs" MessageBox on program termination and included' e; v3 Z$ q8 O
a check box "Enable Drives" inside the dialog. For security and more stability this is deactivated on the
+ Y$ ]) v* ~' J" i first run. If you enable it the checked state is saved to the ini file.
' r4 m- F8 |( |( I8 f) ^0 g0 @7 Q- enabling drives in Windows caused some hangs from time to time, this is now fixed by a recoded enable
" [5 Z# Z# S2 j, E drives function# @* i0 V' i' k* {
- port drivers portio32.sys and portio64.sys are now added to the executable and unpacked during runtime
4 I7 s0 E5 l7 j! y9 X- PATA and SATA controllers list updated
$ l% E5 R& C% A$ a! \) w- Fix for NForce motherboards in combination with drives like the "Samsung SH-D163C", "LG DH18NS40" or3 c; E7 ]& M0 `5 u: ^
"LiteOn iHDS118"1 q! p" V: Q& \- |+ _$ }
Some drives have problems with flash identify, read, write and erase. This is clearly related to the
0 @' @5 G5 k7 _# W D; y) s NVidia NForce chipset. For manual mode in DosFlash16 an additional command line parameter is added called2 B5 J. C0 ~$ I5 G6 c4 ]9 {
"NFORCE FIX". This parameter should be set to 1 for NForce chipsets if you experience strange problems.7 u$ n& O+ U* p: \
In DosFlash32 and DosFlash64 we added a static control which shows if the NForce Fix is applied or not.
0 Z* c, v- G5 r$ J9 K$ i2 n2 n/ v s: U Remember there is no need to activate this with every drive. It seems to be a combination between drive/ d: ?4 V- A# B7 e* K H* H
and NForce chipset that causes the problem. The fix is automatically applied for DosFlash16 in auto mode,& X Y+ H# c4 t E* r8 H& `* L
DosFlash32 and DosFlash64.
+ I& O* b+ N0 k5 P# i" b& i- DosFlash32 and DosFlash64 are now DPI Aware for Windows7
% }; O% Y, v/ N2 F4 l- New task Verfiy Key/Inject Key added for verification/injection of drive keys
! O1 G" j8 \- D* N All DosFlash versions now have the possibility to validate drive keys against an XBOX360 drive and set
) ~7 |% g, ?2 l8 B& s0 U the key for an XBOX360 drive. We use the same authentication method like the console to verify a key.
, M" i- V3 K1 { In the Windows versions you have the choice to paste the drive key from the clipboard to our custom hex
) B- R3 P) c! n0 ?" a( U' J) _ edit control or load a key file. To add a key simply click right inside the hex edit control and select& Y& S3 v, v9 N8 @: P2 u9 V2 C$ V0 c9 p
your choice from the shortcut menu. In DosFlash16 you can enter the key in the format "1A-2B-3C" without2 E, \7 U- M' J" c: H
quotes. Remember that a key has 16 bytes of data. The key file to import should also have 16 bytes of data
1 g0 R3 i+ g. g like the key files exported by LiteOn Key functions.0 q2 }9 r. g5 g0 y v# u; M$ b! G
- Removed multiple key extractions for LiteOn Key functions, added Verify Key after extraction8 y6 j( e* _; Z
For LiteOn Key functions we removed the multiple extractions, because the key is now verified immediately
) U. R8 A' N! ?1 L7 `3 p( X a against the XBOX360 drive.) G6 i8 E2 R' R9 D F0 v) S" }+ g
- LiteOn Key V1 and V2 now also extract the file Serial.bin and the 2nd inquiry file Inquiry2.bin
. n7 L1 \" X, l' I; s8 V' K We added the file Serial.bin and Inquiry2.bin to LiteOn Key functions. Inquiry2.bin is only generated for
2 |) ]6 c$ _1 p d3 x LiteOn drives V1 and V2.
8 ^$ w6 v7 d- [$ F0 e( z8 P, v, y- The drive key of Maximus patched UART drives can be extracted by using the task "LiteOn Key V1 (DvdKey)"8 C1 R+ y7 V. W B3 R' b* ]
The drive check has been removed from LiteOn Key functions. This way we can extract a key from an UART
8 O+ @& M9 ]: A. Z1 S patched drive firmware by Maximus.3 e; ^) H) k/ [7 p
- LiteOn files are now extracted to a destination folder instead of prompting the user for every file name.5 H P4 d9 ]' A/ W8 g; N
- LiteOn key extraction tasks separated per drive version in "LiteOn Key V1 (DvdKey)", "LiteOn Key V2 (FreeKey)"
$ P. X, }3 x, A8 \# u' y3 d- w and "LiteOn Key V3 (Tarablinda)") @0 h3 i5 \. q; s2 u# c
- In DosFlash32 and DosFlash64 the number of installed COM ports in the system are now enumerated instead of
% R" G' ?4 u% n' j; J adding port 1 to 4
. _: }/ v2 l9 F- For failing cdb commands the sense code is returned
2 U8 C v6 V x3 D9 |# G* ?- Geremia's Tarablinda functionality added4 Q+ W. F& W: N5 C8 ]
We added all Tarablinda tasks to every DosFlash version. You can extract the key by choosing the task$ z8 D" W: x4 e: \3 F4 V" Q; {# [# W
"LiteOn Key V3 (Tarablinda)". For read, write and erase of the flash simply use the standard functions.
4 k$ \8 f Q. m Pay attention that the "LiteOn Erase V1/V2" task is only available for older LiteOns and not for the Slim.2 e+ C5 _1 N/ F, E7 ~" @
You should use "Read Flash", "Write Flash" and "Erase Flash" for the Slim. "LiteOn Key V3 (Tarablinda)": S0 q/ E2 A ^% x
extracts 1 additional file in comparison to Tarablinda v04b, this file is called Xtram.bin and contains
+ }# A; ?1 W" b/ x5 }& E( i+ b& {/ e a dump of the XTRAM8000 area. This can differ in a few bytes from one dump to the next.
E; Y% W7 r1 M+ O- Device Reset in DosFlash16 manual mode is now done automatically, there is no option to turn it off anymore. V# |$ e( a2 f; k: g! y
- Code optimization to work with modern SATA2 controllers added, remember to set SATA controllers to IDE and2 w8 ~: K6 y# e
not AHCI mode otherwise Port I/O will not work
; Y/ l) }5 k9 O1 H( e5 p6 @- Warning: The read, write and erase of the Slim drive is considered risky in general! So pay attention and. D4 b+ a6 X4 p( f/ @
always remember you use DosFlash on your own risk every time! Even during flash read the Slim gets flashed `1 B2 R+ C! Q" t3 C8 n' B
with a patched firmware sector to retrieve the complete dump!6 K6 @! j B+ p2 t1 j6 o8 v
- We had to change many command line arguments for DosFlash16 Manual Mode, because of the NForce Fix, added
; A2 V' v# w/ ?" ^* Q Tarablinda support and splitting of LiteOn Key functions. To get a better understanding we added the example
. v' n& f7 V7 s2 ?. J5 j- f: c section below.
# n6 }8 L$ s3 F- H# [* Q. U
# V; y/ [: L! e0 n3 A8 X8 J( g) _% k* | X1 {/ d5 `. V% ?$ W
DosFlash16 Manual Mode Examples4 ]' u# y. l7 n, s' }. L
---------------------------------1 q7 H% R- T& |. g/ u# v7 q
- Extract drive key on a " LDS DG-16D2S 74850C" over UART -> "LiteOn Key V1 (DvdKey)"
5 |; R, m7 k: u! t DOSFLASH LITEON K V1 0970 A0 1* Z1 C3 A2 l: W& u8 q- q7 j
3 h% s; T& q# x- Extract drive key on a "LDS DG-16D2S 83850C" over SATA -> "LiteOn Key V2 (FreeKey)"2 H4 r, p: V' k+ S5 W$ m4 j
DOSFLASH LITEON K V2 0970 A07 S& Q: B6 Z# m! F3 x3 A
+ `3 g8 _( L1 |6 x1 O( h- d- Extract drive key on a "LDS DG-16D4S 9504" over SATA -> "LiteOn Key V3 (Tarablinda)"
3 g9 `3 Y& X* D DOSFLASH LITEON K V3 0970 A0( X# j) F' `+ X2 m& g2 y
6 b/ N& s3 ? r$ T6 ~
- Read firmware on a "LDS DG-16D4S 9504" -> "Read Flash" this is considered risky!
9 x7 q* F" |3 J% ?: q: i DOSFLASH R 0970 1 A0 3 0 4 FWOUT.BIN 0% E! w- m' _3 n4 `/ \- o
2 c( c4 u$ [# W* i/ v q
- Write firmware on a "LDS DG-16D4S 9504" -> "Write Flash" this is considered risky!
- U- @ P+ k1 R$ n/ C DOSFLASH W 0970 1 A0 3 0 4 FWIN.BIN 0
* G1 K8 U! O* x+ k' Q- Z; q7 h) Y2 X% e( R( @* ^) d$ U6 s) n
- Erase firmware on a "LDS DG-16D4S 9504" -> "Erase Flash" this is considered risky!
* _6 ^2 g9 w( A DOSFLASH E 0970 1 A0 3 0 4 C7 0! G- s0 S6 S0 d# I2 T" T
5 b" R6 ?2 m5 U3 w( o( ~- Erase firmware on a "LDS DG-16D2S 74850C" or a "LDS DG-16D2S 83850C" -> "LiteOn Erase V1/V2"
, s% C# z) N3 r2 y, Y DOSFLASH LITEON E 0970 A0' m2 J$ N9 m. U$ F3 |5 L- x4 j+ o
& j) S B' Q u, H
- Read firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Read Flash". g5 t$ y4 w+ Z7 \" {8 e
DOSFLASH R 0970 1 A0 2 0 4 FWOUT.BIN 19 E, t% e2 B/ J
( |: D, m1 Z- F+ E- Q; H/ \4 V9 E- Write firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Write Flash"
L* q" g, f# c+ v! s( u8 f. a. d+ h DOSFLASH W 0970 1 A0 2 0 4 FWIN.BIN 1+ Q2 i% U& w4 }- Y
! o _- ?# L( ~0 I! R2 Z4 P) Z% y- Erase firmware on a "Samsung SH-D163C", "LG DH18NS40" or "LiteOn iHDS118" and a NForce motherboard -> "Erase Flash"% @0 A% Z! L4 k* g: f& T" L
DOSFLASH E 0970 1 A0 2 0 4 C7 1
5 C! V6 N$ }" j# I
: \$ ]/ R8 t1 i) ?' e- l8 o- P- Verify drive key on a XBOX360 drive, enter the drive key manual( q) W. H9 o' K+ K( d
DOSFLASH V 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF
% w7 D A- H, y0 M
9 _ b* U: E6 R) ]- Verify drive key on a XBOX360 drive, load a drive key file
- Z/ B, ~4 B# O8 x V9 l% h8 ~0 g DOSFLASH V 0970 A0 KEY.BIN" ^3 O" X% v! R& t0 [' ?
: c! N3 e" V+ q$ z6 ]- Inject drive key on a XBOX360 drive, enter the drive key manual
; r7 p. s0 n* {6 d/ K DOSFLASH I 0970 A0 12-34-56-78-90-AB-CD-EF-12-34-56-78-90-AB-CD-EF
6 t" b5 h) a0 i0 L
1 \. q. g S& Z- v- Inject drive key on a XBOX360 drive, load a drive key file
2 V" m7 @/ o" \$ z DOSFLASH I 0970 A0 KEY.BIN
& d! ^" `) V. m8 `) T; u8 l( b/ [4 j- G9 Y* z9 M
For DosFlash drives on which we can extract the key via UART are considered V1. Drives we get the key over$ z$ z Q9 B+ q) E: Z. e; c
SATA are considered V2. The new Slim is considered V3 but only firmware version 9504 is supported atm.. F7 b* F: J8 a0 c' X# F1 g. u3 A" s" H
% j' ^- ~, ^- W0 n% r; N9 v( c6 U) W1 i) k$ |: [6 y% f
Many thanks to Geremia, Modfreakz, Redline99 and Tiros for their support. Special thanks to Geremia and5 @ L, |# h$ R8 l
Modfreakz for drive sponsoring, testing, coding and much more. It is always a pleasure to work with you
9 Q; @5 ?* u1 B6 rprofessional guys! Respect to Maximus for his UART enable patch. I'm looking forward to your magic Lizard
$ @9 a# a- K5 G+ E5 e$ nhardware flasher!# U& J7 x( ^9 _0 H3 M2 P8 D
$ f2 g& M( b, l/ P2 K. {5 BHappy new year 2011!
& g. V4 I1 F, ]2 X$ b9 N" w- u5 LKai Schtrom
. y8 V0 s- G5 y6 o1 s: C
T e! V2 a* L4 y************************************************************************************************
) ~3 Y. G4 ?* g$ X
3 O* X' Z& t& u! S1 F7 f
! H+ i+ D' r' w2 ]DosFlash V1.8 Release Date 08.08.2009
3 s* L3 _% s* n9 T5 `& H/ E3 n0 v---------------------------------------* S+ ?8 {4 G+ c, \ _& X$ ?, j; l
- now supports LiteOn PLDS DG-16D2S 83850C V2 Geremia/Maximus LiteOn FreeKey method$ C. y5 P1 R l9 o& m7 Y
- huge firmware read/write speed increase, especially if run from a floppy disk
1 `1 |. e! e/ s* Q7 ?- updated IDE/SATA motherboard chipset list* [: w* }! ^$ b9 ~
- new IDE/SATA detection for Windows and DOS
8 L. l0 j7 M6 Z( i6 d. r5 ~$ c- DosFlash.typ embedded in executable file
( M/ x# [) n" a2 e" @: `# o- LiteOn V1 drive key is now extracted 10 times and compared against each other,0 Z9 C$ u! Q b" _2 j4 w
after the extraction a summary is displayed sorted by the most common matches
7 p2 k* S( K6 ^) _+ Z, J- LiteOn V2 drive key is extracted 2 times and compared% S, i4 h. b2 p; `+ _1 ?* w
- new BenQ unlock keys added to unlock all known BenQ drive firmwares: q1 f9 C3 E. R7 p3 w4 ~$ t
- command line parameter "EnableDrives" removed, DosFlash asks the user on$ Q( T1 b. \7 r) i, V
application close if he wants to enable the drives or not, during the tests it
/ m& U, R) {: a- h. ?' R( W" m( u seems that IDE drives have problems with the enable, SATA drives seem to 1 @ i, N: u7 B! R
work fine2 N. @5 k& f8 ?# j/ v: ^7 e3 @
- new 64-bit DosFlash edition added called DosFlash64, because some driver
9 [' j" U& f* H9 l0 a6 r) w functions don't work as expected in the 32 bit compatibility mode on Windows x649 r( |- h4 C% V3 ~! v
- Beta state removed: Q9 j. o: P; U( G; X( y) F9 M
- ready and tested on Windows7 X86 and x64
2 E+ F$ n+ G3 d) j) e4 ^" {' \# v( z) W& t; h: c
1 s( G) v' t/ y2 ~1 A
Geremia/Maximus FreeKey method with DosFlash16
! S7 `% F+ w% }7 }, Q: y------------------------------------------------9 u& C; S+ U$ S4 F
We have added one cmd line parameter for DosFlash16 in manual mode. The COM port
8 N! k' A, P, T( h8 \7 yis simply ignored and can have any value for the V2 drives.+ h* q) h; @5 d9 Z% S( T3 O0 O
Use the following command line to extract your free key from 83850C:% J4 ~$ k/ E7 `2 J. `$ |
- DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin enckey.bin
0 d2 e8 J3 j, C' o
) O* ]6 y" c$ a0 h$ `' n/ C" M) w; o- C! n3 D: h3 p' @5 b/ a* ^
Tips for running DosFlash on Windows 7
% e1 r0 o5 ^2 b/ x# |----------------------------------------
, Y2 W% X$ h* _3 v% F
1 p- v/ k" }! G jSince Windows Vista 64 Bit and upwards it is necessary that every driver is signed. Because
4 }, P0 ^& i* Tthe DosFlash driver will not be signed by MS due to some unknown reason we need to circumvent$ c6 p* y; l- Y8 Y1 J
this check. You have the following 2 possibilities to do this.) T; J& M' G; O. p, z+ G
" Q9 w" e, D! I3 y! S0 |) q \Safe Way of Disabling Driver Signature Enforcement! B0 u. I# Y: r- G' m4 h
1) On Windows 7 bootup press F8 to get to the extended boot options screen; n: ?; d7 G) K; e; l
2) Choose "Disable Driver Signature Enforcement"
# j3 J7 \5 Y7 U, O3) To start DosFlash right click on it in Windows Explorer and choose
% D2 r4 W9 w, Q: S. }+ c "Run as administrator" > answer the message box with "Yes"& i7 `2 k) I% ^, Q! E
4) Short after the program started a "rogram Compatibility Assistant" warning message& u) o3 c+ N: A+ a, N$ w& V% \
is displayed, you can simply ignore this by pressing the "Close" button' b; z5 T* [$ ]' ]) h
0 [ I Q, G1 Q( O' Q* yRecommended Way of Disabling Driver Signature Enforcement
" X2 s4 Y( y0 i( r7 H$ {" S0 s1) Disable User Account Control (UAC)* L' U7 N+ W7 w3 ^$ A5 v
- go to "Start Menu" > "Control Panel" > "User Accounts and Family Safety" > "User Accounts"
: P: c! H' p9 a) i$ t - click on "Change User Account Control settings"
' U1 H% L. h& X# |, M, Z8 u - set the slider bar to the lowest value (Never notify) > click "OK"
- N S4 @9 z: D. ^2) Sign the DosFlash driver" V' @+ W, z0 J+ h7 w+ ]) c
- download the "Driver Signature Enforcement Overrider" (DSEO) from
- `) _1 R6 B( ?9 ]# k http://www.ngohq.com/home.php?page=dseo
, i7 f8 g, T0 b9 J - start DSEO > click "Next" > "Yes" > choose "Sign a System File" > "Next" > enter the path to/ \3 u4 p. \& K2 v1 d3 M5 f
the used driver (portio32.sys or portio64.sys) > "OK" > "OK"
! ^, K% E# q9 J/ v( A( {3) Disable Driver Signature Enforcement. p y u! P( U
- start DSEO > click "Next" > "Yes" > choose "Enable Test Mode" > "Next" > "OK") r7 k+ P1 c) B7 I+ ~7 \# b4 G
4) Restart the computer$ u0 v( v9 v `$ b2 K1 u
3 A/ V( _4 ~7 I$ K" K" z+ b& n
Keep in mind that with the recommended way the changes will have effect on every reboot without
, R! @" l( |& C" [/ H. M7 z. gdoing anything manual. The first way needs to be done over and over again. In addition the second. p5 ?. X3 _. z1 e9 N
way can be used to sign every driver that doesn't run natively on Windows 7.
9 j" H1 V; X3 H! s* N2 j' W9 c+ Z0 W5 N
For use of the VIA Cards in Windows 7 it is recommended to uninstall the VIA driver. This can be6 [3 B! I& D8 u' e/ A
done like follows:
0 g, j0 s" F& O) f' z8 ?- start "Device Manager" > expand "Storage controllers" > right click on "VIA RAID Controller" > ( u. t; }+ ]2 p s
choose "Uninstall" > "OK"
9 k0 b& H+ i" K. x/ L; A3 K1 u( y0 H- rename C:\Windows\inf\vsmraid.inf to vsmraid.inf_
3 p2 u4 B8 A# _) [) K- rename C:\Windows\inf\vsmraid.PNF to vsmraid.PNF_* Q/ v. L( z" U$ f5 |
- rename C:\Windows\System32\drivers\vsmraid.sys to vsmraid.sys_: [" i* s. V* K j- G/ R
- reboot computer
: K, T: o4 `; ]2 @7 f$ q( C5 p# C/ C1 t6 M
+ M% J1 {' N, dMuch respect and credits go to Geremia and Maximus for their money saving FreeKey app9 t5 }4 i; { N. H/ N' n3 l
and their lightning like decryption speed!
( P y# T" _+ m% R6 ?+ \/ W0 D9 s) E" w9 K! g, L
In Dedication To The Birth Of FreeKey On August Fifth 2009. e3 l; v- S- V+ T" Z
Kai Schtrom
! p7 y$ q! o3 M: N. k8 o( |, ?; [8 V& l- Q
3 I6 }! g6 L* o2 Y" N, g************************************************************************************************
) x8 |8 f O! k
0 {+ U- }, e* N" Y) f. _" D
7 x5 |4 F; \% m# ^3 LDosFlash and DosFlash32 V1.7 Beta Release Date 23.12.2008
2 }9 p* A9 D3 s9 |-----------------------------------------------------------9 c7 x6 H. y6 e
- now supports LiteOn PLDS DG-16D2S 74850C and Geremia's LiteOn Erase and DvdKey method7 m( c1 ~$ Y. r6 S7 x; R' S6 ]
4 E9 n- I+ u7 x( b3 P' L( X
/ L' t) _% X- m1 j5 v( CThe following only applies to the new XBox360 LiteOn drive PLDS DG-16D2S 74850C.: ` }. c8 q- h8 w: E( L
* V; Y# g! y4 f2 Z7 [% v0 P" Q8 i1 d2 E, I- q
Geremia's DvdKey method with DosFlash16 with the PC's psu8 E+ g4 h, t9 ^0 ~. K. A) P* B
-----------------------------------------------------------
; T! u# P0 p7 E0 d7 Y! X7 a* P- disable CD-ROM boot option in BIOS
) l1 U1 l. y6 r, H% h4 |( B3 p- connect LiteOn to your PC's power supply unit and SATA port
$ Z' I$ Q! r& W! g- power up PC, wait until bootup is finished8 C: K/ m7 m7 V7 m5 s
- eject tray of the LiteOn and shutdown PC completely
; R% N# Z% a3 K( {* _- push the LiteOn tray half in$ |8 G1 `% l h
- power up PC and boot into DOS
' `$ s5 K9 B6 X& F1 ?5 P, a1 Q- run DosFlash16 in auto mode$ q' i! k/ q6 m! F' {# Y
- if you read the following:& B( F, M/ ?3 I7 n( B
MTK Vendor Intro failed on port 0x????.
9 J- {4 g) ]9 Q% w If you choose to resend the command you should turn the drive off and on1 n9 n7 y3 k f' U: C
after you pressed "Yes".
0 N9 X. q, N* X; g6 y4 _: B Do you want to resend the command until the drive responds (Y/N)?
9 W0 s0 \# G) j o7 H- press 'N' for "No"% X$ V" {3 `; o7 m$ Q
- choose the number of your LiteOn ATAPI drive" q {0 I: a& j! n; r* h
- enter "LITEON K" to read the drive key( O& f% t% F$ \6 P
- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files: {. j6 n0 l3 ~6 f3 T4 R
- enter the number of the COM port
2 |2 K2 z: {" `- Z- if you read the following:
/ C% r4 b, m3 ~# \# p To receive the drive key use Geremia's DvdKey method like follows:1 b1 w2 Y3 |& c5 Q; w8 N& }! |* i3 l4 F
- Connect your drive with a serial cable to the COM port
5 }' v9 u! k6 E7 X. C! p - Eject drive tray
, t% z. h- D% ~8 ^, I( u/ u6 N8 t0 Y - Power off drive: z1 g d2 k+ v% P% H) U/ g" {) y
- Push drive tray in until it is half open2 h8 o) h5 Q- N1 a' F
- Power on drive
: F z; ?* Y; {$ @6 e0 ] - Press "Yes" if you are ready9 E4 Z* I) \! w9 A! D! ^
Are you ready (Y/N)?
4 x- ~' _' Z2 L9 R- i" t- simply press 'Yes' without doing anything of the above, because we, g5 I# d& f, k" J+ {
already did that before
! G. k1 p8 h8 \- after this DosFlash16 displays your DVD-Key and saves your key and identify data
4 }! B5 \" X+ \- to do the above steps in manual mode use the following command line if your drive. p" |/ J0 n7 |, Q8 j) e/ P
is connected to port 0x0970 and serial cable is on COM port 1
' L; f ^0 e9 F3 n0 t5 j4 D DosFlash LITEON K 0970 1 inquiry.bin identify.bin key.bin dummy.bin
5 X( v9 {" C, \' w7 p1 f% W! f
7 _& [ s; y4 p6 \* @) t: R8 H7 Z. _+ D) V. _2 e H$ C3 z2 o% e
Geremia's DvdKey method with DosFlash16 and 2nd psu* z: O. O2 [! C1 c& e( D
-----------------------------------------------------
- V( F4 p: t, N$ B6 n% C- connect a separate power supply unit to the LiteOn, don't turn it on yet" _+ [! E0 J: s9 l" A1 v5 Q
- power up PC and boot into DOS/ Q2 p2 X! {* p% E8 U
- turn on the LiteOn psu
8 O' J+ D4 F. Y+ }% D4 B. b4 m- run DosFlash16 in auto mode
/ K( m2 L" `8 p' v; A- if you read the following:
" W3 u" U8 I! p MTK Vendor Intro failed on port 0x????.$ ?+ i# \, u% k9 Y" L# z
If you choose to resend the command you should turn the drive off and on
0 R j$ C. l3 F. K! R2 p+ I n after you pressed "Yes".7 B1 a8 g& ~, B$ f) W% a3 O
Do you want to resend the command until the drive responds (Y/N)?: [. @7 j0 `, z2 M2 [) x! I* v% g0 K
- press 'N' for "No"
' r0 f: M! v6 x% d$ G9 T- choose the number of your LiteOn ATAPI drive
8 l' h+ m6 ]8 s. q7 h- enter "LITEON K" to read the drive key: R* X+ h6 O4 w; v) m8 \7 ? H
- type the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files+ z( ^( C& X* n: E+ f
- enter the number of the COM port
( b6 w; h, M* Q: A5 H- if you read the following:! x7 ]2 z% C! E2 p, e& C
To receive the drive key use Geremia's DvdKey method like follows:
% y$ c4 _7 y' G; x - Connect your drive with a serial cable to the COM port
+ N) [) G' C, c; O5 Q- ` - Eject drive tray5 Z9 t; M. d9 o8 ]. c0 h
- Power off drive
. G' A& @5 B2 x; M7 a8 I - Push drive tray in until it is half open
& f/ }' j) i" }9 G5 A5 e2 ]1 \ - Power on drive
/ m `9 a; E, b: N7 |& z& I - Press "Yes" if you are ready6 f' x* `8 n. `" q
Are you ready (Y/N)?
$ B& h! i# E0 H- do the above and press 'Yes'
m& |! _7 [) R* ~1 v+ J+ q5 K- after this DosFlash16 displays your DVD-Key and saves your key and identify data
+ h6 I$ ]5 ~, A/ c
$ h1 @0 V6 q: e4 c8 w+ x* e7 s
0 p# T2 D2 E& P3 J& gGeremia's LiteOn Erase method with DosFlash16 and 2nd psu
# `, h7 e; p' ^. V0 V2 ~) A5 R, n4 _; E-----------------------------------------------------------% F: \# r0 `+ H( j
- connect a separate power supply unit to the LiteOn, don't turn it on yet
4 I3 \3 [9 Z1 {- m, H( ^+ t+ A9 S- power up PC and boot into DOS
% u% G- |1 g1 ?$ P- turn on the LiteOn psu
0 B4 e4 _ A X3 T- x- run DosFlash16 in auto mode
) U6 v! j4 q8 _4 B- if you read the following:+ [: F: i" W, c g i2 N2 a
MTK Vendor Intro failed on port 0x????.2 X. B! T% D. I; b8 o9 {& m; p' E5 }
If you choose to resend the command you should turn the drive off and on
) H0 O6 s5 X w7 j1 A after you pressed "Yes".2 \3 L. f2 }6 ]. S; U* b
Do you want to resend the command until the drive responds (Y/N)?/ {. x S" u( Z
- press 'N' for "No"
# k4 o- u8 b3 L8 H/ J3 F- choose the number of your LiteOn ATAPI drive
3 U% V2 l& _% f) _- Warning!!! Keep in mind that you will need the drive key before you erase the flash,3 r7 u: I1 W3 `/ a
without the drive key your XBox360 will not work anymore. N, }0 Y" k" P6 a
- enter "LITEON E" to erase the flash
0 w* s) J2 V3 f" G3 [* t2 ?- the first time after the LiteOn Erase the drive needs to be repowered to give
$ j( X( ~, W; c2 Z3 { flash chip access, this can be achieved by repowering the drive before another& a( p+ p7 t. R4 m) h8 x4 L+ N
DosFlash16 start in auto mode or by doing a MTK Vendor Intro Power Brute3 B( w8 @6 B/ m/ \& {: T8 n2 _5 p
- in my tests it did not work to power the drive with the PC's psu, because it will' X: q. m" ~. r- p d! i/ g2 C7 j
always respond with busy status" s4 A, O# W9 [' {% `1 `3 L& a
- DosFlash16 can now read, write and erase the flash chip like usual
# Z/ z' k* B" b5 q. p- to do the above steps in manual mode use the following command line if your drive
+ C( P+ [) _3 p( U0 t1 ?, g5 h0 J1 B is connected to port 0x0970
7 b3 R( _( M' U* } DosFlash LITEON E 0970
; W" j9 f2 I, L; P7 G# y; k$ a9 ~
$ z) V6 ^: r1 H& L
6 x z$ P2 E: [# W0 M' y; Q1 JGeremia's DvdKey method with DosFlash32 with the PC's psu9 D8 o3 A0 u' r6 ^. I4 H
-----------------------------------------------------------9 |% k, Z/ o/ _7 C6 \3 L
- disable CD-ROM boot option in BIOS; @/ U% [, c) l. i
- connect LiteOn to your PC's power supply unit and SATA port! ]/ V7 A, K! k4 P; ^2 F2 R( [
- power up PC, wait until bootup is finished& k, c: z& @. u( R( U1 Z
- eject tray of the LiteOn and shutdown PC completely' d2 T3 ~9 A9 `! i
- push the LiteOn tray half in
. J8 z& m! D0 ^- power up PC and boot into Windows6 Q' I6 j# V+ w b3 L* e! y
- run DosFlash32, @% f4 b. T* o0 l4 r7 O
- if you read the following:
5 S8 n6 Q" u3 w MTK Vendor Intro failed on port 0x????.+ |2 v! S5 Y% G8 l/ y# q* |
If you choose to resend the command you should turn the drive off and on
$ A. q1 R0 N7 `% g/ v after you pressed "Yes".
6 E1 I- d% s2 L" Q Do you want to resend the command until the drive responds?6 n, S# v- h) G
- press 'No'% n2 w( J7 C( Z, S0 w
- choose "LiteOn DvdKey" as flashing task
! [1 \1 @: O" l. v$ Q- choose the COM port number) l; s4 A) N3 V2 _0 Y
- press on "LiteOn DvdKey" button
/ r4 d/ d& Z1 B* j, y+ t9 j- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files( Z% R( F1 M k' V- P8 X! `
- if you read the following:- x( ^/ w3 H# w: h$ x" o! T
To receive the drive key use Geremia's DvdKey method like follows:# M# L+ \0 m! X t3 M" v7 [: \
- Connect your drive with a serial cable to the COM port
6 ~+ K' j% M+ Y$ Q: D - Eject drive tray2 t9 V9 y L/ E% l* _. D
- Power off drive
: a( S0 N) b% d. ^8 m d - Push drive tray in until it is half open# C+ v$ C0 ?& {, s; |/ l6 ~4 L. b
- Power on drive( X" |! Q' G1 j$ _5 K% [& r- x
- Press "Yes" if you are ready4 h+ {+ m& ~5 _( H, ?
Are you ready?
4 k7 \# J8 H( P: e; r- simply press 'Yes' without doing anything of the above, because we" r6 U: C6 K8 p$ }
already did that before
: u5 ~) G- @: q g0 `, @- after this DosFlash32 displays your DVD-Key and saves your key and identify data& j5 G+ U' A' Y( ^+ K
) E8 A4 u0 d1 u2 x0 Y Z8 z) V
8 d5 `, ` P3 Y+ SGeremia's DvdKey method with DosFlash32 and 2nd psu
9 i( h4 P( p; y-----------------------------------------------------
: w8 u4 h- g$ u- connect a separate power supply unit to the LiteOn, don't turn it on yet
2 h; Z( Y. f% X9 ^) t) @) J! I- power up PC and boot into Windows
' }" f$ a4 E9 ^7 B. S7 [" g/ c- turn on the LiteOn psu5 M! G) {* O' z% G: E
- run DosFlash32
: J- z3 f* v0 k. l2 V3 ^- if you read the following:! g( s {2 u# A1 e6 a9 b7 i" V
MTK Vendor Intro failed on port 0x????.
( l g2 R, O/ o% B- g6 K; l If you choose to resend the command you should turn the drive off and on
- n1 A, }: b8 | after you pressed "Yes".+ O0 G) @8 b% s
Do you want to resend the command until the drive responds?
' b% ?2 |8 C/ K* g( b6 l0 w6 i3 d6 J- press 'No') N0 i7 {' H" t0 `
- choose "LiteOn DvdKey" as flashing task
- G" e \8 Y& d! @- choose the COM port number
, Y0 C8 ], ~) N$ `9 w8 E: ~% ^- press on "LiteOn DvdKey" button
M4 B* U: t' i9 e5 b% w- enter the names of inquiry.bin, identify.bin, key.bin and dummy.bin output files
8 ?4 G' x! P4 S! T- if you read the following:: c/ F0 L) K2 a: x, k* b, o
To receive the drive key use Geremia's DvdKey method like follows:
" ?5 [' N, Z2 ]" ^7 A9 V& ~) ~& H - Connect your drive with a serial cable to the COM port
6 f. i. O" Q5 W$ K - Eject drive tray
+ Z0 y* r( l# A. ` k' n' U - Power off drive0 N; |+ @8 o( H, B, |# O5 p
- Push drive tray in until it is half open, k% r7 i# T! O9 m; a+ l
- Power on drive
5 f( A% k. n1 e0 }% o - Press "Yes" if you are ready" H3 {( J' h; Q J, M$ }5 t
Are you ready?
7 R0 ~- Y$ Z# c7 G4 O! J7 x- do the above and press 'Yes'
. @; b' N; x: b6 I# v" I2 p- after this DosFlash32 displays your DVD-Key and saves your key and identify data
, P4 m. K- {8 C* u2 S: g
8 j6 C9 J) r8 e0 h# `/ y w/ L1 m& @9 u. x# y. a
Geremia's LiteOn Erase method with DosFlash32 and 2nd psu3 w; g, Y& l6 B1 l
-----------------------------------------------------------
: k: y3 g, l P3 k$ X% d% G- connect a separate power supply unit to the LiteOn, don't turn it on yet* I9 W6 G/ v/ [; J
- power up PC and boot into Windows6 j/ K8 i, @0 `; Y9 D# j, `! F
- turn on the LiteOn psu+ ~& W4 U2 y, X5 s( e& h: T8 p
- run DosFlash32
5 ?6 q8 _* e' b5 S8 N# D- A- if you read the following:
?2 e6 h; N' o MTK Vendor Intro failed on port 0x????.
" q& ~9 W' P7 O, m If you choose to resend the command you should turn the drive off and on
$ ^% c# [+ [( j8 ?% \# l after you pressed "Yes"./ r) Q$ [% G: w6 T2 z* ?* k
Do you want to resend the command until the drive responds?# s, S2 T* f# I# Y" _; J
- press 'No'2 _3 f7 Z4 A$ r2 m# p8 W
- the LiteOn flash is not identified9 ^" M& [7 P- c& _' b' V
- choose "LiteOn Erase" as flashing task
" x& v G2 o1 x6 G: n- Warning!!! Keep in mind that you will need the drive key before you erase the flash,! F8 `/ _& q) ^+ t) h- q6 d: V6 Y
without the drive key your XBox360 will not work anymore& T& _' ^, o/ |7 @) l
- press on "LiteOn Erase" button
, A# k" a# v2 I3 K- the first time after the LiteOn Erase the drive needs to be repowered to give
, \, v4 s( |/ |3 E flash chip access, this can be achieved by repowering the drive before another/ F. k9 q7 h, o: U$ z" R4 G
DosFlash32 start or by doing a MTK Vendor Intro Power Brute
% Y. y: s& T& i6 E1 w- in my tests it did not work to power the drive with the PC's psu, because it will
6 B% X! O4 q3 U9 X0 A. v always respond with busy status" E4 a* d* D9 K! Z+ {- @( M4 @8 X- H
- DosFlash32 can now read, write and erase the flash chip like usual0 `- _/ K% Q* j- ?& m* |
. G4 T7 ^$ r$ s( D
4 W% |% {* x1 ?9 LRespect to Geremia, Modfreakz, Podger, Redline99 and Tiros.
/ |6 [7 J% n+ W8 y) k( [8 Y. W9 p- h
Like a wise man said: "0x2E is the MTK Intro of Death"! J3 M: N3 ~' n' T' X
Kai Schtrom
" P( _% U+ c9 Q& K w
* ^' Q: t& [0 ~3 `& }: z
& s8 r2 \1 [ w************************************************************************************************
( x5 b4 F3 F, R' y. ~+ Z/ z8 F0 f& N) u8 S# s/ ~
7 C3 w; F3 ?0 a! k0 {, x1 v1 K |
DosFlash and DosFlash32 V1.6 Beta
9 O9 F: V# R' A% T( ~+ ~4 P$ C----------------------------------- M( c- Y! h' Q- d; F2 F
- fixed power brute unlock bug for VIA cards, this can stop your VIA from working; |5 h3 s5 w, B8 U2 c8 _
with the power brute unlocking in Version 1.5
& I5 f- M% `8 b# A8 b* }+ D- V8 o- for DosFlash16 in auto mode on DOS my VIA card works best if I do a cold boot9 j$ ?% ~6 |4 y: z5 T
and power up the drive short before or with the PC$ ^3 y+ G* j! J' E! i# c- S/ Q
- for DosFlash32 on Windows my VIA card works best if I power up the drive short
4 k% \$ {9 \# f5 P before starting DosFlash32: N9 G% ?% C% a+ o b: Z
- for me the VIA works with internal and external connectors on DOS and Windows- n. s& L, O6 y$ a8 n1 X8 x8 ^
8 E P/ @# ~4 {# [7 \9 HSorry for the trouble!
p+ A3 y4 T* U) S3 J+ ]Kai Schtrom- e7 m* G0 H6 q1 P7 ]5 a
' C# Q" y5 [, [( M) c
* k# T2 p- X, u% P7 q************************************************************************************************
# n7 a9 G0 y2 l: t: }) I: I, ]
) \1 }% P. ~/ v8 w, b& x, t6 _6 E$ n- t/ M: C% ~. N* E/ q
DosFlash and DosFlash32 V1.5 Beta
% W) u. x! T* }! L-----------------------------------
$ `& I, M+ t; y, x* {9 p5 z- K- now supports serial flash chip MT1309E with mediatek status 0x72 like the SH-D163B, SH-D162D,8 j9 A( D% g2 ^2 y* y0 ^- y
Asus DVD-E616A3, Asus DVD-E818A3, Sony Optiarc DDU1671S
& W' Z" G/ n- B' h5 _1 x, q( w- SST25LF020A and SST25LF040A chip support added
& e# o4 L$ L$ r2 X8 Q- DosFlash32.exe ported from MFC to plain Windows API, exe size is now 22 KB
1 x( q1 y* ^3 | f- new port i/o driver, because giveio.sys can't be compiled for 64 Bit Windows8 k# a2 h2 q; i7 h7 G
- DosFlash16 changed slighly in manual mode, one parameter is added to support SST25LF020A and
2 R" G* i( t- r) k9 z SST25LF040A1 W& }" @3 q3 t# ?
- two new methods of BenQ soft unlock are now possible on all motherboards with only one power
& w- s' @9 @# ]1 n( z supply unit
2 R6 P+ v7 f- N9 _1 M- 1st method is powered by Geremia's unlock core, thanks for the complete idea, concept and
! t; Z! H% @* U& a5 X source to Geremia
4 |3 j& R4 [ X& m4 |- 2nd method is the Magic28 key send, this only works on BenQ VAD6038 firmware, thanks to
7 A' ?4 t/ _6 ~$ H c4eva and podger for the initial idea
4 p! E1 d% T5 N* d) v! }2 {- the two unlock methods are send one after the other if the drive is a possible unlock
; Y6 U+ g& M+ C1 x& F5 R candidate, first the Magic28 command, then Geremia's unlock commands and after that the
8 _5 X" G( e3 O4 F already known power brute unlock is send to the drive, you can cancel any of these methods5 _: s+ i5 J% g6 x3 X% l0 {
before they are send to the target, this only applies to BenQ drives with a locked flash
9 ?/ @+ |, x& N7 | T: P- DosFlash.typ updated
( b/ \ }8 _, s3 K/ ^7 l- other minor improvements
' T* b0 L$ F$ C" C% {; R* n- DosFlash32 is now ready for- u+ `- |( ~7 i( o& ^$ u3 Y
- Windows 2000
3 ~8 X; z/ i: b+ g1 d - Windows XP 32 Bit
1 @5 j9 e6 s2 s+ Y - Windows XP 64 Bit
) ^4 ?4 H5 u( k4 j6 x; e - Windows Server 2003 32 Bit, |. B. U: \! E0 z
- Windows Server 2003 64 Bit
$ v, ^% s1 x) E% } - Windows Vista 32 Bit
. N! y S" x0 ^( q. ^& P; P1 r - Windows Vista 64 Bit$ y6 D8 G1 r: ^% D
- Warning: Drivers for Windows Vista 64 Bit need to be signed, because we can't afford the- w. i1 o( X/ R: R8 w0 z7 v& \
money to let portio64.sys sign you need to do the following:
+ @# W/ b0 h% z( W% w& S) C 1) Log on as Administrator8 E( j0 X4 g4 t; Q
2) Enter the following command in a Dos-Box:
6 j* D8 Z, S2 u( z" | "bcdedit -set loadoptions DDISABLE_INTEGRITY_CHECKS"9 z' X* m+ D& H1 z
(we made sure there are no typos in the line above)  2 a% S [5 o% S0 K
3) Press enter and reboot your PC
! j9 W' _0 M% ]3 K; Z 4) Press F8 key upon initial system boot up
- W2 ^; n! }' H( h+ T6 \) ` 5) Choose to disable forced driver signing enforcement for that boot session7 \0 d7 m }& o3 L
% ^/ X/ `6 _6 }9 Q0 R1 s5 J7 J) O4 _6 t9 F, e1 `
The following only applies to drives with a locked BenQ flash.
7 f2 J$ r- {1 m1 [+ {* A/ ~2 V9 z; ?/ z1 ]
8 W. T: |1 |* \( S; V* O" w( r
Geremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with the PC's psu
7 ?7 n3 n# g; k4 X5 z0 Y-----------------------------------------------------------------------------------------
/ a$ n' L, x7 i; z* ]" g- disable CD-ROM boot option in BIOS* {: T2 ^# }8 C/ v4 `
- connect BenQ to your PC's power supply unit and SATA port+ o/ R- W, E8 F4 u J; v5 H
- power up PC, wait until bootup is finished
; n; ~' A; e; f+ I- eject tray of the BenQ and shutdown PC completely0 k6 x; m G/ b: u" a, Y" U
- push the BenQ tray half in% S5 |9 O! a( y* F
- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash32. H" N, c, L% N8 j/ r
- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows( ~. S! l" Y+ j. [& y
- if you read the following:2 k# n9 X1 C4 |1 j# r
MTK Vendor Intro failed on port 0x????. Because there seems# {; z# m, r5 _# y/ `1 m
to be a BenQ drive connected you should try Geremia's; i$ K C3 T! W
unlock method.
1 c/ \0 @4 j% F, Q7 z+ Y$ k - Eject drive tray2 X" }, d9 O; ]7 b# x# y
- Power off drive: D5 ~8 _0 a9 p
- Push drive tray in until it is half open
; [$ m7 d L3 S6 t+ l - Power on drive/ A7 o5 a6 |. o9 v/ R8 _
- Press "Yes" if you are ready0 t) C2 s* l# y" |
Are you ready (Y/N)?+ H9 o, A8 Q Q' F
- simply press 'Yes' without doing anything of the above, because we7 Z7 V, R6 H+ |7 ?3 V& u" r/ s
already did that before starting DosFlash16 / DosFlash32
$ a/ X9 n$ |+ q- the BenQ flash should now be identified
* {% @% Q* T) c- go on like usual
& M6 p9 c0 _+ ~, F
7 Z$ ~8 N. R& W" W
6 i) K# q$ a: V& A: bGeremia's BenQ unlock with DosFlash16 / DosFlash32 on any motherboard with 2nd psu7 \7 L9 I# r7 X9 @, B( K
------------------------------------------------------------------------------------, T; O! u' P) O. j
- connect a separate power supply unit to the BenQ, don't turn it on yet+ \& \' J! p0 n6 A) A+ X' ?1 _ \+ {
- power up PC and boot into DOS
4 K- b) ]3 W. d ~1 q1 ^0 t _" x% v- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows
^: r; w) }1 P- if you read the following:$ Z0 _5 H2 \! M. v1 i! x
MTK Vendor Intro failed on port 0x????. Because there seems O- _3 l3 g6 Y! z$ U+ s) @( k
to be a BenQ drive connected you should try Geremia's2 [, d! L5 T( R
unlock method.( }- T! G; |& \$ n; r* j* @
- Eject drive tray! o" k8 t _6 z& Q
- Power off drive
& d; c, ^2 {2 W. s) c* ?& F% P - Push drive tray in until it is half open7 l/ A: y" \# V/ t3 a# r& ^
- Power on drive
; @4 ~1 G+ p8 f) l, [6 \; F p( ] - Press "Yes" if you are ready
4 ]' l4 _, H* S' P Are you ready (Y/N)?8 ~: @; T4 n% G2 \" |6 Z
- do the above and press 'Yes'0 f: c9 D" `+ Q2 _3 |, g4 |
- the BenQ flash should now be identified( e% o, w+ }8 X9 T7 }' Z* [
- go on like usual5 _; h, i2 C& w9 y
" {& Z. x; x% D* Q* w9 a- L: a
7 X1 ]/ S! {0 z- kMagic28 BenQ unlock with DosFlash16 / DosFlash32 on any motherboard
) B. V% x- }9 o+ k" F6 r) {---------------------------------------------------------------------
' [( `# w- E, \: w: X0 c- connect BenQ to your PC's power supply unit and SATA port) A- i$ C& U+ U( |/ Y3 k
- power up PC and boot into DOS for DosFlash16 or Windows for DosFlash325 k# }* A$ n9 Q0 H* T; j4 u
- run DosFlash16 in auto mode for DOS or DosFlash32 for Windows/ G7 Q- w X+ S. z: _5 i
- if you read the following:" E- a/ }. }& p3 o
MTK Vendor Intro failed on port 0x????. Because there seems
2 m/ M0 B: y8 N, ~; C% ~6 Z( s+ i to be a BenQ VAD6038 drive connected you should try the
0 S3 F) {- s3 Q6 n3 R( ~% t. [ Magic28 unlock method.* o9 B, x/ o# e8 X- z
Do you want to send the Magic28 command?& R" }& ^# w0 }
- press 'Yes'4 ~! }+ {* Y& {) L' W! a# ~0 @. a
- the BenQ flash should now be identified
1 f( D) f9 P; d1 x- go on like usual8 K8 G* G. U4 } p
8 T7 y9 d$ T- u) j
9 j4 U( H- ~3 v1 t1 D; [Thanks to Redline99 and Tiros for help and support./ i/ e0 l) l, h7 \+ V( w! U, i0 f0 o
9 N) c8 c. p# V; `9 Z) w2 S% c
It's all about DOS!
; [. @, A0 i( S8 B" y# L- [Thanks guys for the excellent team work!) Y4 z$ ~% R4 H3 j, @
Geremia, Modfreakz and Kai Schtrom
: ~ Y( K4 n6 ]- B3 l& H1 b' x8 Z% z
$ h& |6 u6 I8 q- ^( G, m; @************************************************************************************************
2 t; t& x; T" p7 M) n6 {. ?5 M2 I' J5 \7 ]1 m& C& x
4 G5 H. j: X M& b- y
DosFlash and DosFlash32 V1.4 Beta
$ @: [9 R* e3 M( W-----------------------------------# e; D/ [+ q; \
- DROM6316 flashing support
% c8 a! j. y6 `5 r$ k4 t- a flash erase is now always done with a chip erase and not a sector erase command, because
. s( r7 Z! ~* l the sector erase gives problems for some Winbond flash chips including the DROM6316' r. _* Q6 C( P
- DosFlash.typ corrected and updated: q' x3 ^- Y2 L9 j7 y& w9 x) a
- for a detailed explanation on the soft unlock look at the included file SoftUnlockByIriez.txt,
. U1 c! m ?6 p0 g it contains a very good explanation by Iriez from XBS, thanks for that one!
; k9 v3 e! K8 \! |
+ ?( D; ~: _2 [0 F0 D% DThanks to Iriez, Jumba, Redline99 and Tiros for help and support.0 ]# y z# R! z, [
- n! J, f" o) n. T% J
Happy DROM bricking!& B v7 t! ?7 a5 @- ~$ O9 o1 e
Team Modfreakz and Kai Schtrom
0 x4 J+ ^; t5 U$ C
* I: u* y4 k3 s5 _- @1 v- I I1 u7 A- b
************************************************************************************************ P+ j4 h/ F, G9 g& w8 q4 N
, g% S+ Y& Q+ u4 d/ z( T" I4 S# z8 W# S; ~8 g% ~
DosFlash and DosFlash32 V1.3 Beta. N h0 I# H% p" k8 s
-----------------------------------
8 g7 P- e& S9 A, o' ?8 A3 i0 A4 P- BenQ optimization in unlocking the flash chip, it should now be possible to read/write/erase
& l/ W9 O1 D! _# d1 V7 r1 d! [1 Z the flash without any soldering or wire tricks, the drive is polled for the correct mtk4 ]; U9 Q; b1 `1 @; R; X4 L
unlocking status after power on, this only works for VIA cards and NForce boards atm
$ q% q+ ~8 U$ {& j; d* p& d) L- DosFlash32 has one additional parameter, if you start it with the parameter "EnableDrives", ?; t" r3 w5 C P, `! m
all the DVD-ROMs are enabled in device manager after flashing, this could give BSOD on some& F J# u" Z. D; c ?, x
systems, therefor you need to create a DosFlash32 link and add that parameter manual to use it
6 P, t5 w; V9 S3 n+ l6 a- K- DosFlash16 has one additional parameter "Send ATAPI Device Reset" in manual mode, this could! p' @: }8 G* R1 \ U# ?
give better chances for soft flashing on some VIA - motherboard combinations% s( |, `$ Z7 c0 \
- better support of Intel chipsets, drives can now be flashed if the controller is not set to/ B( b4 L4 v9 `. L% b6 O
native mode in the BIOS4 s, @1 Y* b# Z' c
- the following controller list includes vendor and device IDs that are hardcoded to identify/ A+ W% r4 D, N/ \! @ v0 X c6 Y: \
the controller type (IDE or SATA), this is needed if the BIOS uses IDE ports like 0x01F0 or; K) G' p9 A( M! B- J+ d9 p8 P
0x0170 as SATA and not as IDE channels, this list is NOT related to soft flashing% `6 H# _4 O% P2 n {2 N& ^6 J
- the following chipset support is added9 m( U' B$ V! w6 q9 V* ^- p
- VIA cards5 q4 c) |3 ]9 a* s0 f+ j3 h# r
- all VIA cards with a 6420 chipset
4 l( X- K9 b* f) K1 \, h - IDE Controllers
3 m# E1 \1 M& [6 V - NVIDIA nForce 2 IDE Controller5 D& ~- u3 V: R9 ~
- NVIDIA nForce 4 IDE Controller) ?' h" ?. `1 J* g
- Intel ICH9/ \& S4 Q: d5 S7 w1 M5 X! X! y
- Intel ICH (i810,i815,i840)7 U3 R" L; `: F* Z4 w
- Intel ICH0
0 j7 [6 }; t6 e. o' H+ u - Intel ICH2M8 j% s$ {& B; J9 v5 _2 M
- Intel ICH2 (i810E2,i845,850,860), ?( s1 v! e/ } r. x
- Intel C-ICH (i810E2)9 @% K2 m- E# c0 J! d% d
- Intel ICH3M" m3 l6 y9 x9 `& s3 C# r/ S {
- Intel ICH3 (E7500/1)
! E7 U, n# Y. B - Intel ICH4 (i845GV,i845E,i852,i855)
. m9 N- K% b0 h- I( N2 r- a; S - Intel ICH5* z3 v5 G9 r5 P: M
- Intel ESB (855GME/875P + 6300ESB)% T- z8 T; s9 i5 q; L+ h
- Intel ICH6 (and 6) (i915)2 A$ ]+ n) C/ Q7 Q$ v; `
- Intel ICH7/7-R (i945, i975)% X! i- U6 `7 f
- Intel PIIX3 for the 430HX etc: g1 y6 F5 y5 Z6 r1 L# D7 ?
- Intel PIIX43 p) m% I9 d2 a3 z: G& b% M
- Intel PIIX4 for the 430TX/440BX/MX chipset: E* i( i1 h0 m& I/ e
- Intel PIIX
" E+ x: d' {8 X& |6 S ~ - SATA Controllers
' h* _: G# u4 d3 h. a8 d - NVIDIA nForce 4 SATA Controller
& l9 r/ R" d& k5 e - NVIDIA nForce 2 SATA Controller- }2 U9 @& w3 h! n8 H
- NVIDIA nForce 3 SATA Controller% M' q3 I" Q- M# K% U9 _5 w: [
- NVIDIA nForce MCP04 SATA Controller% e7 T$ \/ s2 u m* L4 F7 S
- NVIDIA nForce MCP51 SATA Controller
! [/ k) @& }* j; e; w2 q( e9 Y - NVIDIA nForce MCP55 SATA Controller
2 |2 V% l: ?2 h R' | - NVIDIA nForce MCP61 SATA Controller, ^; J" B% q7 M; Q7 h, A4 [% o
- Intel 82801EB (ICH5)
! K# P- ]" y0 V) Z4 Q' O" w - Intel 6300ESB (ICH5)( I1 }4 R# F- u( R+ G8 b0 u; U
- Intel 82801FB/FW (ICH6/ICH6W)
/ b/ G1 a7 H9 {5 D - Intel 82801FR/FRW (ICH6R/ICH6RW)
) W, z& y$ E8 l4 ~" s - Intel 82801FBM ICH6M R, C0 G r" ~6 I# S8 `4 D
- Intel Enterprise Southbridge 2 (631xESB/632xESB)
7 L! p; L; n5 b% X8 z4 z - Intel 82801GB/GR/GH (ICH7, identical to ICH6)+ v ]) F W, ]. o/ b
- Intel 2801GBM/GHM (ICH7M, identical to ICH6M)
2 _- a% W. s: r0 G% R - Intel SATA Controller IDE (ICH8)
2 P/ {8 _4 p+ L: {% M. A5 G - Intel Mobile SATA Controller IDE (ICH8M)8 e! f& p/ [+ Q! K
- Intel SATA Controller IDE (ICH9)
* M' h4 c) g3 o( a; u7 R - Intel SATA Controller IDE (ICH9M)
! S& V: Z) c1 {% \; y: ?
) ^. W; l$ _. _' X2 U0 h
: I/ r# ]1 o. ^* W! `/ I2 xThe following only applies to a software flash on a locked flash. The methods have been tested
3 p+ _) |( J m; [: Nwith the BenQ and the Sammy. The VCC trick will work on any motherboard, but you need to do
: b0 H" z5 h: ~9 N) C; ^, Zsome soldering and cut traces.) d2 Q4 ~) Z& t$ E
9 P0 c: z5 t+ v$ H) ?2 a _
# k$ R' R7 }9 d, J. NSoft Flashing the BenQ in DOS with a VIA card and DosFlash16 in manual mode
4 s( ?8 h$ Y+ |2 o) |6 ^$ g-----------------------------------------------------------------------------4 x' m% F$ V8 |. f5 [2 G
- first you need to know the port addresses of your VIA card, you can get these by starting9 F# @! L% y+ K7 a- j3 J* y
msinfo32 on Windows XP and looking at the port listing for SCSI devices
. S: ]; M$ H& g1 i5 C8 c- for the 6421 the 1st port is internal SATA, 2nd is external SATA and 3rd is internal IDE
. N* `- D( k6 ?; Y; g1 Q; D3 P- for the 6420 the 1st and 3rd port are internal SATA
& ], f: x' F7 o" W- you need the starting address e.g. 0xD000 or 0x7000
- b7 S/ l. F3 c' u6 j- be warned that these addresses can change from computer to computer, they are assigned
+ H& w7 ]( r7 [6 p8 o at bootup, but Windows XP should display the ones you need for flashing in DOS
6 `* r- i" J3 g5 ?. i- y- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or
, G9 L$ l9 c- M1 \ Xecuter Connectivity Kit)
) Z3 G' [9 ~$ x- V" V% I4 U- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we$ d# q" K$ q" ~' }
need to power the drive off and on during soft flashing
8 i: J8 G% m# ~- A a- cold reboot or reset the computer
8 N. S$ w: @: F: K7 o- boot from a DOS disk, I used a Windows XP MS-DOS startup disk
$ R( g0 u! f8 m- at the prompt type:
, w9 u' ^" j* N! P8 f DosFlash r 7000 1 a0 1 4 a:\orig.bin 0
, y# G: x4 n; G+ R4 r* m: `* ~ A& o3 }! m - instead of port 7000 use the starting address your VIA card uses# f7 l( `/ r* U/ s3 t, O
- press return
" W; M# n& R( O7 ^! r" Y- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
) h" a4 k$ x! d9 }- after you pressed Yes the drive status is shown on the screen, it's something like 0x7F,! A* l7 C3 w S- O: |' A" y1 y0 H
this will change during the next few steps2 G. S1 p* g3 j% F! s( z0 y- r
- turn on the BenQ psu and wait 2 or more seconds, status changes between 0x51 and 0xD1) q9 @. l6 s$ Q# U5 b) R7 ~. N4 }
- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD1
& \& V# X+ M- |! A* J% R- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start
# k! { c/ j( u* ^$ V3 o- this worked only one time after the computer is powered on or resetted for me! h, W, i8 V$ u- H' ^# X# n$ ?7 \8 h
- writing and erasing works the same way
& t- R! |3 F/ \ Y# u- m$ P% |- for writing type:
4 Y+ }% s" k( D9 `# v DosFlash w 7000 1 a0 1 4 a:\ixtreme.bin 0
* v7 L0 `* R: K8 w6 y" d ~- for erasing type:
6 n1 ?; H a' s @5 v$ W. E DosFlash e 7000 1 a0 1 4 D8 0 (D8 is the sector erase opcode for the BenQ flash, if you need
9 x. U* `1 Q/ O( _3 A to erase another drive, lookup the value in the datasheet or DosFlash.typ)3 k( d" R( B( Y# k, ]) g
- if you experience any problems try to use 1 as the parameter to the ATAPI Device Reset, cause* P. ?, x. ?0 m3 ^
the same VIA card will react differently on another motherboard sometimes" q0 R" b' m/ S. G- M5 A
* [, V, j* Z' n1 \: ^: v* ]
* ?4 ?7 p3 V; C8 s4 \Soft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in manuel mode
W( R- B! p4 j& C0 [: y---------------------------------------------------------------------------------------
$ y) G% N3 R9 h9 C. `- first you need to know the port addresses of your NForce motherboard, you can get these by
$ E# _- W1 b( v( U starting msinfo32 on Windows XP and looking at the port listing for IDE devices# X7 s9 \$ K) @5 e! |9 R
- on most motherboards the 1st and 3rd ports are used for SATA V! @: U: q' A/ y! `
- you need the starting address e.g. 0x0970 or 0xE900+ n1 w. {4 y k! Z, a
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or
. B8 v3 A' U0 g# o: H, w: N Xecuter Connectivity Kit); i3 o0 j2 n3 o4 A9 K; \9 g
- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
4 @$ a0 S9 }$ ]8 p. k9 k need to power the drive off and on during soft flashing( {- e1 H' s5 G1 p+ m$ @
- cold reboot or reset the computer
- W+ |: K5 _* o2 w& u& X- \- boot from a DOS disk, I used a Windows XP MS-DOS startup disk" U4 j5 N! R7 \7 `8 R/ L
- at the prompt type: 7 \/ l7 F. X. F0 g
DosFlash r 0970 1 a0 1 4 a:\orig.bin 1
$ F) J* _% o2 i- R2 x: ~3 W( x - instead of port 0970 use the starting address your NForce motherboard uses
8 c' y7 v9 i+ f9 O7 ?- press return
3 F8 c, T4 G5 P8 l+ Z7 l- DosFlash16 will ask you if you wanna resend the mtk vendor intro cmd, press Yes
_3 j% [* l h% f- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,% V8 r/ v7 I- j+ {) l; n1 g7 l9 c
this will change during the next few steps
4 c/ O+ Q9 q1 s$ ?+ \% w) E- turn on the BenQ psu, you should get a good drive status 0x73 and flashing should start
; U9 Y" n& w5 g; e- writing and erasing works the same way
% E' M: }5 w2 L2 ^/ C- for writing type:
. f: } f; I" m9 G3 g4 ~" L/ F DosFlash w 0970 1 a0 1 4 a:\ixtreme.bin 1
7 F- H/ u3 o; F* r4 q# ]" J$ ^3 {- for erasing type:
# K9 y5 \, T) J# p% t DosFlash e 0970 1 a0 1 4 D8 1 (D8 is the sector erase opcode for the BenQ flash, if you need; A. T: k+ [0 Z: M
to erase another drive, lookup the value in the datasheet or DosFlash.typ)3 i# R, ? G% D Z8 T
~* V5 J5 B6 a$ |
* b5 P8 K# ~4 sSoft Flashing the BenQ in DOS with a NForce motherboard and DosFlash16 in auto mode
7 C. X4 [- U. z$ g-------------------------------------------------------------------------------------( H, h7 C* p% n5 d# H+ L1 n
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or & |; D7 J1 S8 x7 f* P- l% n
Xecuter Connectivity Kit)
; O" K1 f: E1 r2 _! y- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
( x! F: B* \6 g, y2 C need to power the drive off and on during soft flashing
5 p1 `4 D% K9 I3 j5 L- cold reboot or reset the computer
; G+ v( v& j" j: W- boot from a DOS disk, I used a Windows XP MS-DOS startup disk
+ x# e9 I; V! E' L6 t8 a! d- wait until you are at the cmd prompt
( D2 Q% E9 U& i- turn on the BenQ psu
5 p( |+ ?" T/ G7 E9 j- at the prompt type: 0 v- p) w- C: r1 f. U
DosFlash: l, M Z% {; [, x+ S" @( Y
- press return
: |! f0 V+ {( |6 a% l3 V- during scann of the BenQ's port DosFlash16 will ask you if you wanna resend the mtk vendor
0 v8 O% f* i1 u, r: D( S) z: [ intro cmd, press Yes
3 A3 x9 |! U: |+ i y9 v- after you pressed Yes the drive status is shown on the screen, it's something like 0xD1,
0 r0 n: G) D2 u. P this will change during the next few steps
. g" [4 z3 p: x* N8 I, [' q- turn off the BenQ psu and wait 2 or more seconds, status will stay at 0xD12 Z$ A, C& q2 K/ }* \+ [& K
- turn on the BenQ psu, you should get a good drive status 0x73 and flash access is granted
) h2 ~9 p* E! L2 ]: i( R- you can now continue as usual using DosFlash' B) r# |+ x( [: j
- writing and erasing works the same way( k: `* c4 f& w" N3 H
- if the ports are scanned there is the possibility that you'll get the resend question for) T$ y, l' i2 Z9 i
other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,% a' z, Y6 y6 o/ }
if you know the NEC is at that port you should press No and press Yes only if the port of
$ `, c1 l5 E9 w7 z$ v the BenQ is shown or simply disconnect the NEC
* q3 r# P9 v8 n0 b# F/ S* t$ `" W$ [ H7 s$ g% c3 j
" H; [% D- Y- K( B7 g0 _$ Q: [! }
Soft Flashing the BenQ in Windows XP with a VIA card or NForce motherboard and DosFlash325 m9 e+ ?! d% V! `
-------------------------------------------------------------------------------------------/ |4 b0 G3 L9 b# o3 A% q3 c7 b
- connect a separate power supply unit to the BenQ, don't turn it on yet (can be XBOX360 or & d9 s8 N" T; v
Xecuter Connectivity Kit)
- I' [$ ?! o0 n8 n! I* P0 M- don't use the Xecuter Kit to power the drive with the same psu as your computer, cause we
/ H* ~5 o; ~! B: c" P. L2 D' E need to power the drive off and on during soft flashing
Q9 y# x1 s4 c9 N5 m0 A* T- cold reboot or reset the computer
7 M9 ?; J6 d2 }) a+ X+ h O- turn on the BenQ psu when you are in Windows XP
. c, N# Y: P; i- start DosFlash32
+ \7 x" y3 _3 Y4 G8 v1 I4 H+ h- DosFlash32 will ask you if you wanna resend the mtk vendor intro cmd, press Yes | t9 H# n3 Z) c
- turn off the BenQ psu and wait 2 or more seconds% V8 O" d4 i6 H5 h. `3 u. y* a; V
- turn on the BenQ psu, the DosFlash32 dialog should show up) x6 b" N' x4 d& p Z
- the flash should be recognized by DosFlash32
+ ~) ]( e3 ?: B8 V1 N- you can now read, write or erase the flash4 X4 z4 G1 r6 y, t2 f
- you should be able to do the flashing more than one time in Windows, only do the power : U+ l; ^" t4 X
off/on trick again
7 L, c8 H3 l( Z9 L5 z! ~- if the ports are scanned there is the possibility that you'll get the resend question for* p( u/ d* _) o6 W* p" y
other drives like a NEC, this is because the NEC has no MTK chip and returns a bad status,! {3 |. P3 P7 L( O' }6 @+ u
if you know the NEC is at that port you should press No and press Yes only if the port of7 |5 K2 O1 n9 H3 i) X: G
the BenQ is shown or simply disconnect the NEC: R8 V5 [- A7 V9 z7 d- J6 s
2 O7 r2 h) G4 s# M+ n/ l$ @
5 k' e1 ]8 u) g) V) uMany thanks to jumba for the great idea of BenQ polling!% m8 r: e5 l; R& K) U
Thanks to Iriez, Jumba, Redline99, TeamModfreakz, Tiros and all the IRC people for testing
8 t! Z" j. N. T0 `1 V' R4 fand support.9 J, `* v- E5 T/ N' N2 U
1 c3 h5 O8 }7 _5 L! u5 hJoin us on IRC efnet at the channel #dosflash for support., K8 u% k, j0 O) q) ]! Z# V
7 |, g1 c' E: W
Don't brick your BenQ!8 O* q4 l# c6 M7 {! b
Kai Schtrom0 t4 q9 Z: o6 ?, _( _. c- ?$ |6 _
7 ?1 ?, a# s$ g
( G) i8 H$ p( V- w) K# {2 C+ O3 {7 i' _
************************************************************************************************+ b, T, C/ _/ e
$ n0 B( x& m/ ^$ w3 Z! E: A6 |' w
& i" A( S2 O% J* U, Y/ VDosFlash and DosFlash32 V1.2 Beta5 |/ d3 L: i7 U3 J' T
-----------------------------------/ P4 ]+ q$ |9 ]/ q8 [
- bug fix for BenQ recognition8 d" i3 O, v7 g/ u: ?0 Y
- manufacturer and device id are sometimes 0x00 for a correct installed switch
* G) L' r3 m7 Z! e# n - this issue is fixed with an additional ATAPI device reset before the mtk vendor intro is sent
; [) d# n! V4 `' b$ M1 t0 i
5 j, Z0 @+ ?# o. o6 g2 kThanks to Redline99 who fixed my buggy code by adding one line!
, d9 I% ?0 [7 n0 o1 z. w/ z7 O
) F: a( \- t1 l# ?+ }+ r" u# w7 E0 m" m/ c' E& W
************************************************************************************************
/ q1 b' S0 F9 I& I( A' _. g2 C( K- M4 K: o% g" R
4 ^4 z# f( j: K! X' N# @
DosFlash and DosFlash32 V1.1 Beta
& m% A" W6 S$ h0 C' D" K$ h& a-----------------------------------# M K( l/ F2 b
- DosFlash.typ modified for better BenQ support % B+ u% }; R I: M1 g+ {
- DosFlash16 Flash Manufacturer and Device ID screen output restructured8 G8 c% D0 Y( m. Z9 }* F
- flash chips are first erased before writing starts
5 D# D) u r+ } J; O- DosFlash32 no reenable of DVD-ROMs in device manager after flashing, this means you can't see the drive" Q8 S3 H2 T5 L3 v
and maybe have to activate it manually again in device manager, this could give better compatibility and, `+ O$ S* y+ t9 g
hopefully no more blue screens
* V7 x" J1 e, {4 @& k. {; C" k1 D9 @
Many thanks to Jumba, Redline99, TeamModfreakz and Tiros for inspiration and help!, d& u7 [, m w* B# E; E7 J5 x+ E
& T9 D& U( b( {- ^6 }+ n; V7 M, F* Y3 l, z2 _; F: U3 D
************************************************************************************************$ T( u. Y) B$ [; K
) P+ M+ L6 n3 v, b
y1 l9 _$ M4 V# M. x
DosFlash and DosFlash32 V1.0 Beta
' i' C% [7 x5 q-----------------------------------
1 B* W }8 {# w; t9 \DosFlash can be used to read/write/erase the flash chips of most CD/DVD-ROM drives$ Q2 S' q3 H7 f7 z1 O8 Z
that have a mediatek chipset installed. DosFlash is for DOS flashing, DosFlash32
7 Y7 n& i& P+ V/ G6 O, mfor Windows flashing.0 v4 D- ?5 i/ v3 l# J5 |
& m% Z+ Q* {) K \/ N% z
' K; V& _) m; o& V! g. n( aFeatures:
" V3 M" V* E9 F) b-----------
2 L0 Q) c2 \5 g$ D. w- flashes IDE and SATA drives( _! s2 K9 F5 |' p7 g! B# A* y
- supports parallel and serial flash chips
1 b5 D4 f% l8 ]/ {3 M# S- flash drives in Windows with direct port access
# R1 v2 f6 ~: W$ |4 Z7 _4 J( a- no vendor cdb flashing commands are used
" u4 K3 e+ e Y7 h1 x6 F- tested with the following drives:' K( k( a7 G8 D3 |* p, W# q
- TS-H943A MS25, MS28
5 N* x/ Z) X9 ^+ w3 Z - SH-D162C
! w* S: L- @ F5 K& C - SH-D163A
$ ]4 M5 \* `" Z - and some other drives like Liteon, Hitachi, ...
) O% M B6 a7 |% l2 a+ n- NEC drives are not supported, cause they have no mediatek chipset installed( ]( |9 z( t- ^- ?3 Y
- ^1 S! o' P( q0 O3 f, V( j4 O; ~9 b% K' l& b H
DosFlash
0 W6 k) G# }6 a4 [' ~4 t# ]" {----------
, w) \9 E* x9 u% \8 W: J9 C+ f0 nDosFlash supports two flashing modes, Auto and Manual. If you type DOSFLASH at a DOS prompt it
# u) M ?! Z* e& i" H, }0 uwill start in Auto mode. All drives and the corresponding flash chips are detected automatically.* M5 T" r _! e2 ]+ R. q' ?9 }
If you can't get a flash chip recognized due to a bad flash or other problems you should use the
$ R) p" E8 U+ |$ D, k: XManual mode. In Manual mode you can enter all the parameters used for flashing by hand. The
% R5 t' ` T2 T8 @, ffollowing help screen is displayed if you start DosFlash with a wrong number of parameters:- t- |4 y. D5 T3 l# P, d
# x9 H& Z5 g# i
' X1 u6 l; ^+ B* B
DOSFLASH by Kai Schtrom, 08/05/2007 (Ver 1.0 Beta)
1 m5 I" N: ]0 u) l0 @DOSFLASH [R|W|E] [PORT] [PORT TYPE] [DRIVE POS] [FLASH TYPE]
2 l$ E" y/ T# w2 I! G1 a% f& K [FLASH SIZE] [FLASH SECTOR ERASE OPCODE] [FILE NAME]
3 V4 A/ W1 Z8 E) \ R: Read FLASH* P& v7 A" ]! y9 o# X/ w5 z) h
W: Write FLASH
+ L, O) p" f) P E: Erase FLASH
" t$ ? M0 p) ]$ O PORT: Port to send command to: P. o' t+ P9 v9 K7 b
PORT TYPE: 0 for IDE, 1 for SATA
9 P: {6 a T! g# u DRIVE POS: A0 for Master, B0 for Slave
9 a# m% u+ S, R( [6 h: K& ]9 ~ FLASH TYPE: 0 for parallel flash, 1 for serial flash# |$ }3 _! E' a
FLASH SIZE: size of flash chip in number of banks I) o7 E+ L; u
FLASH SECTOR ERASE OPCODE: individual sector erase opcode command byte
G+ v" \3 O. R% s' A this is only needed for erasing a serial flash! Q$ O# y1 @8 a8 T% Z, B
FILE NAME: name of the file to read/write from/to flash
# a3 V& h- q% s# VAll numbers are intepreted as hex values!
: F+ ^$ @( Q/ P3 f: r3 t" e* _( T7 v/ c" X6 A1 S5 g
Example Usage:
a8 v5 U% p* i4 \/ M"DOSFLASH R 01F0 0 A0 1 4 C:\flash.bin"
3 Y" q) F! t* z& G" z2 X=> Read serial flash with a size of 4 bank (262144 bytes) from Master Device
/ X+ R1 Z, Z/ H* `' b on IDE port 0x01F0
7 {( _8 I/ f/ ?3 W* [1 g" P"DOSFLASH E C000 1 A0 1 4 D8"
- Q% ^7 S/ a, b. V- D=> Erase serial flash with opcode 0xD8 and a size of 4 banks (262144 bytes)1 K) T: K7 P) Y2 Z; H8 F+ f5 n
from Master Device on SATA port 0xC000
2 x- C% H3 ]$ d; j7 d8 W. L 4 v% Q8 S( N3 C% J
% {# o: @8 m2 Q8 y6 i' b& I8 uExplanation of the Parameters:
$ n2 P2 i8 R( j9 {, D- f, t% X--------------------------------' F1 _/ g/ q( k$ z2 F
8 Z! V8 o, L; L4 i9 }4 S# V0 A
[R|W|E]% r8 x; G# {8 T' b9 ]/ O
---------9 a# S& j; `- b, X$ P
- this will set the mode of flashing, it is recommended to first try read on any1 j* D3 c+ \3 ~
drive, if the read will fail, it is highly unlikely that a write or erase will _. I: i$ ?7 [& u! O
succeed5 B! ~, Y$ o+ Y; h' O Q
: _/ S2 I+ r d9 E
[PORT]" {- p6 D- R% q- q
--------8 q4 y8 D* l* Q$ e/ [/ |' l
- the port to which the drive is connected, a port number should always be entered& J+ V- ?# }9 B8 I& L
in hexadecimal and have 4 hex digits, valid ports are: 01F0, 0170, C000, C800
|! I4 \% v! v7 q" X- this option can be used if your PCI adapter card or on board IDE/SATA ports are$ q' [2 k: Z! l$ r) ^
not identified by the auto mode
5 ^6 R- M: e% s: S5 J8 p! Y
1 S, @2 G# E* x3 p* v7 `[PORT TYPE]
W. s: f* F3 ~-------------& R0 s0 Y+ Q M9 h/ z$ j
- the port type tells DosFlash what type of port is installed on the before entered1 L& A. {2 c/ P( [5 L% W
port address8 {) c0 i. t1 q' o, D: m6 y
- valid values are 0 for IDE and 1 for SATA
. v, x: ? d6 d# }$ L& C* n' t9 i- make sure you never mix the wrong port with the wrong port type, this could give
" O/ c# G$ {+ `9 p& i strange results or in the worst case a bricked drive! ^9 N% Z* @' d. g* o$ ~
) g: @5 N5 \8 u( P$ j, D1 V5 r, \5 W[DRIVE POS]
) J% L' J4 a* M# g$ h7 N* i-------------
/ c8 e5 X0 O) d7 P8 f- w% N- old style IDE channels have the possibility to connect two drives at one IDE
0 Z) Y) N- E( X! e0 \$ @ channel, the first drive is called the master, the second drives is called the9 `3 x( \, Y8 T
slave% b: W. V4 j1 B* M$ q' \: w
- you can select which drive should be flashed on the channel, A0 selects Master,
+ B! }) ?7 L b B0 selects Slave; ~3 O& B2 u" b- k. y8 D- U6 L
- on SATA ports this value is always A0, cause you can only connect one drive to: T4 S% E, j1 K8 }7 \7 r. ^4 E
a SATA port, so for SATA you will always type A0 here
3 M1 L _' U5 L) u2 q" c8 n- it is not recommended to flash IDE drives with another drive connected to the
! G4 g* }* C! j1 P; X same IDE channel, this could be risky if something in the Master/Slave selection8 T1 w/ U, }0 Q2 ]: z
fails
8 p- }& ^$ h, }% R: b$ t I , N% `% Z7 H- Z6 I3 y
[FLASH TYPE]
7 ?, w- U& |3 b: E ~# Z5 g--------------4 @( m9 d# P' ?7 n- V
- there are two types of flash chips out for CD/DVD-ROM drives atm7 Y# S5 L7 E+ ?0 ~
- the older type is parallel flash, which is also supported by mtkflash for example: Y y3 {& O' ?. p
- the newer type is serial flash, which is supported by flashers like XSF- ^3 Y; t2 \( w2 a9 @
- the problem here is that no tool is out that can flash serial flash chips on ! A ]) n2 E, W+ v' ?& Y
SATA ports* \: D2 _- t, h4 I& a& g" P. l% j
. B- @. I% }' H n. f2 L[FLASH SIZE]: u8 X! D3 k; b8 x
--------------; j0 R- @" B5 Z. P" m8 T/ i) b
- this is specifies the flash chip size in banks
0 k2 D1 a7 M* S- one bank is always 65.536 bytes in size- A. H$ X' N* a4 p
- if you know your drive has a flash chip of 262.144 bytes in size you need to enter 4: X" P0 P5 y5 W
$ ]/ A8 ^" l) V* h
[FLASH SECTOR ERASE OPCODE]
! t% E+ Q8 U4 V8 k% d-----------------------------
, v* P& n- f% Z) U6 z, s- the opcode used in the flash chips datasheet for erasing
8 N" ~4 t! |3 {/ a: t+ D' I- for serial chips this command can be different from the standard and needs to be
& G/ b' Y C5 B5 Z entered for flash erase' ~: S$ `% s4 O, t
- for parallel flash chips you can enter a dummy cmd byte, the integrated command' J: a1 h. s0 T4 O4 n4 S% \( {
should work on all parallel flash chips without a prob$ \2 J) C4 m! U N6 `+ }, e' F
4 Q, s/ ^0 I4 ]+ I$ K8 u[FILE NAME] t' x/ X9 p7 A5 r
-------------& o* e1 F# A3 p) U
- name of the file that should be used for flashing
# f& X. ~. X6 u( A% |. }, p1 C- for reading operations this should be the output file7 f# ?3 U9 C4 R: }) w/ n7 B. b- u
- for writing operations this should be the input file
5 R0 o5 T5 y) d: ~6 c# d
6 _. e1 b6 c0 @ D2 d1 B: P" p F! C& Q! t8 S* u+ k; {& Q: |: d
Hints and Warnings
/ s0 I2 E4 @/ S6 D--------------------' O1 y5 J0 |- h2 U
- read, write erase TS-H943A MS28 after the firmware stealth has been disabled with Enable0800 disc
: A L% J* Z5 A- }- K( |4 x5 Q - this only works one time, after the first mtk vendor specific intro cmd is send0 j% H* U1 |% j. I+ I
- if the mtk vendor specific outro cmd is send the chip goes back to stealth mode and you need3 }. J! P& r# e: \
again the Enable0800.iso to disable it
5 b0 H9 G2 a, f8 \' g: g/ V& L - therefor the mtk vendor specific intro is send at program start to all present devices and the! I/ R% o% j% l3 ~ M
mtk outro is sent at program end
; @2 g/ k+ Z6 K, c( y - if you have a chip manufacturer id of 0x02 and a chip device id of 0x02 for the TS-H943A1 Z, q! z/ B$ |
the flash chip is in stealth mode and won't give access to any reading, writing, erasing
* {( _. S( B% Q* i; U! O u- always have a look at the DataSum generated, this is exactly the DataSum of mtkflash3 B( |- p! n8 r1 E0 T
- the DataSum is calculated as the sum of all bytes of the firmware in a short integer+ {% R- _5 p3 Q5 R
- to make 100% sure that the flash is written right compare that DataSum to a known one: Y, @* o2 n" W. O
- this tool has not been tested on all drives out there, the typ list is simply copied from well$ ?& n% ?/ E, L! N8 d# o, f
known programs like mtkflash and XSF/ t- S) r7 l8 }+ c3 S/ {4 V
- always try a flash read on a not yet tested drive before doing anything else+ R4 j0 B w( ?0 W
- if the read doesn't succeed it is highly unlikely that a write or erase will& p) y/ C- h% e* P% E
- some LiteOn drives seem to have probs to write the firmware correct, this prob seems to be1 K% U0 T4 H+ W: H0 i" X) T
related to windows register flashing, cause even an assembler app can't do this error free
& j' P! F, a9 K1 E4 q& u - if you get errors on LiteOn drives, write the flash two times in a row) G. @+ d+ V' ]( v/ i& C
- for direct port I/O in windows the givoio.sys driver is used, this driver is loaded at DosFlash32
0 {7 _1 J9 l( [( B& y start and unloaded at program end, be warned, this driver can possibly make your system unstable,0 B; N0 ]1 h* h/ j
it's intention is to let privileged assembler instruction like in and out pass, even in windows,& U" f; ^6 g" \" Y+ Q3 ]: B
if this driver is not used you will not be able to get direct access to port registers. w5 y# X! h6 J; B- z9 R( u
- DosFlash was tested on MS-DOS 6.22 and later, you can easily copy it on a MS-DOS boot disk created8 C6 x5 u" O" Y
in Windows XP and start DosFlash directly from the disk. b$ ]/ W' _: W+ @
- don't forget to also copy the DosFlash.typ file, it has all the informations about flash chips2 |# n) g2 h& l2 w& }1 T% Y
for auto mode flashing
/ l" x4 F& E% K8 [$ M/ ?- DosFlash32 was tested without a prob on Windows XP SP2, you'll need also the typ file for the q" Z5 a5 L" ^7 N1 T, w; G9 }% f, [
win version
" ^1 v0 O9 x ]. p) ]5 c- DosFlash32 will deactivate all CD-ROMs in device manager at startup, this is better for flashing,1 m( N. s: k0 P- I
cause Windows seems to poll the drives all the time and this could result in a bad fw file or# s) H' A* x/ w4 g G7 _( e; Z- j& X
a program hang, the drives are activated again at program end/ d+ B: P& G6 L) w1 v" k! k7 p
- you should make sure that the flash is not in an erased state at program end, cause device manager7 z: o9 }- G: ~+ m
don't like drives that do not respond to the inquiry command
( u0 i* I, X) {' Z4 K- deactivating all CD-ROMs could take a few seconds, so please be patient at program start& R$ d, z2 @ ~4 A, J# Z* O+ c; e
- DosFlash and DosFlash32 will try to scan for the VIA 6421L Raid Controller card, based on vendor
( V0 Y6 r6 d5 r id 1106 and device id 3249, it doesn't matter if the card driver is installed or not
; w, u3 w9 D9 U- J) y9 U7 a0 ~( x$ Q# u H
3 U0 N9 B: [ ?* _( @& H
Many thanks to Dale Roberts and his Direct Port I/O driver giveio.sys!- i+ v9 d) _! a# ]4 o1 {
% U( y6 ]8 S/ e, \! S; ~Avoid a bad flash!% `* u, S Z5 D/ I+ N0 @
Kai Schtrom |
|
窺視卡
雷達卡
發表於 2011-8-12 20:40:35
顯身卡