Вы находитесь на странице: 1из 23

Cristal hack: September 2012

4/18/14 8:04 PM

Cristal hack
The Ultimate Hack's Ever

Search
Archive

People Find

Archives

You Archive IT

Go

About Author
Chitika | Opt out?

Seema Rawat
Toonswarz

Monday, 29 October 2012

Want To Update Your BIOS

Total Pageviews

Hello guys, Today i will talking about How You Can Update Your BIOS software.Most of old

6 5 7 7 8

computer has old Bios software and it does't support new HDD and Pen-drive boot systems.
So I Found Some Solutions for updating your bios.

Support Mee !!
Dedicated for those
lazy to read and those
who just want to get it
done A.S.A.P.
NOTE: if youre
interested in this

Enter your email address:

article, youre supposed


to have some

Subscribe

background in things
like:

Delivered by FeedBurner

what is BIOS, what is it


intended for and what
types of BIOS-es exist?

Blog Archive

what is DOS command-line interface and how to use it?

Nov 2013 (1)

and maybe some other stuff

Aug 2013 (1)


Jul 2013 (4)

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 1 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

At least, you should be able to find the required/missing information in the Net this

Jun 2013 (1)

article wont help you with it. So, instead of starting from basics, lets do just the

May 2013 (3)

opposite and start with clearing up the most typical myths and confusions.

Mar 2013 (2)


Feb 2013 (2)

Some Myths

Jan 2013 (7)


Myth #1: One has to (should) reprogram the FLASH memory chip (which contains the BIOS)
using only the flashing software supplied by the BIOS manufacturer (for example,
useAwdFlash with AwardBIOS, or AMIFlash with AMIBIOS).
Thats wrong, but many people believe in this myth particularly because there are so many
misleading warnings on manufacturers websites (especially for people for whom English is a
foreign language!). You could ask: Why is it wrong?. If you want to know the answer dont

Dec 2012 (5)


Nov 2012 (2)
Oct 2012 (16)
Sep 2012 (15)
Sep 2009 (1)

be lazy to read this part of the article and the next one!
Myth #2: One has to (should) use the so-called Hot Swap method only with a motherboard of
exactly the same type (same chipset, same manufacturer, etc.)
Thats wrong, and its the second most common mistake. It comes from the lack of knowledge

Labels
Adsense

Blogging

(1)

(6)

CMD

(1)

about how different flash chips work, and this difference actually may cause some limitations

downloads (11) FaceBook (4) Fix


Problems
(12)
G-Mail
(1)

on the type of motherboards that can be used to (re)program a specific flash memory chip.

Informative (29)

Anyway, if you need to reprogram the flash chip of a (dead) motherboard, and you have a

Book

Ms-Dos

(1)

working motherboard of exactly the same type this would be an advantage.

Programming (3) regedit (3) Tools

(15)

(1)

Mobile

(8)

Lunix (2) Mac

Windows (30)

Some Flashers and their usage


A flasher is a piece of software for flash memory chips (re)programming (process also
commonly known as (re)flasing). The most popular universal flashers

Categories

are AwdFlash,AMIFlash and UniFlash; other flashers are mostly special ones for specific

Adsense (1)

brands, like aFlash for ASUS motherboards or special flashers for Intel boards (note that

Blogging (6)

universal flashers may not work with these boards). In this article well concentrate only on the

CMD (1)

mentioned three universal flashers.

downloads (11)
FaceBook (4)

As most DOS programs, flashers can be controlled by command line switches. As there is

Fix Problems (12)

plenty of information about them in the Net, so only the essential ones will be described here.

G-Mail (1)

ATTENTION GUYS ! Running a flasher WITHOUT specifying any swithes (i.e. using the
default ones) might damage the BIOS, even though you had no intention to reflash it and
were just wondering how it works and/or just wanted to backup the current version of your
BIOS. Although its a very rare case and is related usually to some specific versions of
AMIFlash, it has happened personally to the author, and not just once!

Executing some

special utilities (like DMICFG), which are sometimes included on CDs that came with a
motherboard (for fine-tuning BIOS), often causes the same problem damages the BIOS,
even when you had no intention to reflash the flash chip, but just wanted to have a look on
what the utility does.

Informative (29)
Lunix (2)
Mac Book (1)
Mobile (8)
Ms-Dos (1)
Programming (3)
regedit (3)
Tools (15)
Windows (30)

AwdFlash
The most popular flasher but not the best one. Should be used with the following switches:
AWDFLASH bios_file /py/sn/f/r/cd/cp

These switches will cause AwdFlash to do the following:


/py reprogram the flash memory with the contents of bios_file without asking for
confirmations (here p means Program, y means Yes);
http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 2 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

/sn do not save the old BIOS (Save=No);


/f do not check if the BIOS in the bios_file file is intended for this particular motherboard
and if this is a BIOS file at all (Force reprogramming);
/r reboot the computer after flashing is complete (Reboot). If you dont need this just
dont use this switch;
/cd and /cp clear some setup data. It is highly recommended to use these switches
(ClearDMI data, Clear PNP data). It is also recommended to add one more switch /cc,
to automatically Clear CMOS.
Not so popular as AwdFlash, but actually the best one (despite even the problems with some
versions when being executed without any switches see the warning above). It should be
used with the following switches:

My Other Blog
Next To Shine

AMIFLASH bios_file /b /n /-o /-c /-d /-r /v /-i /-k /-e /-g

To backup your current BIOS, run AMIFlash as follows (NOTE: there is no SPACE character
after the /s switch):

Healthy tips
8 months ago

Love Kill People's


5 LOVE TIPS
8 months ago

AMIFLASH /b /n /-o /-c /-d /-r /v /-i /-k /-e /-g /sbackup_file

If youre going to reprogram a flash chip(s) more than twice dont be lazy and prepare a
.BAT file on your DOS system disk(ette), with a string like this:
A:\UTILS\AMIFLASH.EXE %1 /b /n /-o /-c /-d /-r /v /-i /-k /-e /-g

A UniFlash

UniFlash is a much more advanced flasher (compared to AwdFlash


and AMIFlash) and requires some major knowledge/experience from
the user, so it will not be described in this article.

Some details about flashing BIOS-es of ASUS motherboards

Regular flashers shouldnt be used for reprogramming flash


chips on ASUS motherboards, because vast majority of ASUS BIOSes
(starting from ancient Pentium1) are blocking the regular
methods of reprogramming. For these motherboards, ASUS own
branded utilities must be used. For the oldest boards it would
be PFlash, and for the newer ones it would be AFlash (in many
cases AFLASH will work with older boards as well). For the
modern boards you will need to use Windows-based flashing
utilities.

It should be mentioned, that the statement you will need to in


the preceding paragraph doesnt mean that ASUS own flashing

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 3 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

utilities are troublesome. Quite the contrary: they are very


comfortable to use, easy to understand, quite universal, dont
ask hundreds of questions and successfully flash everything on
their way. In addition, AMIFlash is still usable, despite the
error at the end of the flashing process (it is actually caused
by DOS4GW rather then by AMIFLASH).

In any case, all happy owners of ASUS motherboards should be


extra careful while flashing their boards, as the resurrection
process in case of the BIOS corruption may be difficult. And
even if you think you are an advanced user with a great
experience once more: be careful ! ASUS engineers use very
complex and sometimes weird BIOS protection techniques in their
masterpieces, and this other side of the medal can make the
process of repairing a motherboard with corrupted BIOS very
complicated. Your motherboard may seem to be dead (00 on
a POST card), as well as the flash memory chip (e.g., you may
not be able to reflash it on a board other then ASUS), but
actually both of them are in good, absolutely operational
condition the dead chip will work well if put into another,
exactly similar, but working board, and/or the dead board will
return to live with the flash chip from that working board. If
youre dealing with problems like these you can read
the chapter about the LPC interface (ASUS uses this interface
long ago compared to other companies who have started using it
later).

P.S. Similar problems (necessity to use branded flashers) may


appear with some (usually well known) other brands, for
example a couple of Abit motherboards have fine points in
the flashing procedure. UniFlash will warn you that it does not
like this brand.

Common issues and their solutions

BIOS image files size does not match the flash memory chip
capacity.

Its a rather common problem, most likely caused by the fact


that manufacturers sometimes use flash memory chips of different
http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 4 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

capacity in different motherboard revisions. The MS6117 motherboard (made by MSI) may serve as an example: look at
its BIOS list and youll see that all AMI BIOS releases are for
a 1Mbit flash chip, as well as AWARD BIOS releases 1.x and 2.x;
however, the AWARD BIOS release 3.2 is for a 2Mbit flash chip.

Rarely, you may run on a board with a flash chip of some


specific capacity, while the manufacturer claims that the board
is/was produ?ed only with flash chips of different capacity.
That may just mean that your board is after repair, but it may
also mean that you have a fake motherboard (i.e. some company
has cloned (copied) a design of another manufacturer and has
used a cheaper flash memory chip of different capacity).

A flasher refuses to accept the given BIOS image file,


producing error messages like that the given file is not a
BIOS image at all, or its a BIOS for a motherboard of
different model.

Its an even more common issue, but if youre 100% sure that you
know what youre doing, just use the switches described
previously to force the flasher to do the job.

A flasher cannot recognize the used flash memory chip and thus
cannot (re)program it.

This issue is also a common one, and there could be a few


reasons for that:

1. the flash memory write protection is turned on (thats what


most flashers would ask you to check in this case). Old boards
hase a jumper that enables/disables flash chip protection,
while newer ones have it as an option in BIOS Setup (something
like BIOS FLASH PROTECTION = ENABLE/DISABLE);
2. the particular version of the flasher that youre using
doesnt know the particular type of a flash memory chip. Its
a rare occasion, but it happens, usually when you are trying

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 5 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

to flash some stone-age flash chip by a newer version flasher,


or vise versa.
3. the flash memory chip is not supported by the motherboard
(this may happen e.g. when you try to hot-swap flash chips)
read the chapter dedicated to different interfaces like
FWH/LPC;
4. the flash memory chip is inserted in the wrong way. Double
check that you have inserted it correctly before you turn the
motherboard on, otherwise you may end up with the next option
;
5. the flash memory chip is dead;
6. the flash chip is not actually a flash chip, but an OTP (onetime programmable) ROM or an Ultra Violet EPROM (UVEPROM, with
small transparent window). May apply only to stone-age
motherboards (the ones before Pentium 1); its easy to
recognize those chips by the marks on them (they would go like
27xxx).

Everything went fine, no visible errors, you turn the board on


and silence

For recovering in this case, you will need to read the article
further

CHAPTER TWO. Dedicated for those who hasnt read the first
chapter on time and now needs a recovery.

Considering that a person would read this chapter not to study


about updating the BIOS of a working board but for recovering it
after a failure, lets go ahead and see what options do we have.

Option 1. Reprogramming the flash chip using a hardware


programmer unit

Plain and simple you will have to break your piggy-box, pull
out your flash chip, take a floppy disk, bottle of beer (keg
sounds better :) and go to one of your tech-buddies. If the
flash chip is soldered in, then you will have to break another
piggy-box and take the motherboard with you. In this case,

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 6 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

consider asking the technitian to solder in a chipbed for the


flash chip this may lighten your future expenses.

Option 2. Hot swap

You will need another WORKING motherboard. As was mentioned


before, in most cases it neither has to be a one with the same
chipset, nor of the same brand. What is most important, indeed,
is the type of flash chips that the working board is compatible
with there are two major types:

the regular ones all flash chips in DIP32 (rectangular)


package are of this type. They are usually marked
as xx28xxxx, xx29xxxx, sometimes xx39xxxx, xx49xxxx;
the ones with LPC and/or FWH interface (sometimes
called hub chips) vast majority of these chips are in
square PLCC32 package. Most of those are marked
as xx49xxxx and sometimes xx39xxxx, while Intels chips of
this type like 82802xx.

So, if our recovery board uses the same (or compatible) type of
BIOS flash chip as the dead one (and of same or larger capacity)
everything should work fine.

How-to Do ?

Use your imagination. The most important thing during this


process do not drop any ironware on the motherboard or spill any
liquid. For chips in DIP32 everything is easy. Usually it is
recommended to tie the native chip with a fishing line or
similar non-conducting thread for easier pulling it out of the
chipbed before reprogramming. As for myself, I use a hoop ring
belt (an old COM-port wiring, for example) and set it up under
the chip so it would be comfortable and safe to pull the belt
without cutting it and without damaging the chip and the
chipbed.

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 7 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

As for the square chips aka PLCC32 its a bit harder. One can
try using fishing line as well or any non-conducting type of
threads or if you have a good access point and your hands are
straight just use a needle, slowly lifting the chip from
access corners in chipbed. If you, however, reprogram chips
everyday or just want to be 100% sure glue something like a
piece of plastic or even melt some glue from the glue-gun to the
top of the chip. This would allow you to pull it out. You can
also just buy PLCC32 extractor. Anyway, it is your choice.

Option 3.Using a floppy disk (for modern motherboards HDD or


CD-ROM)

If the BIOS is not completely dead (during the boot-up, the


board tries to access the floppy disk drive and/or displays a
BIOS CHECKSUM ERROR message) it may be possible to recover the
BIOS without additional hardware.

Note: on most boards up to PentiumIII-class ones, the error


message wont be displayed if you have an AGP/PCI video card. If
the board has ISA slot(s), try using some ancient ISA video
card; for boards not having such slot try using a PCI video
card. As of many modern boards, the boot block (which actually
produces and displays this error message) supports AGP video
cards.

In addition: if youre using a POST card(or the motherboard has


a built-in one), the following POST codes may help you to
determine that the bootblock tries to recover the BIOS from a
floppy:
for Award BIOS: POST code 41h shown in the beginning of the
POST procedure(something about the 5th-6th POST code of those
you could see on the POST card). In Award BIOS this code
corresponds to FDD controller and FDD(s) initialization.
for AMI BIOS: POST codes F0h-FEh will mean that AMI BIOS
attempts to boot from a floppy drive.

Mostly all you need is:

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 8 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

a minimal bootable diskette (i.e.:


only IO.SYS, MSDOS.SYS, COMMAND.COM);
a flasher (e.g. AWDFLASH.EXE)
of course, the BIOS image file (in many cases, must be
(re)named to bios.bin) that youll have to get (from the
boards manufacturers website or from somewhere else)
AUTOEXEC.BAT with appropriate string inside:

for AwdFlash:

awdflash bios.bin /cd/cp/py/sn/f/r

for AMIFlash:

amiflash amibios.rom /b /n /-o /-c /-d /-r /v /-i /-k /-e /-g

It is not recommended to use other names for the BIOS image file
and/or flashers (use only the standard names mentioned above)
some BIOS-es (basically, their bootblocks) may just ignore
them, producing an error message like NON SYSTEM DISK or DISK DRIVE
NOT READY.

There is no standard procedure for BIOS recovery from a floppy


drive. A plenty of brand-name computers made by Intel, HP,
Compaq, Dell, IBM, Fujitsu and some others could be restored
using a special floppy disk its image is usually availible for
download from their website along with detailed descriptions of
how to use it.

It is also possible that you will need just a flasher program


and the BIOS image file (the diskette should not even contain
any system files), or even only the BIOS image file itself,

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 9 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

because both the flasher and the BIOS would be built into that
file. Usually, this may be applicable to newer boards.

To be short there may be some unexpected variations. Taking


into account a possibility of hardware and/or bootblock
corruption, this method (using a floppy drive) is rather not
reliable and promising (and statistics prove it), but its the
best method to start BIOS recovery with who knows, maybe
youll be the lucky one !

Dedicated for those who want to know not only how to do, but
also how and why it works

PP-type Flash ROM chips interface (DIP32 and PLCC32 packages).

A little about operating principles

The regular flash chip operates with the following signals:

DQ0-DQ7 8 data lines;

A00-A16/A17 17 or 18 address lines (depends on the chips capacity: 1


Mbit chips have 17 lines, 2Mbit ones have 18 lines);

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 10 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

CE# chip enable (or chip select); this signal enables the chip to
be read/written (think of it as a turn on button);

OE# output enable (or RE read enable); this signal allows to re


ad a data byte.

WE# write enable; allows to write a data byte.

It is quite simple to understand even when you dont have a degree in elec
tronics.

Now we can see that a 8-bit data bus seriously limits the read speed from
the chip (you can think of it as a road with 8 lanes, while e.g. the nForc
e chips access the RAM through a highway of 128 lanes!), so the startup
process of even the fastest computer could become a turtle run. To avoid t
hat, the chip is connected to the south bridge in a special way, allowing
the latter toshadow the contents of the flash to RAM, thus improving the s
peed dramatically.

However, if the flash chip you use is (partially or totally) damaged, or i


s inserted incorrectly the consequences may be bad not only for the chip
itself (which could be expected), but for the whole chipset thats due
to the direct connection between the chip and the south bridge.

The flash chip occupies upper addresses E0000-FFFFF of the address space (
True for 1Mbit) and because of similarity to other chips lets take 1Mbit/
AwardBIOS for example. After you turn computer on and RESET# signal disapp

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 11 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

ears, the CPU executes the first command located by F000:FFF0 address. Aft
er initialization process beginning, CPU recalculates different checksums
(there are quite a bit of those in BIOS) but the main is at E000:0-FFFF+F0
00:0-BFFC. If this one is wrong, then bootblock located in *most* upper ad
dresses (F000:C000/E000-FFF -the last 8/16Kb) is executed trying to initia
lize floppy drive and to read the system and/or flasher and/or BIOS file f
rom floppy disk in attempt to recover/boot normally.

And yet, another conclusion: if you want to force boot block execution (fo
r reflashing purposes, as an example) you can do it purposely corrupting C
RC (checksum) by shortening address lines above bootblocks. As for myself
, I usually shorten bylocated A15 and A16 lines (pin 2 and 3). Bootblock s
ize=16Kb=2^14 and so this would not lead to bootblock corruption, but chec
ksum of the *rest* will be corrupted. If you can not understand why you ne
ed that, you will when you meet soldered in flash chip fashed with *simila
r* bios and, by the way, such shortening is harmless for address lines and
chip itself.

After successful CRC check, bios is shadowed i.e. the flash contents is co
pied to the ram and flash chip is turned off by south bridge. To force all
programs working with shadowed bios as with ROM contents it is marked wit
h READ ONLY atribute by means of programming south bridge SB (and/or Model
Specific Registers MSRs for AMD K7/K8 CPUs). All foregoing bios calls ar
e redirected to the shadowed copy of the bios.

Conclusion: So you can extract the flash chip just after the report Start
ing Windows/DOS/linux on the screen. And now if you wish to work with the
flash itself (for example write ESCD/DMI), you have to fulfil the special
procedures (chipset specific !). You have to connect the flash to the bus
before the operation and disconnect after.

Conclusion: because of different methods of turning flash chips ON/OFF (fo


r different chipsets), flasher should know how to do it i.e. flasher has t
o *know* chipset of the system where flashing is performing.

PARTICULARITIES OF FLASHING INTEL 28FXXX CHIPS

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 12 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

If your motherboard has an INTEL flash chip you have to be triple careful
while flashing it, because intel chips use hardware botblock protection. W
hat does it mean ? This means that intel chips have one more signal RP# (p
in 30), and this signal allows chip bootblock programming. For 2Mbit it is
A17, 1Mbit -NC (not connected, not used) i.e. for correct flashing of _al
l_memory_space_, there should be +12Volt present on RP# pin. The special j
umpers were made on many Socket7 motherboards and named: INTEL/NON-INTEL f
or this purpose.

Conclusion: If the particular motheroard has Intel 28FXXX flash chip and P
CB (Printed Circuit Board) does not support correct commutation for progra
mming those chips (a common matter) BIOS will die after the first attemp
t to flash the chip without any chances for revival (on this board).

For flashing Intel 28FXXX on such boards (without RP# pin) you have to con
nect pin30 to +12Volt source manually, but so it would not get to the moth
erboard itself (A17). To avoid this you may just bend this pin so it will
not have a connection with chipbed.

SOFTWARE PARTICULARITIES OF FLASHING PROCESS

The main aspect you have to know is that you can not reprogram this flash
chip *at once*. You can not also write one separate byte. This type of chi
ps supports blocks (sectorization) reprograming methods only. Different ty
pe of flash chips support different type of sector organization. For examp
le, a very popular flash Intel 28F001BX has the following blocks:

1. First block, in the very beginning and the biggest one -*main* block, o
ccupies 112Kb of space, it usually contains main body of the bios (that
is why it is the biggest).

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 13 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

2. Next are two identical blocks, each occupies 4Kb space the data relat
ed toESCD/DMI/CMOS/PASSWORDS etc. located usually in these blocks.

3. Last block 8Kb -bootblock

Speaking technicaly i28F001BX has 112+4*2+8 organization. Simple and log


ical: the biggest block, 112Kb, anyways being rewritten only during bios r
enewal process, the next follows changing data area, thats why there are t
wo small blocks used. They can be rewritten faster and easier. And the non
-changeable bootblock purposely was separated from other blocks for bios p
rotection in case of emergency recovery from floppy drive. Bootblock is al
ways separated from oher blocks so it could peacefully reside during norma
l updates of the other blocks.

Some flash chips are made with very high sectorization, for example: SST29
EE020 (2Mbit) has 2048 similar sectors each occupying 128 bytes, but most
part of chips has organization similar to Intel one, because smaller block
s have drawbacks as for example quite complicated write protection realiza
tion.

CHAPTER 4

HUB TYPE FLASH CHIPS

Old schoolHow simple it wasaddress bus, data bus CE/WE/OEBut the progre
ss is not standing on the same spot (especially In certaIn. companies) and
with appearing of the i8XX chipsets, there came so called hub flash chips
.

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 14 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

LPC Interface

The end of year 1997. Intel decided that powerful processor must have BIG
bios (4-8Mbit and more) eventhough, many that time companies were OK with
what they had and present companies still use 2Mbit.

Regular* (PLCC32), widely used flash type chips, would not have enough
pins for address lines, so Intel invented LPC standart (Low Pin Count)
but decided to keep PLCC body. Besides possibility to have huge flash c
hip capacieties up to 4Gb, one of the other main reasons to have LPC,
was soon-to-be-useless ISA bus, absense of which would remove address/
data lines and allowed to have less traces in between Super I/O chip an
d the south bridge (obvious possibility to hide SIO in to the South Bri
dge were kept in secret).

LPC chips are using only 5 lines: LAD0-LAD3 + LFRAME# (thats why it is cal
led LOW PIN COUNT) See typical LPC flash chip pinout at picture below (thi
s standart may be used not only in flash chips, thats why iam being specif
ic)

LPC/FWH interface

As you can see this type of flash can work in 2 different modes: LPC and P

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 15 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

arallel Programming (PP). Mode is chosen by logic level on IC pin (Interfa


ce Configuration Pin) during computer startup process as follows: logic 0
-LPC mode and logic 1 -PP mode.

PP mode is the closest to *regular* flash chips and somewhat compatible wi


th them, but not completely by all pins, so be aware! PP mode uses 11 (0-1
0) address lines, but those are multiplexed i.e. first, addresses A00-A10
are read and then, through the same lines, addresses A11-A21 are read as w
ell. This multiplexing thing and dissappearance of CE# signal is the only
difference between PP and *regular* flash chips.

As of LPC mode, communication between flash chip and south bridge is made
through 4 bit bus and fifth LFRAME# needed as a start point for data to tr
avel. LRESET# and LCLK# which are identical to their cousin signals used o
n motherboards all other lines are optional. This is how interface got sim
lpyfied, but, its still not serial interface as I2C and still allowing it
to use DMA and BUS MASTERING (Which are used in devices like DiskOnChip/LP
C)

PP mode is used during manufacturer flashing process of the chip (because


it is faster), LPC is used for communication when already set in motherboa
rd, so chipset must know how to communicate this way, thats why this stand
ard got so popular after appearance of Nforce2 (ISA bus was never imlement
ed for use in this chipset)

FWH INTERFACE

Intel was very pleased with own work and decided to carry the flag forward
and made another standart FWH (Firm Ware Hub, thats how *HUB* type of f
lash chips appeared). It was fully electrically and by pin number compatib
le, but _absolutely_ incompatible by communication protocol. As you can re
ad in many papers it was made in purpose, so those chips can be set up in

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 16 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

one system, on the same bus (electrically compatible) but during communica
tion each chip would take own data packets, because of the difference in c
ommunication protocols. by the way it is possible to hook up to 16 *HUB* t
ype flash chips in one system, because of additional ID0-ID3 signals.

(by Author: Please think of all my stones towards the Father of x86 as a j
oke, however every joke has a piece of joke ;0)

As you can see FWH is similar to LPC, only pins LAD0-3 + LFRAME# renamed t
o FWH0-3 + FWH4. PP mode is absolutely same.

FWH differs from LPC by protocol, i.e. all commands for operation have dif
ferent code values in the field of data exchange, plus, the ability to use
up to 16 FWH devices, thanks to newly implemented identification signals
ID0-3. As of system default ID configuration for flash chip it is assigned
ID=0000, you may easily check it (intel boards) with multimeter (ohms), a
ll those pins are connected to the ground.

Common way to check what kind of (FWH/LPC) flash chip we have is: using Oh
m meter, check continuity between PINs 16/28 (flash chip) and GND (anywher
e on the board) in *HUB* type flash chip resistance will be 0 Ohms (or clo
se to it) while *regular* will have about 1KOhms.

If you have the need of flashing chips every-so-often, at work, or for any
other reasons, i would have a few suggestions for you.

Someone may recommend you, in this case, to use a flash chip programmer de

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 17 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

vice, but personally myself i would not advice that and not even recommend
to use one. There are two major reasons. Reason one is : many programmer
device will not recognize all flash chip types and those which do, cost we
ll over three digit numbers. Second reason would be: just any programmer d
evice cost would be, as low as, a three digit number, that being said here
is my solution all you may need to flash 99% of flash chips (talking ab
out the chips that are used in motherboards) are next three type of mother
boards:

1. Something out of stoneage, like P1 (pentium) for flashing well spread


ed 1Mbit Intel chips

2. Something out of PII (Pentium 2) age with 2Mbit BIOS chip for flashin
g *regular* 1Mbit and 2Mbit flash chips.

3. As you already guessed, something out of P!!! (Pentium 3) for example,


any motherboard with i8xx chipset for flashing *HUB* type chips.

4. (added for last version of edited article) Something, that is built on


nForce1/2/3 chipset.

As of myself, towards the first point, I use ASUS motherboard built on i43
0HX chipset P55T2P4, for cases like this one i recommend ASUS, because o
f very usable asus made flasher program, an old PFLASH or newer version
AFLASH, very simple to use, stable and may show you memory address where e
rror occured, in case you will have an error of course.

Talking about second point, I use motherboard built on i440BX, PC Partner928.It has 2Mbit flash chip, which allows us to flash *regular* chips with
1 and 2Mbit capacities.It has a DIP32 bed, for flashing PLCC32, I use PLC
C32<->DIP32 adapter, which was made out of old non working board with PLCC
32 bed.

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 18 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

Hand-made PLCC32->DIP32
adapter (made by a figured groove by a fret saw on faulty motherboards;) p
lus manually soldered pins)

Hand-made PLCC32->DIP32 adapter bottom view

As of point 3, I use motherboard built on i820 Chaintech 6CTA2, it has i


82802AB (4Mbit), that allows us to flash intel *hub* chips including HUBs
themselves.

Point 4. I use motherboard on nForce1 ABIT NV7-133R (it is not a big dea
l if it be NF2 /NF3).This board is used for heavyest cases, for flashing *
PURE LPC* chips.Many mobo manufacturers, if not all of them, that built bo
ards on nForce1/2/3/etc chipsets are using chips that are compatible with
both LPC and FWH protocols, which allows us to flash those on equipment me
ntioned in point#3

Talking overall, about facts towards motherboard choices, there are no suc
h thing, so it is solely depends on your personal needs, but i will mentio
n the case with an ASUS for Intel flash chips combination.

It is not necessarily has to be some kind of advanced board, it is better


to act counterwise trying to find cheapest and simple boards, even so ca

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 19 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

lled No-Name boards are good, Acorp or PC-Partner are just a couple of suc
h. Other important fact is easy access to flash chip bed.

As of the software I use for major flashing purpose AMIFLASH (v.8.37 wit
h keys, of course) Flasher knows many flash chips/chipsets and very friend
ly to use (I prefer command prompt).

For rare cases, when AMIFLASH cannot handle the task (some kind of exotic
chips/bioses/chipsets)- I recommend to use AWDFLASH with /f key.

The heavyest case is when we need to reprogram very exotic/rare chips/bios


es/chipsets, either very old or newest boards) I recommend to use UNIFLASH
, it can be used for *visual* check of an error spot in memory space. Happ
y owners of gigabyte/epox or other mobo that has nForce2 Chipset with LPC
flash chips like PMC.

PMCs are compatible with all three protocols LPC/FWH/PP and that is the p
robable cause of an error in case of *regular* flasher usage (those may ev
en just hang/lock the PC), however UNIFLASH works just fine.

p.s. Latest versions of Uniflash are so knowledgeable and stable that i us


e it in most cases now.

Some extreme flash/reprogram methods.

There are cases when you may need to use two flashers to flash one chip, f
or example you reprogram chip with amiflash, at the end it may give you an

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 20 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

error, then, you will reprogram it rightaway, again with uniflash, but yo
u should not use it counterwise, because you will fail, its more likely wi
ll not work other way.

Probable cause are programming algorithms of particular chips, when one


flasher will be able to accomplish first part and other one will finish th
e job (by the way, this is not insanes speach, but my personal experience
with amd chips, for example, that do have some non-standart read/write pro
tection or damaged or non stable memory area.)

If you have a board that has only 1Mbit chip, but you need to reprogram 2M
bit chip you may do it in two sets, first megabit last and second megabi
t first, as separate processes, when your first part is done, you will nee
d to short PIN#30 (A17 for 2Mbit and PIN#NC in 1Mbit) to the ground and th
en flash second part.You will need to split file in two pieces, 1Mbit each
(1Mbit=128kb), you may do it with any HEX editor, the only limitation for
this process will be no support from flash chip for sector writing.

This situation may evolve in to case when we need only a bootblock. the se
cond part (end part) of the splitted file. After this will be done, you ne
ed to insert this chip in to motherboard and start the pc, because of unfi
nished flashing, chip will have bad crc and bootblock will be loaded for r
ecovery purposes, where you can use a floppy disk with bios file.

FLASHING CHIPS WITH DIFFERENT FLASHING VOLTAGES.

Different chips require different programming voltages. Most popular ones


are 12V/5V for older boards and 3,3V/3V/2,7V and lower for modern. Accordi
ng to the theory, you should set onboard jumpers into appropriate position
(if there are such junpers) to accomplish reprogramming. Practically we s
ee that the chips designed for lower voltages can be reprogrammed with hig
her voltages as well.

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 21 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

For example, if the motherboard has 5V chip (usually 29xxxx series), you c
an flash the chips designed for lower voltages on this board and you will
succeed.

But in the case when you try to flash 12V chip in 5V motherboard (or with
jumpers set to 5V), you may succeed and may not, thence when you reprogram
28xxxx series chips (most of them are 12V ones) you have to pay attention
to the jumpers and dont try to reprogram those using HOT-SWAP method on
newer boards (12V chips were mostly used in P1/P2 period). So, the older m
otherboard you have, the bigger chance to succeed.

If the motherboard jumpers have no marks, you can use multimeter to see th
e pin32 voltage (the first one by the right side from the key, when lookin
g to the chips top). You also can bend or isolate this pin on the board/s
ocket and connect the chips pin right to 12V manually (from the power sup
ply).

Posted by Anukul Saini


Reactions:

AweSome (0)

Funny (0)

Interesting (0)

Cool (0)

Booring (0)

0 comments
Labels: Fix Problems, Informative

Newer Posts

Home

http://cristalhack.blogspot.com/2012_09_30_archive.html

Older Posts

Page 22 of 23

Cristal hack: September 2012

4/18/14 8:04 PM

Archive

People Find

Archives

You Archive IT

Carter

Used Boats

Archived

Hours

Public

Dividend Income Funds

Best Culinary Schools

Free Credit Report Online


Chitika | Opt out?

(c) 2009. Cristal hack. Powered by Blogger


Blogger Templates created by Deluxe Templates
Wordpress designed by Roam 2 Rome.

http://cristalhack.blogspot.com/2012_09_30_archive.html

Page 23 of 23

Вам также может понравиться